Edit tour

Windows Analysis Report
https://cscslions-my.sharepoint.com/:o:/r/personal/townanna_cscslions_org/Documents/Notebooks/Incoming%20Secured%20Documents?d=w0d9de69417ec4658accc7b13d437f099&e=5%3ac065c2863fe74bbcbe226a07bdb64d8c&sharingv2=true&fromShare=true&at=9

Overview

General Information

Sample URL:	https://cscslions-my.sharepoint.com/:o:/r/personal/townanna_cscslions_org/Documents/Notebooks/Incoming%20Secured%20Documents?d=w0d9de69417ec4658accc7b13d437f099&e=5%3ac065c2863fe74bbcbe226a07bdb64d8c&
Analysis ID:	1467203
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML title does not match URL

HTTP GET or POST without a user agent

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6732 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://cscslions-my.sharepoint.com/:o:/r/personal/townanna_cscslions_org/Documents/Notebooks/Incoming%20Secured%20Documents?d=w0d9de69417ec4658accc7b13d437f099&e=5%3ac065c2863fe74bbcbe226a07bdb64d8c&sharingv2=true&fromShare=true&at=9 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6600 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1848,i,10240505638957547112,14902115120237314369,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://login.microsoftonline.com/18d5b6a3-deb9-4f24-9d39-2d9ef885718b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=EDC3341AE9E916BE89A1EB813F5AC44D51DF79533827CF13%2D54E4085150232EBD5D08E804E70BFAE75AC439E8292E8C8542D6FE57C2989E9D&redirect%5Furi=https%3A%2F%2Fcscslions%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=75c238a1%2D8070%2D0000%2D1ca8%2Ddcfb33df0a80	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/18d5b6a3-deb9-4f24-9d39-2d9ef885718b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=EDC3341AE9E916BE89A1EB813F5AC44D51DF79533827CF13%2D54E4085150232EBD5D08E804E70BFAE75AC439E8292E8C8542D6FE57C2989E9D&redirect%5Furi=https%3A%2F%2Fcscslions%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=75c238a1%2D8070%2D0000%2D1ca8%2Ddcfb33df0a80&sso_reload=true	HTTP Parser: Number of links: 0

Source: https://login.microsoftonline.com/18d5b6a3-deb9-4f24-9d39-2d9ef885718b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=EDC3341AE9E916BE89A1EB813F5AC44D51DF79533827CF13%2D54E4085150232EBD5D08E804E70BFAE75AC439E8292E8C8542D6FE57C2989E9D&redirect%5Furi=https%3A%2F%2Fcscslions%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=75c238a1%2D8070%2D0000%2D1ca8%2Ddcfb33df0a80	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/18d5b6a3-deb9-4f24-9d39-2d9ef885718b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=EDC3341AE9E916BE89A1EB813F5AC44D51DF79533827CF13%2D54E4085150232EBD5D08E804E70BFAE75AC439E8292E8C8542D6FE57C2989E9D&redirect%5Furi=https%3A%2F%2Fcscslions%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=75c238a1%2D8070%2D0000%2D1ca8%2Ddcfb33df0a80&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://login.microsoftonline.com/18d5b6a3-deb9-4f24-9d39-2d9ef885718b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=EDC3341AE9E916BE89A1EB813F5AC44D51DF79533827CF13%2D54E4085150232EBD5D08E804E70BFAE75AC439E8292E8C8542D6FE57C2989E9D&redirect%5Furi=https%3A%2F%2Fcscslions%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=75c238a1%2D8070%2D0000%2D1ca8%2Ddcfb33df0a80&sso_reload=true

HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

Source: https://login.microsoftonline.com/18d5b6a3-deb9-4f24-9d39-2d9ef885718b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=EDC3341AE9E916BE89A1EB813F5AC44D51DF79533827CF13%2D54E4085150232EBD5D08E804E70BFAE75AC439E8292E8C8542D6FE57C2989E9D&redirect%5Furi=https%3A%2F%2Fcscslions%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=75c238a1%2D8070%2D0000%2D1ca8%2Ddcfb33df0a80	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/18d5b6a3-deb9-4f24-9d39-2d9ef885718b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=EDC3341AE9E916BE89A1EB813F5AC44D51DF79533827CF13%2D54E4085150232EBD5D08E804E70BFAE75AC439E8292E8C8542D6FE57C2989E9D&redirect%5Furi=https%3A%2F%2Fcscslions%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=75c238a1%2D8070%2D0000%2D1ca8%2Ddcfb33df0a80&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/18d5b6a3-deb9-4f24-9d39-2d9ef885718b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=EDC3341AE9E916BE89A1EB813F5AC44D51DF79533827CF13%2D54E4085150232EBD5D08E804E70BFAE75AC439E8292E8C8542D6FE57C2989E9D&redirect%5Furi=https%3A%2F%2Fcscslions%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=75c238a1%2D8070%2D0000%2D1ca8%2Ddcfb33df0a80&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/18d5b6a3-deb9-4f24-9d39-2d9ef885718b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=EDC3341AE9E916BE89A1EB813F5AC44D51DF79533827CF13%2D54E4085150232EBD5D08E804E70BFAE75AC439E8292E8C8542D6FE57C2989E9D&redirect%5Furi=https%3A%2F%2Fcscslions%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=75c238a1%2D8070%2D0000%2D1ca8%2Ddcfb33df0a80&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/18d5b6a3-deb9-4f24-9d39-2d9ef885718b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=EDC3341AE9E916BE89A1EB813F5AC44D51DF79533827CF13%2D54E4085150232EBD5D08E804E70BFAE75AC439E8292E8C8542D6FE57C2989E9D&redirect%5Furi=https%3A%2F%2Fcscslions%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=75c238a1%2D8070%2D0000%2D1ca8%2Ddcfb33df0a80	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/18d5b6a3-deb9-4f24-9d39-2d9ef885718b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=EDC3341AE9E916BE89A1EB813F5AC44D51DF79533827CF13%2D54E4085150232EBD5D08E804E70BFAE75AC439E8292E8C8542D6FE57C2989E9D&redirect%5Furi=https%3A%2F%2Fcscslions%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=75c238a1%2D8070%2D0000%2D1ca8%2Ddcfb33df0a80&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/18d5b6a3-deb9-4f24-9d39-2d9ef885718b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=EDC3341AE9E916BE89A1EB813F5AC44D51DF79533827CF13%2D54E4085150232EBD5D08E804E70BFAE75AC439E8292E8C8542D6FE57C2989E9D&redirect%5Furi=https%3A%2F%2Fcscslions%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=75c238a1%2D8070%2D0000%2D1ca8%2Ddcfb33df0a80&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/18d5b6a3-deb9-4f24-9d39-2d9ef885718b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=EDC3341AE9E916BE89A1EB813F5AC44D51DF79533827CF13%2D54E4085150232EBD5D08E804E70BFAE75AC439E8292E8C8542D6FE57C2989E9D&redirect%5Furi=https%3A%2F%2Fcscslions%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=75c238a1%2D8070%2D0000%2D1ca8%2Ddcfb33df0a80&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.17:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.17:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.17:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.133:443 -> 192.168.2.17:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.17:49767 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: cscslions-my.sharepoint.com to https://login.microsoftonline.com:443/18d5b6a3-deb9-4f24-9d39-2d9ef885718b/oauth2/authorize?client%5fid=00000003%2d0000%2d0ff1%2dce00%2d000000000000&response%5fmode=form%5fpost&response%5ftype=code%20id%5ftoken&resource=00000003%2d0000%2d0ff1%2dce00%2d000000000000&scope=openid&nonce=edc3341ae9e916be89a1eb813f5ac44d51df79533827cf13%2d54e4085150232ebd5d08e804e70bfae75ac439e8292e8c8542d6fe57c2989e9d&redirect%5furi=https%3a%2f%2fcscslions%2dmy%2esharepoint%2ecom%2f%5fforms%2fdefault%2easpx&state=od0w&claims=%7b%22id%5ftoken%22%3a%7b%22xms%5fcc%22%3a%7b%22values%22%3a%5b%22cp1%22%5d%7d%7d%7d&wsucxt=1&cobrandid=11bd8083%2d87e0%2d41b5%2dbb78%2d0bc43c8a8e8a&client%2drequest%2did=75c238a1%2d8070%2d0000%2d1ca8%2ddcfb33df0a80

Source: global traffic

HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13

Source: global traffic	HTTP traffic detected: GET /:o:/r/personal/townanna_cscslions_org/Documents/Notebooks/Incoming%20Secured%20Documents?d=w0d9de69417ec4658accc7b13d437f099&e=5%3ac065c2863fe74bbcbe226a07bdb64d8c&sharingv2=true&fromShare=true&at=9 HTTP/1.1Host: cscslions-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/townanna_cscslions_org/Documents/Notebooks/Incoming%20Secured%20Documents?d=w0d9de69417ec4658accc7b13d437f099&e=5%3ac065c2863fe74bbcbe226a07bdb64d8c&sharingv2=true&fromShare=true&at=9&CID=cc283c77-1b67-44e4-9a75-60ef7c8c7c80 HTTP/1.1Host: cscslions-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/townanna_cscslions_org/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Ftownanna%5Fcscslions%5Forg%2FDocuments%2FNotebooks%2FIncoming%20Secured%20Documents%3Fd%3Dw0d9de69417ec4658accc7b13d437f099%26e%3D5%253ac065c2863fe74bbcbe226a07bdb64d8c%26sharingv2%3Dtrue%26fromShare%3Dtrue%26at%3D9%26CID%3Dcc283c77%2D1b67%2D44e4%2D9a75%2D60ef7c8c7c80 HTTP/1.1Host: cscslions-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_forms/default.aspx?ReturnUrl=%2fpersonal%2ftownanna_cscslions_org%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Ftownanna%255Fcscslions%255Forg%252FDocuments%252FNotebooks%252FIncoming%2520Secured%2520Documents%253Fd%253Dw0d9de69417ec4658accc7b13d437f099%2526e%253D5%25253ac065c2863fe74bbcbe226a07bdb64d8c%2526sharingv2%253Dtrue%2526fromShare%253Dtrue%2526at%253D9%2526CID%253Dcc283c77%252D1b67%252D44e4%252D9a75%252D60ef7c8c7c80&Source=cookie HTTP/1.1Host: cscslions-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: RpsContextCookie=U291cmNlPSUyRnBlcnNvbmFsJTJGdG93bmFubmElNUZjc2NzbGlvbnMlNUZvcmclMkZEb2N1bWVudHMlMkZOb3RlYm9va3MlMkZJbmNvbWluZyUyMFNlY3VyZWQlMjBEb2N1bWVudHMlM0ZkJTNEdzBkOWRlNjk0MTdlYzQ2NThhY2NjN2IxM2Q0MzdmMDk5JTI2ZSUzRDUlMjUzYWMwNjVjMjg2M2ZlNzRiYmNiZTIyNmEwN2JkYjY0ZDhjJTI2c2hhcmluZ3YyJTNEdHJ1ZSUyNmZyb21TaGFyZSUzRHRydWUlMjZhdCUzRDklMjZDSUQlM0RjYzI4M2M3NyUyRDFiNjclMkQ0NGU0JTJEOWE3NSUyRDYwZWY3YzhjN2M4MA==
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_sw-M8KkV3_nBot-G1ImRcw2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_mc5ac6ol0l4d2iaqspstyg2.css HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_Kjlmc42uL0ATl_21eYcwVg2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: login.live.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_fo8rkc18qnhjh4wnzabsdg2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=BEMz9zVAXPzpGpb&MD=euPZlAu9 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_0b5ca5d48eeaf75b0528.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /18d5b6a3-deb9-4f24-9d39-2d9ef885718b/winauth/ssoprobe?client-request-id=75c238a1-8070-0000-1ca8-dcfb33df0a80&_=1720033387907 HTTP/1.1Host: autologon.microsoftazuread-sso.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: -240X-DeviceID: 01000A41090080B6X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAR9FZRdiJ3FsSv4wfUCFwarbffAjrahhuK1etGluHfybiYTx%2BZgsLyMm2vbzIdkafn4FUa5uR8YE1krHSZIRSjndgRMn7P5%2B3b6QE9VRQJ2fl0yOBigiL0eyvtj8ecNsMvdDlvgWBHs2NB5DJzkshzB0s8c8YhHPkh9v7Ux%2Bp3ynCHwEYfHlQbkfBCv2P1KLimwFcLdPDh9HfevK1ljE9ptJ/iAmFh7hsg07nnzYqFWZpfpMUCrmzTfrG7MI4s5LgvZVChuRGKzXeidaF/Ll8nb6bbZQZe5H%2BKFQCYc1WwFckVHvmtFhw%2BOpLKvYm4dnno3gMMomiV3j4VIHq3%2BAPBUDZgAACEPq%2B1xySyHvqAHmBtudV6OqkpjipQzddaHKyhiNTiroJZS6g5JXmmnnR/D8YwjI1HbZ%2BY2GewDLQAWcmccnMK%2BWT9Z5uLq0OFBH2UwE3jjIgUbd4mh0rD%2B%2BwjUhIchdWc/ubFBxMz6WV3HCubhGYE1N38lLaqYLhhVaaYUGp05KpCR5vMFpSwAsq%2BUStj1HBoy9ihqvKIrlC7TgiH1kj6XfEi7wA2QvM4IQmTwiFmFV/LVEhaBuBJW/mwx3xt9c6fEOypNS%2BSrl03K0rtRLvYwCbLUVqlNLGRnP/6HrFVepTJTXvHTwl0I8mpoBL6OtTaZ7hSbglRf8TeaN%2BMh8sHc6oadJTCcOuIpVcXYUJ1tQQBtHYr8H1VDtTSAGBpk0hTR9NDRXI3Tke2GHCa8jgZIYlwVyYiciMhGkVTNL8w3H59eIObHUtSI69luqhoTIKz1VXsWsR8Ns3wuMYTGpvuosZTuzJKGzyPM7lksJ/BgRRjzs9hThiWKFbP6Jfv9kDIXIaCyYsU6P6PGu/MRUZ2jQPCa3IRH4LO9Z6OnycceuqVKlHNr30xeWPSYvojfCzX3W1wE%3D%26p%3DX-Agent-DeviceId: 01000A41090080B6X-BM-CBT: 1720033411User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: 823A3482C0D940F7B4386E3AA6E49F3AX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=BEMz9zVAXPzpGpb&MD=euPZlAu9 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: cscslions-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: autologon.microsoftazuread-sso.com

Source: chromecache_89.1.dr	String found in binary or memory: http://feross.org
Source: chromecache_85.1.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_85.1.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_89.1.dr, chromecache_100.1.dr, chromecache_85.1.dr, chromecache_88.1.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_79.1.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_79.1.dr	String found in binary or memory: https://login.windows-ppe.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.17:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.17:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.17:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.133:443 -> 192.168.2.17:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.17:49767 version: TLS 1.2

Source: classification engine

Classification label: clean2.win@15/48@18/9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://cscslions-my.sharepoint.com/:o:/r/personal/townanna_cscslions_org/Documents/Notebooks/Incoming%20Secured%20Documents?d=w0d9de69417ec4658accc7b13d437f099&e=5%3ac065c2863fe74bbcbe226a07bdb64d8c&sharingv2=true&fromShare=true&at=9
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1848,i,10240505638957547112,14902115120237314369,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1848,i,10240505638957547112,14902115120237314369,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://cscslions-my.sharepoint.com/:o:/r/personal/townanna_cscslions_org/Documents/Notebooks/Incoming%20Secured%20Documents?d=w0d9de69417ec4658accc7b13d437f099&e=5%3ac065c2863fe74bbcbe226a07bdb64d8c&sharingv2=true&fromShare=true&at=9	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
http://knockoutjs.com/	0%	URL Reputation	safe
https://login.windows-ppe.net	0%	URL Reputation	safe
https://login.microsoftonline.com	0%	URL Reputation	safe
http://www.opensource.org/licenses/mit-license.php)	0%	URL Reputation	safe
http://feross.org	0%	URL Reputation	safe
https://github.com/douglascrockford/JSON-js	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_0b5ca5d48eeaf75b0528.js	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg	0%	Avira URL Cloud	safe
https://cscslions-my.sharepoint.com/personal/townanna_cscslions_org/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Ftownanna%5Fcscslions%5Forg%2FDocuments%2FNotebooks%2FIncoming%20Secured%20Documents%3Fd%3Dw0d9de69417ec4658accc7b13d437f099%26e%3D5%253ac065c2863fe74bbcbe226a07bdb64d8c%26sharingv2%3Dtrue%26fromShare%3Dtrue%26at%3D9%26CID%3Dcc283c77%2D1b67%2D44e4%2D9a75%2D60ef7c8c7c80	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_Kjlmc42uL0ATl_21eYcwVg2.js	0%	Avira URL Cloud	safe
https://cscslions-my.sharepoint.com/_forms/default.aspx?ReturnUrl=%2fpersonal%2ftownanna_cscslions_org%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Ftownanna%255Fcscslions%255Forg%252FDocuments%252FNotebooks%252FIncoming%2520Secured%2520Documents%253Fd%253Dw0d9de69417ec4658accc7b13d437f099%2526e%253D5%25253ac065c2863fe74bbcbe226a07bdb64d8c%2526sharingv2%253Dtrue%2526fromShare%253Dtrue%2526at%253D9%2526CID%253Dcc283c77%252D1b67%252D44e4%252D9a75%252D60ef7c8c7c80&Source=cookie	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_fo8rkc18qnhjh4wnzabsdg2.js	0%	Avira URL Cloud	safe
https://cscslions-my.sharepoint.com/personal/townanna_cscslions_org/Documents/Notebooks/Incoming%20Secured%20Documents?d=w0d9de69417ec4658accc7b13d437f099&e=5%3ac065c2863fe74bbcbe226a07bdb64d8c&sharingv2=true&fromShare=true&at=9&CID=cc283c77-1b67-44e4-9a75-60ef7c8c7c80	0%	Avira URL Cloud	safe
https://autologon.microsoftazuread-sso.com/18d5b6a3-deb9-4f24-9d39-2d9ef885718b/winauth/ssoprobe?client-request-id=75c238a1-8070-0000-1ca8-dcfb33df0a80&_=1720033387907	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_mc5ac6ol0l4d2iaqspstyg2.css	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
dual-spo-0005.spo-msedge.net	13.107.136.10	true	false	unknown
sni1gl.wpc.omegacdn.net	152.199.21.175	true	false	unknown
www.google.com	172.217.16.132	true	false	unknown
s-part-0039.t-0009.t-msedge.net	13.107.246.67	true	false	unknown
autologon.microsoftazuread-sso.com	40.126.32.134	true	false	unknown
identity.nel.measure.office.net	unknown	unknown	false	unknown
aadcdn.msftauth.net	unknown	unknown	false	unknown
login.microsoftonline.com	unknown	unknown	false	unknown
cscslions-my.sharepoint.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cscslions-my.sharepoint.com/:o:/r/personal/townanna_cscslions_org/Documents/Notebooks/Incoming%20Secured%20Documents?d=w0d9de69417ec4658accc7b13d437f099&e=5%3ac065c2863fe74bbcbe226a07bdb64d8c&sharingv2=true&fromShare=true&at=9	false		unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_0b5ca5d48eeaf75b0528.js	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/18d5b6a3-deb9-4f24-9d39-2d9ef885718b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=EDC3341AE9E916BE89A1EB813F5AC44D51DF79533827CF13%2D54E4085150232EBD5D08E804E70BFAE75AC439E8292E8C8542D6FE57C2989E9D&redirect%5Furi=https%3A%2F%2Fcscslions%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=75c238a1%2D8070%2D0000%2D1ca8%2Ddcfb33df0a80	false		unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_Kjlmc42uL0ATl_21eYcwVg2.js	false	Avira URL Cloud: safe	unknown
https://cscslions-my.sharepoint.com/personal/townanna_cscslions_org/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Ftownanna%5Fcscslions%5Forg%2FDocuments%2FNotebooks%2FIncoming%20Secured%20Documents%3Fd%3Dw0d9de69417ec4658accc7b13d437f099%26e%3D5%253ac065c2863fe74bbcbe226a07bdb64d8c%26sharingv2%3Dtrue%26fromShare%3Dtrue%26at%3D9%26CID%3Dcc283c77%2D1b67%2D44e4%2D9a75%2D60ef7c8c7c80	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg	false	Avira URL Cloud: safe	unknown
https://cscslions-my.sharepoint.com/_forms/default.aspx?ReturnUrl=%2fpersonal%2ftownanna_cscslions_org%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Ftownanna%255Fcscslions%255Forg%252FDocuments%252FNotebooks%252FIncoming%2520Secured%2520Documents%253Fd%253Dw0d9de69417ec4658accc7b13d437f099%2526e%253D5%25253ac065c2863fe74bbcbe226a07bdb64d8c%2526sharingv2%253Dtrue%2526fromShare%253Dtrue%2526at%253D9%2526CID%253Dcc283c77%252D1b67%252D44e4%252D9a75%252D60ef7c8c7c80&Source=cookie	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/18d5b6a3-deb9-4f24-9d39-2d9ef885718b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=EDC3341AE9E916BE89A1EB813F5AC44D51DF79533827CF13%2D54E4085150232EBD5D08E804E70BFAE75AC439E8292E8C8542D6FE57C2989E9D&redirect%5Furi=https%3A%2F%2Fcscslions%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=75c238a1%2D8070%2D0000%2D1ca8%2Ddcfb33df0a80&sso_reload=true	false		unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif	false	Avira URL Cloud: safe	unknown
https://autologon.microsoftazuread-sso.com/18d5b6a3-deb9-4f24-9d39-2d9ef885718b/winauth/ssoprobe?client-request-id=75c238a1-8070-0000-1ca8-dcfb33df0a80&_=1720033387907	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_mc5ac6ol0l4d2iaqspstyg2.css	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_fo8rkc18qnhjh4wnzabsdg2.js	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg	false	Avira URL Cloud: safe	unknown
https://cscslions-my.sharepoint.com/personal/townanna_cscslions_org/Documents/Notebooks/Incoming%20Secured%20Documents?d=w0d9de69417ec4658accc7b13d437f099&e=5%3ac065c2863fe74bbcbe226a07bdb64d8c&sharingv2=true&fromShare=true&at=9&CID=cc283c77-1b67-44e4-9a75-60ef7c8c7c80	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://knockoutjs.com/	chromecache_85.1.dr	false	URL Reputation: safe	unknown
https://github.com/douglascrockford/JSON-js	chromecache_89.1.dr, chromecache_100.1.dr, chromecache_85.1.dr, chromecache_88.1.dr	false	Avira URL Cloud: safe	unknown
https://login.windows-ppe.net	chromecache_79.1.dr	false	URL Reputation: safe	unknown
https://login.microsoftonline.com	chromecache_79.1.dr	false	URL Reputation: safe	unknown
http://www.opensource.org/licenses/mit-license.php)	chromecache_85.1.dr	false	URL Reputation: safe	unknown
http://feross.org	chromecache_89.1.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
40.126.32.134	autologon.microsoftazuread-sso.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.67	s-part-0039.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.126.32.74	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
152.199.21.175	sni1gl.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
172.217.16.132	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467203
Start date and time:	2024-07-03 21:02:20 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://cscslions-my.sharepoint.com/:o:/r/personal/townanna_cscslions_org/Documents/Notebooks/Incoming%20Secured%20Documents?d=w0d9de69417ec4658accc7b13d437f099&e=5%3ac065c2863fe74bbcbe226a07bdb64d8c&sharingv2=true&fromShare=true&at=9
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean2.win@15/48@18/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, TextInputHost.exe
Excluded IPs from analysis (whitelisted): 216.58.212.131, 142.250.110.84, 142.250.186.46, 34.104.35.123, 20.190.159.75, 20.190.159.68, 20.190.159.23, 20.190.159.2, 20.190.159.71, 40.126.31.71, 20.190.159.0, 20.190.159.4, 2.16.238.152, 2.16.238.149, 192.229.221.95, 142.250.185.202, 216.58.206.42, 172.217.16.138, 216.58.212.170, 142.250.186.138, 142.250.181.234, 142.250.185.138, 142.250.185.234, 142.250.184.202, 172.217.18.10, 216.58.212.138, 142.250.185.170, 142.250.185.106, 142.250.186.106, 142.250.186.42, 142.250.186.74, 40.126.31.67, 40.126.31.73, 20.190.159.73, 20.190.159.64, 20.50.73.4, 13.69.109.130, 142.250.184.227
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, browser.events.data.trafficmanager.net, ak.privatelink.msidentity.com, a1894.dscb.akamai.net, onedscolprdweu00.westeurope.cloudapp.azure.com, clients2.google.com, ocsp.digicert.com, login.live.com, update.googleapis.com, login.mso.msidentity.com, www.bing.com, clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, aadcdnoriginwus2.azureedge.net, www.tm.ak.prd.aadg.akadns.net, aadcdn.msauth.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, 201294-ipv4v6w.farm.dprodmgd108.sharepointonline.com.akadns.net, browser.events.data.microsoft.com, edgedl.me.gvt1.com, nel.measure.office.net.edgesuite.net, evoke-windowsservices-tas.msedge.net, aadcdnoriginwus2.afd.azureedge.net, onedscolprdneu13.northeurope.cloudapp.azure.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://cscslions-my.sharepoint.com/:o:/r/personal/townanna_cscslions_org/Documents/Notebooks/Incoming%20Secured%20Documents?d=w0d9de69417ec4658accc7b13d437f099&e=5%3ac065c2863fe74bbcbe226a07bdb64d8c&sharingv2=true&fromShare=true&at=9

Input	Output
URL: https://login.microsoftonline.com/18d5b6a3-deb9-4f24-9d39-2d9ef885718b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D0000000 Model: Perplexity: mixtral-8x7b-instruct	{"loginform": false,"urgency": false,"captcha": false,"reasons": ["The title 'Sign in to your account' suggests the presence of a login form, but upon analysis, the text 'Microsoft Terms of use Privacy & ckies' does not contain any login fields or requests for sensitive information.","The text does not create a sense of urgency, as it only contains information about Microsoft's terms of use and privacy policy.","There is no CAPTCHA or anti-robot detection mechanism present on the webpage."]}
Title: Sign in to your account OCR: Microsoft Terms of use Privacy & ckies
URL: https://login.microsoftonline.com/18d5b6a3-deb9-4f24-9d39-2d9ef885718b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D0000000 Model: Perplexity: mixtral-8x7b-instruct	{"loginform": true,"urgency": false,"captcha": false,"reasons": ["The text 'Sign in to your account' suggests that this page is a login form.","No elements in the text create a sense of urgency.","No CAPTCHA or anti-robot detection mechanism was present in the webpage."]}
Title: Sign in to your account OCR: Microsoft Sign in Email, phone, or Skype Can't access ur account? Back Next Sign-in options Terms of use Privacy & ckies
URL: https://login.microsoftonline.com Model: gpt-4o	```json{ "phishing_score": 0, "brands": "Microsoft", "phishing": false, "suspicious_domain": false, "has_prominent_loginform": true, "has_captcha": false, "setechniques": false, "has_suspicious_link": false, "legitmate_domain": "microsoftonline.com", "reasons": "The URL 'https://login.microsoftonline.com' is a legitimate domain associated with Microsoft. The login page design and branding match Microsoft's official style. There are no suspicious elements, social engineering techniques, or suspicious links present. The domain is not suspicious and is well-known for Microsoft services."}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 18:02:56 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.000738026060365
Encrypted:	false
SSDEEP:	48:8GQdvTs7hJHeidAKZdA1JehwiZUklqehKy+3:8G046Fy
MD5:	B89D076757D1BE3A0FEEC1D907BD9BD4
SHA1:	548E6C85AA5750943D3B9BA8ED26226991702246
SHA-256:	D7DE60DA29CFA29BDFBC4BF413009FDA4132F75D7C7DC2351B175448D8A7D01F
SHA-512:	D3D19BA330069E50F720924A8F1BB1725F7AB06FAC639C1703EDE756BFD9882DB5B4229BCE1845E510D6BE630E30FF51848850FFCA91FA0D2FFE7B2DCB4FAF51
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....[..{.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.XQ.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X[.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X[.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X[............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X]............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........M........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 18:02:56 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.01726435270259
Encrypted:	false
SSDEEP:	48:8rQdvTs7hJHeidAKZdA10eh/iZUkAQkqeh1y+2:8r04g9Qoy
MD5:	6DFAC579EB24A03B467768D41DA1B5AE
SHA1:	340D50F31BCDCD674E8046E8842D9BF33D4DD366
SHA-256:	6616329E16623C89844075FB0E4C31F1C7D52E02DDD0B1F3F8E22653A8DC2CC4
SHA-512:	CAE647489C04ACFEA2B70C2DD975D1BF22C650E2C28632834AE2DD3D65110948827EB5B240E51D4EF2B7C53EF5C45665CB0E91B0757CBAB20E598D3D673A5472
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......w.{.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.XQ.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X[.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X[.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X[............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X]............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........M........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.021773912170663
Encrypted:	false
SSDEEP:	48:8eQdvTs7hjHeidAKZdA14tIeh7sFiZUkmgqeh7sby+BX:8e04Wn5y
MD5:	DDA7D8715A50C03F9D62B3ECAC153BCE
SHA1:	DF6DDA84C4EB81B4136CD850AA097471799E5CA7
SHA-256:	DFC837AA56BCD3E97FE8B3113C70577803B8AEF1C5F515DEC1FB777426E91B67
SHA-512:	6B58B53AA635AF7ADACA5A6A5681DB5DCDB5D7075D345472D461FD3AD7C55396B890EA3F607BCFE10C8DEDA307F6574610FE691CC39007DB346C8A89CF570BC0
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.XQ.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X[.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X[.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X[............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........M........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 18:02:56 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.014204225077456
Encrypted:	false
SSDEEP:	48:8cQdvTs7hJHeidAKZdA1behDiZUkwqehxy+R:8c047zy
MD5:	D4499A21F34E4428E595028E051FD09B
SHA1:	597715E98C25C9D40CAAC2DADA3BF429DE1054D9
SHA-256:	98B628214FA25BCD4ED3FEB34F40CF35FFB563E64CA65CD1D2F68301E2A8CFB7
SHA-512:	22BCD9E19344DAE0BD30E6D57AB6308B697E462AE64962FF148FE8D78F6D241EE61BB46307E7B5C7E3AFFDD7E8423E04A4E9F8046FF8DFFEF018B2B486BF6EDC
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....,.q.{.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.XQ.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X[.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X[.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X[............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X]............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........M........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 18:02:56 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.00211016131904
Encrypted:	false
SSDEEP:	48:8KQdvTs7hJHeidAKZdA1VehBiZUk1W1qehPy+C:8K04b9vy
MD5:	79082B855162FD7B3BA03EAD1EEB3AE0
SHA1:	55A72E7E21EF7C8CF42DD64945EF68F177A8B3C9
SHA-256:	9B0B6A354AA208515746FC3A781E214DC9BE32D3CCDB0F6065D898A019AE275B
SHA-512:	3B90B31D80B4C6A6C36072F433062E821A992A3E6E6EE6D18BA7E94B3585ED0D9206D60718C4F5BE25DB49E6411B08251BE3DEEB5EE6B2B03A59D874627F8D42
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....@A~.{.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.XQ.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X[.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X[.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X[............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X]............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........M........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 18:02:56 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.014889109225299
Encrypted:	false
SSDEEP:	48:8jQdvTs7hJHeidAKZdA1duT6ehOuTbbiZUk5OjqehOuTb5y+yT+:8j04HTTTbxWOvTb5y7T
MD5:	E1ADA5CE3A5A8083DC313E684223F17A
SHA1:	D7D4E5C506EB6DFCC8FE348FC5C4F250B16E6583
SHA-256:	D8453994DA2601CBDD3D35F787294A03B03894A562A88BCF3E67D42713D85FA1
SHA-512:	07430C61D622F859D7E886E6861AEA831563BA7CC7C201CDFFD6A239D7B2125A0372D71737074EE80B54E71B1C13F1EE22429972364C4F5B24A6579B712DD6FA
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......i.{.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.XQ.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X[.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X[.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X[............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X]............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........M........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64612)
Category:	downloaded
Size (bytes):	113657
Entropy (8bit):	5.491055924169325
Encrypted:	false
SSDEEP:	1536:VlqCwY8gIRPY0+r5qnWisnv9ILXtlTJCwggqdq/7XtvUN5bHo:EgDTMnWBaTJggqkDxUbzo
MD5:	B6783C7717E4042517138D9C9A48C867
SHA1:	7A7D6B0F36C2A3B557F1A75461630D433E5F4942
SHA-256:	4BE11C075187615ADAF493D54CB7B05556E76806AED2B3B082D72952D0025BE5
SHA-512:	2A322A8377784CBE543C978F32CB811388658F2E328B0024580D83DDE24AF0E131276AA76FEBED0B3AD1073ABCA8189AB9CD40BC4D36CFD93C0A1ECDAD63B705
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[37],{488:function(e,t,r

