Edit tour

Windows Analysis Report
https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2Iz

Overview

General Information

Sample URL:	https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIy
Analysis ID:	1467843
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected non-DNS traffic on DNS port

HTML page contains hidden URLs or javascript code

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5948 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2148 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2224,i,9236425076649525401,17373768222617990273,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4524 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3d" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3d

HTTP Parser: Base64 decoded: )\.\d+))/.test(navigator.userAgent) || /[?&]env=TeamsWebView/.test(location.search) || /Teams\/((?:(\d+)\.)?(?:(\d+)\.)?(?:(\d+)\.\d+))(?:\/(\\d+))?/.test(navigator.userAgent) || window.name =...

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49737 version: TLS 1.2

Source: global traffic

TCP traffic: 192.168.2.5:49738 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103

Source: global traffic	HTTP traffic detected: GET /:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3d HTTP/1.1Host: rjnmail-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/1033/styles/corev15.css?rev=tMQyIYuqg6gA5d4OhqkBpg%3D%3DTAG70 HTTP/1.1Host: rjnmail-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG70 HTTP/1.1Host: rjnmail-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=m0jG364j4NGS2YAs366ZrZDboV4Z4bFzITp5H7GFyGl5jl65Lbpu-UrJGNYkJiyMKh_2o8DlLjj2JCb-mjtO9VW3kGmOPrqQt-uz2hmCl3mvyRBTYzSNC0LScv0k4JPTUCKJ93XWl7YzfH_wwkM9o132ph7t7ADI0-vM90YnialpRvumW-KQRu8tslYSpNAz0&t=74258c30 HTTP/1.1Host: rjnmail-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=sFKYt98rkOEepMD8HaYdQxw0MdI8XppwKu-u05zm-jrdxw_0lu_7y2XSfk2fjigBSMiXa-lE5A34AyUu4bGg1HoWgo42ZIBCrXE8VVmtBgVmQ72TbUOinfYqW44dx5TAwOn4gaZ14vXlYqMzaycjq_il_bbHsGdSivnjJD1G3gQv2-7SLslJ_DcgLBUXY2VD0&t=74258c30 HTTP/1.1Host: rjnmail-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=cJDku4LPR0hyEjv_M8Kns8-LnsNih-hW-uLOSr1zW1jQmNRW7lEiJ5sSjrYld8ki7UcxJbybV3H2_HmR_ribQxD8ZBjx1xRfOab_Fx2WmQs1&t=638533172441064469 HTTP/1.1Host: rjnmail-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1Host: rjnmail-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1Host: rjnmail-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=shRHyYyVrawGE2l&MD=B1B9KYW5 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=shRHyYyVrawGE2l&MD=B1B9KYW5 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: rjnmail-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: spo.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: chromecache_86.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.25019.12007/1033/initstrings.js
Source: chromecache_86.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.25019.12007/blank.js
Source: chromecache_86.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.25019.12007/init.js
Source: chromecache_86.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.25019.12007/theming.js
Source: chromecache_86.2.dr	String found in binary or memory: https://res.cdn.office.net/teams-js/2.21.0/js/MicrosoftTeams.min.js

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49737 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@16/33@8/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2224,i,9236425076649525401,17373768222617990273,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3d"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2224,i,9236425076649525401,17373768222617990273,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3d	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://rjnmail-my.sharepoint.com/_layouts/15/1033/styles/corev15.css?rev=tMQyIYuqg6gA5d4OhqkBpg%3D%3DTAG70	0%	Avira URL Cloud	safe
https://rjnmail-my.sharepoint.com/_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG70	0%	Avira URL Cloud	safe
https://rjnmail-my.sharepoint.com/WebResource.axd?d=cJDku4LPR0hyEjv_M8Kns8-LnsNih-hW-uLOSr1zW1jQmNRW7lEiJ5sSjrYld8ki7UcxJbybV3H2_HmR_ribQxD8ZBjx1xRfOab_Fx2WmQs1&t=638533172441064469	0%	Avira URL Cloud	safe
https://rjnmail-my.sharepoint.com/_layouts/15/images/favicon.ico?rev=47	0%	Avira URL Cloud	safe
https://rjnmail-my.sharepoint.com/ScriptResource.axd?d=m0jG364j4NGS2YAs366ZrZDboV4Z4bFzITp5H7GFyGl5jl65Lbpu-UrJGNYkJiyMKh_2o8DlLjj2JCb-mjtO9VW3kGmOPrqQt-uz2hmCl3mvyRBTYzSNC0LScv0k4JPTUCKJ93XWl7YzfH_wwkM9o132ph7t7ADI0-vM90YnialpRvumW-KQRu8tslYSpNAz0&t=74258c30	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
dual-spo-0005.spo-msedge.net	13.107.136.10	true	false	unknown
www.google.com	172.217.18.100	true	false	unknown
rjnmail-my.sharepoint.com	unknown	unknown	false	unknown
spo.nel.measure.office.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3d	false		unknown
https://rjnmail-my.sharepoint.com/_layouts/15/1033/styles/corev15.css?rev=tMQyIYuqg6gA5d4OhqkBpg%3D%3DTAG70	false	Avira URL Cloud: safe	unknown
https://rjnmail-my.sharepoint.com/WebResource.axd?d=cJDku4LPR0hyEjv_M8Kns8-LnsNih-hW-uLOSr1zW1jQmNRW7lEiJ5sSjrYld8ki7UcxJbybV3H2_HmR_ribQxD8ZBjx1xRfOab_Fx2WmQs1&t=638533172441064469	false	Avira URL Cloud: safe	unknown
https://rjnmail-my.sharepoint.com/_layouts/15/images/favicon.ico?rev=47	false	Avira URL Cloud: safe	unknown
https://rjnmail-my.sharepoint.com/ScriptResource.axd?d=m0jG364j4NGS2YAs366ZrZDboV4Z4bFzITp5H7GFyGl5jl65Lbpu-UrJGNYkJiyMKh_2o8DlLjj2JCb-mjtO9VW3kGmOPrqQt-uz2hmCl3mvyRBTYzSNC0LScv0k4JPTUCKJ93XWl7YzfH_wwkM9o132ph7t7ADI0-vM90YnialpRvumW-KQRu8tslYSpNAz0&t=74258c30	false	Avira URL Cloud: safe	unknown
https://rjnmail-my.sharepoint.com/_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG70	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.18.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467843
Start date and time:	2024-07-04 21:42:55 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3d
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@16/33@8/4

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.212.131, 142.250.110.84, 172.217.18.14, 34.104.35.123, 2.22.242.16, 2.22.242.64, 2.19.126.199, 2.19.126.200, 88.221.110.121, 192.229.221.95, 142.250.65.227
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, 201091-ipv4v6w.farm.dprodmgd108.sharepointonline.com.akadns.net, e40491.dscd.akamaiedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, res-1.cdn.office.net, a1894.dscb.akamai.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, nel.measure.office.net.edgesuite.net, update.googleapis.com, clients.l.google.com, res-1.cdn.office.net-c.edgekey.net, res-1.cdn.office.net-c.edgekey.net.globalredir.akadns.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3d

Input	Output
URL: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg Model: Perplexity: mixtral-8x7b-instruct	{"loginform": false,"urgency": false,"captcha": false,"reasons": ["The text 'Sorry, something went wrong' does not indicate a sense of urgency.","The text does not contain a login form, as it does not request sensitive information.","The text does not contain a CAPTCHA or any other anti-robot detection mechanism."]}
Title: Error OCR: Sorry, something went wrong Sorry: you cannot access this document. Please contact the person who shared it u,ith you. Techmcal Details Troubleshoot Issues with Microsoft SharePomt Foundation. Correlation ID 311739a1-ff39 OOOO-1ccS-3dOde28149tb Date and Time: 7 4/2024 PM Go back to site
URL: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg Model: Perplexity: mixtral-8x7b-instruct	{"loginform": false,"urgency": false,"captcha": false,"reasons": ["The text 'Sorry, something went wrong' does not indicate a login form on the webpage.","The text does not create a sense of urgency, as it does not encourage the user to take immediate action.","There is no mention of a CAPTCHA or any other anti-robot detection mechanism on the webpage."]}
Title: Error OCR: Sorry, something went wrong Sorry: you cannot access this document. Please contact the person who shared it u,ith you. echmcal Detail Troubleshoot Issues with Microsoft SharePomt Foundation. Correlation ID 311739a1-ff39 OOOO-1ccS-3dOde28149tb Date and Time: 7 4/2024 PM Go back to site