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (61177)
Category:	downloaded
Size (bytes):	113355
Entropy (8bit):	5.285112404757625
Encrypted:	false
SSDEEP:	1536:QpHDgBvguhw+EViazA/PWrF7qvEAFiQcpmchSeC1Jzc6VUWU:xkNhp6VUj
MD5:	302E4073AA25D25E03DA26AA4A94AD62
SHA1:	CBB8C69EC1FE0E5795DF9BD6C12B7837C61A81DC
SHA-256:	8B81B6DBB9AF6502D78ABE8A85D135861848E0597989901DA42C62ECB841A07D
SHA-512:	3F1F0CEB445D074B3B60C6E63AC03F061119379B49306387BFA2834C2F3330BA019A2C5BFB01D553398DE18E7C6CC7199CF3B70334A69B2373C9F51DA44359F2
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_mc5ac6ol0l4d2iaqspstyg2.css
Preview:	/! Copyright (C) Microsoft Corporation. All rights reserved. //*!.------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------..This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise...//-----------------------------------------------------------------------------.twbs-bootstrap-sass (3.3.0).//-----------------------------------------------------------------------------..The MIT License (MIT)..Copyright (c) 2013 Twitter, Inc..Permission is hereby granted, free of charge, to any person

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 141492
Category:	downloaded
Size (bytes):	49696
Entropy (8bit):	7.995313044786981
Encrypted:	true
SSDEEP:	768:z3DVBhZjMlfZAC5OzOo51h9TG/vwkVC+VWAK0zuPKKdYkevC3MPGp7Lu:/vj0fmDio7SpVC+VGVPKEIviME7Lu
MD5:	3D5FBC4186EF45B04DE8BF8BA6861967
SHA1:	EFB2759A486E84730182091A9710DCE3EDCD8F6F
SHA-256:	099E7356BAE6752C1A7052BC9DE4AD113187EDA6A1385794E12955F7AE636D25
SHA-512:	949516390D8CEA5A1057647B2487634CFCFBD2510D9571965DC714954723EA9FA1FA79C240671888613964D8D43C921DCA8BAE3802E15C98F127B82092E51126
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/BssoInterrupt_Core_sw-M8KkV3_nBot-G1ImRcw2.js
Preview:	............[.8.8...+.w..OL..hp._..nf.0$.......t....e .o?u.l.q.../g..J.T.U.J..k.S......T.......T.~9:?.........h.........;?.L.......W..J.U.`.F.0r..W..o...$..+....O1N....(4...R..".r.F.s...C..j.o..J...3<.%. L.....G.M.%.Ee.x".<....?..8.$.H.........Uq#Q.ER..Qr..W..)k..3.........N....:.....:.e.`.\...V........p.[....n+.......Yu..o>N.n."z.&N......!+.W......s.6r.D.....{..q/.....:z...3h....8.g31.....X...T..a...W..Fsg....h..u.$.........>..7.p~;uch..+t...i.?..3...+.r6.A......[g:..r.?S..............;.=6.&.`.....E=W.j.oaT}p..Vd.Np..\.i^[.....u'~..".M.:q.fF..._[..rM.F?....q.1.....S}.c_...\_./....y}6...._1-\|p..l@..[q........k.?&.0^_.Cw:s.Rs^...IR5..Bv.yYX.....N.....O..epmF".GA...@...q..;...v`M.%3..#..,DMLTY+..g.........d+.>...{}.&N/..g-#FV.V.p.......Xs.(..{..]..-...!..F...XQge.X.MP.&.3....Re...b23v..M.a...'......c.i...9...l..Z.`.F.._%>U.'.."..;.M......D$.}..~\|....*u...ma.f:\......p..jy.<.r...cjG.N...{{}M_oEr8%...\|.......d..nZ.S..H.Lx...x1t.

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (3437), with CRLF line terminators
Category:	downloaded
Size (bytes):	3439
Entropy (8bit):	5.12253249098629
Encrypted:	false
SSDEEP:	96:3qO9I9Sz9KHULMO34UiEBGLosqAsosushswsosry:a2IYz95oTEBac
MD5:	6635D7000669B3B00D3577DB7EE58F5D
SHA1:	7DB793D847EDC78B731185C85AD93BA4761D139B
SHA-256:	4E52043A45804E7CDB6C9D09A0F64A4293082E6F32BB3D689BE4822A6E18BACB
SHA-512:	FE3D01776B8D98E975D4DB6E956196B0D5602563E0252BD960A5A739D591F3AC96F5F2EF48EF6B49286822D80106932C104B324BD355EBE1D2FEFCB124D5866B
Malicious:	false
Reputation:	low
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(t,e){for(var s in e)t[s]=e[s]}(this,function(t){function e(n){if(s[n])return s[n].exports;var i=s[n]={exports:{},id:n,loaded:!1};return t[n].call(i.exports,i,i.exports,e),i.loaded=!0,i.exports}var s={};return e.m=t,e.c=s,e.p="",e(0)}([function(t,e){function s(t){for(var e=f[S],s=0,n=e.length;s<n;++s)if(e[s]===t)return!0;return!1}function n(t){if(!t)return null;for(var e=t+"=",s=document.cookie.split(";"),n=0,i=s.length;n<i;n++){var a=s[n].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===a.indexOf(e))return a.substring(e.length)}return null}function i(t,e,s){if(t)for(var n=t.split(":"),i=null,a=0,r=n.length;a<r;++a){var c=null,S=n[a].split("$");if(0===a&&(i=parseInt(S.shift()),!i))return;var l=S.length;if(l>=1){var p=o(i,S[0]);if(!p\|\|s[p])continue;c={signInName:p,idp:"msa",isSignedIn:!0}}if(l>=3&&(c.firstName=o(i,S[1]),c.lastName=o(i,S[2])),l>=4){var f=S[3],d=f.split("\|");c.otherHashedAliases=d}if(l>=5){var h=parseInt(S[4],16);h&&(c.

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	3651
Entropy (8bit):	4.094801914706141
Encrypted:	false
SSDEEP:	96:wO4DZ+Stb/jY+eo4hAryAes9mBYYQgWLDm9:wToSBjlevudl9nO
MD5:	EE5C8D9FB6248C938FD0DC19370E90BD
SHA1:	D01A22720918B781338B5BBF9202B241A5F99EE4
SHA-256:	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
SHA-512:	C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE253D88B1B1FF60901F053113C5D7C1919852D58
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0,0,1,.419-.967,1.413,1.413,0,0,1,1-.39,1.392,1.392,0,0,1,1.02.4,1.3,1.3,0,0,1,.4.958,1.248,1.248,0,0,1-.414.953,1.428,1.428,0,0,1-1.01.385A1.4,1.4,0,0,1,47.25,6.6a1.261,1.261,0,0,1-.409-.948M49.41,18.4H47.081V8.507H49.41Zm7.064-1.694a3.213,3.213,0,0,0,1.145-.241,4.811,4.811,0,0,0,1.155-.635V18a4.665,4.665,0,0,1-1.266.481,6.886,6.886,0,0,1-1.554.164,4.707,4.707,0,0,1-4.918-4.908,5.641,5.641,0,0,1,1.4-3.932,5.055,5.055,0,0,1,3.955-1.545,5.414,5.414,0,0,1,1.324.168,4.431,4.431,0,0,1,1.063.39v2.233a4.763,4.763,0,0,0-1.1-.611,3.184,3.184,0,0,0-1.15-.217,2.919,2.919,0,0,0-2.223.9,3.37,3.37,0,0,0-.847,2.416,3.216,3.216,0,0,0,.813,2.338,2.936,2.936,0,0,0,2.209.837M65.4,8.343a2.952,2.952,0,0,1,.5.039,2.1,2.1,0,0,1,.375.1v2.358a2.04,2.04,0,0,0-.

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:	48:yvswNIBLBpJawmMH44log6gw/MHm7pJroog6gwkMH9Xog6gwdMHdqdyqog7C:ykfXYx+odPcs9B
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3651
Entropy (8bit):	4.094801914706141
Encrypted:	false
SSDEEP:	96:wO4DZ+Stb/jY+eo4hAryAes9mBYYQgWLDm9:wToSBjlevudl9nO
MD5:	EE5C8D9FB6248C938FD0DC19370E90BD
SHA1:	D01A22720918B781338B5BBF9202B241A5F99EE4
SHA-256:	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
SHA-512:	C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE253D88B1B1FF60901F053113C5D7C1919852D58
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0,0,1,.419-.967,1.413,1.413,0,0,1,1-.39,1.392,1.392,0,0,1,1.02.4,1.3,1.3,0,0,1,.4.958,1.248,1.248,0,0,1-.414.953,1.428,1.428,0,0,1-1.01.385A1.4,1.4,0,0,1,47.25,6.6a1.261,1.261,0,0,1-.409-.948M49.41,18.4H47.081V8.507H49.41Zm7.064-1.694a3.213,3.213,0,0,0,1.145-.241,4.811,4.811,0,0,0,1.155-.635V18a4.665,4.665,0,0,1-1.266.481,6.886,6.886,0,0,1-1.554.164,4.707,4.707,0,0,1-4.918-4.908,5.641,5.641,0,0,1,1.4-3.932,5.055,5.055,0,0,1,3.955-1.545,5.414,5.414,0,0,1,1.324.168,4.431,4.431,0,0,1,1.063.39v2.233a4.763,4.763,0,0,0-1.1-.611,3.184,3.184,0,0,0-1.15-.217,2.919,2.919,0,0,0-2.223.9,3.37,3.37,0,0,0-.847,2.416,3.216,3.216,0,0,0,.813,2.338,2.936,2.936,0,0,0,2.209.837M65.4,8.343a2.952,2.952,0,0,1,.5.039,2.1,2.1,0,0,1,.375.1v2.358a2.04,2.04,0,0,0-.

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64616)
Category:	downloaded
Size (bytes):	447070
Entropy (8bit):	5.44924152415959
Encrypted:	false
SSDEEP:	6144:hFR9WWEL65lcf6d/1GmpxcqsAdKmYUO9OarYvqcEHKE0H3NX445:hF+e1GmpqDAkmsYv4u
MD5:	2A3966738DAE2F401397FDB579873056
SHA1:	646C2AA679DE2C25E12BBBDFF0F6212BF7E4E35E
SHA-256:	BA7BBEA9A5DD4776F3FA38C23A772CD97CC7A00A0F28D1D7232E10B2FF0655AD
SHA-512:	C4C8EAAE55DB46CB0F7AD7428D988D164B77FBE4DA2E06739200173DBC40948D8E60893AEE75EDB7882C50624E31246F05AEA072E970CD83C3F944487D78F253
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_Kjlmc42uL0ATl_21eYcwVg2.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */!function(e){function n(n){for(var t,i,o=n[0],r=n[1],s=0,c=[];s<o.length;s++)

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1592
Entropy (8bit):	4.205005284721148
Encrypted:	false
SSDEEP:	48:ztSAS1OtmCtc7aIVmt4yyR9S2lKUyDWwh:RoOtmCtc7aCmVQHSRh
MD5:	4E48046CE74F4B89D45037C90576BFAC
SHA1:	4A41B3B51ED787F7B33294202DA72220C7CD2C32
SHA-256:	8E6DB1634F1812D42516778FC890010AA57F3E39914FB4803DF2C38ABBF56D93
SHA-512:	B2BBA2A68EDAA1A08CFA31ED058AFB5E6A3150AABB9A78DB9F5CCC2364186D44A015986A57707B57E2CC855FA7DA57861AD19FC4E7006C2C239C98063FE903CF
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,1,19,30a10.9,10.9,0,0,1-5.547-1.5,11.106,11.106,0,0,1-2.219-1.719A11.373,11.373,0,0,1,9.5,24.547a10.4,10.4,0,0,1-1.109-2.625A11.616,11.616,0,0,1,8,19a10.9,10.9,0,0,1,1.5-5.547,11.106,11.106,0,0,1,1.719-2.219A11.373,11.373,0,0,1,13.453,9.5a10.4,10.4,0,0,1,2.625-1.109A11.616,11.616,0,0,1,19,8a10.9,10.9,0,0,1,5.547,1.5,11.106,11.106,0,0,1,2.219,1.719A11.373,11.373,0,0,1,28.5,13.453a10.4,10.4,0,0,1,1.109,2.625A11.616,11.616,0,0,1,30,19a10.015,10.015,0,0,1-.125,1.578,10.879,10.879,0,0,1-.359,1.531Zm-2,.844L27.219,22.641a14.716,14.716,0,0,0,.562-1.782A7.751,7.751,0,0,0,28,19a8.786,8.786,0,0,0-.7-3.5,8.9,8.9,0,0,0-1.938-2.859A9.269,9.269,0,0,0,22.5,10.719,8.9,8.9,0,0,0,19,10a8.786,8.786,0,0,0-3.5.7,8.9,8.9,0,0,0-2.859,1.938A9.269,9.269,0,0,0,

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14782)
Category:	downloaded
Size (bytes):	15755
Entropy (8bit):	5.3639874329526815
Encrypted:	false
SSDEEP:	384:DDeX/4OSgcw2Z12ZfeXOh+rF3X1JDZDFzfXdv79dq:2/gf57Pq
MD5:	F9ACA9B63334C3E31116F20A71A3F601
SHA1:	BC6D6693249B280F1F598859D654C76926F2320F
SHA-256:	04E2853193CB2766A21222CBE47E5D76E8E778B700B9DEDB12A8A8E805E019B9
SHA-512:	D4034BFC1E52B2FE7B5189ADD15FBB4DE5C829197BF8BFB3F0BC0E1AF0FF4533D1F6D01FF21B33B5BA3273A7698D4C85734908516544E315A30FAAACA88D281E
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_0b5ca5d48eeaf75b0528.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[17],{515:function(e,n,s

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (43896)
Category:	downloaded
Size (bytes):	196606
Entropy (8bit):	5.251581319467305
Encrypted:	false
SSDEEP:	3072:5Q0ZqoBmLJEoWcjY6B66pO25rksurxIDZViY:RmNdTpOFsursZ7
MD5:	48B0240457BA7EB00FB0628070F0F00A
SHA1:	6556DF3A592CAABA4FFCAADBD7B344235D1CD1BC
SHA-256:	1BA584713F5490B040D7F89AB36E5D0B6E9661A3EA99A126234CACF435580394
SHA-512:	5EFFDC8B67F9AFD5BB2D84A79562E4E1D87D5274558F33F37C90FD654C8E9CA021D1A59B19994425E411BC82EF642F918DDA84D599B42BD7AB9E3A06EF670BEF
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[8],{529:function(e,t,r)

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (32049)
Category:	downloaded
Size (bytes):	55503
Entropy (8bit):	5.379641678097791
Encrypted:	false
SSDEEP:	1536:ABqF1tlfretkF7IKbVaqDRx3/ym+d/Px2g+0wtdmixn/TPRUbx3VDg/MvXl:ABrkF7IyJvym+d/Pog+0wtdmiJig/Mt
MD5:	7E8F2B91CD7CAA78498785A7CC06EC0E
SHA1:	3C7A02EB6223223DFEE7FB94B53972DFEE7EA999
SHA-256:	54EB78792CFC22E6B724ED2BE39DE23339022B2F044265FC98E3D437470C91C6
SHA-512:	91FAC38B76ADB79D8C4CCCBAB751993226E46CB40FF7B7E03E0C1B6436062D0AF853B71A4DE31C63186D774D94930D5C4C7EB93E18FDF050A69DB718B67231BD
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_fo8rkc18qnhjh4wnzabsdg2.js
Preview:	!function(e){function o(n){if(i[n])return i[n].exports;var t=i[n]={exports:{},id:n,loaded:!1};return e[n].call(t.exports,t,t.exports,o),t.loaded=!0,t.exports}var i={};return o.m=e,o.c=i,o.p="",o(0)}([function(e,o,i){i(2);var n=i(1),t=i(5),r=i(6),a=r.StringsVariantId,s=r.AllowedIdentitiesType;n.registerSource("str",function(e,o){if(e.WF_STR_SignupLink_AriaLabel_Text="Create a Microsoft account",e.WF_STR_SignupLink_AriaLabel_Generic_Text="Create a new account",e.CT_STR_CookieBanner_Link_AriaLabel="Learn more about Microsoft's Cookie Policy",e.WF_STR_HeaderDefault_Title=o.iLoginStringsVariantId===a.CombinedSigninSignupV2WelcomeTitle?"Welcome":"Sign in",e.STR_Footer_IcpLicense_Text=".ICP.13015306.-10",o.oAppCobranding&&o.oAppCobranding.friendlyAppName){var i=o.fBreakBrandingSigninString?"to continue to {0}":"Continue to {0}";e.WF_STR_App_Title=t.format(i,o.oAppCobranding.friendlyAppName)}switch(o.oAppCobranding&&o.oAppCobranding.signinDescription&&(e.WF_STR_Default_Desc=o.oAppCobrand

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	36
Entropy (8bit):	4.503258334775644
Encrypted:	false
SSDEEP:	3:Eq62iczBr9ks:EqdiczBys
MD5:	06B313E93DD76909460FBFC0CD98CB6B
SHA1:	C4F9B2BBD840A4328F85F54873C434336A193888
SHA-256:	B4532478707B495D0BB1C21C314AEF959DD1A5E0F66E52DAD5FC332C8B697CBA
SHA-512:	EFD7E8195D9C126883C71FED3EFEDE55916848B784F8434ED2677DF5004436F7EDE9F80277CB4675C4DEB8F243B2705A3806B412FAA8842E039E9DC467C11645
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSFwmCAmly1gHbXRIFDdFbUVISBQ1Xevf9?alt=proto
Preview:	ChgKDQ3RW1FSGgQIVhgCIAEKBw1Xevf9GgA=

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1592
Entropy (8bit):	4.205005284721148
Encrypted:	false
SSDEEP:	48:ztSAS1OtmCtc7aIVmt4yyR9S2lKUyDWwh:RoOtmCtc7aCmVQHSRh
MD5:	4E48046CE74F4B89D45037C90576BFAC
SHA1:	4A41B3B51ED787F7B33294202DA72220C7CD2C32
SHA-256:	8E6DB1634F1812D42516778FC890010AA57F3E39914FB4803DF2C38ABBF56D93
SHA-512:	B2BBA2A68EDAA1A08CFA31ED058AFB5E6A3150AABB9A78DB9F5CCC2364186D44A015986A57707B57E2CC855FA7DA57861AD19FC4E7006C2C239C98063FE903CF
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,1,19,30a10.9,10.9,0,0,1-5.547-1.5,11.106,11.106,0,0,1-2.219-1.719A11.373,11.373,0,0,1,9.5,24.547a10.4,10.4,0,0,1-1.109-2.625A11.616,11.616,0,0,1,8,19a10.9,10.9,0,0,1,1.5-5.547,11.106,11.106,0,0,1,1.719-2.219A11.373,11.373,0,0,1,13.453,9.5a10.4,10.4,0,0,1,2.625-1.109A11.616,11.616,0,0,1,19,8a10.9,10.9,0,0,1,5.547,1.5,11.106,11.106,0,0,1,2.219,1.719A11.373,11.373,0,0,1,28.5,13.453a10.4,10.4,0,0,1,1.109,2.625A11.616,11.616,0,0,1,30,19a10.015,10.015,0,0,1-.125,1.578,10.879,10.879,0,0,1-.359,1.531Zm-2,.844L27.219,22.641a14.716,14.716,0,0,0,.562-1.782A7.751,7.751,0,0,0,28,19a8.786,8.786,0,0,0-.7-3.5,8.9,8.9,0,0,0-1.938-2.859A9.269,9.269,0,0,0,22.5,10.719,8.9,8.9,0,0,0,19,10a8.786,8.786,0,0,0-3.5.7,8.9,8.9,0,0,0-2.859,1.938A9.269,9.269,0,0,0,

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	low
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 223759
Category:	downloaded
Size (bytes):	54318
Entropy (8bit):	7.995006031600911
Encrypted:	true
SSDEEP:	1536:GPYhFQ0hY97NgEQMoCG/D6oAPSZGh7Xifaz8TAiQzsr:Gn37ih787GA8Ei+sr
MD5:	3F98A175D5232F665BEFFC23352D7176
SHA1:	8413FCCF22CEBAAED144736F5415F09EFD45CE48
SHA-256:	C6D80B97A3828280862163C72A94F5902F10D927FA1F6BDEAB5479B94F04F5AC
SHA-512:	93D0C9BBB7B204AE18A2392F137DC02B71A9E5352EC24267C2CEBAE5C286EEB68BCABF73F3F4B6DA1DF1D49E3998F6190D843144CD1ACDD5B4AA707CDF7CC24D
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js
Preview:	...........k{.F.0.}...gF.L."..eR..v.y.O....g...............~...@....f<...F./...u...;............x.y.C...y...sx.....^=}.....N.W.I.Y$.....".w....$..\|..a...+.7O.eg.gW..2...8..2)J..<^f.:.4..;....<}.....ZK.......5..,;iV&Q...9......;U:....$....DyVd....Q...N......N..".;.,//.8...X..ZP7......&shpA...a.I.C\U0i.&K..}m..1..9.N.u....^.'I/:......r...a^Ee.f..oq..e'..y..U..;...T(...<L..;X.."..8-}.^L.._w.....f.w..V.x.kK..K../.A..[....oE....G..ao0...\........Qv.7..eX..70.....\|.s.}.#...:..t...$.}=....s..g.}Q..........SO.....p.%..v..\|.Fo.. ..,e.......=;;..7....E.F8+7.K?.n.y'.rw.........x~...=?.?...z~.?....<...(H./.....V.....yx.?.O.>l...E..c]..n.?..>......%<.....?....w........../.2.^...d........1b...4~.)\W....k-.n.0..._..8....qZ..^...D=...~..w...^g.........*.r.......d.O............a....R.)O.[v...C......2.....s..y...o6...6...z}8d....e<+..y.cs....X...v.O...p.....3.v.~D..IAo.<.....,H..9.xx....h.....B\.f.a.&..V...no"MJ.R...6...Y.....F<...9....s`..Q...X

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	190152
Entropy (8bit):	5.348678574819375
Encrypted:	false
SSDEEP:	3072:0+mTq9mTuZEOHEXp6WXWkYVlMBMwMlJNbdffVv6GhL+rUWxa:STekBWkYVdLlJNbr6m+rUGa
MD5:	4877EFC88055D60953886EC55B04DE34
SHA1:	2341B026A3E2A3B01AFA1A39D1706840D75E09B3
SHA-256:	8405362EB8F09DF13AE244DE155B51B1577274673D9728B6C81CD0278A63C8B0
SHA-512:	625844EDC37594D5C2F7622BD1B59278BF68ABB2FA22476C56826433C961C7B1924858A7588F8B6284D3C5AC8738ECB895EEC949DE18667A98C04A59CB03DAC0
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
Preview:	(window.telemetry_webpackJsonp=window.telemetry_webpackJsonp\|\|[]).push([[2],[,,,function(e,t,n){"use strict";n.r(t),n.d(t,"ValueKind",(function(){return r.e})),n.d(t,"EventLatency",(function(){return r.a})),n.d(t,"EventPersistence",(function(){return r.b})),n.d(t,"TraceLevel",(function(){return r.d})),n.d(t,"AppInsightsCore",(function(){return i.a})),n.d(t,"BaseCore",(function(){return d})),n.d(t,"_ExtendedInternalMessageId",(function(){return r.f})),n.d(t,"EventPropertyType",(function(){return r.c})),n.d(t,"ESPromise",(function(){return g})),n.d(t,"ESPromiseScheduler",(function(){return C})),n.d(t,"ValueSanitizer",(function(){return I})),n.d(t,"NotificationManager",(function(){return E.a})),n.d(t,"BaseTelemetryPlugin",(function(){return S.a})),n.d(t,"ProcessTelemetryContext",(function(){return N.a})),n.d(t,"MinChannelPriorty",(function(){return w.a})),n.d(t,"EventsDiscardedReason",(function(){return P.a})),n.d(t,"DiagnosticLogger",(function(){return c.a})),n.d(t,"LoggingSeverity",(fun

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	low
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:	48:yvswNIBLBpJawmMH44log6gw/MHm7pJroog6gwkMH9Xog6gwdMHdqdyqog7C:ykfXYx+odPcs9B
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 21:02:51.642137051 CEST	49677	443	192.168.2.17	204.79.197.200
Jul 3, 2024 21:02:51.642137051 CEST	49678	443	192.168.2.17	204.79.197.200
Jul 3, 2024 21:02:51.642174006 CEST	49676	443	192.168.2.17	204.79.197.200
Jul 3, 2024 21:02:55.007644892 CEST	49714	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:55.007699966 CEST	443	49714	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:55.007776976 CEST	49714	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:55.009624958 CEST	49714	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:55.009641886 CEST	443	49714	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:55.627518892 CEST	443	49714	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:55.627722979 CEST	49714	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:55.627748013 CEST	443	49714	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:55.628993988 CEST	443	49714	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:55.629077911 CEST	49714	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:55.629812956 CEST	49714	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:55.629867077 CEST	443	49714	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:55.629936934 CEST	49714	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:55.629942894 CEST	443	49714	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:55.678215027 CEST	49714	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:55.838505030 CEST	443	49714	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:55.839837074 CEST	443	49714	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:55.839907885 CEST	49714	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:55.840387106 CEST	49714	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:55.840403080 CEST	443	49714	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:55.842335939 CEST	49717	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:55.842382908 CEST	443	49717	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:55.842470884 CEST	49717	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:55.842679024 CEST	49717	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:55.842698097 CEST	443	49717	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:56.414833069 CEST	443	49717	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:56.415282965 CEST	49717	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:56.415312052 CEST	443	49717	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:56.415668011 CEST	443	49717	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:56.415966034 CEST	49717	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:56.416038990 CEST	443	49717	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:56.416100979 CEST	49717	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:56.456515074 CEST	443	49717	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:56.595099926 CEST	443	49717	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:56.595129013 CEST	443	49717	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:56.595212936 CEST	443	49717	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:56.595326900 CEST	49717	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:56.595328093 CEST	49717	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:56.595696926 CEST	49717	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:56.595715046 CEST	443	49717	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:56.597809076 CEST	49718	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:56.597826958 CEST	443	49718	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:56.597939968 CEST	49718	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:56.598171949 CEST	49718	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:56.598184109 CEST	443	49718	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:57.191695929 CEST	443	49718	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:57.191965103 CEST	49718	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:57.191992044 CEST	443	49718	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:57.192351103 CEST	443	49718	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:57.192660093 CEST	49718	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:57.192737103 CEST	443	49718	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:57.192816973 CEST	49718	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:57.236499071 CEST	443	49718	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:57.380662918 CEST	443	49718	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:57.380750895 CEST	443	49718	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:57.380815029 CEST	49718	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:57.380853891 CEST	49718	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:57.381737947 CEST	49718	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:57.381757021 CEST	443	49718	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:57.383652925 CEST	49720	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:57.383708000 CEST	443	49720	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:57.383794069 CEST	49720	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:57.384192944 CEST	49720	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:57.384212017 CEST	443	49720	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:57.977338076 CEST	443	49720	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:57.977708101 CEST	49720	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:57.977736950 CEST	443	49720	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:57.978076935 CEST	443	49720	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:57.978410959 CEST	49720	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:57.978499889 CEST	443	49720	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:57.978656054 CEST	49720	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:57.978682041 CEST	443	49720	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:58.187412024 CEST	443	49720	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:58.187439919 CEST	443	49720	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:58.187470913 CEST	443	49720	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:58.187511921 CEST	49720	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:58.187536955 CEST	443	49720	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:58.187567949 CEST	49720	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:58.187635899 CEST	443	49720	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:58.187688112 CEST	49720	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:58.189675093 CEST	49720	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:58.189687967 CEST	443	49720	13.107.136.10	192.168.2.17
Jul 3, 2024 21:02:58.189696074 CEST	49720	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:58.189738989 CEST	49720	443	192.168.2.17	13.107.136.10
Jul 3, 2024 21:02:59.449403048 CEST	49722	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:02:59.449455023 CEST	443	49722	13.107.246.67	192.168.2.17
Jul 3, 2024 21:02:59.449549913 CEST	49722	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:02:59.449754953 CEST	49722	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:02:59.449768066 CEST	443	49722	13.107.246.67	192.168.2.17
Jul 3, 2024 21:02:59.776953936 CEST	49723	443	192.168.2.17	172.217.16.132
Jul 3, 2024 21:02:59.777005911 CEST	443	49723	172.217.16.132	192.168.2.17
Jul 3, 2024 21:02:59.777091026 CEST	49723	443	192.168.2.17	172.217.16.132
Jul 3, 2024 21:02:59.777399063 CEST	49723	443	192.168.2.17	172.217.16.132
Jul 3, 2024 21:02:59.777415037 CEST	443	49723	172.217.16.132	192.168.2.17
Jul 3, 2024 21:03:00.108984947 CEST	443	49722	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:00.109304905 CEST	49722	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:00.109338045 CEST	443	49722	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:00.110209942 CEST	443	49722	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:00.110291958 CEST	49722	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:00.111401081 CEST	49722	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:00.111457109 CEST	443	49722	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:00.111603975 CEST	49722	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:00.111619949 CEST	443	49722	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:00.161087036 CEST	49722	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:00.213130951 CEST	443	49722	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:00.213154078 CEST	443	49722	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:00.213161945 CEST	443	49722	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:00.213185072 CEST	443	49722	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:00.213211060 CEST	443	49722	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:00.213232040 CEST	49722	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:00.213257074 CEST	443	49722	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:00.213290930 CEST	49722	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:00.213306904 CEST	49722	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:00.301687002 CEST	443	49722	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:00.301703930 CEST	443	49722	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:00.301944971 CEST	49722	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:00.301966906 CEST	443	49722	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:00.302026033 CEST	49722	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:00.303606033 CEST	443	49722	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:00.303620100 CEST	443	49722	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:00.303652048 CEST	443	49722	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:00.303697109 CEST	49722	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:00.303704977 CEST	443	49722	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:00.303714991 CEST	443	49722	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:00.303731918 CEST	49722	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:00.303756952 CEST	49722	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:00.304171085 CEST	49722	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:00.304188013 CEST	443	49722	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:00.447498083 CEST	443	49723	172.217.16.132	192.168.2.17
Jul 3, 2024 21:03:00.448079109 CEST	49723	443	192.168.2.17	172.217.16.132
Jul 3, 2024 21:03:00.448108912 CEST	443	49723	172.217.16.132	192.168.2.17
Jul 3, 2024 21:03:00.449217081 CEST	443	49723	172.217.16.132	192.168.2.17
Jul 3, 2024 21:03:00.449316025 CEST	49723	443	192.168.2.17	172.217.16.132
Jul 3, 2024 21:03:00.451006889 CEST	49723	443	192.168.2.17	172.217.16.132
Jul 3, 2024 21:03:00.451077938 CEST	443	49723	172.217.16.132	192.168.2.17
Jul 3, 2024 21:03:00.496228933 CEST	49723	443	192.168.2.17	172.217.16.132
Jul 3, 2024 21:03:00.496267080 CEST	443	49723	172.217.16.132	192.168.2.17
Jul 3, 2024 21:03:00.544254065 CEST	49723	443	192.168.2.17	172.217.16.132
Jul 3, 2024 21:03:01.782962084 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:01.783004999 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:01.783109903 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:01.783338070 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:01.783354998 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:01.789963007 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:01.790002108 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:01.790088892 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:01.790190935 CEST	49730	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:01.790199041 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:01.790254116 CEST	49730	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:01.790365934 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:01.790380955 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:01.790501118 CEST	49730	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:01.790512085 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:01.798055887 CEST	49731	443	192.168.2.17	40.126.32.74
Jul 3, 2024 21:03:01.798063040 CEST	443	49731	40.126.32.74	192.168.2.17
Jul 3, 2024 21:03:01.798127890 CEST	49731	443	192.168.2.17	40.126.32.74
Jul 3, 2024 21:03:01.798281908 CEST	49731	443	192.168.2.17	40.126.32.74
Jul 3, 2024 21:03:01.798293114 CEST	443	49731	40.126.32.74	192.168.2.17
Jul 3, 2024 21:03:01.830297947 CEST	49732	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:01.830319881 CEST	443	49732	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:01.830416918 CEST	49732	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:01.832257986 CEST	49732	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:01.832272053 CEST	443	49732	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:02.608794928 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.608877897 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.609072924 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.609100103 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.609189987 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.609214067 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.610156059 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.610220909 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.610228062 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.610286951 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.611162901 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.611232996 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.611253023 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.611350060 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.611515999 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.611526966 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.611599922 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.611607075 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.613183022 CEST	443	49731	40.126.32.74	192.168.2.17
Jul 3, 2024 21:03:02.613368988 CEST	49731	443	192.168.2.17	40.126.32.74
Jul 3, 2024 21:03:02.613375902 CEST	443	49731	40.126.32.74	192.168.2.17
Jul 3, 2024 21:03:02.614438057 CEST	443	49731	40.126.32.74	192.168.2.17
Jul 3, 2024 21:03:02.614500999 CEST	49731	443	192.168.2.17	40.126.32.74
Jul 3, 2024 21:03:02.615386009 CEST	49731	443	192.168.2.17	40.126.32.74
Jul 3, 2024 21:03:02.615456104 CEST	443	49731	40.126.32.74	192.168.2.17
Jul 3, 2024 21:03:02.615658998 CEST	49731	443	192.168.2.17	40.126.32.74
Jul 3, 2024 21:03:02.615664005 CEST	443	49731	40.126.32.74	192.168.2.17
Jul 3, 2024 21:03:02.626832008 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.627049923 CEST	49730	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.627057076 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.628062010 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.628139973 CEST	49730	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.628418922 CEST	49730	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.628473043 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.628523111 CEST	49730	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.650377035 CEST	443	49732	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:02.650496006 CEST	49732	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:02.652600050 CEST	49732	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:02.652606964 CEST	443	49732	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:02.652859926 CEST	443	49732	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:02.663110018 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.663111925 CEST	49731	443	192.168.2.17	40.126.32.74
Jul 3, 2024 21:03:02.663321018 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.672514915 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.679120064 CEST	49730	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.679136038 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.695107937 CEST	49732	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:02.715774059 CEST	49732	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:02.726110935 CEST	49730	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.756501913 CEST	443	49732	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:02.876790047 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.877948046 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.877954960 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.877991915 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.878010035 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.878017902 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.878035069 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.878070116 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.878103971 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.878125906 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.880903959 CEST	443	49731	40.126.32.74	192.168.2.17
Jul 3, 2024 21:03:02.880927086 CEST	443	49731	40.126.32.74	192.168.2.17
Jul 3, 2024 21:03:02.880983114 CEST	49731	443	192.168.2.17	40.126.32.74
Jul 3, 2024 21:03:02.881000042 CEST	443	49731	40.126.32.74	192.168.2.17
Jul 3, 2024 21:03:02.881047010 CEST	49731	443	192.168.2.17	40.126.32.74
Jul 3, 2024 21:03:02.881102085 CEST	443	49731	40.126.32.74	192.168.2.17
Jul 3, 2024 21:03:02.881161928 CEST	443	49731	40.126.32.74	192.168.2.17
Jul 3, 2024 21:03:02.881208897 CEST	49731	443	192.168.2.17	40.126.32.74
Jul 3, 2024 21:03:02.882119894 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.882134914 CEST	49731	443	192.168.2.17	40.126.32.74
Jul 3, 2024 21:03:02.882150888 CEST	443	49731	40.126.32.74	192.168.2.17
Jul 3, 2024 21:03:02.899327040 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.927035093 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.927047968 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.927081108 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.927093983 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.927105904 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.927110910 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.927130938 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.927171946 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.927196026 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.948121071 CEST	49730	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.968590021 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.968615055 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.968674898 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.968708038 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.968751907 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.968767881 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.969646931 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.969662905 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.969734907 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.969742060 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.969772100 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.969786882 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.972601891 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.972615957 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.972640038 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.972650051 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.972680092 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.972693920 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.972728014 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.972738981 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.973684072 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.973702908 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.973758936 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.973767996 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.973814011 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.984833956 CEST	443	49732	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:02.984850883 CEST	443	49732	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:02.984858036 CEST	443	49732	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:02.984867096 CEST	443	49732	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:02.984890938 CEST	443	49732	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:02.984926939 CEST	49732	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:02.984941959 CEST	443	49732	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:02.984954119 CEST	49732	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:02.984992981 CEST	49732	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:02.985275984 CEST	443	49732	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:02.985332012 CEST	49732	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:02.985337019 CEST	443	49732	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:02.985650063 CEST	443	49732	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:02.985697031 CEST	49732	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:02.989201069 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.989207983 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.989240885 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.989255905 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.989269018 CEST	49730	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.989270926 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.989284992 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.989315987 CEST	49730	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.989350080 CEST	49730	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.989964962 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.989970922 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.989994049 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.990001917 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.990015030 CEST	49730	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.990025997 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:02.990081072 CEST	49730	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.990107059 CEST	49730	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:02.997003078 CEST	49732	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:02.997025013 CEST	443	49732	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:02.997037888 CEST	49732	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:02.997045040 CEST	443	49732	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:03.031794071 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.031806946 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.031826019 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.031873941 CEST	49730	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.031898022 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.031929016 CEST	49730	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.031949043 CEST	49730	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.058326006 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.058348894 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.058429003 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.058454037 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.058495045 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.059732914 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.059751987 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.059783936 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.059791088 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.059830904 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.060786963 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.060807943 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.060853958 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.060859919 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.060903072 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.061124086 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.061141968 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.061201096 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.061223984 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.061242104 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.061290026 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.062091112 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.062107086 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.062170029 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.062179089 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.062211037 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.062278032 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.062319994 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.062333107 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.062340975 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.062366962 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.062371969 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.062385082 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.062416077 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.062936068 CEST	49728	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.062952042 CEST	443	49728	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.063684940 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.063699961 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.063747883 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.063756943 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.063791990 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.064740896 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.064755917 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.064810038 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.064817905 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.064851999 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.079044104 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.079098940 CEST	49730	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.079102993 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.079138994 CEST	49730	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.079428911 CEST	49730	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.079443932 CEST	443	49730	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.150165081 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.150192976 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.150243998 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.150274992 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.150305033 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.150317907 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.150979042 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.150998116 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.151053905 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.151063919 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.151124954 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.151834965 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.151858091 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.151890039 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.151896954 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.151921988 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.151945114 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.152765036 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.152785063 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.152818918 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.152825117 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.152861118 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.152880907 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.153665066 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.153682947 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.153734922 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.153743029 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.153783083 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.154613018 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.154628992 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.154665947 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.154673100 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.154711962 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.154726028 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.155420065 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.155437946 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.155503988 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.155512094 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.155551910 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.239525080 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.239553928 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.239617109 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.239629984 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.239665985 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.239679098 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.239944935 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.239963055 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.240015030 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.240015984 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.240029097 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.240071058 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.240509033 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.240529060 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.240578890 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.240587950 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.240962029 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.240982056 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.241024971 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.241038084 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.241053104 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.241465092 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.241480112 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.241514921 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.241528988 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.241558075 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.244556904 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.244576931 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.244633913 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.244642019 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.244673967 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.244941950 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.244956970 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.245004892 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.245012999 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.267287970 CEST	49697	443	192.168.2.17	204.79.197.200
Jul 3, 2024 21:03:03.272218943 CEST	443	49697	204.79.197.200	192.168.2.17
Jul 3, 2024 21:03:03.289112091 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.289138079 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.289189100 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.289200068 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.289247990 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.329199076 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.329215050 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.329258919 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.329272032 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.329349995 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.329758883 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.329777002 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.329823971 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.329830885 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.329845905 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.330203056 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.330220938 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.330244064 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.330255032 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.330281019 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.330852985 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.330868959 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.330918074 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.330933094 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.330949068 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.331170082 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.331187963 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.331216097 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.331227064 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.331249952 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.331383944 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.331432104 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.331440926 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.331454992 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.331512928 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.331770897 CEST	49729	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.331789017 CEST	443	49729	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.347290993 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.347335100 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.347409964 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.347661018 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:03.347685099 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:03.367336988 CEST	443	49697	204.79.197.200	192.168.2.17
Jul 3, 2024 21:03:03.367393970 CEST	49697	443	192.168.2.17	204.79.197.200
Jul 3, 2024 21:03:03.368503094 CEST	49697	443	192.168.2.17	204.79.197.200
Jul 3, 2024 21:03:03.368597031 CEST	49697	443	192.168.2.17	204.79.197.200
Jul 3, 2024 21:03:03.368971109 CEST	49697	443	192.168.2.17	204.79.197.200
Jul 3, 2024 21:03:03.368990898 CEST	49697	443	192.168.2.17	204.79.197.200
Jul 3, 2024 21:03:03.369039059 CEST	49697	443	192.168.2.17	204.79.197.200
Jul 3, 2024 21:03:03.373311996 CEST	443	49697	204.79.197.200	192.168.2.17
Jul 3, 2024 21:03:03.373478889 CEST	443	49697	204.79.197.200	192.168.2.17
Jul 3, 2024 21:03:03.373490095 CEST	443	49697	204.79.197.200	192.168.2.17
Jul 3, 2024 21:03:03.373830080 CEST	443	49697	204.79.197.200	192.168.2.17
Jul 3, 2024 21:03:03.375354052 CEST	443	49697	204.79.197.200	192.168.2.17
Jul 3, 2024 21:03:03.378355980 CEST	443	49697	204.79.197.200	192.168.2.17
Jul 3, 2024 21:03:03.465322018 CEST	443	49697	204.79.197.200	192.168.2.17
Jul 3, 2024 21:03:03.465444088 CEST	49697	443	192.168.2.17	204.79.197.200
Jul 3, 2024 21:03:03.597078085 CEST	443	49697	204.79.197.200	192.168.2.17
Jul 3, 2024 21:03:03.597171068 CEST	49697	443	192.168.2.17	204.79.197.200
Jul 3, 2024 21:03:04.217474937 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.217744112 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.217772007 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.218774080 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.218837023 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.219367027 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.219429970 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.219525099 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.219532967 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.270107031 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.492872953 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.539118052 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.541292906 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.541309118 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.541330099 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.541340113 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.541368961 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.541376114 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.541397095 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.541434050 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.587114096 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.589390039 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.589401960 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.589432001 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.589441061 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.589485884 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.589494944 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.589538097 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.592072010 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.592084885 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.592116117 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.592147112 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.592153072 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.592180967 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.592199087 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.734489918 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.734514952 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.734589100 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.734620094 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.734674931 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.735542059 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.735558033 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.735618114 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.735626936 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.735692024 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.736973047 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.736989021 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.737102032 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.737109900 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.737205029 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.741415977 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.741431952 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.741472960 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.741480112 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.741507053 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.741538048 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.840898991 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.840920925 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.840990067 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.841005087 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.841058016 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.841429949 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.841444016 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.841516018 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.841525078 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.841573954 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.842329025 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.842343092 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.842403889 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.842411995 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.842467070 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.843287945 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.843302011 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.843365908 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.843374014 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.843413115 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.844031096 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.844079018 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.844113111 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.844134092 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.844177008 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.844367027 CEST	49735	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.844383001 CEST	443	49735	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.876566887 CEST	49736	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.876595974 CEST	443	49736	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.876671076 CEST	49736	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.876887083 CEST	49736	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.876902103 CEST	443	49736	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.897099972 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.897142887 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:04.897226095 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.897459030 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:04.897475004 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:05.705509901 CEST	443	49736	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:05.705890894 CEST	49736	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:05.705918074 CEST	443	49736	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:05.706264019 CEST	443	49736	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:05.706585884 CEST	49736	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:05.706656933 CEST	443	49736	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:05.706747055 CEST	49736	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:05.716736078 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:05.716958046 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:05.716983080 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:05.717264891 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:05.717540026 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:05.717597008 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:05.717631102 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:05.748501062 CEST	443	49736	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:05.762134075 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:05.762161016 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:05.974730968 CEST	443	49736	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:05.984100103 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:05.988965988 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:05.988975048 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:05.988990068 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:05.989070892 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:05.989099026 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:05.989176035 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.029308081 CEST	443	49736	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.029326916 CEST	443	49736	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.029416084 CEST	49736	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.029436111 CEST	443	49736	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.029503107 CEST	49736	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.029869080 CEST	49736	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.029881954 CEST	443	49736	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.041297913 CEST	49738	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.041321039 CEST	443	49738	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.041400909 CEST	49738	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.041634083 CEST	49738	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.041646004 CEST	443	49738	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.082716942 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.082735062 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.082808971 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.082818985 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.083458900 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.084470987 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.084491968 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.084549904 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.084556103 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.085000992 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.172029018 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.172054052 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.172146082 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.172153950 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.172668934 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.173140049 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.173156023 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.173214912 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.173222065 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.173629999 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.174448013 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.174463034 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.174529076 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.174535036 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.174968958 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.259607077 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.259624004 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.259717941 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.259727001 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.259757996 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.259777069 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.261847973 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.261862993 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.261928082 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.261934042 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.262453079 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.262710094 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.262731075 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.262772083 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.262778044 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.262808084 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.262820959 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.263600111 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.263622999 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.263680935 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.263686895 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.264170885 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.264457941 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.264487028 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.264519930 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.264524937 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.264554024 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.264569044 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.265400887 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.265417099 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.265479088 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.265485048 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.265930891 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.266057968 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.266112089 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.266160011 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.266254902 CEST	49737	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.266263008 CEST	443	49737	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.268835068 CEST	49739	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:06.268867970 CEST	443	49739	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:06.268938065 CEST	49739	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:06.269155025 CEST	49739	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:06.269162893 CEST	443	49739	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:06.871167898 CEST	443	49738	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.871479034 CEST	49738	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.871505022 CEST	443	49738	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.872600079 CEST	443	49738	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.872679949 CEST	49738	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.873006105 CEST	49738	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.873100042 CEST	443	49738	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.873236895 CEST	49738	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.873250961 CEST	443	49738	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:06.917118073 CEST	49738	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:06.940198898 CEST	443	49739	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:06.940439939 CEST	49739	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:06.940469980 CEST	443	49739	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:06.941457033 CEST	443	49739	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:06.941521883 CEST	49739	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:06.941796064 CEST	49739	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:06.941859007 CEST	443	49739	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:06.941946983 CEST	49739	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:06.941957951 CEST	443	49739	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:06.997109890 CEST	49739	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:07.046202898 CEST	443	49739	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:07.046224117 CEST	443	49739	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:07.046232939 CEST	443	49739	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:07.046261072 CEST	443	49739	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:07.046272993 CEST	443	49739	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:07.046283007 CEST	443	49739	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:07.046307087 CEST	49739	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:07.046340942 CEST	443	49739	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:07.046360016 CEST	49739	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:07.046391010 CEST	49739	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:07.135689020 CEST	443	49739	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:07.135710001 CEST	443	49739	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:07.135776043 CEST	49739	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:07.135792017 CEST	443	49739	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:07.135860920 CEST	49739	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:07.137469053 CEST	443	49739	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:07.137485981 CEST	443	49739	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:07.137548923 CEST	49739	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:07.137558937 CEST	443	49739	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:07.137614012 CEST	49739	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:07.142158031 CEST	443	49738	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:07.180099010 CEST	443	49739	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:07.180176020 CEST	49739	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:07.180185080 CEST	443	49739	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:07.180197954 CEST	443	49739	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:07.180244923 CEST	49739	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:07.180490017 CEST	49739	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:07.180509090 CEST	443	49739	13.107.246.67	192.168.2.17
Jul 3, 2024 21:03:07.180522919 CEST	49739	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:07.180556059 CEST	49739	443	192.168.2.17	13.107.246.67
Jul 3, 2024 21:03:07.185426950 CEST	443	49738	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:07.185440063 CEST	443	49738	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:07.185456991 CEST	443	49738	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:07.185523987 CEST	49738	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:07.185538054 CEST	443	49738	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:07.185545921 CEST	443	49738	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:07.185575008 CEST	443	49738	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:07.185606956 CEST	49738	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:07.185622931 CEST	49738	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:07.186197042 CEST	49738	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:07.186207056 CEST	443	49738	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:07.197117090 CEST	49742	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:07.197155952 CEST	443	49742	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:07.197232008 CEST	49742	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:07.197495937 CEST	49742	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:07.197509050 CEST	443	49742	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:07.198609114 CEST	49743	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:07.198623896 CEST	443	49743	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:07.198697090 CEST	49743	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:07.198863983 CEST	49744	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:07.198899031 CEST	443	49744	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:07.198951960 CEST	49744	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:07.199054956 CEST	49743	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:07.199068069 CEST	443	49743	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:07.199203968 CEST	49744	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:07.199215889 CEST	443	49744	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.033411026 CEST	443	49744	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.033727884 CEST	49744	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.033755064 CEST	443	49744	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.033936024 CEST	443	49743	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.034135103 CEST	49743	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.034159899 CEST	443	49743	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.034512997 CEST	443	49743	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.034670115 CEST	443	49744	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.034744024 CEST	49744	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.034820080 CEST	49743	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.034893036 CEST	443	49743	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.035099983 CEST	49744	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.035165071 CEST	443	49744	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.035260916 CEST	49743	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.035311937 CEST	49744	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.035320044 CEST	443	49744	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.043596983 CEST	443	49742	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.043797016 CEST	49742	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.043826103 CEST	443	49742	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.044189930 CEST	443	49742	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.044450045 CEST	49742	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.044524908 CEST	443	49742	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.044579983 CEST	49742	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.076175928 CEST	49744	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.080497026 CEST	443	49743	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.092509031 CEST	443	49742	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.302793026 CEST	443	49744	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.302846909 CEST	443	49744	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.302907944 CEST	443	49744	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.302938938 CEST	49744	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.302973986 CEST	49744	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.303956032 CEST	49744	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.303977966 CEST	443	49744	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.306653976 CEST	443	49743	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.306948900 CEST	49745	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.306984901 CEST	443	49745	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.307065964 CEST	49745	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.307274103 CEST	49745	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.307291031 CEST	443	49745	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.308049917 CEST	443	49743	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.308069944 CEST	443	49743	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.308135986 CEST	49743	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.308165073 CEST	443	49743	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.308217049 CEST	49743	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.308415890 CEST	49743	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.308428049 CEST	443	49743	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.321355104 CEST	443	49742	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.321408033 CEST	443	49742	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.321485043 CEST	443	49742	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.321492910 CEST	49742	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.321536064 CEST	49742	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.322319031 CEST	49742	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.322333097 CEST	443	49742	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.328700066 CEST	49746	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.328732014 CEST	443	49746	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.328831911 CEST	49746	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.329030991 CEST	49746	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.329046965 CEST	443	49746	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.332016945 CEST	49747	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.332066059 CEST	443	49747	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.332155943 CEST	49747	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.332468987 CEST	49748	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.332477093 CEST	443	49748	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.332557917 CEST	49748	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.333065033 CEST	49747	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.333086967 CEST	443	49747	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.333367109 CEST	49748	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:08.333380938 CEST	443	49748	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:08.419851065 CEST	49749	443	192.168.2.17	40.126.32.134
Jul 3, 2024 21:03:08.419898987 CEST	443	49749	40.126.32.134	192.168.2.17
Jul 3, 2024 21:03:08.419975042 CEST	49749	443	192.168.2.17	40.126.32.134
Jul 3, 2024 21:03:08.420197010 CEST	49749	443	192.168.2.17	40.126.32.134
Jul 3, 2024 21:03:08.420214891 CEST	443	49749	40.126.32.134	192.168.2.17
Jul 3, 2024 21:03:08.684334993 CEST	49675	443	192.168.2.17	204.79.197.203
Jul 3, 2024 21:03:08.987169981 CEST	49675	443	192.168.2.17	204.79.197.203
Jul 3, 2024 21:03:09.143222094 CEST	443	49745	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.143650055 CEST	49745	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.143676996 CEST	443	49745	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.143984079 CEST	443	49745	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.144295931 CEST	49745	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.144382000 CEST	443	49745	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.144449949 CEST	49745	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.152465105 CEST	443	49746	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.152652025 CEST	49746	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.152662992 CEST	443	49746	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.153011084 CEST	443	49746	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.153271914 CEST	49746	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.153331995 CEST	443	49746	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.153362036 CEST	49746	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.167746067 CEST	443	49748	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.167998075 CEST	49748	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.168004036 CEST	443	49748	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.168318033 CEST	443	49748	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.168602943 CEST	49748	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.168654919 CEST	443	49748	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.168715954 CEST	49748	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.184775114 CEST	443	49747	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.185000896 CEST	49747	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.185012102 CEST	443	49747	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.185358047 CEST	443	49747	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.185626984 CEST	49747	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.185679913 CEST	443	49747	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.185717106 CEST	49747	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.188498974 CEST	443	49745	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.195143938 CEST	49746	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.195153952 CEST	443	49746	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.212508917 CEST	443	49748	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.227149963 CEST	49747	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.227174997 CEST	443	49747	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.254184961 CEST	443	49749	40.126.32.134	192.168.2.17
Jul 3, 2024 21:03:09.254441977 CEST	49749	443	192.168.2.17	40.126.32.134
Jul 3, 2024 21:03:09.254470110 CEST	443	49749	40.126.32.134	192.168.2.17
Jul 3, 2024 21:03:09.255434036 CEST	443	49749	40.126.32.134	192.168.2.17
Jul 3, 2024 21:03:09.255510092 CEST	49749	443	192.168.2.17	40.126.32.134
Jul 3, 2024 21:03:09.259773970 CEST	49749	443	192.168.2.17	40.126.32.134
Jul 3, 2024 21:03:09.259881973 CEST	443	49749	40.126.32.134	192.168.2.17
Jul 3, 2024 21:03:09.259994030 CEST	49749	443	192.168.2.17	40.126.32.134
Jul 3, 2024 21:03:09.260009050 CEST	443	49749	40.126.32.134	192.168.2.17
Jul 3, 2024 21:03:09.307209015 CEST	49749	443	192.168.2.17	40.126.32.134
Jul 3, 2024 21:03:09.423420906 CEST	443	49746	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.423474073 CEST	443	49746	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.423540115 CEST	49746	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.423547029 CEST	443	49746	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.423604965 CEST	49746	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.424607992 CEST	49746	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.424626112 CEST	443	49746	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.429444075 CEST	443	49745	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.429486990 CEST	443	49745	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.429547071 CEST	49745	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.429567099 CEST	443	49745	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.429596901 CEST	443	49745	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.429644108 CEST	49745	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.430097103 CEST	49745	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.430104971 CEST	443	49745	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.437232971 CEST	443	49748	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.437256098 CEST	443	49748	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.437297106 CEST	443	49748	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.437308073 CEST	49748	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.437345028 CEST	49748	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.437923908 CEST	49748	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.437928915 CEST	443	49748	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.440045118 CEST	49751	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.440064907 CEST	443	49751	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.440162897 CEST	49751	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.440382004 CEST	49751	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.440395117 CEST	443	49751	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.464091063 CEST	443	49747	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.464149952 CEST	443	49747	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.464207888 CEST	443	49747	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.464224100 CEST	49747	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.464261055 CEST	49747	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.465071917 CEST	49747	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.465091944 CEST	443	49747	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.467638016 CEST	49752	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.467653036 CEST	443	49752	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.467839956 CEST	49752	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.468060970 CEST	49752	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.468072891 CEST	443	49752	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.593168020 CEST	49675	443	192.168.2.17	204.79.197.203
Jul 3, 2024 21:03:09.621447086 CEST	443	49749	40.126.32.134	192.168.2.17
Jul 3, 2024 21:03:09.621570110 CEST	443	49749	40.126.32.134	192.168.2.17
Jul 3, 2024 21:03:09.621650934 CEST	49749	443	192.168.2.17	40.126.32.134
Jul 3, 2024 21:03:09.653285980 CEST	49749	443	192.168.2.17	40.126.32.134
Jul 3, 2024 21:03:09.653317928 CEST	443	49749	40.126.32.134	192.168.2.17
Jul 3, 2024 21:03:09.916192055 CEST	49754	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.916227102 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.916342020 CEST	49754	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.916539907 CEST	49754	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.916549921 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.938280106 CEST	49755	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.938328028 CEST	443	49755	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:09.938467026 CEST	49755	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.938832998 CEST	49755	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:09.938848972 CEST	443	49755	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.259378910 CEST	443	49751	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.259850025 CEST	49751	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:10.259881020 CEST	443	49751	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.260212898 CEST	443	49751	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.260914087 CEST	49751	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:10.260998011 CEST	443	49751	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.261482000 CEST	49751	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:10.304508924 CEST	443	49751	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.315373898 CEST	443	49752	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.315697908 CEST	49752	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:10.315726042 CEST	443	49752	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.316057920 CEST	443	49752	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.316363096 CEST	49752	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:10.316426992 CEST	443	49752	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.316644907 CEST	49752	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:10.360522985 CEST	443	49752	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.562117100 CEST	443	49723	172.217.16.132	192.168.2.17
Jul 3, 2024 21:03:10.562186956 CEST	443	49723	172.217.16.132	192.168.2.17
Jul 3, 2024 21:03:10.562366009 CEST	49723	443	192.168.2.17	172.217.16.132
Jul 3, 2024 21:03:10.562374115 CEST	443	49751	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.562423944 CEST	443	49751	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.562493086 CEST	443	49751	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.562489033 CEST	49751	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:10.562557936 CEST	49751	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:10.563463926 CEST	49751	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:10.563508987 CEST	443	49751	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.565676928 CEST	49723	443	192.168.2.17	172.217.16.132
Jul 3, 2024 21:03:10.565696955 CEST	443	49723	172.217.16.132	192.168.2.17
Jul 3, 2024 21:03:10.589513063 CEST	443	49752	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.589561939 CEST	443	49752	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.589624882 CEST	443	49752	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.589626074 CEST	49752	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:10.589790106 CEST	49752	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:10.590225935 CEST	49752	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:10.590239048 CEST	443	49752	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.752552986 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.752847910 CEST	49754	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:10.752881050 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.753242970 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.753596067 CEST	49754	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:10.753664017 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.753767014 CEST	49754	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:10.760804892 CEST	443	49755	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.761050940 CEST	49755	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:10.761075974 CEST	443	49755	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.761424065 CEST	443	49755	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.761760950 CEST	49755	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:10.761828899 CEST	443	49755	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.761915922 CEST	49755	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:10.800507069 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.802232981 CEST	49675	443	192.168.2.17	204.79.197.203
Jul 3, 2024 21:03:10.804512024 CEST	443	49755	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:10.834367990 CEST	49757	443	192.168.2.17	2.19.244.127
Jul 3, 2024 21:03:10.834399939 CEST	443	49757	2.19.244.127	192.168.2.17
Jul 3, 2024 21:03:10.834484100 CEST	49757	443	192.168.2.17	2.19.244.127
Jul 3, 2024 21:03:10.835480928 CEST	49757	443	192.168.2.17	2.19.244.127
Jul 3, 2024 21:03:10.835494041 CEST	443	49757	2.19.244.127	192.168.2.17
Jul 3, 2024 21:03:11.022331953 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.023386002 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.023415089 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.023591995 CEST	49754	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.023591995 CEST	49754	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.023623943 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.023680925 CEST	49754	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.038204908 CEST	443	49755	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.038290977 CEST	443	49755	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.038372040 CEST	443	49755	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.038381100 CEST	49755	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.038541079 CEST	49755	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.039081097 CEST	49755	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.039098978 CEST	443	49755	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.043284893 CEST	49758	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.043329000 CEST	443	49758	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.043410063 CEST	49758	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.043697119 CEST	49758	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.043710947 CEST	443	49758	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.113286018 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.113317013 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.113449097 CEST	49754	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.113481998 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.113534927 CEST	49754	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.115633011 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.115652084 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.115730047 CEST	49754	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.115748882 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.115818024 CEST	49754	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.203367949 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.203397036 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.203514099 CEST	49754	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.203547001 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.203597069 CEST	49754	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.204623938 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.204647064 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.204701900 CEST	49754	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.204706907 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.204746962 CEST	49754	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.204767942 CEST	49754	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.205640078 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.205656052 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.205733061 CEST	49754	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.205739975 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.205784082 CEST	49754	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.207369089 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.207403898 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.207453012 CEST	49754	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.207457066 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.207485914 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.207503080 CEST	49754	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.211337090 CEST	49754	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.211337090 CEST	49754	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.518258095 CEST	49754	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.518285990 CEST	443	49754	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.602965117 CEST	443	49757	2.19.244.127	192.168.2.17
Jul 3, 2024 21:03:11.603051901 CEST	49757	443	192.168.2.17	2.19.244.127
Jul 3, 2024 21:03:11.606167078 CEST	49757	443	192.168.2.17	2.19.244.127
Jul 3, 2024 21:03:11.606178999 CEST	443	49757	2.19.244.127	192.168.2.17
Jul 3, 2024 21:03:11.606406927 CEST	443	49757	2.19.244.127	192.168.2.17
Jul 3, 2024 21:03:11.646068096 CEST	49757	443	192.168.2.17	2.19.244.127
Jul 3, 2024 21:03:11.688489914 CEST	443	49757	2.19.244.127	192.168.2.17
Jul 3, 2024 21:03:11.872729063 CEST	443	49758	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.872927904 CEST	49758	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.872956038 CEST	443	49758	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.873292923 CEST	443	49758	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.873569965 CEST	49758	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.873621941 CEST	443	49758	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.873688936 CEST	49758	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:11.900365114 CEST	443	49757	2.19.244.127	192.168.2.17
Jul 3, 2024 21:03:11.900441885 CEST	443	49757	2.19.244.127	192.168.2.17
Jul 3, 2024 21:03:11.900505066 CEST	49757	443	192.168.2.17	2.19.244.127
Jul 3, 2024 21:03:11.900569916 CEST	49757	443	192.168.2.17	2.19.244.127
Jul 3, 2024 21:03:11.900593042 CEST	443	49757	2.19.244.127	192.168.2.17
Jul 3, 2024 21:03:11.900604963 CEST	49757	443	192.168.2.17	2.19.244.127
Jul 3, 2024 21:03:11.900610924 CEST	443	49757	2.19.244.127	192.168.2.17
Jul 3, 2024 21:03:11.916513920 CEST	443	49758	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:11.937757015 CEST	49761	443	192.168.2.17	2.19.244.127
Jul 3, 2024 21:03:11.937788963 CEST	443	49761	2.19.244.127	192.168.2.17
Jul 3, 2024 21:03:11.937871933 CEST	49761	443	192.168.2.17	2.19.244.127
Jul 3, 2024 21:03:11.938143969 CEST	49761	443	192.168.2.17	2.19.244.127
Jul 3, 2024 21:03:11.938158989 CEST	443	49761	2.19.244.127	192.168.2.17
Jul 3, 2024 21:03:12.141993046 CEST	443	49758	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:12.142054081 CEST	443	49758	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:12.142117977 CEST	443	49758	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:12.142118931 CEST	49758	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:12.142169952 CEST	49758	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:12.143315077 CEST	49758	443	192.168.2.17	152.199.21.175
Jul 3, 2024 21:03:12.143335104 CEST	443	49758	152.199.21.175	192.168.2.17
Jul 3, 2024 21:03:12.595385075 CEST	443	49761	2.19.244.127	192.168.2.17
Jul 3, 2024 21:03:12.595477104 CEST	49761	443	192.168.2.17	2.19.244.127
Jul 3, 2024 21:03:12.596645117 CEST	49761	443	192.168.2.17	2.19.244.127
Jul 3, 2024 21:03:12.596669912 CEST	443	49761	2.19.244.127	192.168.2.17
Jul 3, 2024 21:03:12.596889019 CEST	443	49761	2.19.244.127	192.168.2.17
Jul 3, 2024 21:03:12.598000050 CEST	49761	443	192.168.2.17	2.19.244.127
Jul 3, 2024 21:03:12.640505075 CEST	443	49761	2.19.244.127	192.168.2.17
Jul 3, 2024 21:03:12.854500055 CEST	49680	443	192.168.2.17	20.189.173.13
Jul 3, 2024 21:03:12.869102955 CEST	443	49761	2.19.244.127	192.168.2.17
Jul 3, 2024 21:03:12.869174004 CEST	443	49761	2.19.244.127	192.168.2.17
Jul 3, 2024 21:03:12.870049953 CEST	49761	443	192.168.2.17	2.19.244.127
Jul 3, 2024 21:03:12.870089054 CEST	49761	443	192.168.2.17	2.19.244.127
Jul 3, 2024 21:03:12.870089054 CEST	49761	443	192.168.2.17	2.19.244.127
Jul 3, 2024 21:03:12.870109081 CEST	443	49761	2.19.244.127	192.168.2.17
Jul 3, 2024 21:03:12.870121002 CEST	443	49761	2.19.244.127	192.168.2.17
Jul 3, 2024 21:03:13.157160044 CEST	49680	443	192.168.2.17	20.189.173.13
Jul 3, 2024 21:03:13.205270052 CEST	49675	443	192.168.2.17	204.79.197.203
Jul 3, 2024 21:03:13.762206078 CEST	49680	443	192.168.2.17	20.189.173.13
Jul 3, 2024 21:03:14.976169109 CEST	49680	443	192.168.2.17	20.189.173.13
Jul 3, 2024 21:03:17.388207912 CEST	49680	443	192.168.2.17	20.189.173.13
Jul 3, 2024 21:03:18.011329889 CEST	49675	443	192.168.2.17	204.79.197.203
Jul 3, 2024 21:03:21.300328016 CEST	49682	80	192.168.2.17	192.229.211.108
Jul 3, 2024 21:03:21.603190899 CEST	49682	80	192.168.2.17	192.229.211.108
Jul 3, 2024 21:03:22.193218946 CEST	49680	443	192.168.2.17	20.189.173.13
Jul 3, 2024 21:03:22.209312916 CEST	49682	80	192.168.2.17	192.229.211.108
Jul 3, 2024 21:03:23.419323921 CEST	49682	80	192.168.2.17	192.229.211.108
Jul 3, 2024 21:03:25.830310106 CEST	49682	80	192.168.2.17	192.229.211.108
Jul 3, 2024 21:03:27.621305943 CEST	49675	443	192.168.2.17	204.79.197.203
Jul 3, 2024 21:03:30.638250113 CEST	49682	80	192.168.2.17	192.229.211.108
Jul 3, 2024 21:03:31.808734894 CEST	49680	443	192.168.2.17	20.189.173.13
Jul 3, 2024 21:03:32.679286003 CEST	49765	443	192.168.2.17	13.107.5.88
Jul 3, 2024 21:03:32.679325104 CEST	443	49765	13.107.5.88	192.168.2.17
Jul 3, 2024 21:03:32.679404974 CEST	49765	443	192.168.2.17	13.107.5.88
Jul 3, 2024 21:03:32.707465887 CEST	49765	443	192.168.2.17	13.107.5.88
Jul 3, 2024 21:03:32.707479000 CEST	443	49765	13.107.5.88	192.168.2.17
Jul 3, 2024 21:03:33.231482983 CEST	49766	443	192.168.2.17	2.23.209.133
Jul 3, 2024 21:03:33.231509924 CEST	443	49766	2.23.209.133	192.168.2.17
Jul 3, 2024 21:03:33.231595039 CEST	49766	443	192.168.2.17	2.23.209.133
Jul 3, 2024 21:03:33.233452082 CEST	49766	443	192.168.2.17	2.23.209.133
Jul 3, 2024 21:03:33.233464003 CEST	443	49766	2.23.209.133	192.168.2.17
Jul 3, 2024 21:03:33.315330029 CEST	443	49765	13.107.5.88	192.168.2.17
Jul 3, 2024 21:03:33.315407991 CEST	49765	443	192.168.2.17	13.107.5.88
Jul 3, 2024 21:03:33.318878889 CEST	49765	443	192.168.2.17	13.107.5.88
Jul 3, 2024 21:03:33.318886995 CEST	443	49765	13.107.5.88	192.168.2.17
Jul 3, 2024 21:03:33.319128036 CEST	443	49765	13.107.5.88	192.168.2.17
Jul 3, 2024 21:03:33.357227087 CEST	49765	443	192.168.2.17	13.107.5.88
Jul 3, 2024 21:03:33.404494047 CEST	443	49765	13.107.5.88	192.168.2.17
Jul 3, 2024 21:03:33.467513084 CEST	443	49765	13.107.5.88	192.168.2.17
Jul 3, 2024 21:03:33.467804909 CEST	443	49765	13.107.5.88	192.168.2.17
Jul 3, 2024 21:03:33.468044043 CEST	49765	443	192.168.2.17	13.107.5.88
Jul 3, 2024 21:03:33.472006083 CEST	49765	443	192.168.2.17	13.107.5.88
Jul 3, 2024 21:03:33.896327019 CEST	443	49766	2.23.209.133	192.168.2.17
Jul 3, 2024 21:03:33.896409988 CEST	49766	443	192.168.2.17	2.23.209.133
Jul 3, 2024 21:03:33.936378956 CEST	49766	443	192.168.2.17	2.23.209.133
Jul 3, 2024 21:03:33.936397076 CEST	443	49766	2.23.209.133	192.168.2.17
Jul 3, 2024 21:03:33.936609983 CEST	443	49766	2.23.209.133	192.168.2.17
Jul 3, 2024 21:03:33.936656952 CEST	49766	443	192.168.2.17	2.23.209.133
Jul 3, 2024 21:03:33.938435078 CEST	49766	443	192.168.2.17	2.23.209.133
Jul 3, 2024 21:03:33.938460112 CEST	443	49766	2.23.209.133	192.168.2.17
Jul 3, 2024 21:03:34.241497040 CEST	443	49766	2.23.209.133	192.168.2.17
Jul 3, 2024 21:03:34.241542101 CEST	443	49766	2.23.209.133	192.168.2.17
Jul 3, 2024 21:03:34.241580963 CEST	49766	443	192.168.2.17	2.23.209.133
Jul 3, 2024 21:03:34.241604090 CEST	443	49766	2.23.209.133	192.168.2.17
Jul 3, 2024 21:03:34.241615057 CEST	49766	443	192.168.2.17	2.23.209.133
Jul 3, 2024 21:03:34.241662025 CEST	49766	443	192.168.2.17	2.23.209.133
Jul 3, 2024 21:03:34.242191076 CEST	443	49766	2.23.209.133	192.168.2.17
Jul 3, 2024 21:03:34.242233038 CEST	443	49766	2.23.209.133	192.168.2.17
Jul 3, 2024 21:03:34.242239952 CEST	49766	443	192.168.2.17	2.23.209.133
Jul 3, 2024 21:03:34.242280006 CEST	49766	443	192.168.2.17	2.23.209.133
Jul 3, 2024 21:03:34.244097948 CEST	49766	443	192.168.2.17	2.23.209.133
Jul 3, 2024 21:03:34.244112015 CEST	443	49766	2.23.209.133	192.168.2.17
Jul 3, 2024 21:03:34.244127035 CEST	49766	443	192.168.2.17	2.23.209.133
Jul 3, 2024 21:03:34.244163990 CEST	49766	443	192.168.2.17	2.23.209.133
Jul 3, 2024 21:03:34.686388969 CEST	49698	80	192.168.2.17	173.222.108.210
Jul 3, 2024 21:03:34.686444998 CEST	49700	80	192.168.2.17	93.184.221.240
Jul 3, 2024 21:03:34.691567898 CEST	80	49698	173.222.108.210	192.168.2.17
Jul 3, 2024 21:03:34.691641092 CEST	49698	80	192.168.2.17	173.222.108.210
Jul 3, 2024 21:03:34.692089081 CEST	80	49700	93.184.221.240	192.168.2.17
Jul 3, 2024 21:03:34.692198038 CEST	49700	80	192.168.2.17	93.184.221.240
Jul 3, 2024 21:03:39.287192106 CEST	49767	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:39.287225962 CEST	443	49767	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:39.287329912 CEST	49767	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:39.287719965 CEST	49767	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:39.287734032 CEST	443	49767	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:40.161458015 CEST	443	49767	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:40.161556005 CEST	49767	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:40.163283110 CEST	49767	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:40.163294077 CEST	443	49767	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:40.163523912 CEST	443	49767	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:40.164835930 CEST	49767	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:40.208503962 CEST	443	49767	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:40.242311954 CEST	49682	80	192.168.2.17	192.229.211.108
Jul 3, 2024 21:03:40.498053074 CEST	443	49767	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:40.498121977 CEST	443	49767	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:40.498141050 CEST	443	49767	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:40.498212099 CEST	49767	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:40.498229027 CEST	443	49767	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:40.498289108 CEST	49767	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:40.498310089 CEST	49767	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:40.499644041 CEST	443	49767	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:40.499711990 CEST	49767	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:40.499722004 CEST	443	49767	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:40.499782085 CEST	443	49767	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:40.499794006 CEST	49767	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:40.499888897 CEST	443	49767	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:40.499938965 CEST	49767	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:40.501637936 CEST	49767	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:40.501650095 CEST	443	49767	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:40.501661062 CEST	49767	443	192.168.2.17	40.127.169.103
Jul 3, 2024 21:03:40.501669884 CEST	443	49767	40.127.169.103	192.168.2.17
Jul 3, 2024 21:03:59.819418907 CEST	49769	443	192.168.2.17	172.217.16.132
Jul 3, 2024 21:03:59.819514036 CEST	443	49769	172.217.16.132	192.168.2.17
Jul 3, 2024 21:03:59.819611073 CEST	49769	443	192.168.2.17	172.217.16.132
Jul 3, 2024 21:03:59.819827080 CEST	49769	443	192.168.2.17	172.217.16.132
Jul 3, 2024 21:03:59.819864035 CEST	443	49769	172.217.16.132	192.168.2.17
Jul 3, 2024 21:04:00.499902010 CEST	443	49769	172.217.16.132	192.168.2.17
Jul 3, 2024 21:04:00.500188112 CEST	49769	443	192.168.2.17	172.217.16.132
Jul 3, 2024 21:04:00.500215054 CEST	443	49769	172.217.16.132	192.168.2.17
Jul 3, 2024 21:04:00.500505924 CEST	443	49769	172.217.16.132	192.168.2.17
Jul 3, 2024 21:04:00.500765085 CEST	49769	443	192.168.2.17	172.217.16.132
Jul 3, 2024 21:04:00.500822067 CEST	443	49769	172.217.16.132	192.168.2.17
Jul 3, 2024 21:04:00.554322004 CEST	49769	443	192.168.2.17	172.217.16.132
Jul 3, 2024 21:04:10.399674892 CEST	443	49769	172.217.16.132	192.168.2.17
Jul 3, 2024 21:04:10.399748087 CEST	443	49769	172.217.16.132	192.168.2.17
Jul 3, 2024 21:04:10.399934053 CEST	49769	443	192.168.2.17	172.217.16.132
Jul 3, 2024 21:04:11.154140949 CEST	49769	443	192.168.2.17	172.217.16.132
Jul 3, 2024 21:04:11.154208899 CEST	443	49769	172.217.16.132	192.168.2.17
Jul 3, 2024 21:04:19.373692036 CEST	49695	80	192.168.2.17	173.222.108.210
Jul 3, 2024 21:04:19.379323959 CEST	80	49695	173.222.108.210	192.168.2.17
Jul 3, 2024 21:04:19.379424095 CEST	49695	80	192.168.2.17	173.222.108.210