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jul 4 18:43:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9850428197802183
Encrypted:	false
SSDEEP:	48:8X3drcTLAkcHfidAKZdA19ehwiZUklqehekJy+3:8hcHPw/Yy
MD5:	124F80B1839954D3A4337F8839AE96F5
SHA1:	05172BF0EDC80A03F0B5D5EF2842758F902501E7
SHA-256:	D96D8C430D9B713A831DA2DAE66F9226DFB9C486A7E62221BD7C955626870B0B
SHA-512:	5C946C0DF1C4521FD4D24DFC53F62BB983360D910366BAD01C98AED9D2899F46AC05D559493457EB7F94F7019931642D091A449F107060616ADF6EF1FD7B772D
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....?=R\|J...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Xv.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xv.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Xv.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Xv............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Xx............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............`9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jul 4 18:43:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.0014989507519605
Encrypted:	false
SSDEEP:	48:8odrcTLAkcHfidAKZdA1weh/iZUkAQkqehvkJy+2:8ocHPK9Q0Yy
MD5:	0012A5C3197C9948FB424A2E8D1E20D3
SHA1:	6454404120455E45544531309E4BA78B69C08F73
SHA-256:	F6B9CF810CB03CB775EF9B087894031EB51FC49C0E2E087123E5779066C0AA78
SHA-512:	BE9E03E0BBB112EC880DF1687A8ECB489846CC1087024AA21B559EE73027C23C708E146BA13F077F203181B7070154CF5F4A3BB39ED7404756FCD7DA59CF06FC
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......C\|J...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Xv.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xv.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Xv.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Xv............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Xx............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............`9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.0091520323718965
Encrypted:	false
SSDEEP:	48:8xldrcTLAksHfidAKZdA14tseh7sFiZUkmgqeh7s9kJy+BX:8xzcHPinjYy
MD5:	B26C965C3F4B18A89C3772CC7AC3F529
SHA1:	B2D3FFBDBC804DE55511BE08388403DE2A577871
SHA-256:	38B0C5D0C979D3CA005E9D447033534FB247934C25B4B2007B0BFAA89FE135D9
SHA-512:	8C0BE5CF8EB438E67C2A142067C6A5D00BA089231BBAF99E42F98C892CCAEC3CFF9CF51A429D8C4C7DB9ABB3C2E5F5183CF1F21FC4C78990B16DA8E8B5991607
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Xv.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xv.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Xv.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Xv............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............`9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jul 4 18:43:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.999490973606819
Encrypted:	false
SSDEEP:	48:8GdrcTLAkcHfidAKZdA1vehDiZUkwqehLkJy+R:8acHPRlYy
MD5:	46C809F66E78EE5E19BCDDF1521F8453
SHA1:	26045EB03FE181540A59CC99ABBEB167FA3ABCD6
SHA-256:	81A43FAB79DD2867B8883C02B375BF34C60559A03034FDC37C93854B4C42D9DC
SHA-512:	64BC6DD1433C8274DB730743A63CBE37C8B3349B7459809FDF06A6A8D76ADD546A18EDEB62D65B94F8660654DA2E589CEF41E8F3647EC7B3EA32BFCB582BBE5F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....6.?\|J...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Xv.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xv.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Xv.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Xv............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Xx............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............`9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jul 4 18:43:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9891887618430495
Encrypted:	false
SSDEEP:	48:8WdrcTLAkcHfidAKZdA1hehBiZUk1W1qehRkJy+C:8KcHPx9xYy
MD5:	549D5CBF8C34475E4C15A4BC2BF1988B
SHA1:	73566D8BF86BC533E1C86FE4C77F94230A7084A7
SHA-256:	0E14EA232F2054E4222D512C5D223F342B923362A0B18CA1AE011A0322D29F6C
SHA-512:	774F7C617BCCE2D1624E339D631DC3180E520B59D3E4D898D1EB6BF58557105C745D85D804DFBE8F48AE3F3FD12A19A7A0FBFACF279F598B3BE6104FA21193DE
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....$.L\|J...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Xv.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xv.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Xv.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Xv............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Xx............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............`9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jul 4 18:43:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.0003999119181435
Encrypted:	false
SSDEEP:	48:8KdrcTLAkcHfidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbjkJy+yT+:8GcHPtT/TbxWOvTbjYy7T
MD5:	9AF2DE640EEDADA639AE96724B3BF52F
SHA1:	7827F84A4BCE925A8C66487141926C85927A6C94
SHA-256:	E8228B255FB3EC7B98975F0A03330BECBF182D069E230B591144F4DB884D54F7
SHA-512:	E31807D2C7A9A92129F67619E3625C517F72313C8E40DFAFAA1F080332183E32BA446879F37D62E438D585E09F1ABA9AD115F2F7A500AF8BCE96F96C2364A0C0
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......6\|J...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Xv.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xv.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Xv.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Xv............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Xx............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............`9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 40329
Category:	downloaded
Size (bytes):	9984
Entropy (8bit):	7.979200972475404
Encrypted:	false
SSDEEP:	192:/Z/x+yzJpYhEFmtHByePw0JwScHXWumyaxkomNwWs8pQegUOX+B/rHiG:/JP8hEFshyePw8cHXx58k3OWVpQegUO0
MD5:	027A7D52E1CEED8AEF7DC13505B81D36
SHA1:	33CF0BCE6A4C8B44B4A80B3116C978C12EE93FD0
SHA-256:	29061464FB6FCE2326B952EACAA95C3C6183BFEA74C3851390E9838720D372A6
SHA-512:	FCDDEBF6DE759B5079E7DF2432771A866DE1824B119AD8CB3BAE11F9FAA060B943D52F121E4C63E7E20D43F31B2220C1D4E9C24A20004C4B061CD1A0A5EE5AC9
Malicious:	false
Reputation:	low
URL:	https://rjnmail-my.sharepoint.com/ScriptResource.axd?d=sFKYt98rkOEepMD8HaYdQxw0MdI8XppwKu-u05zm-jrdxw_0lu_7y2XSfk2fjigBSMiXa-lE5A34AyUu4bGg1HoWgo42ZIBCrXE8VVmtBgVmQ72TbUOinfYqW44dx5TAwOn4gaZ14vXlYqMzaycjq_il_bbHsGdSivnjJD1G3gQv2-7SLslJ_DcgLBUXY2VD0&t=74258c30
Preview:	...........}ks.H......@a{ebU......h.^.._a..3!k...HB....m.%....?i..e..U@.........wefefefU........O.....?8).we:...?x..eQ.....EQ.:-.`p.e.^....b.W..X.........UQ.......,...4.jV~..tQ........`......Y..,.]........sR..E...M....\.c>H5.t......xW.jt.?6?.c(..`_....B.G..'.<.1.c....o...yZ..cZ.a=K+....l.l...EQ..4.=......L_..Z..4gYuQ\|._!]m1.`Q.uQ....)..=..\|.....2.8G."XY.......]c..\|xT....3@..?..Zm..E.'........2..E gy..<(.Z...8XY..4O2....U...4.0..5.W!}x._i.`.T,.V.G...b/.t..j>...<.((....,."Uo5X}.@QE.b.khU.h...>...Q~=.k.?.....o.0k........GM..X......P^G....=..<fY.U..S....K....H..9:......'...J=).O....#G[m...30k...j.2+.im.(Km3.uxv._.pT.4.>..f.-..UZ.=e...C....._5..xR.:..\U..jR. .....9A..1:1.......a..2...U......YTP..`...l0.9.t.}.'.p.c3q.. {m.,...G1..".L.Aj@.D.h.p......fZ{...eYB......1.Ep.b&..% .c.._i9.).,.eD.'...`.E.i..M3#+6...9+....B..NYB..%..8..?....zv.r..XP..W.../+..e.N........Z..i..... ....4I..iR...8+.>....k...N?....MA.....uU...&...Xyb..u..H....%.

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	294299
Entropy (8bit):	5.325494649328898
Encrypted:	false
SSDEEP:	1536:k6Bi397Ra/9FjWr5JwiaPyJmbu52JmKI1DS9sw83nm5ZMUuj24S+o0WmuGUmh4jN:Lvf42B9HecP
MD5:	C002BB0EB0C85B5C943E860D47D670E6
SHA1:	5CFB54603DF1D19741B53057948454EBD019BDDC
SHA-256:	763520E7504C16BD8816F508C3FC4309180A6F7FD0623CA2744818B6999B6974
SHA-512:	657093C5C74E4DF4229F318CE26F236EA57866511A82D97E29D4E3121E31C3A251A256E3A5001F061DA5608E09445E16DF876EEC3A1E19160CBE470B0C74B39A
Malicious:	false
Reputation:	low
URL:	https://rjnmail-my.sharepoint.com/_layouts/15/1033/styles/corev15.css?rev=tMQyIYuqg6gA5d4OhqkBpg%3D%3DTAG70
Preview:	/* _lcid="1033".._LocalBinding /..body,...ms-core-defaultFont,..#pageStatusBar,..#hybridTooltipStatusBar,...ms-status-msg,...js-callout-body..{../ [ReplaceFont(themeFont:"body")] / font-family:"Segoe UI","Segoe",Tahoma,Helvetica,Arial,sans-serif;..font-size:13px;..}..body,...ms-core-defaultFont,...js-callout-body..{../ [ReplaceColor(themeColor:"BodyText")] / color:#444;..}...ms-core-defaultFont..{..font-weight:normal;..text-decoration:none;..white-space:normal;..word-break:normal;..line-height:normal;..}..body..{..margin:0px;..overflow:hidden;../ [ReplaceColor(themeColor:"PageBackground")] / background-color:#fff;..background-size:cover;..background-repeat:no-repeat;..}..html > .ms-core-needIEFilter..{../ [ReplaceBGImage] / -ms-filter:"progid:DXImageTransform.Microsoft.AlphaImageLoader(src='about:blank',sizingMethod='scale');";..}...ms-backgroundImage..{../ [ReplaceBGImage] */ background-image:url();..}..#s4-ribbonrow..{..position:relative;..}..#s4-workspace..{..overflow:auto

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (456), with no line terminators
Category:	downloaded
Size (bytes):	456
Entropy (8bit):	5.229841670569642
Encrypted:	false
SSDEEP:	6:A+roDEH6IgMbIZc8Z11+cJF5IKMPAI0qKIKMPAI0qeCMRTxIj+01KyBui9YDre:A+MYcYkc8Z18cJ/ASAWCKx2+Wuit
MD5:	C00C5934432450DB1EB2A306922FDF4D
SHA1:	7A1BE0832268B1665D75593CF1AC1EB3F1097D75
SHA-256:	A742ACE9C468D77041CE881436B6C7F5B8D1E06C2ED00D0E38FFA834702D7C2E
SHA-512:	A8716400FB56174A049C895A71708FD0885F2A425FDD5168E391A17907F952A0FAF4D5539433F1A721DEBA05CAFF4125B4E5DD3802213759BBB634D9A0E8CFD8
Malicious:	false
Reputation:	low
URL:	https://res-1.cdn.office.net/bld/_layouts/15/16.0.25019.12007/blank.js
Preview:	function $_global_blank(){if("undefined"==typeof g_all_modules)g_all_modules={};g_all_modules["blank.js"]={version:{rmj:16,rmm:0,rup:25019,rpr:12007}};typeof spWriteProfilerMark=="function"&&spWriteProfilerMark("perfMarkBegin_blank.js");typeof spWriteProfilerMark=="function"&&spWriteProfilerMark("perfMarkEnd_blank.js")}function ULSaew(){var a={};a.ULSTeamName="Microsoft SharePoint Foundation";a.ULSFileName="blank.commentedjs";return a}$_global_blank();

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	622
Entropy (8bit):	5.030708856292114
Encrypted:	false
SSDEEP:	12:UXRtEohlWNmONv0MBR0/vUvFa9vN8ESve77Lxukm3auDjqHV:Ofa9n2H8qzxukmKuDjkV
MD5:	B45EDFC9FCDB690CCDA004A8483955E0
SHA1:	BAEDF73329EABB32504CAC640538EE3B6B31819F
SHA-256:	E817BF53005172205995AA07E0021BD8254A0204A1177E925F365E838C32D069
SHA-512:	E2709C77BA686FC58FE528EC2C2CEB6B9C84D045018D77FB9B376359F204FB6B889910B6748C978B4FF9712A7611342DF3C8C59711AA42090219DEC0C83778D2
Malicious:	false
Reputation:	low
URL:	https://rjnmail-my.sharepoint.com/_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG70
Preview:	/* _lcid="1033".._LocalBinding */..#ms-error-header..{..margin:118px 0px 16px;..min-height:50px;..}..#ms-error-gobackcont..{..margin-top:28px;..}..#ms-accessDenied-reqDialog..{..max-width:100%;..}..#ms-error-body..{..background-size:auto;..overflow:auto;..width:830px;..margin-right:auto;..margin-left:auto;..}...ms-error-returnLink..{..line-height:19px;..vertical-align:middle;..}...ms-error-detailsFold..{..padding-top:42px;..}...ms-error-techMsg..{..padding-top:28px;..}...ms-error-groupJoinPanel..{..margin-top:15px;..}...ms-error-groupProfileText..{..margin-top:17px;..}...ms-error-separator..{..margin:34px 0px;..}..

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (35238), with no line terminators
Category:	downloaded
Size (bytes):	35238
Entropy (8bit):	5.390650418562352
Encrypted:	false
SSDEEP:	768:PrxzCC2akwbs7lSZTprPaTrPyrfKwKTZiNOzpCk47S:hsp7ly9rP0S4pCkx
MD5:	C637DE6889D81964119BA1FD124E2454
SHA1:	5DB2B1681BE6FF9A7B26E269CD80D817D41A01BE
SHA-256:	18E8366C8C5590C3D056BA6CA9691B7471D6970EE00D0E22A4B68E517B54F087
SHA-512:	78288767F08DB38F6DC8C366546CECC05DF35C25BCD898B94DCCC5ECCB3ACD7807817BAF813BCA11F4CCAC169A980E4F10EBF4334000C4D2D0F74DCC30BB36EE
Malicious:	false
Reputation:	low
URL:	https://res-1.cdn.office.net/bld/_layouts/15/16.0.25019.12007/theming.js
Preview:	var Theming={__namespace:true};Theming_module_def();function Theming_module_def(){Theming.ApplyThemeToCss=tb;Theming.ReplaceCssTextForElement=J;Theming.ThemeInfo=E;Theming.ImageProcessor=R;Theming.Colors={Color:a,ColorApplication:x,HslColor:h};function cb(d,c,e){for(var b=true,a=0;a<c.length;a++)if(d.charCodeAt(e+a)!==c.charCodeAt(a)){b=false;break}return b}var c={text:0,comment:1,string:2,url:3,right_par:4,font_family:5,rgb:6,rgba:7,colon:8,semicolon:9,right_curly:10,color:11};function d(a,b){this.kind=a;this.text=b}function Db(b){var e,a,g,f,l="*/",u="url(",i=")",j="font-family",t="rgb(",s="rgba(",o="#",w=":",y=";",x="}",k=new d(c.text,"");if(!Boolean(b))b="";a=0;f=b.length;m.prototype={kind:0,text:"",getToken:function(){return null}};function m(){}var r={"/":{},"'":{},'"':{},"#":{},")":new d(c.right_par,")"),";":new d(c.semicolon,";"),":":new d(c.colon,":"),"}":new d(c.right_curly,"}"),u:{getToken:q},f:{getToken:n},r:{getToken:p}};function h(c){var a=b.indexOf(")",c);if(a<0)a=f;retu

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	511765
Entropy (8bit):	5.440740942962719
Encrypted:	false
SSDEEP:	12288:l3OkpWeupsTyhEQLQr4ABnIF7wEyAJU7/:l3OkpWeuGTyhEQLQr4ABnIdwEyAm
MD5:	4832BF4EE58A9C0023A855E80A5B424A
SHA1:	7C98E34B1A2AE96D2337467F843DD1524E458A70
SHA-256:	49173F537CADBE461A165497605DD15628D613C75C4D64A7BA0F6D1F4AE5E4EF
SHA-512:	2251AF81EB0EC4627B11A5E8B6509AA6194288DD780D72E33EFDB0B7137ADF3E4CD14B3DE3BE320B4CFA3C299BF3FDF32F96982ACB45D31BA7CB9963748B064C
Malicious:	false
Reputation:	low
URL:	https://res-1.cdn.office.net/bld/_layouts/15/16.0.25019.12007/core.js
Preview:	function $_global_core(){if("undefined"==typeof g_all_modules)g_all_modules={};g_all_modules["core.js"]={version:{rmj:16,rmm:0,rup:25019,rpr:12007}};typeof spWriteProfilerMark=="function"&&spWriteProfilerMark("perfMarkBegin_core.js");SPAnimation={};SPAnimation.g_Curves=new Array(7);SPAnimation.g_Curves[0]=new SPCurve(0,0,0,0,0,0);SPAnimation.g_Curves[1]=new SPCurve(1,1,0,0,0,0);SPAnimation.g_Curves[2]=new SPCurve(2,2,0,0,0,0);SPAnimation.g_Curves[3]=new SPCurve(3,3,.1,.9,.2,1);SPAnimation.g_Curves[4]=new SPCurve(4,3,.42,0,1,1);SPAnimation.g_Curves[5]=new SPCurve(5,3,0,0,.58,1);SPAnimation.g_Curves[6]=new SPCurve(6,3,.42,0,.58,1);SPKeyFrame.prototype={type:0,curveID:0,startTime:0,endTime:0,startValue:0,endValue:0,relativeTo:0,operationType:0};SPAnimation.Attribute={PositionX:1,PositionY:2,Height:3,Width:4,Opacity:5};SPAnimation.ID={Basic_Show:0,Basic_SlowShow:1,Basic_Fade:2,Basic_Move:3,Basic_Size:4,Content_SlideInFadeInRight:5,Content_SlideInFadeInRightInc:6,Content_SlideOutFadeOutRigh

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	dropped
Size (bytes):	7886
Entropy (8bit):	3.9482833105763633
Encrypted:	false
SSDEEP:	48:gubb4a2MNTgopLqyhFTv07EVc91JbV5FIXH0wp53O:Bbb4a5NTX1c9L6E
MD5:	0B60F3C9E4DA6E807E808DA7360F24F2
SHA1:	9AFC7ABB910DE855EFB426206E547574A1E074B7
SHA-256:	ADDEEDEEEF393B6B1BE5BBB099B656DCD797334FF972C495CCB09CFCB1A78341
SHA-512:	1328363987ABBAD1B927FC95F0A3D5646184EF69D66B42F32D1185EE06603AE1A574FAC64472FB6E349C2CE99F9B54407BA72B2908CA7AB01D023EC2F47E7E80
Malicious:	false
Reputation:	low
Preview:	...... .... .....6......... ............... .h...f...(... ...@..... ...........................................................................70..7...7...7...7...7...7...70..............................................................................................7`..7...7...7...7...7...7...7...7...7`......................................................................................7P..7...7...7...7...7...7...7...7...7...7...7P..............................................................................7...7...7...7...7...7...7...7...7...7...7...7...7...7...........................................................................7`..7...7...7...7...7...7...7...7...7...7...7...7...7`..........................................................................,...,...,...,...,...,...,.......7...7...7...7...7...7...........................................................................'...'...'...'...'...'...'...'...2...7...7...7...7...,....................`..........................

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 102804
Category:	downloaded
Size (bytes):	25609
Entropy (8bit):	7.992070293592458
Encrypted:	true
SSDEEP:	768:65FO8CctusRS+4iLLuVC9Vri5MLPMTleAD5:8FbxwsR/4iAz5MbMl5
MD5:	B62553925BD98826C60457D2EB6B9A46
SHA1:	84DBBB6D9B36A587C21B5A56B1D9E587E33BA943
SHA-256:	C58166FE4DF4BA8F25A960C21451EAF841D97F6F552F104E43431C9DB1C2E2CC
SHA-512:	7B6872144AE308224FF671A1EC63F040A40115888790CF6834AD85D517471CE5DAD3EC297EE751FB196B55118A181017151F7F06FCE0F2F26FF94E8EEC070033
Malicious:	false
Reputation:	low
URL:	https://rjnmail-my.sharepoint.com/ScriptResource.axd?d=m0jG364j4NGS2YAs366ZrZDboV4Z4bFzITp5H7GFyGl5jl65Lbpu-UrJGNYkJiyMKh_2o8DlLjj2JCb-mjtO9VW3kGmOPrqQt-uz2hmCl3mvyRBTYzSNC0LScv0k4JPTUCKJ93XWl7YzfH_wwkM9o132ph7t7ADI0-vM90YnialpRvumW-KQRu8tslYSpNAz0&t=74258c30
Preview:	............r.I.(.>f..d..B6. )U/.(....mGRuw.... I..B..X...<.O..p}.=#.P.>s.Y...D,..........................'.......;.'..2.Uu5.C..%..v.M&;T...u1.T.=...m....'_z.......4.&?~.__....".db00..IR..\|.(tj6+.y.$.L.$..."..FIx3+..tG%.7...N.'..........A9....9;.O...j...Y\|8.........LW........h&.%WW...\|\.Q..Tr....$\..?-&....}O...w..$R}....W.k.+.._..q...P..dR......`^.j]0.L..9......)...."...I....,.K..j...`1.a9-.`..-p..O..t...\|Bo..Uu.~.t...uB9S.J.o..Fe<.....A.SM.....d>.].HO..Qx...ao....a.J..h6K..q7.N.n'..Ga78....v..n...>..0.I.X?...$=...x..H..&.V.+.h..GyTJ....AT...x.Jl...X..t.H4...$9..^u....r9rq3.._..a...^I.{{.Ch....@.l.....@..BW.[..8~6.U3].I#....8....H`...4..I..6...I...Q1...W^]>...P.KJ.L......A...>.@hf.M...RP..)m.F...Wp{.!.R.".j.....!soO..]k...a."eo.S,...G\|n.\|!F[..O../.aR...$.\..4.N.-p1..}...2...r\a[`e.E..{H..?.....J.ak.Y...P......DP.d.?...<..Y.8....%d...@..e.....exc..g...b.....<z....7*8!...n..wG0.C..f..Y5....qE..p....2.rH-..r.S........q..R.$Q^q....!....

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (23437), with CRLF line terminators
Category:	downloaded
Size (bytes):	23594
Entropy (8bit):	5.107347306409284
Encrypted:	false
SSDEEP:	384:zyWvVsT5pTtxJOyNm7lMqasjI8LWv3n8wyM:zJsT5pTt7kK+M
MD5:	964FCB2BAF87049DC68975291AE89431
SHA1:	D0CD8C989D44BC531472B632868D3FB2DE4B3184
SHA-256:	B8F7BD568E379502CF0C00027581D2761C7DC14B166F5D25FC048A0B56B7BFBB
SHA-512:	03CB58D197A776F9C315C2A14B9C034D88C7B7E9F4247C5698396F4FE7363A22FC2042A24C02A245C7E035DD2862F88E8EF46A7E5A269EDC2B69E39752A52987
Malicious:	false
Reputation:	low
URL:	https://res-1.cdn.office.net/bld/_layouts/15/16.0.25019.12007/1033/initstrings.js
Preview:	var Strings; if (Strings === undefined) { Strings=new Object(); }Strings.STS=function(){};Strings.STS.L_NewTab="New tab";Strings.STS.L_CalloutLastEditedNameAndDate="Changed by ^1 on ^2";Strings.STS.L_CalloutSourceUrlHeader="Location";Strings.STS.L_SPDiscBestUndo="Remove best reply";Strings.STS.L_SPClientManage="manage";Strings.STS.L_SPAddNewWiki="new Wiki page";Strings.STS.L_SPCategorySortRecent="Recent";Strings.STS.L_ViewSelectorTitle="Change View";Strings.STS.L_SPDiscNumberOfLikes="{0} likes\|\|{0} like\|\|{0} likes";Strings.STS.L_Timeline_DfltViewName="Timeline";Strings.STS.L_TimelineToday="Today";Strings.STS.L_SPDiscNoPreviewAvailable="No preview available for this reply";Strings.STS.L_NODOCView="There are no documents in this view.";Strings.STS.L_SPBlogPostAuthorCategories="by {0} in {1}";Strings.STS.L_SPBlogsNoItemsInCategory="There are no posts in this category.";Strings.STS.L_QRCodeDescription="Scan this QR code with your phone or tablet to open {0}";Strings.STS.L_RelativeDateTime