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 21:02:54.925959110 CEST	50197	53	192.168.2.17	1.1.1.1
Jul 3, 2024 21:02:54.926110029 CEST	64930	53	192.168.2.17	1.1.1.1
Jul 3, 2024 21:02:54.932328939 CEST	53	62002	1.1.1.1	192.168.2.17
Jul 3, 2024 21:02:54.990034103 CEST	53	49841	1.1.1.1	192.168.2.17
Jul 3, 2024 21:02:56.029963017 CEST	53	53636	1.1.1.1	192.168.2.17
Jul 3, 2024 21:02:58.190548897 CEST	65235	53	192.168.2.17	1.1.1.1
Jul 3, 2024 21:02:58.190716028 CEST	57975	53	192.168.2.17	1.1.1.1
Jul 3, 2024 21:02:59.767303944 CEST	59797	53	192.168.2.17	1.1.1.1
Jul 3, 2024 21:02:59.767611980 CEST	64890	53	192.168.2.17	1.1.1.1
Jul 3, 2024 21:02:59.775229931 CEST	53	59797	1.1.1.1	192.168.2.17
Jul 3, 2024 21:02:59.776185989 CEST	53	64890	1.1.1.1	192.168.2.17
Jul 3, 2024 21:03:01.500241041 CEST	55989	53	192.168.2.17	1.1.1.1
Jul 3, 2024 21:03:01.500538111 CEST	55309	53	192.168.2.17	1.1.1.1
Jul 3, 2024 21:03:01.770221949 CEST	57404	53	192.168.2.17	1.1.1.1
Jul 3, 2024 21:03:01.770452976 CEST	59595	53	192.168.2.17	1.1.1.1
Jul 3, 2024 21:03:01.778655052 CEST	53	57404	1.1.1.1	192.168.2.17
Jul 3, 2024 21:03:01.780740023 CEST	53	59595	1.1.1.1	192.168.2.17
Jul 3, 2024 21:03:06.032778978 CEST	57449	53	192.168.2.17	1.1.1.1
Jul 3, 2024 21:03:06.032938957 CEST	56019	53	192.168.2.17	1.1.1.1
Jul 3, 2024 21:03:06.040366888 CEST	53	57449	1.1.1.1	192.168.2.17
Jul 3, 2024 21:03:06.040846109 CEST	53	56019	1.1.1.1	192.168.2.17
Jul 3, 2024 21:03:08.410324097 CEST	64118	53	192.168.2.17	1.1.1.1
Jul 3, 2024 21:03:08.410499096 CEST	56046	53	192.168.2.17	1.1.1.1
Jul 3, 2024 21:03:08.418628931 CEST	53	64118	1.1.1.1	192.168.2.17
Jul 3, 2024 21:03:08.419461012 CEST	53	56046	1.1.1.1	192.168.2.17
Jul 3, 2024 21:03:10.026606083 CEST	53	60777	1.1.1.1	192.168.2.17
Jul 3, 2024 21:03:11.071688890 CEST	63584	53	192.168.2.17	1.1.1.1
Jul 3, 2024 21:03:11.071822882 CEST	52159	53	192.168.2.17	1.1.1.1
Jul 3, 2024 21:03:13.006373882 CEST	53	50383	1.1.1.1	192.168.2.17
Jul 3, 2024 21:03:31.986800909 CEST	53	63816	1.1.1.1	192.168.2.17
Jul 3, 2024 21:03:55.161966085 CEST	53	49333	1.1.1.1	192.168.2.17
Jul 3, 2024 21:03:55.167095900 CEST	53	49724	1.1.1.1	192.168.2.17
Jul 3, 2024 21:04:01.514620066 CEST	64622	53	192.168.2.17	1.1.1.1
Jul 3, 2024 21:04:01.514755011 CEST	58441	53	192.168.2.17	1.1.1.1
Jul 3, 2024 21:04:10.071198940 CEST	138	138	192.168.2.17	192.168.2.255
Jul 3, 2024 21:04:22.770405054 CEST	53	51323	1.1.1.1	192.168.2.17

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jul 3, 2024 21:02:55.066648006 CEST	192.168.2.17	1.1.1.1	c36d	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 21:02:54.925959110 CEST	192.168.2.17	1.1.1.1	0x982e	Standard query (0)	cscslions-my.sharepoint.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:02:54.926110029 CEST	192.168.2.17	1.1.1.1	0x2f44	Standard query (0)	cscslions-my.sharepoint.com	65	IN (0x0001)	false
Jul 3, 2024 21:02:58.190548897 CEST	192.168.2.17	1.1.1.1	0x6bb	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:02:58.190716028 CEST	192.168.2.17	1.1.1.1	0x5b7f	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
Jul 3, 2024 21:02:59.767303944 CEST	192.168.2.17	1.1.1.1	0x4c04	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:02:59.767611980 CEST	192.168.2.17	1.1.1.1	0x3a38	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jul 3, 2024 21:03:01.500241041 CEST	192.168.2.17	1.1.1.1	0xd342	Standard query (0)	identity.nel.measure.office.net	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:03:01.500538111 CEST	192.168.2.17	1.1.1.1	0x9699	Standard query (0)	identity.nel.measure.office.net	65	IN (0x0001)	false
Jul 3, 2024 21:03:01.770221949 CEST	192.168.2.17	1.1.1.1	0x650f	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:03:01.770452976 CEST	192.168.2.17	1.1.1.1	0x74b5	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Jul 3, 2024 21:03:06.032778978 CEST	192.168.2.17	1.1.1.1	0x64e7	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:03:06.032938957 CEST	192.168.2.17	1.1.1.1	0x86f1	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Jul 3, 2024 21:03:08.410324097 CEST	192.168.2.17	1.1.1.1	0xe2c0	Standard query (0)	autologon.microsoftazuread-sso.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:03:08.410499096 CEST	192.168.2.17	1.1.1.1	0xd1b	Standard query (0)	autologon.microsoftazuread-sso.com	65	IN (0x0001)	false
Jul 3, 2024 21:03:11.071688890 CEST	192.168.2.17	1.1.1.1	0x7678	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:03:11.071822882 CEST	192.168.2.17	1.1.1.1	0x3c39	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
Jul 3, 2024 21:04:01.514620066 CEST	192.168.2.17	1.1.1.1	0x30f1	Standard query (0)	identity.nel.measure.office.net	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:04:01.514755011 CEST	192.168.2.17	1.1.1.1	0x3aa5	Standard query (0)	identity.nel.measure.office.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 21:02:54.986298084 CEST	1.1.1.1	192.168.2.17	0x982e	No error (0)	cscslions-my.sharepoint.com	cscslions.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:02:54.986298084 CEST	1.1.1.1	192.168.2.17	0x982e	No error (0)	cscslions.sharepoint.com	547-ipv4v6e.clump.dprodmgd108.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:02:54.986298084 CEST	1.1.1.1	192.168.2.17	0x982e	No error (0)	547-ipv4v6e.clump.dprodmgd108.aa-rt.sharepoint.com	201294-ipv4v6e.farm.dprodmgd108.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:02:54.986298084 CEST	1.1.1.1	192.168.2.17	0x982e	No error (0)	201294-ipv4v6e.farm.dprodmgd108.aa-rt.sharepoint.com	201294-ipv4v6w.farm.dprodmgd108.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:02:54.986298084 CEST	1.1.1.1	192.168.2.17	0x982e	No error (0)	201294-ipv4v6.farm.dprodmgd108.aa-rt.sharepoint.com.dual-spo-0005.spo-msedge.net	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:02:54.986298084 CEST	1.1.1.1	192.168.2.17	0x982e	No error (0)	dual-spo-0005.spo-msedge.net		13.107.136.10	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:02:54.986298084 CEST	1.1.1.1	192.168.2.17	0x982e	No error (0)	dual-spo-0005.spo-msedge.net		13.107.138.10	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:02:55.066555023 CEST	1.1.1.1	192.168.2.17	0x2f44	No error (0)	cscslions-my.sharepoint.com	cscslions.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:02:55.066555023 CEST	1.1.1.1	192.168.2.17	0x2f44	No error (0)	cscslions.sharepoint.com	547-ipv4v6e.clump.dprodmgd108.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:02:55.066555023 CEST	1.1.1.1	192.168.2.17	0x2f44	No error (0)	547-ipv4v6e.clump.dprodmgd108.aa-rt.sharepoint.com	201294-ipv4v6e.farm.dprodmgd108.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:02:55.066555023 CEST	1.1.1.1	192.168.2.17	0x2f44	No error (0)	201294-ipv4v6e.farm.dprodmgd108.aa-rt.sharepoint.com	201294-ipv4v6w.farm.dprodmgd108.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:02:58.197850943 CEST	1.1.1.1	192.168.2.17	0x6bb	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:02:58.199928999 CEST	1.1.1.1	192.168.2.17	0x5b7f	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:02:59.447973967 CEST	1.1.1.1	192.168.2.17	0xdeab	No error (0)	shed.dual-low.s-part-0039.t-0009.t-msedge.net	s-part-0039.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:02:59.447973967 CEST	1.1.1.1	192.168.2.17	0xdeab	No error (0)	s-part-0039.t-0009.t-msedge.net		13.107.246.67	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:02:59.775229931 CEST	1.1.1.1	192.168.2.17	0x4c04	No error (0)	www.google.com		172.217.16.132	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:02:59.776185989 CEST	1.1.1.1	192.168.2.17	0x3a38	No error (0)	www.google.com			65	IN (0x0001)	false
Jul 3, 2024 21:03:01.509107113 CEST	1.1.1.1	192.168.2.17	0x9699	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:03:01.510440111 CEST	1.1.1.1	192.168.2.17	0xd342	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:03:01.778655052 CEST	1.1.1.1	192.168.2.17	0x650f	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:03:01.778655052 CEST	1.1.1.1	192.168.2.17	0x650f	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:03:01.778655052 CEST	1.1.1.1	192.168.2.17	0x650f	No error (0)	sni1gl.wpc.omegacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:03:01.780740023 CEST	1.1.1.1	192.168.2.17	0x74b5	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:03:01.780740023 CEST	1.1.1.1	192.168.2.17	0x74b5	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:03:06.040366888 CEST	1.1.1.1	192.168.2.17	0x64e7	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:03:06.040366888 CEST	1.1.1.1	192.168.2.17	0x64e7	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:03:06.040366888 CEST	1.1.1.1	192.168.2.17	0x64e7	No error (0)	sni1gl.wpc.omegacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:03:06.040846109 CEST	1.1.1.1	192.168.2.17	0x86f1	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:03:06.040846109 CEST	1.1.1.1	192.168.2.17	0x86f1	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:03:08.418628931 CEST	1.1.1.1	192.168.2.17	0xe2c0	No error (0)	autologon.microsoftazuread-sso.com		40.126.32.134	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:03:08.418628931 CEST	1.1.1.1	192.168.2.17	0xe2c0	No error (0)	autologon.microsoftazuread-sso.com		40.126.32.74	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:03:08.418628931 CEST	1.1.1.1	192.168.2.17	0xe2c0	No error (0)	autologon.microsoftazuread-sso.com		20.190.160.17	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:03:08.418628931 CEST	1.1.1.1	192.168.2.17	0xe2c0	No error (0)	autologon.microsoftazuread-sso.com		40.126.32.138	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:03:08.418628931 CEST	1.1.1.1	192.168.2.17	0xe2c0	No error (0)	autologon.microsoftazuread-sso.com		40.126.32.76	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:03:08.418628931 CEST	1.1.1.1	192.168.2.17	0xe2c0	No error (0)	autologon.microsoftazuread-sso.com		40.126.32.136	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:03:08.418628931 CEST	1.1.1.1	192.168.2.17	0xe2c0	No error (0)	autologon.microsoftazuread-sso.com		40.126.32.133	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:03:08.418628931 CEST	1.1.1.1	192.168.2.17	0xe2c0	No error (0)	autologon.microsoftazuread-sso.com		20.190.160.14	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:03:11.080168962 CEST	1.1.1.1	192.168.2.17	0x7678	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:03:11.080689907 CEST	1.1.1.1	192.168.2.17	0x3c39	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:04:01.674988985 CEST	1.1.1.1	192.168.2.17	0x3aa5	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:04:01.675056934 CEST	1.1.1.1	192.168.2.17	0x30f1	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

cscslions-my.sharepoint.com

https:

aadcdn.msauth.net

aadcdn.msftauth.net

autologon.microsoftazuread-sso.com

slscr.update.microsoft.com

fs.microsoft.com

evoke-windowsservices-tas.msedge.net

www.bing.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.17	49714	13.107.136.10	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:02:55 UTC	868	OUT	GET /:o:/r/personal/townanna_cscslions_org/Documents/Notebooks/Incoming%20Secured%20Documents?d=w0d9de69417ec4658accc7b13d437f099&e=5%3ac065c2863fe74bbcbe226a07bdb64d8c&sharingv2=true&fromShare=true&at=9 HTTP/1.1 Host: cscslions-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:02:55 UTC	1083	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/plain Location: https://cscslions-my.sharepoint.com/personal/townanna_cscslions_org/Documents/Notebooks/Incoming%20Secured%20Documents?d=w0d9de69417ec4658accc7b13d437f099&e=5%3ac065c2863fe74bbcbe226a07bdb64d8c&sharingv2=true&fromShare=true&at=9&CID=cc283c77-1b67-44e4-9a75-60ef7c8c7c80 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-NetworkStatistics: 0,2102272,0,208,3243282,0,1630411,40 SPRequestGuid: 74c238a1-00df-0000-20f1-6b81415cb4d5 request-id: 74c238a1-00df-0000-20f1-6b81415cb4d5 MS-CV: oTjCdN8AAAAg8WuBQVy01Q.0 Strict-Transport-Security: max-age=31536000 SPRequestDuration: 7 SPIisLatency: 15 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25012 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 7B5FD5CC414D4B1C8F6110512D4264ED Ref B: EWR311000108021 Ref C: 2024-07-03T19:02:55Z Date: Wed, 03 Jul 2024 19:02:55 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.17	49717	13.107.136.10	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:02:56 UTC	903	OUT	GET /personal/townanna_cscslions_org/Documents/Notebooks/Incoming%20Secured%20Documents?d=w0d9de69417ec4658accc7b13d437f099&e=5%3ac065c2863fe74bbcbe226a07bdb64d8c&sharingv2=true&fromShare=true&at=9&CID=cc283c77-1b67-44e4-9a75-60ef7c8c7c80 HTTP/1.1 Host: cscslions-my.sharepoint.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:02:56 UTC	2323	IN	HTTP/1.1 302 Found Content-Length: 504 Content-Type: text/html; charset=utf-8 Location: https://cscslions-my.sharepoint.com/personal/townanna_cscslions_org/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Ftownanna%5Fcscslions%5Forg%2FDocuments%2FNotebooks%2FIncoming%20Secured%20Documents%3Fd%3Dw0d9de69417ec4658accc7b13d437f099%26e%3D5%253ac065c2863fe74bbcbe226a07bdb64d8c%26sharingv2%3Dtrue%26fromShare%3Dtrue%26at%3D9%26CID%3Dcc283c77%2D1b67%2D44e4%2D9a75%2D60ef7c8c7c80 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-NetworkStatistics: 0,525568,0,0,506516,0,207658,40 X-SharePointHealthScore: 0 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: 75c238a1-e00e-0000-1a10-b9b4e454552c request-id: 75c238a1-e00e-0000-1a10-b9b4e454552c MS-CV: oTjCdQ7gAAAaELm05FRVLA.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=Edge-Prod-EWR31r5d&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com *.onedrive.live.com securebroker.sharepointonline.com; SPRequestDuration: 21 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25012 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: F1D9CF1F5905443E8729E31B53F09DED Ref B: EWR311000107049 Ref C: 2024-07-03T19:02:56Z Date: Wed, 03 Jul 2024 19:02:55 GMT Connection: close
2024-07-03 19:02:56 UTC	504	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 73 63 73 6c 69 6f 6e 73 2d 6d 79 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 70 65 72 73 6f 6e 61 6c 2f 74 6f 77 6e 61 6e 6e 61 5f 63 73 63 73 6c 69 6f 6e 73 5f 6f 72 67 2f 5f 6c 61 79 6f 75 74 73 2f 31 35 2f 41 75 74 68 65 6e 74 69 63 61 74 65 2e 61 73 70 78 3f 53 6f 75 72 63 65 3d 25 32 46 70 65 72 73 6f 6e 61 6c 25 32 46 74 6f 77 6e 61 6e 6e 61 25 35 46 63 73 63 73 6c 69 6f 6e 73 25 35 46 6f 72 67 25 32 46 44 6f 63 75 6d 65 6e 74 73 25 32 46 4e 6f 74 65 62 6f 6f 6b 73 25 32 46 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://cscslions-my.sharepoint.com/personal/townanna_cscslions_org/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Ftownanna%5Fcscslions%5Forg%2FDocuments%2FNotebooks%2F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.17	49718	13.107.136.10	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:02:57 UTC	1021	OUT	GET /personal/townanna_cscslions_org/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Ftownanna%5Fcscslions%5Forg%2FDocuments%2FNotebooks%2FIncoming%20Secured%20Documents%3Fd%3Dw0d9de69417ec4658accc7b13d437f099%26e%3D5%253ac065c2863fe74bbcbe226a07bdb64d8c%26sharingv2%3Dtrue%26fromShare%3Dtrue%26at%3D9%26CID%3Dcc283c77%2D1b67%2D44e4%2D9a75%2D60ef7c8c7c80 HTTP/1.1 Host: cscslions-my.sharepoint.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:02:57 UTC	2378	IN	HTTP/1.1 302 Found Cache-Control: private Content-Length: 584 Content-Type: text/html; charset=utf-8 Location: /_forms/default.aspx?ReturnUrl=%2fpersonal%2ftownanna_cscslions_org%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Ftownanna%255Fcscslions%255Forg%252FDocuments%252FNotebooks%252FIncoming%2520Secured%2520Documents%253Fd%253Dw0d9de69417ec4658accc7b13d437f099%2526e%253D5%25253ac065c2863fe74bbcbe226a07bdb64d8c%2526sharingv2%253Dtrue%2526fromShare%253Dtrue%2526at%253D9%2526CID%253Dcc283c77%252D1b67%252D44e4%252D9a75%252D60ef7c8c7c80&Source=cookie P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: RpsContextCookie=U291cmNlPSUyRnBlcnNvbmFsJTJGdG93bmFubmElNUZjc2NzbGlvbnMlNUZvcmclMkZEb2N1bWVudHMlMkZOb3RlYm9va3MlMkZJbmNvbWluZyUyMFNlY3VyZWQlMjBEb2N1bWVudHMlM0ZkJTNEdzBkOWRlNjk0MTdlYzQ2NThhY2NjN2IxM2Q0MzdmMDk5JTI2ZSUzRDUlMjUzYWMwNjVjMjg2M2ZlNzRiYmNiZTIyNmEwN2JkYjY0ZDhjJTI2c2hhcmluZ3YyJTNEdHJ1ZSUyNmZyb21TaGFyZSUzRHRydWUlMjZhdCUzRDklMjZDSUQlM0RjYzI4M2M3NyUyRDFiNjclMkQ0NGU0JTJEOWE3NSUyRDYwZWY3YzhjN2M4MA==; expires=Wed, 03-Jul-2024 19:12:57 GMT; path=/; SameSite=None; secure; HttpOnly X-NetworkStatistics: 0,1051136,2,184,741508,0,776792,44 X-SharePointHealthScore: 3 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: 75c238a1-6040-0000-16c2-7e1a0119fa37 request-id: 75c238a1-6040-0000-16c2-7e1a0119fa37 MS-CV: oTjCdUBgAAAWwn4aARn6Nw.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=Edge-Prod-EWR31r5a&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 SPRequestDuration: 14 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25012 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: A48A9EFDFA354A9983C95ACB3E388DBC Ref B: EWR311000102035 Ref C: 2024-07-03T19:02:57Z Date: Wed, 03 Jul 2024 19:02:57 GMT Connection: close
2024-07-03 19:02:57 UTC	584	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 2f 5f 66 6f 72 6d 73 2f 64 65 66 61 75 6c 74 2e 61 73 70 78 3f 52 65 74 75 72 6e 55 72 6c 3d 25 32 66 70 65 72 73 6f 6e 61 6c 25 32 66 74 6f 77 6e 61 6e 6e 61 5f 63 73 63 73 6c 69 6f 6e 73 5f 6f 72 67 25 32 66 5f 6c 61 79 6f 75 74 73 25 32 66 31 35 25 32 66 41 75 74 68 65 6e 74 69 63 61 74 65 2e 61 73 70 78 25 33 66 53 6f 75 72 63 65 25 33 64 25 32 35 32 46 70 65 72 73 6f 6e 61 6c 25 32 35 32 46 74 6f 77 6e 61 6e 6e 61 25 32 35 35 46 63 73 63 73 6c 69 6f 6e 73 25 32 35 35 46 6f 72 67 25 32 35 32 46 44 6f 63 75 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="/_forms/default.aspx?ReturnUrl=%2fpersonal%2ftownanna_cscslions_org%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Ftownanna%255Fcscslions%255Forg%252FDocu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.17	49720	13.107.136.10	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:02:57 UTC	1547	OUT	GET /_forms/default.aspx?ReturnUrl=%2fpersonal%2ftownanna_cscslions_org%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Ftownanna%255Fcscslions%255Forg%252FDocuments%252FNotebooks%252FIncoming%2520Secured%2520Documents%253Fd%253Dw0d9de69417ec4658accc7b13d437f099%2526e%253D5%25253ac065c2863fe74bbcbe226a07bdb64d8c%2526sharingv2%253Dtrue%2526fromShare%253Dtrue%2526at%253D9%2526CID%253Dcc283c77%252D1b67%252D44e4%252D9a75%252D60ef7c8c7c80&Source=cookie HTTP/1.1 Host: cscslions-my.sharepoint.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: RpsContextCookie=U291cmNlPSUyRnBlcnNvbmFsJTJGdG93bmFubmElNUZjc2NzbGlvbnMlNUZvcmclMkZEb2N1bWVudHMlMkZOb3RlYm9va3MlMkZJbmNvbWluZyUyMFNlY3VyZWQlMjBEb2N1bWVudHMlM0ZkJTNEdzBkOWRlNjk0MTdlYzQ2NThhY2NjN2IxM2Q0MzdmMDk5JTI2ZSUzRDUlMjUzYWMwNjVjMjg2M2ZlNzRiYmNiZTIyNmEwN2JkYjY0ZDhjJTI2c2hhcmluZ3YyJTNEdHJ1ZSUyNmZyb21TaGFyZSUzRHRydWUlMjZhdCUzRDklMjZDSUQlM0RjYzI4M2M3NyUyRDFiNjclMkQ0NGU0JTJEOWE3NSUyRDYwZWY3YzhjN2M4MA==
2024-07-03 19:02:58 UTC	4378	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Length: 885 Content-Type: text/html; charset=utf-8 Expires: -1 Location: https://login.microsoftonline.com:443/18d5b6a3-deb9-4f24-9d39-2d9ef885718b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=EDC3341AE9E916BE89A1EB813F5AC44D51DF79533827CF13%2D54E4085150232EBD5D08E804E70BFAE75AC439E8292E8C8542D6FE57C2989E9D&redirect%5Furi=https%3A%2F%2Fcscslions%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=75c238a1%2D8070%2D0000%2D1ca8%2Ddcfb33df0a80 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: nSGt-EDC3341AE9E916BE89A1EB813F5AC44D51DF79533827CF13=gYEwQ0MzQzkzQ0ZFRDE3MTlBMURDQUFCNjVEQjc2MDNDMjNEQkExN0UzNDEwQTlCNEY5MEVEQzMzNDFBRTlFOTE2QkU4OUExRUI4MTNGNUFDNDRENTFERjc5NTMzODI3Q0YxMxIxMzM2NDUwNzIxODA3MjYwNjAbY3Njc2xpb25zLW15LnNoYXJlcG9pbnQuY29tArYv6osRTSkE9K6e9HkGAhE2yqHMUv8OnKX1oLVCfz3+P9XB49PaETgeTQHxRAvyquOm9HQoKU4tz2gE2tkeeAZXUuKWRbk71275pyDyMICSAZuWzmHPA2LP7gDHweCOseKPTW93SrD2zurwyLFB5Kr1G525iUlz0auqDlE+vJx5QzM+JEbQNV/zxE0hJVdS1LgC2drz0DZoH6QEqI1ssaQik/Y5o0FBl6Q17HfErgOUWs+DSswbPrBoi9VGNOp2qmCiTfW4XqW5bi38OKo+6vJd29SqG8mr9gMS9GlCp1iWFd+t8ZnmCsn4fuKhRtdfZwzv600/iTLHC9qPAFhD45MAAAA=; expires=Wed, 03-Jul-2024 19:06:58 GMT; path=/; SameSite=None; secure; HttpOnly Set-Cookie: nSGt-EDC3341AE9E916BE89A1EB813F5AC44D51DF79533827CF13=; expires=Thu, 01-Jan-1970 08:00:00 GMT; path=/; SameSite=None; Partitioned; secure; HttpOnly Set-Cookie: RpsContextCookie=U291cmNlPSUyRnBlcnNvbmFsJTJGdG93bmFubmElNUZjc2NzbGlvbnMlNUZvcmclMkZEb2N1bWVudHMlMkZOb3RlYm9va3MlMkZJbmNvbWluZyUyMFNlY3VyZWQlMjBEb2N1bWVudHMlM0ZkJTNEdzBkOWRlNjk0MTdlYzQ2NThhY2NjN2IxM2Q0MzdmMDk5JTI2ZSUzRDUlMjUzYWMwNjVjMjg2M2ZlNzRiYmNiZTIyNmEwN2JkYjY0ZDhjJTI2c2hhcmluZ3YyJTNEdHJ1ZSUyNmZyb21TaGFyZSUzRHRydWUlMjZhdCUzRDklMjZDSUQlM0RjYzI4M2M3NyUyRDFiNjclMkQ0NGU0JTJEOWE3NSUyRDYwZWY3YzhjN2M4MCZQcmV2aW91c1JlcXVlc3RDb3JyZWxhdGlvbklkPTc1YzIzOGExJTJEODA3MCUyRDAwMDAlMkQxY2E4JTJEZGNmYjMzZGYwYTgwJlJldHVyblVybD0lMkZwZXJzb25hbCUyRnRvd25hbm5hJTVGY3Njc2xpb25zJTVGb3JnJTJGJTVGbGF5b3V0cyUyRjE1JTJGQXV0aGVudGljYXRlJTJFYXNweCUzRlNvdXJjZSUzRCUyNTJGcGVyc29uYWwlMjUyRnRvd25hbm5hJTI1NUZjc2NzbGlvbnMlMjU1Rm9yZyUyNTJGRG9jdW1lbnRzJTI1MkZOb3RlYm9va3MlMjUyRkluY29taW5nJTI1MjBTZWN1cmVkJTI1MjBEb2N1bWVudHMlMjUzRmQlMjUzRHcwZDlkZTY5NDE3ZWM0NjU4YWNjYzdiMTNkNDM3ZjA5OSUyNTI2ZSUyNTNENSUyNTI1M2FjMDY1YzI4NjNmZTc0YmJjYmUyMjZhMDdiZGI2NGQ4YyUyNTI2c2hhcmluZ3YyJTI1M0R0cnVlJTI1MjZmcm9tU2hhcmUlMjUzRHRydWUlMjUyNmF0JTI1M0Q5JTI1MjZDSUQlMjU [TRUNCATED] Set-Cookie: RpsContextCookie=; expires=Thu, 01-Jan-1970 08:00:00 GMT; path=/; SameSite=None; Partitioned; secure; HttpOnly X-NetworkStatistics: 0,1051136,0,0,710373,0,1051136,36 X-SharePointHealthScore: 1 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: 75c238a1-8070-0000-1ca8-dcfb33df0a80 request-id: 75c238a1-8070-0000-1ca8-dcfb33df0a80 MS-CV: oTjCdXCAAAAcqNz7M98KgA.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=e7cd2151-b3af-4ab5-bc01-dab8e214944a&destinationEndpoint=Edge-Prod-EWR31r5a&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 SPRequestDuration: 55 SPIisLatency: 0 Include-Referred-Token-Binding-ID: true X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25012 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: E37265DA74E54FD7BE9B1C55BB1D70CC Ref B: EWR311000101053 Ref C: 2024-07-03T19:02:58Z Date: Wed, 03 Jul 2024 19:02:57 GMT Connection: close
2024-07-03 19:02:58 UTC	885	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 3a 34 34 33 2f 31 38 64 35 62 36 61 33 2d 64 65 62 39 2d 34 66 32 34 2d 39 64 33 39 2d 32 64 39 65 66 38 38 35 37 31 38 62 2f 6f 61 75 74 68 32 2f 61 75 74 68 6f 72 69 7a 65 3f 63 6c 69 65 6e 74 25 35 46 69 64 3d 30 30 30 30 30 30 30 33 25 32 44 30 30 30 30 25 32 44 30 66 66 31 25 32 44 63 65 30 30 25 32 44 30 30 30 30 30 30 30 30 30 30 30 30 26 61 6d 70 3b 72 65 73 70 6f 6e 73 65 25 35 46 6d 6f 64 65 3d 66 6f 72 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://login.microsoftonline.com:443/18d5b6a3-deb9-4f24-9d39-2d9ef885718b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=for

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.17	49722	13.107.246.67	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:00 UTC	633	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_sw-M8KkV3_nBot-G1ImRcw2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:03:00 UTC	797	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 19:03:00 GMT Content-Type: application/x-javascript Content-Length: 49696 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 24 May 2024 22:13:21 GMT ETag: 0x8DC7C3EB8EDBF94 x-ms-request-id: ed2f6aa1-401e-0055-1bcb-cad3dd000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240703T190300Z-157bfc59976dspld7apvpb5s0s0000000fd0000000007k5h x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-07-03 19:03:00 UTC	15587	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e4 bd eb 5b e3 38 d2 38 fa fd fd 2b 82 77 0f 13 4f 4c c8 05 68 70 da 9d 5f 1a e8 6e 66 80 30 24 cc e5 05 96 c7 89 15 f0 74 b0 b3 b6 c3 65 20 e7 6f 3f 75 91 6c d9 71 e8 9e dd f3 9c 2f 67 2e c4 96 4a b2 54 aa 2a 55 95 4a d2 e6 8f 6b ff 53 f9 b1 b2 f1 fd ff 54 06 c3 de f9 b0 d2 ff 54 19 7e 39 3a 3f a8 9c c1 db 1f 95 d3 fe f0 68 ff f0 fb eb c1 8f e2 ff c3 3b 3f ae 4c fc a9 a8 c0 ef c8 8d 85 57 09 83 4a 18 55 fc 60 1c 46 b3 30 72 13 11 57 ee e1 6f e4 bb d3 ca 24 0a ef 2b c9 9d a8 cc a2 f0 4f 31 4e e2 ca d4 8f 13 28 34 12 d3 f0 b1 52 85 ea 22 af 72 e6 46 c9 73 e5 e8 cc ac 43 fd 02 6a f3 6f fd 00 4a 8f c3 d9 33 3c df 25 95 20 4c fc b1 a8 b8 81 47 b5 4d e1 25 88 45 65 1e 78 22 aa 3c de f9 e3 bb ca 89 3f 8e c2 38 9c 24 95 48 8c 85 ff Data Ascii: [88+wOLhp_nf0$te o?ulq/g.JT*UJkSTT~9:?h;?LWJU`F0rWo$+O1N(4R"rFsCjoJ3<% LGM%Eex"<?8$H
2024-07-03 19:03:00 UTC	16384	IN	Data Raw: 2e b7 f6 3f f6 cf 11 8a 63 a5 49 a4 a8 49 28 d5 0d 41 59 e3 36 4b e1 be dd c8 64 fa 76 93 fc 38 74 42 0b 75 16 78 23 72 79 77 a4 26 b6 6d 43 64 2f 6c 19 d9 74 94 90 61 91 60 34 f0 86 29 63 e5 69 ae 49 b5 65 76 82 3a 1d fc 74 11 80 41 e2 c1 88 1c 3e e1 11 1b 00 db 07 eb f8 4f 26 f5 dc 61 9e e2 d2 a0 a3 84 8c eb 6a c9 61 90 a2 83 77 39 02 26 c1 28 09 27 7c 4e 1a 9d a2 af 9d 9a 96 7e ab 22 0f 8f ad 44 ea 4b 76 c5 a8 e1 89 8b b1 50 0a 8c f6 11 f3 45 9e 51 b5 30 ad 06 5d 8b 00 a8 29 bd 0a 6f e9 e0 39 ed a6 b3 48 ab 31 b4 7c bc 95 21 bd e0 ae 6a 9a 75 94 ac 94 b1 aa 11 21 de 1c 60 e2 45 42 a6 f9 06 6e b7 4d 8b 4e 5d 69 e0 81 e6 78 0e 99 e5 32 c6 b3 53 2c 53 b4 e1 99 e6 78 24 cb dc f1 f1 84 18 32 00 e8 e8 65 3e ea 9f 8f a3 b7 c6 8e c0 ab 7d 26 cc 3b ec 27 40 fd Data Ascii: .?cII(AY6Kdv8tBux#ryw&mCd/lta`4)ciIev:tA>O&ajaw9&('\|N~"DKvPEQ0])o9H1\|!ju!`EBnMN]ix2S,Sx$2e>}&;'@
2024-07-03 19:03:00 UTC	16384	IN	Data Raw: 0e cf 44 6d 1e 41 54 1d 69 1d 00 32 87 8c 70 54 bd c4 49 e5 f3 7a f4 57 6d 21 e3 e3 28 9f c9 5e 7b a7 de e3 ad 96 b5 b6 5a 64 aa 0d c1 66 a8 dd 1d a4 50 a3 73 c5 d5 f6 8a 7f d5 6d e8 af f9 78 76 d2 ae b3 65 79 eb 8f 56 52 89 bd 02 4b 5d 8b 6c 9c ec da 22 a6 62 47 ab 46 ba 85 c4 37 58 97 52 1d 0f 18 dc 56 31 6f 99 71 74 e2 b7 0e a2 fa 41 5f aa d0 ba 8c f5 ac d7 2c 58 8e 74 a6 4d 9d 2b 73 d2 d0 2d b5 9f 06 9c 84 b6 c1 2a 36 cc 8a b2 40 3a 7e d3 40 df fa d7 2a 2d 92 09 47 3a e8 0b d7 be f2 dc 63 53 ac 35 2d 49 8f 5e 80 73 3e ff 1e c3 a9 d8 51 26 77 e7 44 62 6c ac 1b 24 0b 0b f9 0f 12 d7 79 5f 12 5d 51 5f f0 07 d3 15 f8 fc c1 93 97 cf 14 e1 42 9e 28 10 3c 50 78 90 c6 aa 69 d9 ec 9a 49 32 ad 43 ec 50 42 ed 82 8e 4c 96 c4 ae eb 6d 01 c2 64 60 e9 bb f9 56 77 b2 Data Ascii: DmATi2pTIzWm!(^{ZdfPsmxveyVRK]l"bGF7XRV1oqtA_,XtM+s-6@:~@-G:cS5-I^s>Q&wDbl$y_]Q_B(<PxiI2CPBLmd`Vw
2024-07-03 19:03:00 UTC	1341	IN	Data Raw: af c7 23 18 0e a7 3e 06 23 48 88 f9 87 13 83 84 72 88 31 2d cc 3c 9f da 66 8d df 09 4d 5e b3 bb 47 09 c7 18 f5 f7 d6 55 7a 5f b9 01 6e 11 07 0a 1c d9 f5 fb 05 7b 3f 19 17 80 be 98 57 2d 92 59 26 82 49 8a 36 e5 8b 2b 65 1e 58 2d 18 ee d3 0b 52 db 21 24 56 0e 21 e2 92 4b dc 98 a0 69 b1 4d c6 67 27 5e af e9 76 fb ae a6 2b 07 b7 b7 6e d4 73 94 77 ef 01 78 8f fb e2 e0 00 6d 0e 0e 2f 22 8c 8e f2 5a 17 03 fa 01 12 96 aa 1c 75 70 1e 3d 08 df b8 6b 19 a2 a0 77 dd 99 09 0b 4c 4a 24 3d 28 9b 8d 1a b9 27 74 ee 1c d4 5d 79 e2 4a 86 09 e5 e4 ce 89 49 c3 9b d1 3c 2d ca 8a 63 bb c6 d9 d8 03 ef 19 8b 3a 1e 44 e5 fe 7d 67 b9 cc a6 d9 32 c9 17 67 17 e9 ec 2c 39 bb 98 5e 4c 3f 5e 9e 2f a8 2d f9 32 fd 98 3a ec 6c 8f 97 e0 06 44 3f 90 df 46 1c d7 24 62 2f f3 da df 61 df 1d 05 Data Ascii: #>#Hr1-<fM^GUz_n{?W-Y&I6+eX-R!$V!KiMg'^v+nswxm/"Zup=kwLJ$=('t]yJI<-c:D}g2g,9^L?^/-2:lD?F$b/a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.17	49728	152.199.21.175	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:02 UTC	660	OUT	GET /ests/2.1/content/cdnbundles/converged.v2.login.min_mc5ac6ol0l4d2iaqspstyg2.css HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:03:02 UTC	734	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 3799895 Cache-Control: public, max-age=31536000 Content-MD5: Xt+D0D6ntnvS81Ry5DXRfg== Content-Type: text/css Date: Wed, 03 Jul 2024 19:03:02 GMT Etag: 0x8DC7543615A617D Last-Modified: Thu, 16 May 2024 00:59:03 GMT Server: ECAcc (lhc/78AB) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: e719be1e-401e-005f-79ec-aab00a000000 x-ms-version: 2009-09-19 Content-Length: 113355 Connection: close
2024-07-03 19:03:02 UTC	15668	IN	Data Raw: 2f 2a 21 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2a 2f 2f 2a 21 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 0a 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 Data Ascii: /! Copyright (C) Microsoft Corporation. All rights reserved. //*!------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------This file is based on or incorporates material from the projects listed
2024-07-03 19:03:02 UTC	16383	IN	Data Raw: 31 30 2c 2e 63 6f 6c 2d 6d 64 2d 31 30 2c 2e 63 6f 6c 2d 6c 67 2d 31 30 2c 2e 63 6f 6c 2d 78 73 2d 31 31 2c 2e 63 6f 6c 2d 73 6d 2d 31 31 2c 2e 63 6f 6c 2d 6d 64 2d 31 31 2c 2e 63 6f 6c 2d 6c 67 2d 31 31 2c 2e 63 6f 6c 2d 78 73 2d 31 32 2c 2e 63 6f 6c 2d 73 6d 2d 31 32 2c 2e 63 6f 6c 2d 6d 64 2d 31 32 2c 2e 63 6f 6c 2d 6c 67 2d 31 32 2c 2e 63 6f 6c 2d 78 73 2d 31 33 2c 2e 63 6f 6c 2d 73 6d 2d 31 33 2c 2e 63 6f 6c 2d 6d 64 2d 31 33 2c 2e 63 6f 6c 2d 6c 67 2d 31 33 2c 2e 63 6f 6c 2d 78 73 2d 31 34 2c 2e 63 6f 6c 2d 73 6d 2d 31 34 2c 2e 63 6f 6c 2d 6d 64 2d 31 34 2c 2e 63 6f 6c 2d 6c 67 2d 31 34 2c 2e 63 6f 6c 2d 78 73 2d 31 35 2c 2e 63 6f 6c 2d 73 6d 2d 31 35 2c 2e 63 6f 6c 2d 6d 64 2d 31 35 2c 2e 63 6f 6c 2d 6c 67 2d 31 35 2c 2e 63 6f 6c 2d 78 73 2d 31 36 Data Ascii: 10,.col-md-10,.col-lg-10,.col-xs-11,.col-sm-11,.col-md-11,.col-lg-11,.col-xs-12,.col-sm-12,.col-md-12,.col-lg-12,.col-xs-13,.col-sm-13,.col-md-13,.col-lg-13,.col-xs-14,.col-sm-14,.col-md-14,.col-lg-14,.col-xs-15,.col-sm-15,.col-md-15,.col-lg-15,.col-xs-16
2024-07-03 19:03:02 UTC	16383	IN	Data Raw: 31 36 2e 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 35 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 30 2e 38 33 33 33 33 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 36 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 35 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 37 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 39 2e 31 36 36 36 37 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 38 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 33 33 2e 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 39 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 33 37 2e 35 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 31 30 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 34 31 2e 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 31 31 7b 6d 61 Data Ascii: 16.66667%}.col-xl-offset-5{margin-left:20.83333%}.col-xl-offset-6{margin-left:25%}.col-xl-offset-7{margin-left:29.16667%}.col-xl-offset-8{margin-left:33.33333%}.col-xl-offset-9{margin-left:37.5%}.col-xl-offset-10{margin-left:41.66667%}.col-xl-offset-11{ma
2024-07-03 19:03:03 UTC	16383	IN	Data Raw: 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 74 68 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 2e 74 61 62 6c 65 7b 77 69 64 74 68 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 2e 74 61 62 6c 65 3e 74 68 65 61 64 3e 74 72 3e 74 68 2c 2e 74 61 62 6c 65 3e 74 68 65 61 64 3e 74 72 3e 74 64 2c 2e 74 61 62 6c 65 3e 74 62 6f 64 79 3e 74 72 3e 74 68 2c 2e 74 61 62 6c 65 3e 74 62 6f 64 79 3e 74 72 3e 74 64 2c 2e 74 61 62 6c 65 3e 74 66 6f 6f 74 3e 74 72 3e 74 68 2c 2e 74 61 62 6c 65 3e 74 66 6f 6f 74 3e 74 72 3e 74 64 7b 70 61 64 64 69 6e 67 3a 31 36 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 6f 70 7d 2e 74 61 62 6c 65 3e 74 68 65 61 64 3e 74 72 3e 74 68 7b 76 65 72 74 69 63 61 6c Data Ascii: {background-color:transparent}th{text-align:left}.table{width:100%;max-width:100%}.table>thead>tr>th,.table>thead>tr>td,.table>tbody>tr>th,.table>tbody>tr>td,.table>tfoot>tr>th,.table>tfoot>tr>td{padding:16px;vertical-align:top}.table>thead>tr>th{vertical
2024-07-03 19:03:03 UTC	16383	IN	Data Raw: 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 53 65 67 6f 65 20 55 49 20 57 65 62 66 6f 6e 74 22 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 33 30 30 3b 73 72 63 3a 6c 6f 63 61 6c 28 22 53 65 67 6f 65 20 55 49 20 53 65 6d 69 6c 69 67 68 74 22 29 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 53 65 67 6f 65 20 55 49 20 57 65 62 66 6f 6e 74 22 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 73 72 63 3a 6c 6f 63 61 6c 28 22 53 65 67 6f 65 20 55 49 20 42 6f 6c 64 22 29 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 53 65 67 6f 65 20 55 49 20 57 65 62 66 6f 6e 74 22 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 69 74 61 6c 69 63 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 73 72 63 3a 6c 6f 63 61 6c 28 22 53 65 Data Ascii: e{font-family:"Segoe UI Webfont";font-weight:300;src:local("Segoe UI Semilight")}@font-face{font-family:"Segoe UI Webfont";font-weight:700;src:local("Segoe UI Bold")}@font-face{font-family:"Segoe UI Webfont";font-style:italic;font-weight:400;src:local("Se
2024-07-03 19:03:03 UTC	16383	IN	Data Raw: 74 6e 3a 68 6f 76 65 72 2c 62 75 74 74 6f 6e 3a 68 6f 76 65 72 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 5d 3a 68 6f 76 65 72 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 75 62 6d 69 74 22 5d 3a 68 6f 76 65 72 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 65 73 65 74 22 5d 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 62 32 62 32 62 32 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 33 29 7d 2e 62 74 6e 2d 66 6f 63 75 73 2c 2e 62 74 6e 3a 66 6f 63 75 73 2c 62 75 74 74 6f 6e 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 75 62 6d 69 74 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b Data Ascii: tn:hover,button:hover,input[type="button"]:hover,input[type="submit"]:hover,input[type="reset"]:hover{background-color:#b2b2b2;background-color:rgba(0,0,0,0.3)}.btn-focus,.btn:focus,button:focus,input[type="button"]:focus,input[type="submit"]:focus,input[
2024-07-03 19:03:03 UTC	15772	IN	Data Raw: 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 2e 32 35 72 65 6d 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 2e 32 35 72 65 6d 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 38 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 33 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 37 35 72 65 6d 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 32 2e 33 36 33 32 70 78 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 32 2e 33 36 33 32 70 78 3b 63 6f 6c 6f 72 3a 23 31 62 31 62 31 62 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 36 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 Data Ascii: x;margin-top:20px;margin-bottom:1.25rem;margin-top:1.25rem;font-size:24px;line-height:28px;font-weight:300;line-height:1.75rem;padding-bottom:2.3632px;padding-top:2.3632px;color:#1b1b1b;font-size:1.5rem;font-weight:600;padding:0;margin-top:16px;margin-bot