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	downloaded
Size (bytes):	7886
Entropy (8bit):	3.9482833105763633
Encrypted:	false
SSDEEP:	48:gubb4a2MNTgopLqyhFTv07EVc91JbV5FIXH0wp53O:Bbb4a5NTX1c9L6E
MD5:	0B60F3C9E4DA6E807E808DA7360F24F2
SHA1:	9AFC7ABB910DE855EFB426206E547574A1E074B7
SHA-256:	ADDEEDEEEF393B6B1BE5BBB099B656DCD797334FF972C495CCB09CFCB1A78341
SHA-512:	1328363987ABBAD1B927FC95F0A3D5646184EF69D66B42F32D1185EE06603AE1A574FAC64472FB6E349C2CE99F9B54407BA72B2908CA7AB01D023EC2F47E7E80
Malicious:	false
Reputation:	low
URL:	https://rjnmail-my.sharepoint.com/_layouts/15/images/favicon.ico?rev=47
Preview:	...... .... .....6......... ............... .h...f...(... ...@..... ...........................................................................70..7...7...7...7...7...7...70..............................................................................................7`..7...7...7...7...7...7...7...7...7`......................................................................................7P..7...7...7...7...7...7...7...7...7...7...7P..............................................................................7...7...7...7...7...7...7...7...7...7...7...7...7...7...........................................................................7`..7...7...7...7...7...7...7...7...7...7...7...7...7`..........................................................................,...,...,...,...,...,...,.......7...7...7...7...7...7...........................................................................'...'...'...'...'...'...'...'...2...7...7...7...7...,....................`..........................

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (64259), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	227571
Entropy (8bit):	5.005677946181372
Encrypted:	false
SSDEEP:	6144:aVF2h8ouk20jU7fD2aZ8uemAm1YqnhmsFVsvz1oBdOA3NnWzNhrYFiS:Q3/k2qU7fD2aZ8uIRp+CS
MD5:	8E0F868C45B6A53ACBAB5731F0CE41E3
SHA1:	6B224EC173092B895CFD44EA565C7F1042C3840B
SHA-256:	4A735B70735E9B4DBC961D164261F653BCEDDB225ECC0236F6824D83B8B15E8D
SHA-512:	CFAF2287D1FEB5A97062C765DD16ADE3AEF6848832EEF12DCE1A3C825B94BF620D0CD2F857132906D066332E0271DC6F06C4C675B1431F9458A7CA1A7F2A61BA
Malicious:	false
Reputation:	low
URL:	https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3d
Preview:	..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN".."http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns:o="urn:schemas-microsoft-com:office:office" lang="en-us" dir="ltr">..<head><meta name="GENERATOR" content="Microsoft SharePoint" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta http-equiv="Expires" content="0" /><meta http-equiv="X-UA-Compatible" content="IE=8"/><meta name="ROBOTS" content="NOHTMLINDEX" /><title>......Error....</title><link id="CssLink-7ec17127ed2242d9b486a8abd2b7a88f" rel="stylesheet" type="text/css" href="/_layouts/15/1033/styles/corev15.css?rev=tMQyIYuqg6gA5d4OhqkBpg%3D%3DTAG70"/>.<link id="CssLink-db9a8a1f567f426b9904927cf1ee2ed3" rel="stylesheet" type="text/css" href="/_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG70"/>.<style id="SPThemeHideForms" type="text/css">body {opacity:0 !important}</style><script type="text/javascript">// <![CDATA[ ...var _initGlobalSnapShot = {};try { if (Obj

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	186722
Entropy (8bit):	5.127936869447186
Encrypted:	false
SSDEEP:	1536:qofu83Pw6jz1+8YZwf7BN6pJsnNxezT8+zacaS8Ob4C//aT5L4DK:883z5+nMDEuvezT8++6kZCe
MD5:	2DE2482829622DE740DB42E04CBCD047
SHA1:	2A88D65A01BDA232B97B24163F66BA7F90A63386
SHA-256:	947D9E7117E8528021EC98FBBD6FE75A4D393A699DFFFFB3A2803EAE42845CEB
SHA-512:	35A2B88CF1FD1505BAD30CF68FB235ED5E5029D4824EC8586452A53E820563229AEA06156B46702C5046DC4BCE0046DFC74E934E215BFDD040B2715D298E8886
Malicious:	false
Reputation:	low
URL:	https://res-1.cdn.office.net/bld/_layouts/15/16.0.25019.12007/1033/strings.js
Preview:	var Strings; if (Strings === undefined) { Strings=new Object(); }Strings.CMS=function(){};Strings.CMS.L_SelectAllAltKey_TEXT="false";Strings.CMS.L_SpellCheckKey_VALUE="0x76";Strings.CMS.L_Callout_Usage_Count="<p>{0}</p>view\|\|<p>{0}</p>views";Strings.CMS.L_NoElementStylesWereRemoved_TEXT="The selection did not contain any instances of element styles to remove.";Strings.CMS.L_DecWidthAltKey_TEXT="false";Strings.CMS.L_ExpandedTagNameH4="Heading 4";Strings.CMS.L_DecWidthShiftKey_TEXT="true";Strings.CMS.L_EditImageRenditionsAction="Edit Renditions";Strings.CMS.L_TabBackKey_TEXT="N";Strings.CMS.L_SvrBusySpellchecker_TEXT="The spell checking server was busy";Strings.CMS.L_RemoveLinkShiftKey_TEXT="false";Strings.CMS.L_Show_TEXT="Show";Strings.CMS.L_Title_TEXT="Title:";Strings.CMS.L_ShowSpecific_TEXT="Show the selected item in navigation";Strings.CMS.L_DecHeightShiftKey_TEXT="true";Strings.CMS.L_ChangeColumnWidthAndRowHeightKey_TEXT="W";Strings.CMS.L_UnlinkToolTip_TEXT="Remove Hyperlink";Strin

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	23063
Entropy (8bit):	4.7535440881548165
Encrypted:	false
SSDEEP:	384:GvUzYI+Vi4g1V5it1ONhA6w+Kv8i/4CYzLKL4DrLU0iTxZTAzIzrwDlTWMClQip9:bkON69kClQq8hDRJHp2tWU25Zt/gREVG
MD5:	90EA7274F19755002360945D54C2A0D7
SHA1:	647B5D8BF7D119A2C97895363A07A0C6EB8CD284
SHA-256:	40732E9DCFA704CF615E4691BB07AECFD1CC5E063220A46E4A7FF6560C77F5DB
SHA-512:	7474667800FF52A0031029CC338F81E1586F237EB07A49183008C8EC44A8F67B37E5E896573F089A50283DF96A1C8F185E53D667741331B647894532669E2C07
Malicious:	false
Reputation:	low
URL:	https://rjnmail-my.sharepoint.com/WebResource.axd?d=cJDku4LPR0hyEjv_M8Kns8-LnsNih-hW-uLOSr1zW1jQmNRW7lEiJ5sSjrYld8ki7UcxJbybV3H2_HmR_ribQxD8ZBjx1xRfOab_Fx2WmQs1&t=638533172441064469
Preview:	function WebForm_PostBackOptions(eventTarget, eventArgument, validation, validationGroup, actionUrl, trackFocus, clientSubmit) {.. this.eventTarget = eventTarget;.. this.eventArgument = eventArgument;.. this.validation = validation;.. this.validationGroup = validationGroup;.. this.actionUrl = actionUrl;.. this.trackFocus = trackFocus;.. this.clientSubmit = clientSubmit;..}..function WebForm_DoPostBackWithOptions(options) {.. var validationResult = true;.. if (options.validation) {.. if (typeof(Page_ClientValidate) == 'function') {.. validationResult = Page_ClientValidate(options.validationGroup);.. }.. }.. if (validationResult) {.. if ((typeof(options.actionUrl) != "undefined") && (options.actionUrl != null) && (options.actionUrl.length > 0)) {.. theForm.action = options.actionUrl;.. }.. if (options.trackFocus) {.. var lastFocus = theForm.elements["__LASTFOCUS"];.. if ((typeo

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	340993
Entropy (8bit):	5.442857712532807
Encrypted:	false
SSDEEP:	6144:iXVJjsUJaW86hPIjcfb+47IunpizIcxdS+MI4Ny6qF+HNJdWLWnAboc3lexR1Yh5:iXVJjsUPV0ugzIE
MD5:	1CFE669C56C16B6E05ECE68B579BECF0
SHA1:	43E0986C77CC738D318DECDFCEA3BA3C7E86DA0E
SHA-256:	DD19BB9BE9A5959BC1BD732EFABBCC88B5A07782513851B6EC86962A6F237F27
SHA-512:	F41681D88AFC0FA6A2B5744BAAF1BB2F14FCBD6684F421DD021BE303F3E5D35835F8FD95EA90163D745065D8692DCDA2C9E8178458488D0DEDBDA943D358B1DB
Malicious:	false
Reputation:	low
URL:	https://res-1.cdn.office.net/bld/_layouts/15/16.0.25019.12007/init.js
Preview:	function $_global_init(){if("undefined"==typeof g_all_modules)g_all_modules={};g_all_modules["init.js"]={version:{rmj:16,rmm:0,rup:25019,rpr:12007}};if(-1!=navigator.userAgent.indexOf("ProfilerMark")&&"function"==typeof msWriteProfilerMark)spWriteProfilerMark=function(a){window.msWriteProfilerMark(a)};typeof spWriteProfilerMark=="function"&&spWriteProfilerMark("perfMarkBegin_init.js");if(typeof OffSwitch=="undefined"){OffSwitch={__namespace:true};OffSwitch_module_def()}if(typeof RuntimeErrors=="undefined"){RuntimeErrors={__namespace:true};RuntimeErrors_module_def()}if(typeof Verify=="undefined"){Verify={__namespace:true};Verify_module_def()}if(typeof Define=="undefined"){Define={__namespace:true};Define_module_def()}if(typeof BrowserDetection=="undefined"){BrowserDetection={__namespace:true};BrowserDetection_module_def()}(function(){b.prototype={firefox:undefined,firefox36up:undefined,firefox3up:undefined,firefox4up:undefined,ie:undefined,ie55up:undefined,ie5up:undefined,ie7down:undefi

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 4, 2024 21:43:41.338597059 CEST	49674	443	192.168.2.5	23.1.237.91
Jul 4, 2024 21:43:41.338607073 CEST	49675	443	192.168.2.5	23.1.237.91
Jul 4, 2024 21:43:41.432385921 CEST	49673	443	192.168.2.5	23.1.237.91
Jul 4, 2024 21:43:46.958168983 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:46.958210945 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:46.958292007 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:46.958538055 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:46.958545923 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:46.958606005 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:46.958751917 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:46.958767891 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:46.958976984 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:46.958991051 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:47.548857927 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:47.549139023 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:47.549181938 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:47.550182104 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:47.550247908 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:47.551307917 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:47.551389933 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:47.551544905 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:47.551554918 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:47.555502892 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:47.555687904 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:47.555696964 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:47.556658030 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:47.556716919 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:47.557166100 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:47.557214975 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:47.594407082 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:47.609724045 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:47.609733105 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:47.657064915 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:47.993330956 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:47.993362904 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:47.993506908 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:47.993551016 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:47.993601084 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:47.994350910 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:47.994362116 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:47.994471073 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:47.994482040 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:47.994514942 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:47.994566917 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:47.994575024 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:47.994610071 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.008804083 CEST	49712	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.008856058 CEST	443	49712	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.008924007 CEST	49712	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.008997917 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.009216070 CEST	49712	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.009238005 CEST	443	49712	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.056509972 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.083018064 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.083141088 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.083172083 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.083425045 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.083498001 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.083508968 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.084424973 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.084491968 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.084501028 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.085320950 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.085381985 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.085391045 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.138753891 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.168751955 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.168775082 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.168874979 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.168910980 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.168956995 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.169857025 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.169866085 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.169898987 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.169912100 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.169934034 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.169977903 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.169984102 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.172647953 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.172660112 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.172751904 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.172775030 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.173091888 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.173126936 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.173156023 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.173171997 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.173183918 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.174164057 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.174237967 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.174256086 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.174292088 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.174341917 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.174350977 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.174860954 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.174916029 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.174926996 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.175018072 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.175062895 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.175076008 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.175626040 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.175683975 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.175694942 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.177560091 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.177634954 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.177659035 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.181600094 CEST	49713	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.181637049 CEST	443	49713	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.181718111 CEST	49713	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.182015896 CEST	49713	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.182028055 CEST	443	49713	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.196288109 CEST	49718	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.196331978 CEST	443	49718	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.196394920 CEST	49718	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.197117090 CEST	49718	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.197144985 CEST	443	49718	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.197509050 CEST	49719	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.197525978 CEST	443	49719	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.197582960 CEST	49719	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.197768927 CEST	49719	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.197777987 CEST	443	49719	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.215413094 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.231471062 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.262557983 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.262567997 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.262650967 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.262691021 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.262706041 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.262713909 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.262753963 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.262763023 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.262979031 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.263014078 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.263041019 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.263048887 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.263078928 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.263200998 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.263211012 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.263240099 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.263257027 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.263286114 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.263427973 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.263480902 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.263489008 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.264043093 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.264059067 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.264096975 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.264106989 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.264133930 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.264807940 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.264815092 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.264858961 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.264893055 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.264899015 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.265304089 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.265357971 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.265367985 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.266017914 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.266074896 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.266102076 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.267527103 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.267545938 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.267585039 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.267606974 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.267620087 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.268007040 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.268022060 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.268060923 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.268071890 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.268086910 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.268598080 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.268626928 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.268671036 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.268680096 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.268697977 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.268979073 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.268994093 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.269041061 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.269052029 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.269084930 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.269102097 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.269165993 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.269210100 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.269295931 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.269321918 CEST	443	49710	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.269332886 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.269362926 CEST	49710	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.307265043 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.357811928 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.357822895 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.357918978 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.357949972 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.358287096 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.358319998 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.358340025 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.358346939 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.358369112 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.358777046 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.358827114 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.358834982 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.359078884 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.359131098 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.359143019 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.360243082 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.360325098 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.360338926 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.360502958 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.360548973 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.360557079 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.361248016 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.361310959 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.361325026 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.362114906 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.362173080 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.362185001 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.417256117 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.452209949 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.452227116 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.452316999 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.452353001 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.452647924 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.452680111 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.452698946 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.452704906 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.452724934 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.453033924 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.453088045 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.453095913 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.453789949 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.453846931 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.453859091 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.454767942 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.454782009 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.454833031 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.454850912 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.454863071 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.455930948 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.455954075 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.456024885 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.456037045 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.457439899 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.457456112 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.457513094 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.457525969 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.457546949 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.458471060 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.458489895 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.458529949 