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.17	49729	152.199.21.175	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:02 UTC	637	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_Kjlmc42uL0ATl_21eYcwVg2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:03:02 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 1674440 Cache-Control: public, max-age=31536000 Content-MD5: mZsgPeo0KhYh8aRT+ErbPw== Content-Type: application/x-javascript Date: Wed, 03 Jul 2024 19:03:02 GMT Etag: 0x8DC89A1FCEDA252 Last-Modified: Mon, 10 Jun 2024 23:06:40 GMT Server: ECAcc (lhc/7966) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 353fa1a0-b01e-001c-3641-be1e1d000000 x-ms-version: 2009-09-19 Content-Length: 447070 Connection: close
2024-07-03 19:03:02 UTC	15652	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-07-03 19:03:02 UTC	16383	IN	Data Raw: 48 45 4e 54 49 43 41 54 45 44 3a 22 38 30 30 34 35 35 33 38 22 2c 50 50 5f 45 5f 48 49 50 5f 56 41 4c 49 44 41 54 49 4f 4e 5f 45 52 52 4f 52 5f 4f 54 48 45 52 3a 22 38 30 30 34 35 35 33 39 22 2c 50 50 5f 45 5f 53 51 5f 43 4f 4e 54 41 49 4e 53 5f 50 41 53 53 57 4f 52 44 3a 22 38 30 30 34 33 34 31 45 22 2c 50 50 5f 45 5f 53 41 5f 43 4f 4e 54 41 49 4e 53 5f 50 41 53 53 57 4f 52 44 3a 22 38 30 30 34 33 34 31 43 22 2c 50 50 5f 45 5f 53 41 5f 43 4f 4e 54 41 49 4e 45 44 5f 49 4e 5f 50 41 53 53 57 4f 52 44 3a 22 38 30 30 34 33 34 31 44 22 2c 50 50 5f 45 5f 4c 49 42 50 48 4f 4e 45 4e 55 4d 42 45 52 49 4e 54 45 52 4f 50 5f 4e 55 4d 42 45 52 50 41 52 53 45 5f 45 58 43 45 50 54 49 4f 4e 3a 22 38 30 30 34 33 35 31 30 22 2c 50 50 5f 45 5f 53 54 52 4f 4e 47 50 52 4f 43 Data Ascii: HENTICATED:"80045538",PP_E_HIP_VALIDATION_ERROR_OTHER:"80045539",PP_E_SQ_CONTAINS_PASSWORD:"8004341E",PP_E_SA_CONTAINS_PASSWORD:"8004341C",PP_E_SA_CONTAINED_IN_PASSWORD:"8004341D",PP_E_LIBPHONENUMBERINTEROP_NUMBERPARSE_EXCEPTION:"80043510",PP_E_STRONGPROC
2024-07-03 19:03:02 UTC	16383	IN	Data Raw: 72 79 2e 70 75 73 68 53 74 61 74 65 28 65 2c 6e 29 7d 2c 72 65 70 6c 61 63 65 53 74 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 50 2e 69 73 48 69 73 74 6f 72 79 53 75 70 70 6f 72 74 65 64 28 29 26 26 75 2e 68 69 73 74 6f 72 79 2e 72 65 70 6c 61 63 65 53 74 61 74 65 28 65 2c 6e 29 7d 7d 2c 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 2c 69 29 7b 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 6e 2c 74 2c 69 29 3a 65 2e 61 74 74 61 63 68 45 76 65 6e 74 26 26 65 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 22 2b 6e 2c 74 29 7d 2c 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 2c Data Ascii: ry.pushState(e,n)},replaceState:function(e,n){P.isHistorySupported()&&u.history.replaceState(e,n)}},addEventListener:function(e,n,t,i){e.addEventListener?e.addEventListener(n,t,i):e.attachEvent&&e.attachEvent("on"+n,t)},removeEventListener:function(e,n,t,
2024-07-03 19:03:03 UTC	16383	IN	Data Raw: 7c 7c 69 2e 45 76 65 6e 74 4c 65 76 65 6c 2e 49 6e 66 6f 2c 7b 76 69 65 77 4d 6f 64 65 6c 3a 65 2c 74 72 61 63 69 6e 67 4f 70 74 69 6f 6e 73 3a 6e 7d 7d 2c 73 2e 67 65 74 44 65 66 61 75 6c 74 54 65 78 74 42 6f 78 50 72 6f 70 65 72 74 79 4c 6f 67 4f 70 74 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 72 65 74 75 72 6e 28 6e 3d 6e 7c 7c 7b 7d 29 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 68 69 64 69 6e 67 4d 6f 64 65 22 29 7c 7c 28 6e 2e 68 69 64 69 6e 67 4d 6f 64 65 3d 69 2e 48 69 64 69 6e 67 4d 6f 64 65 2e 4e 6f 6e 65 29 2c 6e 2e 72 61 74 65 4c 69 6d 69 74 3d 7b 6d 65 74 68 6f 64 3a 22 6e 6f 74 69 66 79 57 68 65 6e 43 68 61 6e 67 65 73 53 74 6f 70 22 7d 2c 73 2e 67 65 74 50 72 6f 70 65 72 74 79 4c 6f 67 4f 70 74 69 6f 6e 28 65 2c 6e 29 7d Data Ascii: \|\|i.EventLevel.Info,{viewModel:e,tracingOptions:n}},s.getDefaultTextBoxPropertyLogOption=function(e,n){return(n=n\|\|{}).hasOwnProperty("hidingMode")\|\|(n.hidingMode=i.HidingMode.None),n.rateLimit={method:"notifyWhenChangesStop"},s.getPropertyLogOption(e,n)}
2024-07-03 19:03:03 UTC	16383	IN	Data Raw: 74 68 69 73 5b 75 2e 50 68 6f 6e 65 43 6f 75 6e 74 72 79 43 6f 64 65 5d 3d 70 29 2c 6d 26 26 28 74 68 69 73 5b 75 2e 55 6e 61 75 74 68 53 65 73 73 69 6f 6e 49 64 5d 3d 6d 29 2c 62 26 26 28 74 68 69 73 5b 75 2e 50 72 6f 6f 66 43 6f 6e 66 69 72 6d 61 74 69 6f 6e 5d 3d 62 29 2c 76 26 26 28 74 68 69 73 5b 75 2e 43 61 6e 61 72 79 46 6c 6f 77 54 6f 6b 65 6e 5d 3d 76 29 7d 2c 6e 2e 52 65 71 75 65 73 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 2c 74 2c 61 2c 63 2c 64 3d 74 68 69 73 2c 6c 3d 70 2e 4e 6f 6e 65 2c 75 3d 22 22 2c 66 3d 22 22 2c 67 3d 22 22 2c 6d 3d 65 2e 64 61 74 61 2c 62 3d 65 2e 6f 6e 53 65 6e 64 2c 76 3d 65 2e 6f 6e 53 65 6e 64 46 61 69 6c 2c 68 3d 65 2e 6f 6e 46 6c 6f 77 45 78 70 69 72 65 64 2c 5f 3d 65 2e 74 69 6d 65 6f 75 74 7c 7c Data Ascii: this[u.PhoneCountryCode]=p),m&&(this[u.UnauthSessionId]=m),b&&(this[u.ProofConfirmation]=b),v&&(this[u.CanaryFlowToken]=v)},n.Request=function(e){var n,t,a,c,d=this,l=p.None,u="",f="",g="",m=e.data,b=e.onSend,v=e.onSendFail,h=e.onFlowExpired,_=e.timeout\|\|
2024-07-03 19:03:03 UTC	16383	IN	Data Raw: 28 6e 2e 43 72 65 64 65 6e 74 69 61 6c 73 26 26 28 6e 2e 43 72 65 64 65 6e 74 69 61 6c 73 2e 46 65 64 65 72 61 74 69 6f 6e 52 65 64 69 72 65 63 74 55 72 6c 7c 7c 6e 2e 43 72 65 64 65 6e 74 69 61 6c 73 2e 4c 69 6e 6b 65 64 49 6e 50 61 72 61 6d 73 7c 7c 6e 2e 43 72 65 64 65 6e 74 69 61 6c 73 2e 47 69 74 48 75 62 50 61 72 61 6d 73 7c 7c 6e 2e 43 72 65 64 65 6e 74 69 61 6c 73 2e 47 6f 6f 67 6c 65 50 61 72 61 6d 73 7c 7c 6e 2e 43 72 65 64 65 6e 74 69 61 6c 73 2e 46 61 63 65 62 6f 6f 6b 50 61 72 61 6d 73 29 29 29 72 65 74 75 72 6e 20 69 3b 73 77 69 74 63 68 28 61 29 7b 63 61 73 65 20 6d 2e 52 65 6d 6f 74 65 4e 47 43 3a 63 61 73 65 20 6d 2e 46 65 64 65 72 61 74 69 6f 6e 3a 63 61 73 65 20 6d 2e 41 63 63 65 73 73 50 61 73 73 3a 63 61 73 65 20 6d 2e 4e 6f 50 72 65 Data Ascii: (n.Credentials&&(n.Credentials.FederationRedirectUrl\|\|n.Credentials.LinkedInParams\|\|n.Credentials.GitHubParams\|\|n.Credentials.GoogleParams\|\|n.Credentials.FacebookParams)))return i;switch(a){case m.RemoteNGC:case m.Federation:case m.AccessPass:case m.NoPre
2024-07-03 19:03:03 UTC	16383	IN	Data Raw: 6f 77 54 6f 6b 65 6e 28 29 2c 6e 2e 6f 6e 55 70 64 61 74 65 46 6c 6f 77 54 6f 6b 65 6e 28 70 29 29 3a 65 2e 46 6c 6f 77 54 6f 6b 65 6e 26 26 28 70 3d 65 2e 46 6c 6f 77 54 6f 6b 65 6e 2c 6e 2e 6f 6e 55 70 64 61 74 65 46 6c 6f 77 54 6f 6b 65 6e 28 70 29 29 29 7d 6e 2e 6f 6e 53 77 69 74 63 68 56 69 65 77 3d 6f 2e 63 72 65 61 74 65 28 29 2c 6e 2e 6f 6e 52 65 64 69 72 65 63 74 3d 6f 2e 63 72 65 61 74 65 28 29 2c 6e 2e 6f 6e 52 65 67 69 73 74 65 72 44 69 61 6c 6f 67 3d 6f 2e 63 72 65 61 74 65 28 29 2c 6e 2e 6f 6e 55 6e 72 65 67 69 73 74 65 72 44 69 61 6c 6f 67 3d 6f 2e 63 72 65 61 74 65 28 29 2c 6e 2e 6f 6e 53 68 6f 77 44 69 61 6c 6f 67 3d 6f 2e 63 72 65 61 74 65 28 29 2c 6e 2e 6f 6e 53 65 74 50 65 6e 64 69 6e 67 52 65 71 75 65 73 74 3d 6f 2e 63 72 65 61 74 65 Data Ascii: owToken(),n.onUpdateFlowToken(p)):e.FlowToken&&(p=e.FlowToken,n.onUpdateFlowToken(p)))}n.onSwitchView=o.create(),n.onRedirect=o.create(),n.onRegisterDialog=o.create(),n.onUnregisterDialog=o.create(),n.onShowDialog=o.create(),n.onSetPendingRequest=o.create
2024-07-03 19:03:03 UTC	16383	IN	Data Raw: 65 2c 64 69 73 70 6c 61 79 4e 61 6d 65 3a 65 2e 6d 65 6d 62 65 72 4e 61 6d 65 7c 7c 65 2e 73 69 67 6e 49 6e 4e 61 6d 65 2c 69 64 70 3a 61 2e 53 65 73 73 69 6f 6e 49 64 70 2e 4d 73 61 2c 69 73 4f 74 68 65 72 49 64 70 3a 21 30 2c 69 73 53 69 67 6e 65 64 49 6e 3a 65 2e 69 73 53 69 67 6e 65 64 49 6e 7c 7c 31 3d 3d 3d 65 2e 61 75 74 68 65 6e 74 69 63 61 74 65 64 53 74 61 74 65 7c 7c 32 3d 3d 3d 65 2e 61 75 74 68 65 6e 74 69 63 61 74 65 64 53 74 61 74 65 2c 69 73 57 69 6e 64 6f 77 73 53 73 6f 3a 65 2e 69 73 57 69 6e 64 6f 77 73 53 73 6f 7c 7c 21 31 2c 69 73 4d 65 43 6f 6e 74 72 6f 6c 53 65 73 73 69 6f 6e 3a 21 30 2c 69 73 47 69 74 48 75 62 46 65 64 3a 65 2e 69 73 47 69 74 48 75 62 46 65 64 7c 7c 21 31 7d 7d 29 29 7d 2c 70 61 72 73 65 42 73 73 6f 53 65 73 73 69 Data Ascii: e,displayName:e.memberName\|\|e.signInName,idp:a.SessionIdp.Msa,isOtherIdp:!0,isSignedIn:e.isSignedIn\|\|1===e.authenticatedState\|\|2===e.authenticatedState,isWindowsSso:e.isWindowsSso\|\|!1,isMeControlSession:!0,isGitHubFed:e.isGitHubFed\|\|!1}}))},parseBssoSessi
2024-07-03 19:03:03 UTC	16383	IN	Data Raw: 74 61 22 29 2c 21 62 26 26 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 72 79 7b 69 66 28 74 6f 70 21 3d 3d 73 65 6c 66 26 26 74 6f 70 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 73 65 6c 66 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 2c 32 3d 3d 3d 65 2e 69 46 65 64 53 74 61 74 65 26 26 65 2e 75 72 6c 46 65 64 29 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 2c 69 29 7b 76 61 72 20 61 3d 69 2e 73 46 65 64 51 53 3b 6e 3d 3d 3d 6d 2e 4e 6f 74 68 69 6e 67 43 68 65 63 6b 65 64 26 26 28 61 3d 66 2e 61 70 70 65 6e 64 4f 72 52 65 70 6c 61 63 65 28 22 3f 22 2b 61 2c 22 77 63 74 78 22 2c 22 4c 6f 67 69 6e 4f 70 74 69 6f 6e 73 25 33 44 33 25 32 36 22 2b 66 2e 65 78 74 72 61 63 74 28 22 77 63 74 78 22 2c 22 3f 22 2b 61 29 29 2e 73 75 62 73 Data Ascii: ta"),!b&&!function(e){try{if(top!==self&&top.location.replace(self.location.href),2===e.iFedState&&e.urlFed)return function(e,n,t,i){var a=i.sFedQS;n===m.NothingChecked&&(a=f.appendOrReplace("?"+a,"wctx","LoginOptions%3D3%26"+f.extract("wctx","?"+a)).subs
2024-07-03 19:03:03 UTC	16383	IN	Data Raw: 63 74 69 6f 6e 28 29 7b 65 28 69 29 7d 29 2c 6e 29 7d 7d 29 7d 2c 72 61 74 65 4c 69 6d 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 76 61 72 20 74 2c 6f 2c 72 3b 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 6e 3f 74 3d 6e 3a 28 74 3d 6e 2e 74 69 6d 65 6f 75 74 2c 6f 3d 6e 2e 6d 65 74 68 6f 64 29 2c 65 2e 48 62 3d 21 31 2c 72 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6f 3f 6f 3a 22 6e 6f 74 69 66 79 57 68 65 6e 43 68 61 6e 67 65 73 53 74 6f 70 22 3d 3d 6f 3f 61 3a 69 2c 65 2e 75 62 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 72 28 65 2c 74 2c 6e 29 7d 29 29 7d 2c 64 65 66 65 72 72 65 64 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 21 30 21 3d 3d 6e 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 54 68 65 Data Ascii: ction(){e(i)}),n)}})},rateLimit:function(e,n){var t,o,r;"number"==typeof n?t=n:(t=n.timeout,o=n.method),e.Hb=!1,r="function"==typeof o?o:"notifyWhenChangesStop"==o?a:i,e.ub((function(e){return r(e,t,n)}))},deferred:function(e,n){if(!0!==n)throw Error("The

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.17	49731	40.126.32.74	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:02 UTC	683	OUT	GET /Me.htm?v=3 HTTP/1.1 Host: login.live.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Purpose: prefetch Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:03:02 UTC	762	IN	HTTP/1.1 200 OK Cache-Control: max-age=315360000 Content-Type: text/html; charset=utf-8 Expires: Sat, 01 Jul 2034 19:03:02 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C511_BL2 x-ms-request-id: 42873697-10b6-4d75-9e2b-41c0994127f8 PPServer: PPV: 30 H: BL02EPF0001D769 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Set-Cookie: uaid=aeaa07f917ea4cd7bbf2b5daeaaaf9d2; domain=login.live.com; Secure; path=/; SameSite=None; HttpOnly Set-Cookie: MSPRequ=id=N&lt=1720033382&co=1; domain=login.live.com; Secure; path=/; SameSite=None; HttpOnly Date: Wed, 03 Jul 2024 19:03:02 GMT Connection: close Content-Length: 3439
2024-07-03 19:03:02 UTC	3439	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 73 20 69 6e 20 65 29 74 5b 73 5d 3d 65 5b 73 5d 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 6e 29 7b 69 66 28 73 5b 6e 5d 29 72 65 74 75 72 6e 20 73 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 69 3d 73 5b 6e 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 2c 69 64 3a 6e 2c 6c 6f 61 64 65 64 3a 21 31 7d 3b 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 63 61 6c 6c 28 69 2e 65 78 70 6f 72 74 73 2c 69 2c 69 2e 65 78 70 6f 72 74 73 2c 65 29 2c 69 2e 6c 6f 61 64 65 64 3d 21 30 2c 69 2e 65 78 70 6f 72 74 73 7d 76 61 72 20 73 3d 7b 7d 3b 72 65 74 75 72 6e 20 65 2e 6d 3d 74 Data Ascii: <script type="text/javascript">!function(t,e){for(var s in e)t[s]=e[s]}(this,function(t){function e(n){if(s[n])return s[n].exports;var i=s[n]={exports:{},id:n,loaded:!1};return t[n].call(i.exports,i,i.exports,e),i.loaded=!0,i.exports}var s={};return e.m=t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.17	49730	152.199.21.175	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:02 UTC	656	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_fo8rkc18qnhjh4wnzabsdg2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:03:02 UTC	749	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 3003160 Cache-Control: public, max-age=31536000 Content-MD5: 2EE6gsOsrXkqWCR+6G8T4w== Content-Type: application/x-javascript Date: Wed, 03 Jul 2024 19:03:02 GMT Etag: 0x8DC7F795B965C2C Last-Modified: Wed, 29 May 2024 00:50:38 GMT Server: ECAcc (lhc/791F) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: f452dcc9-c01e-00ab-112b-b2b957000000 x-ms-version: 2009-09-19 Content-Length: 55503 Connection: close
2024-07-03 19:03:02 UTC	16383	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 69 5b 6e 5d 29 72 65 74 75 72 6e 20 69 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 74 3d 69 5b 6e 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 2c 69 64 3a 6e 2c 6c 6f 61 64 65 64 3a 21 31 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 74 2e 65 78 70 6f 72 74 73 2c 74 2c 74 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 74 2e 6c 6f 61 64 65 64 3d 21 30 2c 74 2e 65 78 70 6f 72 74 73 7d 76 61 72 20 69 3d 7b 7d 3b 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 69 2c 6f 2e 70 3d 22 22 2c 6f 28 30 29 7d 28 5b 66 75 6e 63 74 69 6f 6e 28 65 2c 6f 2c 69 29 7b 69 28 32 29 3b 76 61 72 20 6e 3d 69 28 31 29 2c 74 3d 69 28 35 29 2c 72 3d 69 28 36 29 2c 61 3d 72 2e 53 74 72 69 6e Data Ascii: !function(e){function o(n){if(i[n])return i[n].exports;var t=i[n]={exports:{},id:n,loaded:!1};return e[n].call(t.exports,t,t.exports,o),t.loaded=!0,t.exports}var i={};return o.m=e,o.c=i,o.p="",o(0)}([function(e,o,i){i(2);var n=i(1),t=i(5),r=i(6),a=r.Strin
2024-07-03 19:03:02 UTC	1	IN	Data Raw: 44 Data Ascii: D
2024-07-03 19:03:02 UTC	16383	IN	Data Raw: 65 73 63 72 69 70 74 69 6f 6e 5f 55 6e 66 61 6d 69 6c 69 61 72 44 65 76 69 63 65 3d 22 54 6f 20 73 69 67 6e 20 69 6e 20 77 69 74 68 20 7b 30 7d 2c 20 70 6c 65 61 73 65 20 66 6f 6c 6c 6f 77 20 74 68 65 20 69 6e 73 74 72 75 63 74 69 6f 6e 73 20 6f 6e 20 79 6f 75 72 20 70 68 6f 6e 65 20 61 6e 64 20 65 6e 74 65 72 20 74 68 65 20 6e 75 6d 62 65 72 20 79 6f 75 20 73 65 65 20 62 65 6c 6f 77 2e 22 2c 65 2e 43 54 5f 52 4e 47 43 5f 53 54 52 5f 4c 53 5f 54 69 6d 65 6f 75 74 5f 54 69 74 6c 65 3d 22 52 65 71 75 65 73 74 20 74 69 6d 65 6f 75 74 22 2c 65 2e 43 54 5f 52 4e 47 43 5f 53 54 52 5f 4c 53 5f 54 69 6d 65 6f 75 74 5f 50 61 67 65 44 65 73 63 72 69 70 74 69 6f 6e 3d 22 57 65 20 64 69 64 6e 27 74 20 68 65 61 72 20 66 72 6f 6d 20 79 6f 75 20 69 6e 20 74 69 6d 65 2e Data Ascii: escription_UnfamiliarDevice="To sign in with {0}, please follow the instructions on your phone and enter the number you see below.",e.CT_RNGC_STR_LS_Timeout_Title="Request timeout",e.CT_RNGC_STR_LS_Timeout_PageDescription="We didn't hear from you in time.
2024-07-03 19:03:03 UTC	16383	IN	Data Raw: 69 66 66 65 72 65 6e 74 20 61 63 63 6f 75 6e 74 20 6f 72 20 3c 61 20 69 64 3d 22 61 61 64 53 65 6c 66 53 69 67 6e 75 70 22 20 68 72 65 66 3d 22 23 22 3e 63 72 65 61 74 65 20 61 20 6e 65 77 20 6f 6e 65 3c 2f 61 3e 2e 27 2c 65 2e 43 54 5f 50 57 44 5f 53 54 52 5f 45 72 72 6f 72 5f 57 72 6f 6e 67 43 72 65 64 73 3d 6f 2e 66 4c 6f 63 6b 55 73 65 72 6e 61 6d 65 7c 7c 6f 2e 66 48 69 64 65 52 65 73 65 74 50 61 73 73 77 6f 72 64 4c 69 6e 6b 3f 22 54 68 65 20 70 61 73 73 77 6f 72 64 20 69 73 20 69 6e 63 6f 72 72 65 63 74 2e 20 50 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 2e 22 3a 6f 2e 66 41 6c 6c 6f 77 50 68 6f 6e 65 53 69 67 6e 49 6e 3f 27 59 6f 75 72 20 61 63 63 6f 75 6e 74 20 6f 72 20 70 61 73 73 77 6f 72 64 20 69 73 20 69 6e 63 6f 72 72 65 63 74 2e 20 49 66 Data Ascii: ifferent account or <a id="aadSelfSignup" href="#">create a new one</a>.',e.CT_PWD_STR_Error_WrongCreds=o.fLockUsername\|\|o.fHideResetPasswordLink?"The password is incorrect. Please try again.":o.fAllowPhoneSignIn?'Your account or password is incorrect. If
2024-07-03 19:03:03 UTC	6353	IN	Data Raw: 72 79 52 65 61 63 68 65 64 3a 22 56 6f 69 63 65 4f 54 50 41 75 74 68 46 61 69 6c 65 64 4d 61 78 41 6c 6c 6f 77 65 64 43 6f 64 65 52 65 74 72 79 52 65 61 63 68 65 64 22 2c 41 63 63 65 73 73 50 61 73 73 42 6c 6f 63 6b 65 64 42 79 50 6f 6c 69 63 79 54 66 61 3a 22 41 63 63 65 73 73 50 61 73 73 42 6c 6f 63 6b 65 64 42 79 50 6f 6c 69 63 79 22 2c 49 6e 76 61 6c 69 64 41 63 63 65 73 73 50 61 73 73 54 66 61 3a 22 49 6e 76 61 6c 69 64 41 63 63 65 73 73 50 61 73 73 22 2c 41 63 63 65 73 73 50 61 73 73 45 78 70 69 72 65 64 54 66 61 3a 22 41 63 63 65 73 73 50 61 73 73 45 78 70 69 72 65 64 22 2c 41 63 63 65 73 73 50 61 73 73 41 6c 72 65 61 64 79 55 73 65 64 54 66 61 3a 22 41 63 63 65 73 73 50 61 73 73 41 6c 72 65 61 64 79 55 73 65 64 22 2c 41 70 70 4c 6f 63 6b 52 65 71 Data Ascii: ryReached:"VoiceOTPAuthFailedMaxAllowedCodeRetryReached",AccessPassBlockedByPolicyTfa:"AccessPassBlockedByPolicy",InvalidAccessPassTfa:"InvalidAccessPass",AccessPassExpiredTfa:"AccessPassExpired",AccessPassAlreadyUsedTfa:"AccessPassAlreadyUsed",AppLockReq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.17	49732	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:02 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=BEMz9zVAXPzpGpb&MD=euPZlAu9 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-03 19:03:02 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 4370d693-f530-45ed-b2f7-38e20f5fb092 MS-RequestId: e136990a-e66e-411a-bd05-1202a12b879c MS-CV: zY10TRXY+ESMFrpq.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 03 Jul 2024 19:03:01 GMT Connection: close Content-Length: 24490
2024-07-03 19:03:02 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-07-03 19:03:02 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.17	49735	152.199.21.175	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:04 UTC	579	OUT	GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:03:04 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 8774402 Cache-Control: public, max-age=31536000 Content-MD5: wegr9xrdYirQ87+FcvY0/A== Content-Type: application/x-javascript Date: Wed, 03 Jul 2024 19:03:04 GMT Etag: 0x8DB5D44A2CEB430 Last-Modified: Thu, 25 May 2023 17:22:37 GMT Server: ECAcc (lhc/7931) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: e556728b-d01e-00f6-6fae-7d057f000000 x-ms-version: 2009-09-19 Content-Length: 190152 Connection: close
2024-07-03 19:03:04 UTC	15652	IN	Data Raw: 28 77 69 6e 64 6f 77 2e 74 65 6c 65 6d 65 74 72 79 5f 77 65 62 70 61 63 6b 4a 73 6f 6e 70 3d 77 69 6e 64 6f 77 2e 74 65 6c 65 6d 65 74 72 79 5f 77 65 62 70 61 63 6b 4a 73 6f 6e 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 32 5d 2c 5b 2c 2c 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 72 28 74 29 2c 6e 2e 64 28 74 2c 22 56 61 6c 75 65 4b 69 6e 64 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 2e 65 7d 29 29 2c 6e 2e 64 28 74 2c 22 45 76 65 6e 74 4c 61 74 65 6e 63 79 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 2e 61 7d 29 29 2c 6e 2e 64 28 74 2c 22 45 76 65 6e 74 50 65 72 73 69 73 74 65 6e 63 65 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 2e 62 7d Data Ascii: (window.telemetry_webpackJsonp=window.telemetry_webpackJsonp\|\|[]).push([[2],[,,,function(e,t,n){"use strict";n.r(t),n.d(t,"ValueKind",(function(){return r.e})),n.d(t,"EventLatency",(function(){return r.a})),n.d(t,"EventPersistence",(function(){return r.b}
2024-07-03 19:03:04 UTC	16383	IN	Data Raw: 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 2e 61 7d 29 29 3b 76 61 72 20 63 3d 6e 28 33 30 29 3b 6e 2e 64 28 74 2c 22 44 65 76 69 63 65 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 2e 61 7d 29 29 3b 76 61 72 20 75 3d 6e 28 32 39 29 3b 6e 2e 64 28 74 2c 22 4c 6f 63 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 2e 61 7d 29 29 3b 76 61 72 20 73 3d 6e 28 32 38 29 3b 6e 2e 64 28 74 2c 22 4f 70 65 72 61 74 69 6e 67 53 79 73 74 65 6d 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 73 2e 61 7d 29 29 3b 76 61 72 20 66 3d 6e 28 33 31 29 3b 6e 2e 64 28 74 2c 22 54 65 6c 65 6d 65 74 72 79 43 6f 6e 74 65 78 74 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 2e 61 7d 29 29 3b 76 61 72 20 6c Data Ascii: ction(){return o.a}));var c=n(30);n.d(t,"Device",(function(){return c.a}));var u=n(29);n.d(t,"Loc",(function(){return u.a}));var s=n(28);n.d(t,"OperatingSystem",(function(){return s.a}));var f=n(31);n.d(t,"TelemetryContext",(function(){return f.a}));var l
2024-07-03 19:03:04 UTC	16383	IN	Data Raw: 65 61 74 65 53 69 6d 70 6c 65 45 78 63 65 70 74 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 2c 69 2c 61 29 7b 76 61 72 20 6f 3b 72 65 74 75 72 6e 7b 65 78 63 65 70 74 69 6f 6e 73 3a 5b 28 6f 3d 7b 7d 2c 6f 2e 68 61 73 46 75 6c 6c 53 74 61 63 6b 3d 21 30 2c 6f 2e 6d 65 73 73 61 67 65 3d 65 2c 6f 2e 73 74 61 63 6b 3d 69 2c 6f 2e 74 79 70 65 4e 61 6d 65 3d 74 2c 6f 29 5d 7d 7d 2c 65 2e 65 6e 76 65 6c 6f 70 65 54 79 70 65 3d 22 4d 69 63 72 6f 73 6f 66 74 2e 41 70 70 6c 69 63 61 74 69 6f 6e 49 6e 73 69 67 68 74 73 2e 7b 30 7d 2e 45 78 63 65 70 74 69 6f 6e 22 2c 65 2e 64 61 74 61 54 79 70 65 3d 22 45 78 63 65 70 74 69 6f 6e 44 61 74 61 22 2c 65 2e 66 6f 72 6d 61 74 45 72 72 6f 72 3d 62 65 2c 65 7d 28 29 2c 70 65 3d 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: eateSimpleException=function(e,t,n,r,i,a){var o;return{exceptions:[(o={},o.hasFullStack=!0,o.message=e,o.stack=i,o.typeName=t,o)]}},e.envelopeType="Microsoft.ApplicationInsights.{0}.Exception",e.dataType="ExceptionData",e.formatError=be,e}(),pe=function()
2024-07-03 19:03:04 UTC	16383	IN	Data Raw: 69 6f 6e 28 74 2c 6e 29 7b 74 26 26 21 74 2e 65 78 63 65 70 74 69 6f 6e 26 26 74 2e 65 72 72 6f 72 26 26 28 74 2e 65 78 63 65 70 74 69 6f 6e 3d 74 2e 65 72 72 6f 72 29 3b 74 72 79 7b 65 2e 73 65 6e 64 45 78 63 65 70 74 69 6f 6e 49 6e 74 65 72 6e 61 6c 28 74 2c 6e 29 7d 63 61 74 63 68 28 65 29 7b 45 28 31 2c 33 35 2c 22 74 72 61 63 6b 45 78 63 65 70 74 69 6f 6e 20 66 61 69 6c 65 64 2c 20 65 78 63 65 70 74 69 6f 6e 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 4f 62 6a 65 63 74 28 53 2e 69 29 28 65 29 2c 7b 65 78 63 65 70 74 69 6f 6e 3a 4f 62 6a 65 63 74 28 62 2e 61 29 28 65 29 7d 29 7d 7d 2c 65 2e 5f 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 74 26 26 74 2e 65 72 72 6f 72 2c 72 3d 74 26 26 Data Ascii: ion(t,n){t&&!t.exception&&t.error&&(t.exception=t.error);try{e.sendExceptionInternal(t,n)}catch(e){E(1,35,"trackException failed, exception will not be collected: "+Object(S.i)(e),{exception:Object(b.a)(e)})}},e._onerror=function(t){var n=t&&t.error,r=t&&
2024-07-03 19:03:04 UTC	16383	IN	Data Raw: 6f 2e 6c 6f 61 64 45 76 65 6e 74 53 74 61 72 74 3e 30 26 26 28 72 2e 70 61 67 65 4c 6f 61 64 54 69 6d 65 3d 6f 2e 6c 6f 61 64 45 76 65 6e 74 53 74 61 72 74 2d 6f 2e 6e 61 76 69 67 61 74 69 6f 6e 53 74 61 72 74 29 7d 74 68 69 73 2e 74 72 61 63 6b 50 61 67 65 55 6e 6c 6f 61 64 28 6e 2c 72 29 7d 2c 74 7d 28 6a 74 29 2c 49 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 3d 65 26 26 65 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7c 7c 74 68 69 73 7d 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 28 68 2e 62 29 28 74 2c 65 29 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 63 61 70 74 75 72 65 50 61 67 65 56 69 65 77 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 3d 4f 62 6a 65 63 74 Data Ascii: o.loadEventStart>0&&(r.pageLoadTime=o.loadEventStart-o.navigationStart)}this.trackPageUnload(n,r)},t}(jt),It=function(e){function t(){return null!==e&&e.apply(this,arguments)\|\|this}return Object(h.b)(t,e),t.prototype.capturePageView=function(e,t){e=Object
2024-07-03 19:03:04 UTC	16383	IN	Data Raw: 6e 43 6f 6e 66 69 67 3d 6e 2e 65 78 74 65 6e 73 69 6f 6e 43 6f 6e 66 69 67 7c 7c 5b 5d 3b 6c 5b 69 2e 69 64 65 6e 74 69 66 69 65 72 5d 3d 6e 3f 6e 2e 63 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 3a 7b 7d 2c 6c 5b 61 2e 69 64 65 6e 74 69 66 69 65 72 5d 3d 6e 3f 6e 2e 70 72 6f 70 65 72 74 79 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 3a 7b 7d 2c 6c 5b 72 2e 69 64 65 6e 74 69 66 69 65 72 5d 3d 6e 3f 6e 2e 77 65 62 41 6e 61 6c 79 74 69 63 73 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 3a 7b 7d 3b 74 72 79 7b 74 2e 69 6e 69 74 69 61 6c 69 7a 65 28 6e 2c 63 29 7d 63 61 74 63 68 28 74 29 7b 4f 62 6a 65 63 74 28 66 2e 64 29 28 65 2e 6c 6f 67 67 65 72 2c 31 2c 35 31 34 2c 22 46 61 69 6c 65 64 20 74 6f 20 69 6e 69 74 69 61 6c 69 7a 65 20 53 44 4b 2e 22 2b 4f Data Ascii: nConfig=n.extensionConfig\|\|[];l[i.identifier]=n?n.channelConfiguration:{},l[a.identifier]=n?n.propertyConfiguration:{},l[r.identifier]=n?n.webAnalyticsConfiguration:{};try{t.initialize(n,c)}catch(t){Object(f.d)(e.logger,1,514,"Failed to initialize SDK."+O
2024-07-03 19:03:04 UTC	16383	IN	Data Raw: 75 6e 63 74 69 6f 6e 20 48 28 65 29 7b 72 65 74 75 72 6e 22 62 6f 6f 6c 65 61 6e 22 3d 3d 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 4b 28 65 29 7b 76 61 72 20 74 3d 21 31 3b 69 66 28 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 29 7b 76 61 72 20 6e 3d 43 3f 43 28 65 29 3a 49 28 65 29 3b 6e 3f 28 6e 2e 63 6f 6e 73 74 72 75 63 74 6f 72 26 26 72 2e 65 5b 61 2e 63 5d 28 6e 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 28 6e 3d 6e 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 2c 74 3d 74 79 70 65 6f 66 20 6e 3d 3d 3d 72 2e 68 26 26 68 5b 61 2e 63 5d 28 6e 29 3d 3d 3d 6d 29 3a 74 3d 21 30 7d 72 65 74 75 72 6e 20 74 7d 66 75 6e 63 74 69 6f 6e 20 7a 28 65 29 7b 69 66 28 65 29 72 65 74 75 72 6e 20 70 3f 65 2e 74 6f 49 53 4f 53 74 72 69 Data Ascii: unction H(e){return"boolean"==typeof e}function K(e){var t=!1;if(e&&"object"==typeof e){var n=C?C(e):I(e);n?(n.constructor&&r.e[a.c](n,"constructor")&&(n=n.constructor),t=typeof n===r.h&&h[a.c](n)===m):t=!0}return t}function z(e){if(e)return p?e.toISOStri
2024-07-03 19:03:04 UTC	16383	IN	Data Raw: 78 7c 7c 7b 7d 29 5b 74 5d 3d 6e 29 7d 2c 65 5b 69 2e 6b 5d 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 28 65 2e 63 74 78 7c 7c 7b 7d 29 5b 74 5d 7d 7d 29 29 7d 72 65 74 75 72 6e 20 65 2e 5f 5f 69 65 44 79 6e 3d 31 2c 65 7d 28 29 3b 66 75 6e 63 74 69 6f 6e 20 66 28 65 2c 74 2c 6e 2c 72 2c 61 29 7b 69 66 28 65 29 7b 76 61 72 20 63 3d 65 3b 69 66 28 63 5b 6f 2e 6c 5d 26 26 28 63 3d 63 5b 6f 2e 6c 5d 28 29 29 2c 63 29 7b 76 61 72 20 73 3d 76 6f 69 64 20 30 2c 66 3d 63 5b 69 2e 6b 5d 28 22 43 6f 72 65 55 74 69 6c 73 2e 64 6f 50 65 72 66 22 29 3b 74 72 79 7b 69 66 28 73 3d 63 2e 63 72 65 61 74 65 28 74 28 29 2c 72 2c 61 29 29 7b 69 66 28 66 26 26 73 5b 69 2e 4b 5d 26 26 28 73 5b 69 2e 4b 5d 28 75 2e 50 61 72 65 6e 74 43 6f 6e 74 65 78 74 4b 65 79 Data Ascii: x\|\|{})[t]=n)},e[i.k]=function(t){return(e.ctx\|\|{})[t]}}))}return e.__ieDyn=1,e}();function f(e,t,n,r,a){if(e){var c=e;if(c[o.l]&&(c=c[o.l]()),c){var s=void 0,f=c[i.k]("CoreUtils.doPerf");try{if(s=c.create(t(),r,a)){if(f&&s[i.K]&&(s[i.K](u.ParentContextKey
2024-07-03 19:03:04 UTC	16383	IN	Data Raw: 72 74 69 73 69 6e 67 3a 74 2e 41 64 76 65 72 74 69 73 69 6e 67 7c 7c 21 31 7d 29 7d 7d 63 61 74 63 68 28 65 29 7b 7d 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 2c 4f 62 6a 65 63 74 28 61 2e 41 29 28 65 2c 22 75 73 65 72 43 6f 6e 73 65 6e 74 22 2c 65 2e 67 65 74 55 73 65 72 43 6f 6e 73 65 6e 74 29 7d 29 29 7d 72 65 74 75 72 6e 20 65 2e 5f 73 74 61 74 69 63 49 6e 69 74 3d 76 6f 69 64 20 4f 62 6a 65 63 74 28 61 2e 41 29 28 65 2e 70 72 6f 74 6f 74 79 70 65 2c 22 75 73 65 72 43 6f 6e 73 65 6e 74 22 2c 46 29 2c 65 7d 28 29 3b 66 75 6e 63 74 69 6f 6e 20 48 28 65 2c 74 2c 6e 2c 72 2c 69 29 7b 76 61 72 20 6f 3d 74 2e 65 78 74 5b 63 2e 65 5b 65 5d 5d 3b 72 65 74 75 72 6e 20 6f 26 26 4f 62 6a 65 63 74 28 61 2e 43 29 28 72 2c 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 Data Ascii: rtising:t.Advertising\|\|!1})}}catch(e){}return null},Object(a.A)(e,"userConsent",e.getUserConsent)}))}return e._staticInit=void Object(a.A)(e.prototype,"userConsent",F),e}();function H(e,t,n,r,i){var o=t.ext[c.e[e]];return o&&Object(a.C)(r,(function(e,t){i
2024-07-03 19:03:04 UTC	16383	IN	Data Raw: 76 61 72 20 72 3d 7b 7d 2c 69 3d 65 2e 65 78 74 3b 69 26 26 28 74 2e 65 78 74 3d 72 2c 4f 62 6a 65 63 74 28 73 2e 43 29 28 69 2c 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 6e 28 74 2c 72 5b 65 5d 3d 7b 7d 2c 22 65 78 74 2e 22 2b 65 2c 21 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 21 30 29 7d 29 29 29 3b 76 61 72 20 61 3d 74 2e 64 61 74 61 3d 7b 7d 3b 61 2e 62 61 73 65 54 79 70 65 3d 65 2e 62 61 73 65 54 79 70 65 3b 76 61 72 20 6f 3d 61 2e 62 61 73 65 44 61 74 61 3d 7b 7d 3b 72 65 74 75 72 6e 20 6e 28 65 2e 62 61 73 65 44 61 74 61 2c 6f 2c 22 62 61 73 65 44 61 74 61 22 2c 21 31 2c 5b 22 62 61 73 65 44 61 74 61 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 53 28 72 2c 65 2c 74 2c 6e 29 7d 29 2c 21 30 29 2c 6e 28 65 2e 64 61 74 61 2c 61 2c 22 64 61 Data Ascii: var r={},i=e.ext;i&&(t.ext=r,Object(s.C)(i,(function(e,t){n(t,r[e]={},"ext."+e,!0,null,null,!0)})));var a=t.data={};a.baseType=e.baseType;var o=a.baseData={};return n(e.baseData,o,"baseData",!1,["baseData"],(function(e,t,n){S(r,e,t,n)}),!0),n(e.data,a,"da