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.458537102 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.458573103 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.459603071 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.459616899 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.459678888 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.459691048 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.511112928 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.546897888 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.546916962 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.546998978 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.547034025 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.547076941 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.547214985 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.547230005 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.547283888 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.547291994 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.547313929 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.547336102 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.547790051 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.547811985 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.547858953 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.547866106 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.547883987 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.547907114 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.548541069 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.548558950 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.548607111 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.548615932 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.548645020 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.548666000 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.550029039 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.550086021 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.550128937 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.555634022 CEST	49709	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.555655003 CEST	443	49709	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.620270014 CEST	443	49712	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.624805927 CEST	49712	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.624846935 CEST	443	49712	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.625206947 CEST	443	49712	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.625858068 CEST	49712	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.625932932 CEST	443	49712	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.626466036 CEST	49712	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.672503948 CEST	443	49712	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.763392925 CEST	443	49713	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.768784046 CEST	443	49719	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.795422077 CEST	443	49718	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.804935932 CEST	49713	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.814424992 CEST	443	49712	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.814496040 CEST	443	49712	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.814548969 CEST	49712	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.824021101 CEST	49719	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.855287075 CEST	49718	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.988943100 CEST	49719	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.988955021 CEST	443	49719	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.989168882 CEST	49713	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.989177942 CEST	443	49713	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.989579916 CEST	443	49713	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.989978075 CEST	49718	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.989983082 CEST	443	49718	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.990082979 CEST	443	49719	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.990094900 CEST	443	49719	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.990138054 CEST	49719	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.991076946 CEST	443	49718	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.991089106 CEST	443	49718	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.991134882 CEST	49718	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.992680073 CEST	49713	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.992742062 CEST	443	49713	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.997211933 CEST	49719	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.997461081 CEST	443	49719	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:48.999747038 CEST	49718	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:48.999842882 CEST	443	49718	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.004730940 CEST	49713	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.004878998 CEST	49719	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.004884958 CEST	443	49719	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.005254984 CEST	49718	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.005261898 CEST	443	49718	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.045294046 CEST	49718	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.045335054 CEST	49719	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.048127890 CEST	49712	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.048155069 CEST	443	49712	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.048507929 CEST	443	49713	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.129895926 CEST	443	49718	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.129920959 CEST	443	49718	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.129967928 CEST	49718	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.129983902 CEST	443	49718	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.130022049 CEST	49718	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.130436897 CEST	443	49718	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.130446911 CEST	443	49718	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.130467892 CEST	443	49718	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.130481005 CEST	49718	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.130513906 CEST	49718	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.131994009 CEST	443	49719	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.132018089 CEST	443	49719	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.132047892 CEST	49719	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.132061005 CEST	443	49719	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.132791042 CEST	443	49719	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.132800102 CEST	443	49719	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.132838964 CEST	443	49719	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.132848978 CEST	49719	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.132858992 CEST	443	49719	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.132879972 CEST	49719	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.132896900 CEST	443	49719	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.132937908 CEST	49719	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.133764029 CEST	443	49713	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.133789062 CEST	443	49713	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.133836031 CEST	49713	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.133845091 CEST	443	49713	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.133899927 CEST	49713	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.135690928 CEST	443	49713	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.135699987 CEST	443	49713	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.135741949 CEST	49713	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.135771990 CEST	49713	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.135776997 CEST	443	49713	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.135844946 CEST	443	49713	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.135848045 CEST	443	49718	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.135880947 CEST	49713	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.135886908 CEST	443	49713	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.135914087 CEST	49718	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.135943890 CEST	49713	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.155451059 CEST	49719	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.155462980 CEST	443	49719	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.221082926 CEST	443	49718	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.221092939 CEST	443	49718	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.221155882 CEST	49718	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.221311092 CEST	443	49718	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.221364021 CEST	443	49718	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.221405983 CEST	49718	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.223882914 CEST	443	49713	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.223923922 CEST	443	49713	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.223943949 CEST	49713	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.223953962 CEST	443	49713	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.224004984 CEST	49713	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.224009991 CEST	443	49713	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.224026918 CEST	443	49713	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.224064112 CEST	49713	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.226435900 CEST	49718	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.226454020 CEST	443	49718	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:49.234405994 CEST	49713	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:49.234415054 CEST	443	49713	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:50.170974970 CEST	49724	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:50.170989990 CEST	443	49724	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:50.171328068 CEST	49724	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:50.173388004 CEST	49724	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:50.173404932 CEST	443	49724	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:50.175812960 CEST	49725	443	192.168.2.5	172.217.18.100
Jul 4, 2024 21:43:50.175843954 CEST	443	49725	172.217.18.100	192.168.2.5
Jul 4, 2024 21:43:50.175967932 CEST	49725	443	192.168.2.5	172.217.18.100
Jul 4, 2024 21:43:50.176497936 CEST	49725	443	192.168.2.5	172.217.18.100
Jul 4, 2024 21:43:50.176508904 CEST	443	49725	172.217.18.100	192.168.2.5
Jul 4, 2024 21:43:50.497844934 CEST	49726	443	192.168.2.5	184.28.90.27
Jul 4, 2024 21:43:50.497893095 CEST	443	49726	184.28.90.27	192.168.2.5
Jul 4, 2024 21:43:50.498070955 CEST	49726	443	192.168.2.5	184.28.90.27
Jul 4, 2024 21:43:50.503182888 CEST	49726	443	192.168.2.5	184.28.90.27
Jul 4, 2024 21:43:50.503195047 CEST	443	49726	184.28.90.27	192.168.2.5
Jul 4, 2024 21:43:50.777529955 CEST	443	49724	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:50.778125048 CEST	49724	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:50.778177023 CEST	443	49724	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:50.778517008 CEST	443	49724	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:50.779194117 CEST	49724	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:50.779257059 CEST	443	49724	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:50.779680014 CEST	49724	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:50.824507952 CEST	443	49724	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:50.852422953 CEST	443	49725	172.217.18.100	192.168.2.5
Jul 4, 2024 21:43:50.865823984 CEST	49725	443	192.168.2.5	172.217.18.100
Jul 4, 2024 21:43:50.865845919 CEST	443	49725	172.217.18.100	192.168.2.5
Jul 4, 2024 21:43:50.866945028 CEST	443	49725	172.217.18.100	192.168.2.5
Jul 4, 2024 21:43:50.867012024 CEST	49725	443	192.168.2.5	172.217.18.100
Jul 4, 2024 21:43:50.869750977 CEST	49725	443	192.168.2.5	172.217.18.100
Jul 4, 2024 21:43:50.869815111 CEST	443	49725	172.217.18.100	192.168.2.5
Jul 4, 2024 21:43:50.908777952 CEST	443	49724	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:50.909477949 CEST	443	49724	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:50.909539938 CEST	49724	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:50.909552097 CEST	443	49724	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:50.909652948 CEST	443	49724	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:50.909698009 CEST	49724	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:50.915867090 CEST	49725	443	192.168.2.5	172.217.18.100
Jul 4, 2024 21:43:50.915878057 CEST	443	49725	172.217.18.100	192.168.2.5
Jul 4, 2024 21:43:50.944379091 CEST	49724	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:50.944406986 CEST	443	49724	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:50.947123051 CEST	49674	443	192.168.2.5	23.1.237.91
Jul 4, 2024 21:43:50.947125912 CEST	49675	443	192.168.2.5	23.1.237.91
Jul 4, 2024 21:43:50.962754011 CEST	49725	443	192.168.2.5	172.217.18.100
Jul 4, 2024 21:43:51.040883064 CEST	49673	443	192.168.2.5	23.1.237.91
Jul 4, 2024 21:43:51.160096884 CEST	443	49726	184.28.90.27	192.168.2.5
Jul 4, 2024 21:43:51.160248995 CEST	49726	443	192.168.2.5	184.28.90.27
Jul 4, 2024 21:43:51.243279934 CEST	49726	443	192.168.2.5	184.28.90.27
Jul 4, 2024 21:43:51.243302107 CEST	443	49726	184.28.90.27	192.168.2.5
Jul 4, 2024 21:43:51.243578911 CEST	443	49726	184.28.90.27	192.168.2.5
Jul 4, 2024 21:43:51.292303085 CEST	49726	443	192.168.2.5	184.28.90.27
Jul 4, 2024 21:43:51.413619041 CEST	49726	443	192.168.2.5	184.28.90.27
Jul 4, 2024 21:43:51.460505962 CEST	443	49726	184.28.90.27	192.168.2.5
Jul 4, 2024 21:43:51.601809025 CEST	443	49726	184.28.90.27	192.168.2.5
Jul 4, 2024 21:43:51.601866007 CEST	443	49726	184.28.90.27	192.168.2.5
Jul 4, 2024 21:43:51.601922989 CEST	49726	443	192.168.2.5	184.28.90.27
Jul 4, 2024 21:43:51.602122068 CEST	49726	443	192.168.2.5	184.28.90.27
Jul 4, 2024 21:43:51.602134943 CEST	443	49726	184.28.90.27	192.168.2.5
Jul 4, 2024 21:43:51.602144957 CEST	49726	443	192.168.2.5	184.28.90.27
Jul 4, 2024 21:43:51.602150917 CEST	443	49726	184.28.90.27	192.168.2.5
Jul 4, 2024 21:43:51.646176100 CEST	49727	443	192.168.2.5	184.28.90.27
Jul 4, 2024 21:43:51.646234989 CEST	443	49727	184.28.90.27	192.168.2.5
Jul 4, 2024 21:43:51.646302938 CEST	49727	443	192.168.2.5	184.28.90.27
Jul 4, 2024 21:43:51.646940947 CEST	49727	443	192.168.2.5	184.28.90.27
Jul 4, 2024 21:43:51.646960020 CEST	443	49727	184.28.90.27	192.168.2.5
Jul 4, 2024 21:43:52.174561977 CEST	49729	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:52.174580097 CEST	443	49729	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:52.174674034 CEST	49729	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:52.175270081 CEST	49729	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:52.175280094 CEST	443	49729	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:52.298130989 CEST	443	49727	184.28.90.27	192.168.2.5
Jul 4, 2024 21:43:52.298343897 CEST	49727	443	192.168.2.5	184.28.90.27
Jul 4, 2024 21:43:52.315229893 CEST	49727	443	192.168.2.5	184.28.90.27
Jul 4, 2024 21:43:52.315273046 CEST	443	49727	184.28.90.27	192.168.2.5
Jul 4, 2024 21:43:52.315527916 CEST	443	49727	184.28.90.27	192.168.2.5
Jul 4, 2024 21:43:52.317688942 CEST	49727	443	192.168.2.5	184.28.90.27
Jul 4, 2024 21:43:52.364515066 CEST	443	49727	184.28.90.27	192.168.2.5
Jul 4, 2024 21:43:52.577996969 CEST	443	49727	184.28.90.27	192.168.2.5
Jul 4, 2024 21:43:52.578056097 CEST	443	49727	184.28.90.27	192.168.2.5
Jul 4, 2024 21:43:52.579448938 CEST	49727	443	192.168.2.5	184.28.90.27
Jul 4, 2024 21:43:52.579646111 CEST	49727	443	192.168.2.5	184.28.90.27
Jul 4, 2024 21:43:52.579689026 CEST	443	49727	184.28.90.27	192.168.2.5
Jul 4, 2024 21:43:52.579715967 CEST	49727	443	192.168.2.5	184.28.90.27
Jul 4, 2024 21:43:52.579725027 CEST	443	49727	184.28.90.27	192.168.2.5
Jul 4, 2024 21:43:52.702261925 CEST	443	49703	23.1.237.91	192.168.2.5
Jul 4, 2024 21:43:52.702349901 CEST	49703	443	192.168.2.5	23.1.237.91
Jul 4, 2024 21:43:52.750190973 CEST	443	49729	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:52.750741959 CEST	49729	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:52.750766993 CEST	443	49729	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:52.751647949 CEST	443	49729	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:52.751705885 CEST	49729	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:52.752348900 CEST	49729	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:52.752408028 CEST	443	49729	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:52.752896070 CEST	49729	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:52.752902031 CEST	443	49729	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:52.807327032 CEST	49729	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:52.942131996 CEST	443	49729	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:52.942158937 CEST	443	49729	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:52.942210913 CEST	49729	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:52.942222118 CEST	443	49729	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:52.942477942 CEST	443	49729	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:52.942526102 CEST	49729	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:52.942532063 CEST	443	49729	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:52.942964077 CEST	443	49729	13.107.136.10	192.168.2.5
Jul 4, 2024 21:43:52.943016052 CEST	49729	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:52.945632935 CEST	49729	443	192.168.2.5	13.107.136.10
Jul 4, 2024 21:43:52.945645094 CEST	443	49729	13.107.136.10	192.168.2.5
Jul 4, 2024 21:44:00.747340918 CEST	443	49725	172.217.18.100	192.168.2.5
Jul 4, 2024 21:44:00.747406960 CEST	443	49725	172.217.18.100	192.168.2.5
Jul 4, 2024 21:44:00.747471094 CEST	49725	443	192.168.2.5	172.217.18.100
Jul 4, 2024 21:44:01.359503031 CEST	49730	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:01.359534025 CEST	443	49730	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:01.359648943 CEST	49730	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:01.360873938 CEST	49730	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:01.360888004 CEST	443	49730	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:01.941387892 CEST	49725	443	192.168.2.5	172.217.18.100
Jul 4, 2024 21:44:01.941420078 CEST	443	49725	172.217.18.100	192.168.2.5
Jul 4, 2024 21:44:02.148926020 CEST	443	49730	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:02.151328087 CEST	49730	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:02.266087055 CEST	49730	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:02.266109943 CEST	443	49730	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:02.266449928 CEST	443	49730	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:02.320698023 CEST	49730	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:03.018727064 CEST	49730	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:03.060492992 CEST	443	49730	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:03.277371883 CEST	443	49730	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:03.277398109 CEST	443	49730	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:03.277404070 CEST	443	49730	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:03.277443886 CEST	443	49730	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:03.277452946 CEST	443	49730	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:03.277460098 CEST	443	49730	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:03.277458906 CEST	49730	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:03.277512074 CEST	49730	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:03.277513027 CEST	443	49730	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:03.277559042 CEST	49730	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:03.277818918 CEST	443	49730	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:03.277874947 CEST	49730	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:03.277879953 CEST	443	49730	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:03.277889013 CEST	443	49730	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:03.277928114 CEST	49730	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:03.973912001 CEST	49730	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:03.973912001 CEST	49730	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:03.973933935 CEST	443	49730	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:03.973943949 CEST	443	49730	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:40.360208988 CEST	49737	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:40.360265970 CEST	443	49737	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:40.360416889 CEST	49737	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:40.360805988 CEST	49737	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:40.360822916 CEST	443	49737	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:41.144463062 CEST	443	49737	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:41.144541979 CEST	49737	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:41.148219109 CEST	49737	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:41.148237944 CEST	443	49737	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:41.148468971 CEST	443	49737	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:41.157586098 CEST	49737	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:41.200500965 CEST	443	49737	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:41.472840071 CEST	443	49737	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:41.472865105 CEST	443	49737	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:41.472879887 CEST	443	49737	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:41.472934008 CEST	49737	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:41.472970009 CEST	443	49737	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:41.473017931 CEST	49737	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:41.473970890 CEST	443	49737	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:41.474021912 CEST	443	49737	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:41.474049091 CEST	49737	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:41.474056005 CEST	443	49737	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:41.474072933 CEST	443	49737	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:41.474096060 CEST	49737	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:41.474113941 CEST	49737	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:41.477293968 CEST	49737	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:41.477318048 CEST	443	49737	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:41.477328062 CEST	49737	443	192.168.2.5	40.127.169.103
Jul 4, 2024 21:44:41.477334023 CEST	443	49737	40.127.169.103	192.168.2.5
Jul 4, 2024 21:44:45.332030058 CEST	49738	53	192.168.2.5	1.1.1.1
Jul 4, 2024 21:44:45.340344906 CEST	53	49738	1.1.1.1	192.168.2.5
Jul 4, 2024 21:44:45.340500116 CEST	49738	53	192.168.2.5	1.1.1.1
Jul 4, 2024 21:44:45.340533972 CEST	49738	53	192.168.2.5	1.1.1.1
Jul 4, 2024 21:44:45.340533972 CEST	49738	53	192.168.2.5	1.1.1.1
Jul 4, 2024 21:44:45.348634005 CEST	53	49738	1.1.1.1	192.168.2.5
Jul 4, 2024 21:44:45.348644972 CEST	53	49738	1.1.1.1	192.168.2.5
Jul 4, 2024 21:44:45.804979086 CEST	53	49738	1.1.1.1	192.168.2.5
Jul 4, 2024 21:44:45.805531025 CEST	49738	53	192.168.2.5	1.1.1.1
Jul 4, 2024 21:44:45.810894012 CEST	53	49738	1.1.1.1	192.168.2.5
Jul 4, 2024 21:44:45.811038971 CEST	49738	53	192.168.2.5	1.1.1.1
Jul 4, 2024 21:44:50.224569082 CEST	49740	443	192.168.2.5	172.217.18.100
Jul 4, 2024 21:44:50.224625111 CEST	443	49740	172.217.18.100	192.168.2.5
Jul 4, 2024 21:44:50.224690914 CEST	49740	443	192.168.2.5	172.217.18.100
Jul 4, 2024 21:44:50.224982977 CEST	49740	443	192.168.2.5	172.217.18.100
Jul 4, 2024 21:44:50.224997044 CEST	443	49740	172.217.18.100	192.168.2.5
Jul 4, 2024 21:44:50.879159927 CEST	443	49740	172.217.18.100	192.168.2.5
Jul 4, 2024 21:44:50.879463911 CEST	49740	443	192.168.2.5	172.217.18.100
Jul 4, 2024 21:44:50.879498959 CEST	443	49740	172.217.18.100	192.168.2.5
Jul 4, 2024 21:44:50.879817963 CEST	443	49740	172.217.18.100	192.168.2.5
Jul 4, 2024 21:44:50.880178928 CEST	49740	443	192.168.2.5	172.217.18.100
Jul 4, 2024 21:44:50.880249977 CEST	443	49740	172.217.18.100	192.168.2.5
Jul 4, 2024 21:44:50.926656961 CEST	49740	443	192.168.2.5	172.217.18.100
Jul 4, 2024 21:45:00.780956030 CEST	443	49740	172.217.18.100	192.168.2.5
Jul 4, 2024 21:45:00.781027079 CEST	443	49740	172.217.18.100	192.168.2.5
Jul 4, 2024 21:45:00.781084061 CEST	49740	443	192.168.2.5	172.217.18.100
Jul 4, 2024 21:45:01.949714899 CEST	49740	443	192.168.2.5	172.217.18.100
Jul 4, 2024 21:45:01.949753046 CEST	443	49740	172.217.18.100	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 4, 2024 21:43:45.431875944 CEST	53	56358	1.1.1.1	192.168.2.5
Jul 4, 2024 21:43:45.496077061 CEST	53	63905	1.1.1.1	192.168.2.5
Jul 4, 2024 21:43:46.639617920 CEST	53	59647	1.1.1.1	192.168.2.5
Jul 4, 2024 21:43:46.900343895 CEST	50995	53	192.168.2.5	1.1.1.1
Jul 4, 2024 21:43:46.900511980 CEST	49287	53	192.168.2.5	1.1.1.1
Jul 4, 2024 21:43:48.562463999 CEST	59464	53	192.168.2.5	1.1.1.1
Jul 4, 2024 21:43:48.562728882 CEST	54039	53	192.168.2.5	1.1.1.1
Jul 4, 2024 21:43:50.167068005 CEST	53170	53	192.168.2.5	1.1.1.1
Jul 4, 2024 21:43:50.167721033 CEST	51355	53	192.168.2.5	1.1.1.1
Jul 4, 2024 21:43:50.173774004 CEST	53	53170	1.1.1.1	192.168.2.5
Jul 4, 2024 21:43:50.174623013 CEST	53	51355	1.1.1.1	192.168.2.5
Jul 4, 2024 21:43:52.024607897 CEST	51677	53	192.168.2.5	1.1.1.1
Jul 4, 2024 21:43:52.024607897 CEST	60454	53	192.168.2.5	1.1.1.1
Jul 4, 2024 21:44:03.784759045 CEST	53	61995	1.1.1.1	192.168.2.5
Jul 4, 2024 21:44:22.502892971 CEST	53	49451	1.1.1.1	192.168.2.5
Jul 4, 2024 21:44:45.174460888 CEST	53	57802	1.1.1.1	192.168.2.5
Jul 4, 2024 21:44:45.331648111 CEST	53	64304	1.1.1.1	192.168.2.5
Jul 4, 2024 21:44:45.332042933 CEST	53	64552	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 4, 2024 21:43:46.900343895 CEST	192.168.2.5	1.1.1.1	0xd92c	Standard query (0)	rjnmail-my.sharepoint.com	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:43:46.900511980 CEST	192.168.2.5	1.1.1.1	0xead2	Standard query (0)	rjnmail-my.sharepoint.com	65	IN (0x0001)	false
Jul 4, 2024 21:43:48.562463999 CEST	192.168.2.5	1.1.1.1	0xf8dc	Standard query (0)	spo.nel.measure.office.net	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:43:48.562728882 CEST	192.168.2.5	1.1.1.1	0xfb9	Standard query (0)	spo.nel.measure.office.net	65	IN (0x0001)	false
Jul 4, 2024 21:43:50.167068005 CEST	192.168.2.5	1.1.1.1	0x4efd	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:43:50.167721033 CEST	192.168.2.5	1.1.1.1	0xf2b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jul 4, 2024 21:43:52.024607897 CEST	192.168.2.5	1.1.1.1	0xd19f	Standard query (0)	rjnmail-my.sharepoint.com	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:43:52.024607897 CEST	192.168.2.5	1.1.1.1	0xa85f	Standard query (0)	rjnmail-my.sharepoint.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 4, 2024 21:43:46.950515032 CEST	1.1.1.1	192.168.2.5	0xead2	No error (0)	rjnmail-my.sharepoint.com	rjnmail.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 4, 2024 21:43:46.950515032 CEST	1.1.1.1	192.168.2.5	0xead2	No error (0)	rjnmail.sharepoint.com	32-ipv4v6e.clump.dprodmgd108.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 4, 2024 21:43:46.950515032 CEST	1.1.1.1	192.168.2.5	0xead2	No error (0)	32-ipv4v6e.clump.dprodmgd108.aa-rt.sharepoint.com	201091-ipv4v6e.farm.dprodmgd108.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 4, 2024 21:43:46.950515032 CEST	1.1.1.1	192.168.2.5	0xead2	No error (0)	201091-ipv4v6e.farm.dprodmgd108.aa-rt.sharepoint.com	201091-ipv4v6w.farm.dprodmgd108.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 4, 2024 21:43:46.953438997 CEST	1.1.1.1	192.168.2.5	0xd92c	No error (0)	rjnmail-my.sharepoint.com	rjnmail.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 4, 2024 21:43:46.953438997 CEST	1.1.1.1	192.168.2.5	0xd92c	No error (0)	rjnmail.sharepoint.com	32-ipv4v6e.clump.dprodmgd108.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 4, 2024 21:43:46.953438997 CEST	1.1.1.1	192.168.2.5	0xd92c	No error (0)	32-ipv4v6e.clump.dprodmgd108.aa-rt.sharepoint.com	201091-ipv4v6e.farm.dprodmgd108.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 4, 2024 21:43:46.953438997 CEST	1.1.1.1	192.168.2.5	0xd92c	No error (0)	201091-ipv4v6e.farm.dprodmgd108.aa-rt.sharepoint.com	201091-ipv4v6w.farm.dprodmgd108.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 4, 2024 21:43:46.953438997 CEST	1.1.1.1	192.168.2.5	0xd92c	No error (0)	201091-ipv4v6.farm.dprodmgd108.aa-rt.sharepoint.com.dual-spo-0005.spo-msedge.net	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 4, 2024 21:43:46.953438997 CEST	1.1.1.1	192.168.2.5	0xd92c	No error (0)	dual-spo-0005.spo-msedge.net		13.107.136.10	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:43:46.953438997 CEST	1.1.1.1	192.168.2.5	0xd92c	No error (0)	dual-spo-0005.spo-msedge.net		13.107.138.10	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:43:48.571362019 CEST	1.1.1.1	192.168.2.5	0xfb9	No error (0)	spo.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 4, 2024 21:43:48.571640015 CEST	1.1.1.1	192.168.2.5	0xf8dc	No error (0)	spo.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 4, 2024 21:43:50.173774004 CEST	1.1.1.1	192.168.2.5	0x4efd	No error (0)	www.google.com		172.217.18.100	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:43:50.174623013 CEST	1.1.1.1	192.168.2.5	0xf2b	No error (0)	www.google.com			65	IN (0x0001)	false
Jul 4, 2024 21:43:52.080660105 CEST	1.1.1.1	192.168.2.5	0xa85f	No error (0)	rjnmail-my.sharepoint.com	rjnmail.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 4, 2024 21:43:52.080660105 CEST	1.1.1.1	192.168.2.5	0xa85f	No error (0)	rjnmail.sharepoint.com	32-ipv4v6e.clump.dprodmgd108.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 4, 2024 21:43:52.080660105 CEST	1.1.1.1	192.168.2.5	0xa85f	No error (0)	32-ipv4v6e.clump.dprodmgd108.aa-rt.sharepoint.com	201091-ipv4v6e.farm.dprodmgd108.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 4, 2024 21:43:52.080660105 CEST	1.1.1.1	192.168.2.5	0xa85f	No error (0)	201091-ipv4v6e.farm.dprodmgd108.aa-rt.sharepoint.com	201091-ipv4v6w.farm.dprodmgd108.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 4, 2024 21:43:52.172506094 CEST	1.1.1.1	192.168.2.5	0xd19f	No error (0)	rjnmail-my.sharepoint.com	rjnmail.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 4, 2024 21:43:52.172506094 CEST	1.1.1.1	192.168.2.5	0xd19f	No error (0)	rjnmail.sharepoint.com	32-ipv4v6e.clump.dprodmgd108.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 4, 2024 21:43:52.172506094 CEST	1.1.1.1	192.168.2.5	0xd19f	No error (0)	32-ipv4v6e.clump.dprodmgd108.aa-rt.sharepoint.com	201091-ipv4v6e.farm.dprodmgd108.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 4, 2024 21:43:52.172506094 CEST	1.1.1.1	192.168.2.5	0xd19f	No error (0)	201091-ipv4v6e.farm.dprodmgd108.aa-rt.sharepoint.com	201091-ipv4v6w.farm.dprodmgd108.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 4, 2024 21:43:52.172506094 CEST	1.1.1.1	192.168.2.5	0xd19f	No error (0)	201091-ipv4v6.farm.dprodmgd108.aa-rt.sharepoint.com.dual-spo-0005.spo-msedge.net	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 4, 2024 21:43:52.172506094 CEST	1.1.1.1	192.168.2.5	0xd19f	No error (0)	dual-spo-0005.spo-msedge.net		13.107.136.10	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:43:52.172506094 CEST	1.1.1.1	192.168.2.5	0xd19f	No error (0)	dual-spo-0005.spo-msedge.net		13.107.138.10	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