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.17	49736	152.199.21.175	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:05 UTC	651	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:03:05 UTC	719	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 8774663 Cache-Control: public, max-age=31536000 Content-MD5: EuPayFgGHQiAI7K9SOL6lg== Content-Type: image/x-icon Date: Wed, 03 Jul 2024 19:03:05 GMT Etag: 0x8D8731240E548EB Last-Modified: Sun, 18 Oct 2020 03:02:30 GMT Server: ECAcc (lhc/7944) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 1c016ee5-901e-008a-08ad-7d0366000000 x-ms-version: 2009-09-19 Content-Length: 17174 Connection: close
2024-07-03 19:03:06 UTC	16383	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-07-03 19:03:06 UTC	791	IN	Data Raw: 01 80 00 00 01 80 00 28 00 00 00 18 00 00 00 30 00 00 00 01 00 04 00 00 00 00 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 Data Ascii: (0"P""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.17	49737	152.199.21.175	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:05 UTC	620	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:03:05 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 7913695 Cache-Control: public, max-age=31536000 Content-MD5: P5ihddUjL2Zb7/wjNS1xdg== Content-Type: application/x-javascript Date: Wed, 03 Jul 2024 19:03:05 GMT Etag: 0x8DC4F6D50F3D2E7 Last-Modified: Thu, 28 Mar 2024 21:23:30 GMT Server: ECAcc (lhc/7925) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 6dce4b33-401e-008f-6b82-85846c000000 x-ms-version: 2009-09-19 Content-Length: 223759 Connection: close
2024-07-03 19:03:05 UTC	16383	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-07-03 19:03:06 UTC	16383	IN	Data Raw: 30 21 3d 3d 28 6e 3d 65 2e 6f 72 69 67 69 6e 61 6c 4c 69 6e 65 2d 74 2e 6f 72 69 67 69 6e 61 6c 4c 69 6e 65 29 7c 7c 30 21 3d 3d 28 6e 3d 65 2e 6f 72 69 67 69 6e 61 6c 43 6f 6c 75 6d 6e 2d 74 2e 6f 72 69 67 69 6e 61 6c 43 6f 6c 75 6d 6e 29 3f 6e 3a 66 28 65 2e 6e 61 6d 65 2c 74 2e 6e 61 6d 65 29 7d 2c 74 2e 63 6f 6d 70 61 72 65 42 79 47 65 6e 65 72 61 74 65 64 50 6f 73 69 74 69 6f 6e 73 49 6e 66 6c 61 74 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 72 3d 65 2e 67 65 6e 65 72 61 74 65 64 4c 69 6e 65 2d 74 2e 67 65 6e 65 72 61 74 65 64 4c 69 6e 65 3b 72 65 74 75 72 6e 20 30 21 3d 3d 72 7c 7c 30 21 3d 3d 28 72 3d 65 2e 67 65 6e 65 72 61 74 65 64 43 6f 6c 75 6d 6e 2d 74 2e 67 65 6e 65 72 61 74 65 64 43 6f 6c 75 6d 6e 29 7c 7c 30 21 3d 3d 28 Data Ascii: 0!==(n=e.originalLine-t.originalLine)\|\|0!==(n=e.originalColumn-t.originalColumn)?n:f(e.name,t.name)},t.compareByGeneratedPositionsInflated=function(e,t){var r=e.generatedLine-t.generatedLine;return 0!==r\|\|0!==(r=e.generatedColumn-t.generatedColumn)\|\|0!==(
2024-07-03 19:03:06 UTC	2	IN	Data Raw: 67 74 Data Ascii: gt
2024-07-03 19:03:06 UTC	16383	IN	Data Raw: 68 3b 69 2b 3d 32 29 6f 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 5b 69 5d 2b 32 35 36 2a 6e 5b 69 2b 31 5d 29 3b 72 65 74 75 72 6e 20 6f 7d 66 75 6e 63 74 69 6f 6e 20 52 28 65 2c 74 2c 72 29 7b 69 66 28 65 25 31 21 3d 30 7c 7c 65 3c 30 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 6f 66 66 73 65 74 20 69 73 20 6e 6f 74 20 75 69 6e 74 22 29 3b 69 66 28 65 2b 74 3e 72 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 54 72 79 69 6e 67 20 74 6f 20 61 63 63 65 73 73 20 62 65 79 6f 6e 64 20 62 75 66 66 65 72 20 6c 65 6e 67 74 68 22 29 7d 66 75 6e 63 74 69 6f 6e 20 4d 28 65 2c 74 2c 72 2c 6e 2c 6f 2c 69 29 7b 69 66 28 21 75 2e 69 73 42 75 66 66 65 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 Data Ascii: h;i+=2)o+=String.fromCharCode(n[i]+256*n[i+1]);return o}function R(e,t,r){if(e%1!=0\|\|e<0)throw new RangeError("offset is not uint");if(e+t>r)throw new RangeError("Trying to access beyond buffer length")}function M(e,t,r,n,o,i){if(!u.isBuffer(e))throw new
2024-07-03 19:03:06 UTC	16383	IN	Data Raw: 3d 74 68 69 73 3b 65 3d 65 2e 70 61 72 65 6e 74 3b 29 65 5b 68 5d 3d 21 31 7d 7d 7d 2c 7b 6b 65 79 3a 22 6e 65 78 74 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 74 68 69 73 2e 70 61 72 65 6e 74 29 72 65 74 75 72 6e 20 75 6e 64 65 66 69 6e 65 64 3b 76 61 72 20 65 3d 74 68 69 73 2e 70 61 72 65 6e 74 2e 69 6e 64 65 78 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 61 72 65 6e 74 2e 6e 6f 64 65 73 5b 65 2b 31 5d 7d 7d 2c 7b 6b 65 79 3a 22 70 6f 73 69 74 69 6f 6e 42 79 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 72 3d 74 68 69 73 2e 73 6f 75 72 63 65 2e 73 74 61 72 74 3b 69 66 28 65 2e 69 6e 64 65 78 29 72 3d 74 68 69 73 2e 70 6f 73 69 74 69 6f 6e 49 6e 73 69 64 65 28 65 2e 69 6e 64 65 78 Data Ascii: =this;e=e.parent;)e[h]=!1}}},{key:"next",value:function(){if(!this.parent)return undefined;var e=this.parent.index(this);return this.parent.nodes[e+1]}},{key:"positionBy",value:function(e,t){var r=this.source.start;if(e.index)r=this.positionInside(e.index
2024-07-03 19:03:06 UTC	16383	IN	Data Raw: 72 73 65 28 29 7d 63 61 74 63 68 28 73 29 7b 74 68 72 6f 77 20 73 7d 72 65 74 75 72 6e 20 69 2e 72 6f 6f 74 7d 3b 74 5b 22 64 65 66 61 75 6c 74 22 5d 3d 73 2c 65 2e 65 78 70 6f 72 74 73 3d 74 5b 22 64 65 66 61 75 6c 74 22 5d 7d 2c 35 39 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3b 74 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3d 21 30 2c 74 5b 22 64 65 66 61 75 6c 74 22 5d 3d 76 6f 69 64 20 30 3b 76 61 72 20 6f 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 72 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 74 29 7b 76 61 72 20 72 3b 72 65 74 75 72 6e 28 72 3d 65 2e 63 61 6c 6c 28 74 68 69 73 2c 74 29 7c 7c 74 68 69 73 29 2e 74 79 70 65 3d 22 63 6f 6d 6d 65 6e 74 22 2c 72 7d 72 65 74 75 72 6e 20 72 3d Data Ascii: rse()}catch(s){throw s}return i.root};t["default"]=s,e.exports=t["default"]},596:function(e,t,r){"use strict";var n;t.__esModule=!0,t["default"]=void 0;var o=function(e){var t,r;function n(t){var r;return(r=e.call(this,t)\|\|this).type="comment",r}return r=
2024-07-03 19:03:06 UTC	16383	IN	Data Raw: 74 75 72 6e 20 61 20 70 72 69 6d 69 74 69 76 65 20 76 61 6c 75 65 2e 22 29 7d 72 65 74 75 72 6e 28 22 73 74 72 69 6e 67 22 3d 3d 3d 74 3f 53 74 72 69 6e 67 3a 4e 75 6d 62 65 72 29 28 65 29 7d 28 65 2c 22 73 74 72 69 6e 67 22 29 3b 72 65 74 75 72 6e 22 73 79 6d 62 6f 6c 22 3d 3d 6e 28 74 29 3f 74 3a 53 74 72 69 6e 67 28 74 29 7d 76 61 72 20 73 3d 72 28 36 33 37 29 2c 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 74 2c 72 2c 6e 29 7b 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 21 28 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 74 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 63 61 6c 6c 20 61 20 63 6c 61 73 73 20 61 73 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 7d 28 74 68 69 73 2c 65 29 Data Ascii: turn a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"==n(t)?t:String(t)}var s=r(637),a=function(){function e(t,r,n){!function(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}(this,e)
2024-07-03 19:03:06 UTC	16383	IN	Data Raw: 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 61 73 79 6e 63 28 29 2e 74 68 65 6e 28 65 2c 65 29 7d 2c 66 2e 68 61 6e 64 6c 65 45 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 72 79 7b 69 66 28 74 68 69 73 2e 65 72 72 6f 72 3d 65 2c 22 43 73 73 53 79 6e 74 61 78 45 72 72 6f 72 22 21 3d 3d 65 2e 6e 61 6d 65 7c 7c 65 2e 70 6c 75 67 69 6e 29 7b 69 66 28 74 2e 70 6f 73 74 63 73 73 56 65 72 73 69 6f 6e 29 3b 7d 65 6c 73 65 20 65 2e 70 6c 75 67 69 6e 3d 74 2e 70 6f 73 74 63 73 73 50 6c 75 67 69 6e 2c 65 2e 73 65 74 4d 65 73 73 61 67 65 28 29 7d 63 61 74 63 68 28 72 29 7b 63 6f 6e 73 6f 6c 65 26 26 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 26 26 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 72 29 7d 7d 2c 66 2e 61 73 79 6e 63 54 69 63 6b 3d 66 Data Ascii: ion(e){return this.async().then(e,e)},f.handleError=function(e,t){try{if(this.error=e,"CssSyntaxError"!==e.name\|\|e.plugin){if(t.postcssVersion);}else e.plugin=t.postcssPlugin,e.setMessage()}catch(r){console&&console.error&&console.error(r)}},f.asyncTick=f
2024-07-03 19:03:06 UTC	16383	IN	Data Raw: 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 72 61 77 73 2e 62 65 74 77 65 65 6e 29 72 65 74 75 72 6e 20 74 3d 65 2e 72 61 77 73 2e 62 65 74 77 65 65 6e 2e 72 65 70 6c 61 63 65 28 2f 5b 5e 5c 73 3a 5d 2f 67 2c 22 22 29 2c 21 31 7d 29 29 2c 74 7d 7d 2c 7b 6b 65 79 3a 22 72 61 77 45 6d 70 74 79 42 6f 64 79 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 65 2e 77 61 6c 6b 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 65 2e 6e 6f 64 65 73 26 26 30 3d 3d 3d 65 2e 6e 6f 64 65 73 2e 6c 65 6e 67 74 68 26 26 76 6f 69 64 20 30 21 3d 3d 28 74 3d 65 2e 72 61 77 73 2e 61 66 74 65 72 29 29 72 65 74 75 72 6e 21 31 7d 29 29 2c 74 7d 7d 2c 7b 6b 65 79 3a 22 72 61 77 49 6e 64 65 6e 74 22 2c 76 61 6c 75 65 3a 66 75 6e Data Ascii: ned"!=typeof e.raws.between)return t=e.raws.between.replace(/[^\s:]/g,""),!1})),t}},{key:"rawEmptyBody",value:function(e){var t;return e.walk((function(e){if(e.nodes&&0===e.nodes.length&&void 0!==(t=e.raws.after))return!1})),t}},{key:"rawIndent",value:fun
2024-07-03 19:03:06 UTC	16383	IN	Data Raw: 22 72 75 6e 4f 6e 52 6f 6f 74 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 74 68 69 73 2e 72 65 73 75 6c 74 2e 6c 61 73 74 50 6c 75 67 69 6e 3d 65 3b 74 72 79 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 3d 64 28 65 29 26 26 65 2e 4f 6e 63 65 29 7b 69 66 28 22 64 6f 63 75 6d 65 6e 74 22 3d 3d 3d 74 68 69 73 2e 72 65 73 75 6c 74 2e 72 6f 6f 74 2e 74 79 70 65 29 7b 76 61 72 20 72 3d 74 68 69 73 2e 72 65 73 75 6c 74 2e 72 6f 6f 74 2e 6e 6f 64 65 73 2e 6d 61 70 28 28 66 75 6e 63 74 69 6f 6e 28 72 29 7b 72 65 74 75 72 6e 20 65 2e 4f 6e 63 65 28 72 2c 74 2e 68 65 6c 70 65 72 73 29 7d 29 29 3b 72 65 74 75 72 6e 20 50 28 72 5b 30 5d 29 3f 50 72 6f 6d 69 73 65 2e 61 6c 6c 28 72 29 3a 72 7d 72 65 74 75 72 6e 20 65 2e 4f Data Ascii: "runOnRoot",value:function(e){var t=this;this.result.lastPlugin=e;try{if("object"===d(e)&&e.Once){if("document"===this.result.root.type){var r=this.result.root.nodes.map((function(r){return e.Once(r,t.helpers)}));return P(r[0])?Promise.all(r):r}return e.O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.17	49738	152.199.21.175	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:06 UTC	406	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:03:07 UTC	719	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 8774665 Cache-Control: public, max-age=31536000 Content-MD5: EuPayFgGHQiAI7K9SOL6lg== Content-Type: image/x-icon Date: Wed, 03 Jul 2024 19:03:07 GMT Etag: 0x8D8731240E548EB Last-Modified: Sun, 18 Oct 2020 03:02:30 GMT Server: ECAcc (lhc/7944) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 1c016ee5-901e-008a-08ad-7d0366000000 x-ms-version: 2009-09-19 Content-Length: 17174 Connection: close
2024-07-03 19:03:07 UTC	16383	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-07-03 19:03:07 UTC	791	IN	Data Raw: 01 80 00 00 01 80 00 28 00 00 00 18 00 00 00 30 00 00 00 01 00 04 00 00 00 00 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 Data Ascii: (0"P""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.17	49739	13.107.246.67	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:06 UTC	618	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:03:07 UTC	797	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 19:03:06 GMT Content-Type: application/x-javascript Content-Length: 54318 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 28 Mar 2024 21:22:21 GMT ETag: 0x8DC4F6D2782F92A x-ms-request-id: 9a0311e9-501e-006b-6896-c582ab000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240703T190306Z-157bfc59976cs7dp68mf7de13s0000000ez000000000bgv5 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-07-03 19:03:07 UTC	15587	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ec bd 6b 7b db 46 92 30 fa 7d 7f 05 85 67 46 06 4c 90 22 a9 8b 65 52 10 c7 76 92 79 bd 4f 12 fb d8 ce bc 67 8f cc c9 03 81 a0 84 98 02 b8 b8 d8 d6 88 dc df 7e aa aa ef 40 83 92 af c9 66 3c bb b1 88 46 a3 2f d5 dd d5 75 af bd fb 3b ff d1 b9 df e9 dd fd 7f 9d 97 af 1e bd 78 d5 79 f6 43 e7 d5 ff 79 fa e2 bb ce 73 78 fa af ce cf cf 5e 3d 7d f2 fd dd db c1 4e f1 bf 57 97 49 d1 59 24 cb b8 03 7f cf c3 22 9e 77 b2 b4 93 e5 9d 24 8d b2 7c 95 e5 61 19 17 9d 2b f8 37 4f c2 65 67 91 67 57 9d f2 32 ee ac f2 ec b7 38 2a 8b ce 32 29 4a f8 e8 3c 5e 66 ef 3a 2e 34 97 cf 3b cf c3 bc bc ee 3c 7d ee f5 a1 fd 18 5a 4b 2e 92 14 be 8e b2 d5 35 fc be 2c 3b 69 56 26 51 dc 09 d3 39 b5 b6 84 87 b4 88 3b 55 3a 8f f3 ce bb cb 24 ba ec fc 94 44 79 56 64 Data Ascii: k{F0}gFL"eRvyOg~@f<F/u;xyCysx^=}NWIY$"w$\|a+7OeggW28*2)J<^f:.4;<}ZK.5,;iV&Q9;U:$DyVd
2024-07-03 19:03:07 UTC	16384	IN	Data Raw: 05 4d 84 8d fd f5 21 1e 6b 84 f3 ea a9 30 85 40 d4 f4 35 13 66 96 42 33 ac 63 90 d2 34 a8 34 5c 17 c8 31 ad 89 10 98 41 cf 1d ac 27 d3 16 eb 49 66 37 39 36 6a e6 1e 9a 39 8b 9a ac 07 55 9d 9e 95 6c 10 cf 4d f8 ce 9a 65 85 4c 97 13 1d d1 d7 ac 98 f1 db 2c 33 f6 66 8b a1 ac dd 18 96 b0 03 f7 a4 33 16 ef 33 ba d0 e1 7e 36 8c c6 5b 84 cd f4 a5 66 55 60 f1 38 11 17 bf cd 37 83 48 03 66 fb 1c 93 12 8c 3b 60 a0 2e 6c 0a d4 f8 10 d5 61 43 6f 9c 6b 0e 18 cc 3d ca 17 ea c4 8d 3e d6 c7 d7 4d 8a 7f bb 0f cc 76 33 7d ab 07 4c 5e 9f b5 dd 19 21 6f 75 02 c8 95 94 19 30 30 89 65 0d ea b3 da 42 ba ef 6f 27 dd ef 4a d5 a2 3f 0c 31 19 44 cc 6e 67 32 b8 e5 b4 b9 d7 1b c4 5b dd 06 d2 9c 52 b2 65 4a 07 8d 29 19 87 5a 12 2b 79 43 d0 ea 6b b1 be 87 93 14 83 77 a7 bd 9e ee d7 3e Data Ascii: M!k0@5fB3c44\1A'If796j9UlMeL,3f33~6[fU`87Hf;`.laCok=>Mv3}L^!ou00eBo'J?1Dng2[ReJ)Z+yCkw>
2024-07-03 19:03:07 UTC	16384	IN	Data Raw: a8 b9 03 12 11 9b c5 ab 6d 58 97 46 d1 83 47 47 b4 f2 e8 b8 8e 72 f4 df 6f 92 0c db 87 b9 bc 0c 54 6e 6b 6c 47 1c 71 b0 25 2e 6c 37 a9 4a 69 c3 5e 6d cb fc a6 7c 51 dc bf ac 75 a5 00 11 76 ef 72 90 d7 94 63 f9 fa 1d 1f e5 ee aa bc ba 30 92 8c 6b 0b 5a a4 a5 25 83 97 92 df fb 94 d4 99 2b d8 52 77 37 16 f3 a9 42 71 73 fe d6 ab e8 e7 1b 86 ee 6f 31 5e d2 a5 67 85 28 07 32 44 cc 29 4d cc 57 d9 17 e5 eb f0 92 ca a5 a7 ed 84 34 ba 8e df 7b 05 9d bb c0 85 9c bf 63 f1 b9 a3 6f 7e 8d 16 9e 06 64 e9 95 78 65 83 2c bd 12 4f 75 69 d3 7a ef 95 2f 4e 9a d3 11 94 69 7f 3d 28 93 6b 24 67 fc c6 fe 7d 90 fd 7f 17 db eb ba 99 80 e2 76 7b 6b ad 6d 93 2f b7 b6 fd 02 3b 5b 6a 4b 83 a9 ad 6a 8d 63 71 4b 99 7f b9 d1 ad db d3 e5 9f 36 ea bf b2 8d 3a ba ae fc 9a 36 ea d1 7a 1b f5 Data Ascii: mXFGGroTnklGq%.l7Ji^m\|Quvrc0kZ%+Rw7Bqso1^g(2D)MW4{co~dxe,Ouiz/Ni=(k$g}v{km/;[jKjcqK6:6z
2024-07-03 19:03:07 UTC	5963	IN	Data Raw: 1c fc c6 80 78 52 70 a9 01 29 54 61 64 80 49 1d 85 a8 6b 7a be 30 70 47 23 6c 9e 34 af 86 b3 e9 c1 69 f1 e0 2f 1b 1a 76 0b 7d 16 b1 94 b7 fd c0 87 37 f0 7a 67 87 2d d1 c8 d2 0a bf e0 2e a0 06 b1 fb 67 56 7f 71 45 67 3b 0e 93 65 cc 23 17 d8 a0 b4 94 ec b9 5a 3a 66 45 f2 2a ab 76 1a cd ce 97 26 fc f3 4b 5e db 0d d6 56 21 2f 68 68 18 50 5a 54 7a e7 a7 02 d7 79 4f db 0b e8 bd 80 a7 a5 92 2c 73 bd 3f bc 7f f9 2c bb 9a 65 29 d9 fa ab 49 d1 a0 4d d2 1a be fa 85 53 fa 44 0f f9 b3 22 2e c3 79 39 e9 f4 8f 7a e7 51 11 1f 1e 08 7d 53 2c 16 2b 4b 56 b3 6a cc df 50 b7 e1 7d 7c f1 e2 d3 8c 44 03 af 71 2e 54 93 44 da 4f 69 27 a2 25 1b d7 d3 f2 2d 12 36 b8 4e d2 71 76 bd 0d 47 ec b9 b2 bd cd cc 84 ae 68 90 37 f8 a7 18 b6 7d 41 2b a5 06 60 e8 44 f4 94 21 1d e0 c0 d8 a0 20 Data Ascii: xRp)TadIkz0pG#l4i/v}7zg-.gVqEg;e#Z:fE*v&K^V!/hhPZTzyO,s?,e)IMSD".y9zQ}S,+KVjP}\|Dq.TDOi'%-6NqvGh7}A+`D!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.17	49743	152.199.21.175	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:08 UTC	622	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_0b5ca5d48eeaf75b0528.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:03:08 UTC	749	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2339406 Cache-Control: public, max-age=31536000 Content-MD5: xkvSj1l8u2FW9Fo6B7DKkg== Content-Type: application/x-javascript Date: Wed, 03 Jul 2024 19:03:08 GMT Etag: 0x8DC80FB247365E6 Last-Modified: Thu, 30 May 2024 22:52:11 GMT Server: ECAcc (lhc/7923) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 61b73163-901e-0076-7134-b8522a000000 x-ms-version: 2009-09-19 Content-Length: 15755 Connection: close
2024-07-03 19:03:08 UTC	15755	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.17	49744	152.199.21.175	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:08 UTC	670	OUT	GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:03:08 UTC	715	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 8774615 Cache-Control: public, max-age=31536000 Content-MD5: Fm3lNHEmUlOrOkVt7+baIw== Content-Type: image/gif Date: Wed, 03 Jul 2024 19:03:08 GMT Etag: 0x8DB5C3F4982FD30 Last-Modified: Wed, 24 May 2023 10:11:48 GMT Server: ECAcc (lhc/7945) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: c8ea465c-601e-0025-11ad-7d4c1f000000 x-ms-version: 2009-09-19 Content-Length: 2672 Connection: close
2024-07-03 19:03:08 UTC	2672	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e 69 18 14 00 21 Data Ascii: GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~i!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.17	49742	152.199.21.175	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:08 UTC	664	OUT	GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:03:08 UTC	715	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 8774793 Cache-Control: public, max-age=31536000 Content-MD5: tUCo5RgDcZLjLE/li/Lbqw== Content-Type: image/gif Date: Wed, 03 Jul 2024 19:03:08 GMT Etag: 0x8DB5C3F492F3EE5 Last-Modified: Wed, 24 May 2023 10:11:48 GMT Server: ECAcc (lhc/7941) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 1d63faa2-d01e-009e-5cad-7d1f4c000000 x-ms-version: 2009-09-19 Content-Length: 3620 Connection: close
2024-07-03 19:03:08 UTC	3620	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 0f Data Ascii: GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.17	49745	152.199.21.175	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:09 UTC	425	OUT	GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:03:09 UTC	715	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 8774616 Cache-Control: public, max-age=31536000 Content-MD5: Fm3lNHEmUlOrOkVt7+baIw== Content-Type: image/gif Date: Wed, 03 Jul 2024 19:03:09 GMT Etag: 0x8DB5C3F4982FD30 Last-Modified: Wed, 24 May 2023 10:11:48 GMT Server: ECAcc (lhc/7945) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: c8ea465c-601e-0025-11ad-7d4c1f000000 x-ms-version: 2009-09-19 Content-Length: 2672 Connection: close
2024-07-03 19:03:09 UTC	2672	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e 69 18 14 00 21 Data Ascii: GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~i!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.17	49746	152.199.21.175	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:09 UTC	419	OUT	GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:03:09 UTC	715	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 8774794 Cache-Control: public, max-age=31536000 Content-MD5: tUCo5RgDcZLjLE/li/Lbqw== Content-Type: image/gif Date: Wed, 03 Jul 2024 19:03:09 GMT Etag: 0x8DB5C3F492F3EE5 Last-Modified: Wed, 24 May 2023 10:11:48 GMT Server: ECAcc (lhc/7941) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 1d63faa2-d01e-009e-5cad-7d1f4c000000 x-ms-version: 2009-09-19 Content-Length: 3620 Connection: close
2024-07-03 19:03:09 UTC	3620	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 0f Data Ascii: GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.17	49748	152.199.21.175	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:09 UTC	664	OUT	GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:03:09 UTC	737	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 8774472 Cache-Control: public, max-age=31536000 Content-MD5: DhdidjYrlCeaRJJRG/y9mA== Content-Type: image/svg+xml Date: Wed, 03 Jul 2024 19:03:09 GMT Etag: 0x8DB5C3F466DE917 Last-Modified: Wed, 24 May 2023 10:11:43 GMT Server: ECAcc (lhc/792B) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 60ece416-101e-0092-59ad-7deb55000000 x-ms-version: 2009-09-19 Content-Length: 1864 Connection: close
2024-07-03 19:03:09 UTC	1864	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 39 32 30 22 20 68 65 69 67 68 74 3d 22 31 30 38 30 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 67 20 6f 70 61 63 69 74 79 3d 22 2e 32 22 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 45 29 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 34 36 36 2e 34 20 31 37 39 35 2e 32 63 39 35 30 2e 33 37 20 30 20 31 37 32 30 2e 38 2d 36 32 37 2e 35 32 20 31 37 32 30 2e 38 2d 31 34 30 31 2e 36 53 32 34 31 36 2e 37 37 2d 31 30 30 38 20 31 34 36 36 2e 34 2d 31 30 30 38 2d 32 35 34 2e 34 2d 33 38 30 2e 34 38 32 2d 32 35 34 2e 34 20 33 39 33 2e 36 73 37 37 30 2e 34 32 38 20 31 34 30 31 2e 36 20 31 37 32 30 2e 38 20 31 34 30 31 2e 36 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.17	49747	152.199.21.175	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:09 UTC	665	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:03:09 UTC	737	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 8774512 Cache-Control: public, max-age=31536000 Content-MD5: nzaLxFgP7ZB3dfMcaybWzw== Content-Type: image/svg+xml Date: Wed, 03 Jul 2024 19:03:09 GMT Etag: 0x8DB5C3F495F4B8C Last-Modified: Wed, 24 May 2023 10:11:48 GMT Server: ECAcc (lhc/7892) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 002cd9d5-201e-00e1-69ad-7d6453000000 x-ms-version: 2009-09-19 Content-Length: 3651 Connection: close
2024-07-03 19:03:09 UTC	3651	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 30 38 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 38 20 32 34 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 70 61 74 68 20 64 3d 22 4d 34 34 2e 38 33 36 2c 34 2e 36 56 31 38 2e 34 68 2d 32 2e 34 56 37 2e 35 38 33 48 34 32 2e 34 4c 33 38 2e 31 31 39 2c 31 38 2e 34 48 33 36 2e 35 33 31 4c 33 32 2e 31 34 32 2c 37 2e 35 38 33 68 2d 2e 30 32 39 56 31 38 2e 34 48 32 39 2e 39 56 34 2e 36 68 33 2e 34 33 36 4c 33 37 2e 33 2c 31 34 2e 38 33 68 2e 30 35 38 4c 34 31 2e 35 34 35 2c 34 2e 36 5a 6d 32 2c 31 2e 30 34 39 61 31 2e 32 36 38 2c 31 2e 32 36 38 2c 30 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.17	49749	40.126.32.134	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:09 UTC	727	OUT	GET /18d5b6a3-deb9-4f24-9d39-2d9ef885718b/winauth/ssoprobe?client-request-id=75c238a1-8070-0000-1ca8-dcfb33df0a80&_=1720033387907 HTTP/1.1 Host: autologon.microsoftazuread-sso.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:03:09 UTC	1182	IN	HTTP/1.1 401 Unauthorized Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: image/png; charset=utf-8 Expires: -1 Vary: Origin X-Content-Type-Options: nosniff Access-Control-Allow-Origin: https://login.microsoftonline.com Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, OPTIONS P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: beb2904d-a02a-4fb7-a1e8-9587d021f100 x-ms-ests-server: 2.1.18399.9 - SCUS ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} Referrer-Policy: strict-origin-when-cross-origin X-XSS-Protection: 0 WWW-Authenticate: Negotiate Set-Cookie: fpc=AsK6LzDUTE5Cqk7Qaojg33Y; expires=Fri, 02-Aug-2024 19:03:09 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Set-Cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly Date: Wed, 03 Jul 2024 19:03:09 GMT Connection: close Content-Length: 12
2024-07-03 19:03:09 UTC	12	IN	Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 Data Ascii: Unauthorized

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.17	49751	152.199.21.175	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:10 UTC	419	OUT	GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:03:10 UTC	737	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 8774473 Cache-Control: public, max-age=31536000 Content-MD5: DhdidjYrlCeaRJJRG/y9mA== Content-Type: image/svg+xml Date: Wed, 03 Jul 2024 19:03:10 GMT Etag: 0x8DB5C3F466DE917 Last-Modified: Wed, 24 May 2023 10:11:43 GMT Server: ECAcc (lhc/792B) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 60ece416-101e-0092-59ad-7deb55000000 x-ms-version: 2009-09-19 Content-Length: 1864 Connection: close
2024-07-03 19:03:10 UTC	1864	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 39 32 30 22 20 68 65 69 67 68 74 3d 22 31 30 38 30 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 67 20 6f 70 61 63 69 74 79 3d 22 2e 32 22 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 45 29 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 34 36 36 2e 34 20 31 37 39 35 2e 32 63 39 35 30 2e 33 37 20 30 20 31 37 32 30 2e 38 2d 36 32 37 2e 35 32 20 31 37 32 30 2e 38 2d 31 34 30 31 2e 36 53 32 34 31 36 2e 37 37 2d 31 30 30 38 20 31 34 36 36 2e 34 2d 31 30 30 38 2d 32 35 34 2e 34 2d 33 38 30 2e 34 38 32 2d 32 35 34 2e 34 20 33 39 33 2e 36 73 37 37 30 2e 34 32 38 20 31 34 30 31 2e 36 20 31 37 32 30 2e 38 20 31 34 30 31 2e 36 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.17	49752	152.199.21.175	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:10 UTC	420	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:03:10 UTC	737	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 8774513 Cache-Control: public, max-age=31536000 Content-MD5: nzaLxFgP7ZB3dfMcaybWzw== Content-Type: image/svg+xml Date: Wed, 03 Jul 2024 19:03:10 GMT Etag: 0x8DB5C3F495F4B8C Last-Modified: Wed, 24 May 2023 10:11:48 GMT Server: ECAcc (lhc/7892) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 002cd9d5-201e-00e1-69ad-7d6453000000 x-ms-version: 2009-09-19 Content-Length: 3651 Connection: close
2024-07-03 19:03:10 UTC	3651	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 30 38 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 38 20 32 34 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 70 61 74 68 20 64 3d 22 4d 34 34 2e 38 33 36 2c 34 2e 36 56 31 38 2e 34 68 2d 32 2e 34 56 37 2e 35 38 33 48 34 32 2e 34 4c 33 38 2e 31 31 39 2c 31 38 2e 34 48 33 36 2e 35 33 31 4c 33 32 2e 31 34 32 2c 37 2e 35 38 33 68 2d 2e 30 32 39 56 31 38 2e 34 48 32 39 2e 39 56 34 2e 36 68 33 2e 34 33 36 4c 33 37 2e 33 2c 31 34 2e 38 33 68 2e 30 35 38 4c 34 31 2e 35 34 35 2c 34 2e 36 5a 6d 32 2c 31 2e 30 34 39 61 31 2e 32 36 38 2c 31 2e 32 36 38 2c 30 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.17	49754	152.199.21.175	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:10 UTC	626	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:03:11 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 7913700 Cache-Control: public, max-age=31536000 Content-MD5: /PcUcu/J5hSxDf1JmAX3KQ== Content-Type: application/x-javascript Date: Wed, 03 Jul 2024 19:03:10 GMT Etag: 0x8DC4F6D5254E400 Last-Modified: Thu, 28 Mar 2024 21:23:33 GMT Server: ECAcc (lhc/7966) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 37e0e53c-601e-005d-3282-85e60e000000 x-ms-version: 2009-09-19 Content-Length: 113657 Connection: close
2024-07-03 19:03:11 UTC	15652	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-07-03 19:03:11 UTC	16383	IN	Data Raw: 72 6f 74 6f 63 6f 6c 7c 7c 67 2e 69 6e 64 65 78 4f 66 28 74 2e 70 72 6f 74 6f 63 6f 6c 29 3e 3d 30 29 29 74 72 79 7b 74 2e 68 6f 73 74 6e 61 6d 65 3d 70 2e 74 6f 55 6e 69 63 6f 64 65 28 74 2e 68 6f 73 74 6e 61 6d 65 29 7d 63 61 74 63 68 28 72 29 7b 7d 72 65 74 75 72 6e 20 6c 2e 64 65 63 6f 64 65 28 6c 2e 66 6f 72 6d 61 74 28 74 29 2c 6c 2e 64 65 63 6f 64 65 2e 64 65 66 61 75 6c 74 43 68 61 72 73 2b 22 25 22 29 7d 66 75 6e 63 74 69 6f 6e 20 62 28 65 2c 74 29 7b 69 66 28 21 28 74 68 69 73 20 69 6e 73 74 61 6e 63 65 6f 66 20 62 29 29 72 65 74 75 72 6e 20 6e 65 77 20 62 28 65 2c 74 29 3b 74 7c 7c 6e 2e 69 73 53 74 72 69 6e 67 28 65 29 7c 7c 28 74 3d 65 7c 7c 7b 7d 2c 65 3d 22 64 65 66 61 75 6c 74 22 29 2c 74 68 69 73 2e 69 6e 6c 69 6e 65 3d 6e 65 77 20 63 2c Data Ascii: rotocol\|\|g.indexOf(t.protocol)>=0))try{t.hostname=p.toUnicode(t.hostname)}catch(r){}return l.decode(l.format(t),l.decode.defaultChars+"%")}function b(e,t){if(!(this instanceof b))return new b(e,t);t\|\|n.isString(e)\|\|(t=e\|\|{},e="default"),this.inline=new c,
2024-07-03 19:03:11 UTC	16383	IN	Data Raw: 5c 75 30 34 35 31 22 2c 22 49 6f 67 6f 6e 22 3a 22 5c 75 30 31 32 65 22 2c 22 69 6f 67 6f 6e 22 3a 22 5c 75 30 31 32 66 22 2c 22 49 6f 70 66 22 3a 22 5c 75 64 38 33 35 5c 75 64 64 34 30 22 2c 22 69 6f 70 66 22 3a 22 5c 75 64 38 33 35 5c 75 64 64 35 61 22 2c 22 49 6f 74 61 22 3a 22 5c 75 30 33 39 39 22 2c 22 69 6f 74 61 22 3a 22 5c 75 30 33 62 39 22 2c 22 69 70 72 6f 64 22 3a 22 5c 75 32 61 33 63 22 2c 22 69 71 75 65 73 74 22 3a 22 5c 78 62 66 22 2c 22 69 73 63 72 22 3a 22 5c 75 64 38 33 35 5c 75 64 63 62 65 22 2c 22 49 73 63 72 22 3a 22 5c 75 32 31 31 30 22 2c 22 69 73 69 6e 22 3a 22 5c 75 32 32 30 38 22 2c 22 69 73 69 6e 64 6f 74 22 3a 22 5c 75 32 32 66 35 22 2c 22 69 73 69 6e 45 22 3a 22 5c 75 32 32 66 39 22 2c 22 69 73 69 6e 73 22 3a 22 5c 75 32 32 66 Data Ascii: \u0451","Iogon":"\u012e","iogon":"\u012f","Iopf":"\ud835\udd40","iopf":"\ud835\udd5a","Iota":"\u0399","iota":"\u03b9","iprod":"\u2a3c","iquest":"\xbf","iscr":"\ud835\udcbe","Iscr":"\u2110","isin":"\u2208","isindot":"\u22f5","isinE":"\u22f9","isins":"\u22f
2024-07-03 19:03:11 UTC	16383	IN	Data Raw: 32 35 33 22 2c 22 72 6c 61 72 72 22 3a 22 5c 75 32 31 63 34 22 2c 22 72 6c 68 61 72 22 3a 22 5c 75 32 31 63 63 22 2c 22 72 6c 6d 22 3a 22 5c 75 32 30 30 66 22 2c 22 72 6d 6f 75 73 74 61 63 68 65 22 3a 22 5c 75 32 33 62 31 22 2c 22 72 6d 6f 75 73 74 22 3a 22 5c 75 32 33 62 31 22 2c 22 72 6e 6d 69 64 22 3a 22 5c 75 32 61 65 65 22 2c 22 72 6f 61 6e 67 22 3a 22 5c 75 32 37 65 64 22 2c 22 72 6f 61 72 72 22 3a 22 5c 75 32 31 66 65 22 2c 22 72 6f 62 72 6b 22 3a 22 5c 75 32 37 65 37 22 2c 22 72 6f 70 61 72 22 3a 22 5c 75 32 39 38 36 22 2c 22 72 6f 70 66 22 3a 22 5c 75 64 38 33 35 5c 75 64 64 36 33 22 2c 22 52 6f 70 66 22 3a 22 5c 75 32 31 31 64 22 2c 22 72 6f 70 6c 75 73 22 3a 22 5c 75 32 61 32 65 22 2c 22 72 6f 74 69 6d 65 73 22 3a 22 5c 75 32 61 33 35 22 2c 22 Data Ascii: 253","rlarr":"\u21c4","rlhar":"\u21cc","rlm":"\u200f","rmoustache":"\u23b1","rmoust":"\u23b1","rnmid":"\u2aee","roang":"\u27ed","roarr":"\u21fe","robrk":"\u27e7","ropar":"\u2986","ropf":"\ud835\udd63","Ropf":"\u211d","roplus":"\u2a2e","rotimes":"\u2a35","
2024-07-03 19:03:11 UTC	16383	IN	Data Raw: 34 31 3d 3d 3d 6f 29 72 65 74 75 72 6e 20 63 3b 31 30 3d 3d 3d 73 3f 69 2b 2b 3a 39 32 3d 3d 3d 73 26 26 74 2b 31 3c 72 26 26 28 74 2b 2b 2c 31 30 3d 3d 3d 65 2e 63 68 61 72 43 6f 64 65 41 74 28 74 29 26 26 69 2b 2b 29 2c 74 2b 2b 7d 72 65 74 75 72 6e 20 63 7d 7d 2c 38 32 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 72 28 35 33 32 29 2e 61 73 73 69 67 6e 2c 73 3d 72 28 35 33 32 29 2e 75 6e 65 73 63 61 70 65 41 6c 6c 2c 6f 3d 72 28 35 33 32 29 2e 65 73 63 61 70 65 48 74 6d 6c 2c 69 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 74 68 69 73 2e 72 75 6c 65 73 3d 6e 28 7b 7d 2c 69 29 7d 69 2e 63 6f 64 65 5f 69 6e 6c 69 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 2c 6e 2c 73 29 7b 76 Data Ascii: 41===o)return c;10===s?i++:92===s&&t+1<r&&(t++,10===e.charCodeAt(t)&&i++),t++}return c}},822:function(e,t,r){"use strict";var n=r(532).assign,s=r(532).unescapeAll,o=r(532).escapeHtml,i={};function a(){this.rules=n({},i)}i.code_inline=function(e,t,r,n,s){v
2024-07-03 19:03:11 UTC	16383	IN	Data Raw: 3d 3d 28 69 3d 65 2e 73 72 63 2e 63 68 61 72 43 6f 64 65 41 74 28 71 29 29 29 43 2b 3d 34 2d 28 43 2b 65 2e 62 73 43 6f 75 6e 74 5b 76 5d 29 25 34 3b 65 6c 73 65 7b 69 66 28 33 32 21 3d 3d 69 29 62 72 65 61 6b 3b 43 2b 2b 7d 71 2b 2b 7d 69 66 28 28 6c 3d 28 61 3d 71 29 3e 3d 62 3f 31 3a 43 2d 70 29 3e 34 26 26 28 6c 3d 31 29 2c 75 3d 70 2b 6c 2c 28 52 3d 65 2e 70 75 73 68 28 22 6c 69 73 74 5f 69 74 65 6d 5f 6f 70 65 6e 22 2c 22 6c 69 22 2c 31 29 29 2e 6d 61 72 6b 75 70 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 5f 29 2c 52 2e 6d 61 70 3d 66 3d 5b 74 2c 30 5d 2c 68 26 26 28 52 2e 69 6e 66 6f 3d 65 2e 73 72 63 2e 73 6c 69 63 65 28 46 2c 45 2d 31 29 29 2c 77 3d 65 2e 74 69 67 68 74 2c 44 3d 65 2e 74 53 68 69 66 74 5b 74 5d 2c 78 3d 65 2e Data Ascii: ==(i=e.src.charCodeAt(q)))C+=4-(C+e.bsCount[v])%4;else{if(32!==i)break;C++}q++}if((l=(a=q)>=b?1:C-p)>4&&(l=1),u=p+l,(R=e.push("list_item_open","li",1)).markup=String.fromCharCode(_),R.map=f=[t,0],h&&(R.info=e.src.slice(F,E-1)),w=e.tight,D=e.tShift[t],x=e.
2024-07-03 19:03:11 UTC	16090	IN	Data Raw: 2c 74 29 7b 76 61 72 20 72 2c 6e 2c 73 2c 6f 2c 69 2c 61 2c 63 2c 75 2c 6c 3d 7b 7d 2c 70 3d 74 2e 6c 65 6e 67 74 68 3b 66 6f 72 28 72 3d 30 3b 72 3c 70 3b 72 2b 2b 29 69 66 28 28 73 3d 74 5b 72 5d 29 2e 6c 65 6e 67 74 68 3d 73 2e 6c 65 6e 67 74 68 7c 7c 30 2c 73 2e 63 6c 6f 73 65 29 7b 66 6f 72 28 6c 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 73 2e 6d 61 72 6b 65 72 29 7c 7c 28 6c 5b 73 2e 6d 61 72 6b 65 72 5d 3d 5b 2d 31 2c 2d 31 2c 2d 31 2c 2d 31 2c 2d 31 2c 2d 31 5d 29 2c 69 3d 6c 5b 73 2e 6d 61 72 6b 65 72 5d 5b 28 73 2e 6f 70 65 6e 3f 33 3a 30 29 2b 73 2e 6c 65 6e 67 74 68 25 33 5d 2c 28 6e 3d 72 2d 73 2e 6a 75 6d 70 2d 31 29 3c 2d 31 26 26 28 6e 3d 2d 31 29 2c 61 3d 6e 3b 6e 3e 69 3b 6e 2d 3d 6f 2e 6a 75 6d 70 2b 31 29 69 66 28 28 6f 3d 74 5b Data Ascii: ,t){var r,n,s,o,i,a,c,u,l={},p=t.length;for(r=0;r<p;r++)if((s=t[r]).length=s.length\|\|0,s.close){for(l.hasOwnProperty(s.marker)\|\|(l[s.marker]=[-1,-1,-1,-1,-1,-1]),i=l[s.marker][(s.open?3:0)+s.length%3],(n=r-s.jump-1)<-1&&(n=-1),a=n;n>i;n-=o.jump+1)if((o=t[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.17	49755	152.199.21.175	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:10 UTC	665	OUT	GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:03:11 UTC	737	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 8688495 Cache-Control: public, max-age=31536000 Content-MD5: R2FAVxfpONfnQAuxVxXbHg== Content-Type: image/svg+xml Date: Wed, 03 Jul 2024 19:03:10 GMT Etag: 0x8DB5C3F4BB4F03C Last-Modified: Wed, 24 May 2023 10:11:52 GMT Server: ECAcc (lhc/7928) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 21996301-501e-00c2-0976-7e8866000000 x-ms-version: 2009-09-19 Content-Length: 1592 Connection: close
2024-07-03 19:03:11 UTC	1592	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 61 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 2e 62 7b 66 69 6c 6c 3a 23 34 30 34 30 34 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 72 65 63 74 20 63 6c 61 73 73 3d 22 61 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 62 22 20 64 3d 22 4d 34 30 2c 33 32 2e 35 37 38 56 34 30 48 33 32 56 33 36 48 32 38 56 33 32 48 32 34 56 32 38 2e 37 36 36 41 31 30 2e 36 38 39 2c 31 30 2e 36 38 39 2c 30 2c 30 2c Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.17	49757	2.19.244.127	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:11 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-03 19:03:11 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=76013 Date: Wed, 03 Jul 2024 19:03:11 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.17	49758	152.199.21.175	443	6600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:11 UTC	420	OUT	GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:03:12 UTC	737	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 8688497 Cache-Control: public, max-age=31536000 Content-MD5: R2FAVxfpONfnQAuxVxXbHg== Content-Type: image/svg+xml Date: Wed, 03 Jul 2024 19:03:12 GMT Etag: 0x8DB5C3F4BB4F03C Last-Modified: Wed, 24 May 2023 10:11:52 GMT Server: ECAcc (lhc/7928) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 21996301-501e-00c2-0976-7e8866000000 x-ms-version: 2009-09-19 Content-Length: 1592 Connection: close
2024-07-03 19:03:12 UTC	1592	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 61 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 2e 62 7b 66 69 6c 6c 3a 23 34 30 34 30 34 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 72 65 63 74 20 63 6c 61 73 73 3d 22 61 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 62 22 20 64 3d 22 4d 34 30 2c 33 32 2e 35 37 38 56 34 30 48 33 32 56 33 36 48 32 38 56 33 32 48 32 34 56 32 38 2e 37 36 36 41 31 30 2e 36 38 39 2c 31 30 2e 36 38 39 2c 30 2c 30 2c Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.17	49761	2.19.244.127	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:12 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-03 19:03:12 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=76000 Date: Wed, 03 Jul 2024 19:03:12 GMT Content-Length: 55 Connection: close X-CID: 2
2024-07-03 19:03:12 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.17	49765	13.107.5.88	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:33 UTC	537	OUT	GET /ab HTTP/1.1 Host: evoke-windowsservices-tas.msedge.net Cache-Control: no-store, no-cache X-PHOTOS-CALLERID: 9NMPJ99VJBWV X-EVOKE-RING: X-WINNEXT-RING: Public X-WINNEXT-TELEMETRYLEVEL: Basic X-WINNEXT-OSVERSION: 10.0.19045.0 X-WINNEXT-APPVERSION: 1.23082.131.0 X-WINNEXT-PLATFORM: Desktop X-WINNEXT-CANTAILOR: False X-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd} X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI= If-None-Match: 2056388360_-1434155563 Accept-Encoding: gzip, deflate, br
2024-07-03 19:03:33 UTC	209	IN	HTTP/1.1 400 Bad Request X-MSEdge-Ref: Ref A: EDFD40769F6D44378C35F642F7277E0D Ref B: EWR311000102047 Ref C: 2024-07-03T19:03:33Z Date: Wed, 03 Jul 2024 19:03:32 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.17	49766	2.23.209.133	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:33 UTC	2567	OUT	GET /client/config?cc=CH&setlang=en-CH HTTP/1.1 X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-UserAgeClass: Unknown X-BM-Market: CH X-BM-DateFormat: dd/MM/yyyy X-Device-OSSKU: 48 X-BM-DTZ: -240 X-DeviceID: 01000A41090080B6 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAR9FZRdiJ3FsSv4wfUCFwarbffAjrahhuK1etGluHfybiYTx%2BZgsLyMm2vbzIdkafn4FUa5uR8YE1krHSZIRSjndgRMn7P5%2B3b6QE9VRQJ2fl0yOBigiL0eyvtj8ecNsMvdDlvgWBHs2NB5DJzkshzB0s8c8YhHPkh9v7Ux%2Bp3ynCHwEYfHlQbkfBCv2P1KLimwFcLdPDh9HfevK1ljE9ptJ/iAmFh7hsg07nnzYqFWZpfpMUCrmzTfrG7MI4s5LgvZVChuRGKzXeidaF/Ll8nb6bbZQZe5H%2BKFQCYc1WwFckVHvmtFhw%2BOpLKvYm4dnno3gMMomiV3j4VIHq3%2BAPBUDZgAACEPq%2B1xySyHvqAHmBtudV6OqkpjipQzddaHKyhiNTiroJZS6g5JXmmnnR/D8YwjI1HbZ%2BY2GewDLQAWcmccnMK%2BWT9Z5uLq0OFBH2UwE3jjIgUbd4mh0rD%2B%2BwjUhIchdWc/ubFBxMz6WV3HCubhGYE1N38lLaqYLhhVaaYUGp05KpCR5vMFpSwAsq%2BUStj1HBoy9ihqvKIrlC7TgiH1kj6XfEi7wA2QvM4IQmTwiFmFV/LVEhaBuBJW/mwx3xt9c6fEOypNS%2BSrl03K0rtRLvYwCbLUVqlNLGRnP/6HrFVepTJTXvHTwl0I8mpoBL6OtTaZ7hSbglRf8TeaN%2BMh8sHc6oadJTCcOuIpVcXYUJ1tQQBtHYr8H1VDtTSAGBpk0hTR9NDRXI3Tke2GHCa8jgZIYlwVyYiciMhGkVTNL8w3H59eIObHUtSI69luqhoTIKz1VXsWsR8Ns3wuMYTGpvuosZTuzJKGzyPM7lksJ/BgRRjzs9hThiWKFbP6Jfv9kDIXIaCyYsU6P6PGu/MRUZ2jQPCa3IRH4LO9Z6OnycceuqVKlHNr30xeWPSYvojfCzX3W1wE%3 [TRUNCATED] X-Agent-DeviceId: 01000A41090080B6 X-BM-CBT: 1720033411 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 X-Device-isOptin: false Accept-language: en-GB, en, en-US X-Device-Touch: false X-Device-ClientSession: 823A3482C0D940F7B4386E3AA6E49F3A X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI Host: www.bing.com Connection: Keep-Alive Cookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
2024-07-03 19:03:34 UTC	1148	IN	HTTP/1.1 200 OK Content-Length: 2215 Content-Type: application/json; charset=utf-8 Cache-Control: private X-EventID: 6685a08620984868b298863371e10187 X-AS-SetSessionMarket: de-ch UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Wed, 03 Jul 2024 19:03:34 GMT Connection: close Set-Cookie: _EDGE_S=SID=0F51ADBF52D46DF31AB6B90E53DA6CD0&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: ANON=A=84BEA1DAAAB85FA790252CDAFFFFFFFF; domain=.bing.com; expires=Mon, 28-Jul-2025 19:03:34 GMT; path=/; secure; SameSite=None Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/; secure; SameSite=None Set-Cookie: _SS=SID=0F51ADBF52D46DF31AB6B90E53DA6CD0; domain=.bing.com; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.05d01702.1720033414.25dc6daf
2024-07-03 19:03:34 UTC	2215	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65 Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.17	49767	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:03:40 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=BEMz9zVAXPzpGpb&MD=euPZlAu9 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-03 19:03:40 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: ac5848fc-a0ca-400e-83db-e22ae3b9689a MS-RequestId: 6e7e2e09-fa8c-4e8f-9152-45a69b695e4c MS-CV: R3pR7kynPk69M0+0.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 03 Jul 2024 19:03:39 GMT Connection: close Content-Length: 30005
2024-07-03 19:03:40 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-07-03 19:03:40 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Target ID:	0
Start time:	15:02:53
Start date:	03/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://cscslions-my.sharepoint.com/:o:/r/personal/townanna_cscslions_org/Documents/Notebooks/Incoming%20Secured%20Documents?d=w0d9de69417ec4658accc7b13d437f099&e=5%3ac065c2863fe74bbcbe226a07bdb64d8c&sharingv2=true&fromShare=true&at=9
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	15:02:54
Start date:	03/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1848,i,10240505638957547112,14902115120237314369,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://cscslions-my.sharepoint.com/:o:/r/personal/townanna_cscslions_org/Documents/Notebooks/Incoming%20Secured%20Documents?d=w0d9de69417ec4658accc7b13d437f099&e=5%3ac065c2863fe74bbcbe226a07bdb64d8c&sharingv2=true&fromShare=true&at=9

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 95

Windows Analysis Report
https://cscslions-my.sharepoint.com/:o:/r/personal/townanna_cscslions_org/Documents/Notebooks/Incoming%20Secured%20Documents?d=w0d9de69417ec4658accc7b13d437f099&e=5%3ac065c2863fe74bbcbe226a07bdb64d8c&sharingv2=true&fromShare=true&at=9