rjnmail-my.sharepoint.com

https:

fs.microsoft.com

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49710	13.107.136.10	443	2148	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:43:47 UTC	1101	OUT	GET /:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3d HTTP/1.1 Host: rjnmail-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 19:43:47 UTC	1488	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 227571 Content-Type: text/html; charset=utf-8 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-NetworkStatistics: 0,2102272,0,18,7531911,0,2102272,6 X-SharePointHealthScore: 1 Referrer-Policy: no-referrer, strict-origin-when-cross-origin SharePointError: 0 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: 311739a1-f039-0000-1cc8-3d0de28149fb request-id: 311739a1-f039-0000-1cc8-3d0de28149fb MS-CV: oTkXMTnwAAAcyD0N4oFJ+w.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=657c8bb5-f19a-4cf7-a04d-698bf5076a2a&destinationEndpoint=Edge-Prod-EWR31r5d&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 SPRequestDuration: 317 SPIisLatency: 5 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25019 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: E108C2EEC20B49C0A8DF8F2A586DB5DC Ref B: EWR311000107045 Ref C: 2024-07-04T19:43:47Z Date: Thu, 04 Jul 2024 19:43:47 GMT Connection: close
2024-07-04 19:43:47 UTC	3453	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0d 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3a 6f 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 6f 66 66 69 63 65 3a 6f 66 66 69 63 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 64 69 72 3d 22 6c 74 72 22 3e 0d 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 47 45 4e 45 52 41 54 4f 52 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 69 63 72 6f 73 6f 66 74 20 53 68 61 72 65 50 6f 69 6e 74 22 20 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns:o="urn:schemas-microsoft-com:office:office" lang="en-us" dir="ltr"><head><meta name="GENERATOR" content="Microsoft SharePoint"
2024-07-04 19:43:47 UTC	8192	IN	Data Raw: 42 2d 33 39 39 41 35 36 30 44 31 42 46 43 22 3a 31 2c 22 43 38 45 30 36 43 33 42 2d 46 34 31 46 2d 34 36 33 32 2d 41 44 37 34 2d 31 36 34 39 38 43 44 33 39 36 41 30 22 3a 31 2c 22 33 31 46 36 39 39 35 38 2d 36 34 46 33 2d 34 34 30 46 2d 39 36 41 39 2d 34 41 38 44 45 39 41 45 37 31 41 39 22 3a 31 2c 22 42 42 39 33 30 39 32 36 2d 39 42 42 34 2d 34 42 42 32 2d 41 35 44 45 2d 33 36 32 46 46 30 33 42 42 35 31 35 22 3a 31 2c 22 32 35 30 31 41 31 34 41 2d 45 46 33 44 2d 34 41 38 37 2d 38 33 32 45 2d 38 46 33 41 38 42 44 31 30 32 30 35 22 3a 31 2c 22 34 42 41 37 42 30 33 35 2d 42 34 34 33 2d 34 39 31 39 2d 38 42 46 38 2d 42 33 45 34 44 31 43 33 34 44 41 30 22 3a 31 2c 22 46 44 41 45 39 45 39 34 2d 38 41 38 38 2d 34 38 36 30 2d 38 38 30 42 2d 46 41 33 30 34 39 35 Data Ascii: B-399A560D1BFC":1,"C8E06C3B-F41F-4632-AD74-16498CD396A0":1,"31F69958-64F3-440F-96A9-4A8DE9AE71A9":1,"BB930926-9BB4-4BB2-A5DE-362FF03BB515":1,"2501A14A-EF3D-4A87-832E-8F3A8BD10205":1,"4BA7B035-B443-4919-8BF8-B3E4D1C34DA0":1,"FDAE9E94-8A88-4860-880B-FA30495
2024-07-04 19:43:47 UTC	3373	IN	Data Raw: 34 45 30 39 2d 42 46 31 31 2d 46 42 41 35 46 37 35 46 34 33 37 41 22 3a 31 2c 22 42 37 45 36 36 39 44 30 2d 46 31 38 46 2d 34 37 32 44 2d 42 37 38 41 2d 38 35 32 44 44 32 42 30 45 36 31 33 22 3a 31 2c 22 33 30 38 45 46 30 31 30 2d 44 37 35 42 2d 34 44 36 41 2d 38 36 41 35 2d 33 46 44 37 44 34 45 46 33 34 45 32 22 3a 31 2c 22 42 39 30 44 41 35 46 39 2d 42 41 37 35 2d 34 42 43 43 2d 41 33 45 30 2d 39 46 39 41 42 45 30 36 46 46 35 39 22 3a 31 2c 22 37 33 39 33 39 43 35 46 2d 34 32 37 42 2d 34 43 30 32 2d 42 30 38 42 2d 35 30 45 37 37 38 41 42 44 46 34 42 22 3a 31 2c 22 33 36 45 33 33 36 38 38 2d 37 30 45 44 2d 34 39 34 41 2d 41 39 32 31 2d 37 30 35 46 33 30 38 43 31 30 41 36 22 3a 31 2c 22 30 35 34 36 46 30 36 35 2d 43 33 34 37 2d 34 41 44 30 2d 38 38 36 44 Data Ascii: 4E09-BF11-FBA5F75F437A":1,"B7E669D0-F18F-472D-B78A-852DD2B0E613":1,"308EF010-D75B-4D6A-86A5-3FD7D4EF34E2":1,"B90DA5F9-BA75-4BCC-A3E0-9F9ABE06FF59":1,"73939C5F-427B-4C02-B08B-50E778ABDF4B":1,"36E33688-70ED-494A-A921-705F308C10A6":1,"0546F065-C347-4AD0-886D
2024-07-04 19:43:48 UTC	8192	IN	Data Raw: 32 44 31 45 39 32 36 41 36 37 35 22 3a 31 2c 22 36 35 39 46 44 37 33 46 2d 37 32 33 39 2d 34 31 34 32 2d 39 45 34 39 2d 31 31 38 45 42 45 45 30 33 41 42 35 22 3a 31 2c 22 30 36 44 36 33 35 44 44 2d 44 45 43 46 2d 34 33 46 39 2d 42 36 31 42 2d 37 31 39 41 41 34 36 31 45 39 44 32 22 3a 31 2c 22 43 43 39 35 35 37 46 39 2d 31 31 44 43 2d 34 42 32 32 2d 39 33 42 36 2d 30 44 30 43 45 42 38 33 30 33 34 32 22 3a 31 2c 22 31 36 45 41 38 45 44 35 2d 46 44 34 32 2d 34 42 41 37 2d 42 32 32 39 2d 42 46 34 33 37 30 41 31 42 44 46 35 22 3a 31 2c 22 43 38 37 44 46 31 32 32 2d 30 42 35 46 2d 34 37 45 31 2d 41 33 42 36 2d 31 36 32 35 39 41 41 39 33 34 44 45 22 3a 31 2c 22 41 35 46 34 46 43 32 44 2d 43 44 39 46 2d 34 43 34 37 2d 42 39 44 37 2d 44 30 43 38 36 44 41 42 36 43 Data Ascii: 2D1E926A675":1,"659FD73F-7239-4142-9E49-118EBEE03AB5":1,"06D635DD-DECF-43F9-B61B-719AA461E9D2":1,"CC9557F9-11DC-4B22-93B6-0D0CEB830342":1,"16EA8ED5-FD42-4BA7-B229-BF4370A1BDF5":1,"C87DF122-0B5F-47E1-A3B6-16259AA934DE":1,"A5F4FC2D-CD9F-4C47-B9D7-D0C86DAB6C
2024-07-04 19:43:48 UTC	8192	IN	Data Raw: 44 2d 42 39 33 39 2d 30 32 34 32 41 43 31 32 30 30 30 32 22 3a 31 2c 22 38 46 33 36 42 33 46 39 2d 30 33 35 39 2d 34 35 43 42 2d 42 41 39 34 2d 30 46 35 31 34 45 35 41 37 41 36 38 22 3a 31 2c 22 33 45 34 35 34 42 43 31 2d 36 37 34 30 2d 34 39 39 36 2d 42 38 38 43 2d 30 45 41 45 32 35 44 32 37 33 38 31 22 3a 31 2c 22 46 31 35 39 37 35 35 44 2d 45 31 38 46 2d 34 38 44 32 2d 42 46 36 33 2d 46 31 38 38 35 37 30 37 32 31 43 34 22 3a 31 2c 22 36 37 37 45 42 31 31 42 2d 39 41 46 34 2d 34 32 36 31 2d 42 44 34 35 2d 31 42 35 30 33 36 31 46 36 38 35 39 22 3a 31 2c 22 42 43 38 33 37 34 30 30 2d 44 31 34 37 2d 34 33 37 38 2d 38 44 30 31 2d 46 38 37 35 42 33 37 31 43 36 38 45 22 3a 31 2c 22 33 41 46 33 31 33 33 45 2d 46 46 43 32 2d 34 42 33 41 2d 42 36 45 46 2d 39 35 Data Ascii: D-B939-0242AC120002":1,"8F36B3F9-0359-45CB-BA94-0F514E5A7A68":1,"3E454BC1-6740-4996-B88C-0EAE25D27381":1,"F159755D-E18F-48D2-BF63-F188570721C4":1,"677EB11B-9AF4-4261-BD45-1B50361F6859":1,"BC837400-D147-4378-8D01-F875B371C68E":1,"3AF3133E-FFC2-4B3A-B6EF-95
2024-07-04 19:43:48 UTC	8192	IN	Data Raw: 44 45 46 34 2d 34 42 37 33 2d 42 36 43 44 2d 36 46 34 36 31 33 44 38 46 42 31 36 22 3a 31 2c 22 41 37 35 33 34 34 34 33 2d 43 45 37 30 2d 34 45 41 38 2d 42 41 34 46 2d 41 33 38 38 33 46 30 43 43 44 34 39 22 3a 31 2c 22 39 31 30 42 30 37 41 31 2d 30 41 34 33 2d 34 42 46 41 2d 38 41 39 33 2d 42 41 35 39 32 39 42 38 36 32 31 46 22 3a 31 2c 22 35 46 35 32 30 39 38 44 2d 39 41 44 46 2d 34 36 45 45 2d 38 43 30 44 2d 37 44 39 42 33 41 36 36 38 39 38 32 22 3a 31 2c 22 42 38 36 42 36 35 45 37 2d 36 46 44 39 2d 34 31 34 42 2d 38 45 36 44 2d 34 45 32 33 30 42 42 44 31 39 43 33 22 3a 31 2c 22 35 36 32 43 37 43 43 31 2d 45 46 46 30 2d 34 43 35 31 2d 38 38 38 39 2d 42 43 32 35 36 45 44 32 39 33 39 36 22 3a 31 2c 22 34 36 35 30 39 44 31 30 2d 39 41 46 33 2d 34 31 35 36 Data Ascii: DEF4-4B73-B6CD-6F4613D8FB16":1,"A7534443-CE70-4EA8-BA4F-A3883F0CCD49":1,"910B07A1-0A43-4BFA-8A93-BA5929B8621F":1,"5F52098D-9ADF-46EE-8C0D-7D9B3A668982":1,"B86B65E7-6FD9-414B-8E6D-4E230BBD19C3":1,"562C7CC1-EFF0-4C51-8889-BC256ED29396":1,"46509D10-9AF3-4156
2024-07-04 19:43:48 UTC	8192	IN	Data Raw: 35 41 33 39 39 43 42 2d 45 33 35 34 2d 34 39 43 37 2d 38 43 33 45 2d 39 36 35 42 43 39 37 37 37 46 44 43 22 3a 31 2c 22 30 42 45 33 45 39 32 33 2d 34 32 39 42 2d 34 39 42 35 2d 39 41 42 43 2d 37 41 39 38 34 31 45 32 37 41 30 44 22 3a 31 2c 22 31 41 34 32 37 39 36 37 2d 44 37 44 33 2d 34 46 32 46 2d 39 42 41 41 2d 46 35 44 37 38 46 44 43 32 41 31 38 22 3a 31 2c 22 32 31 37 34 45 42 36 39 2d 36 41 41 34 2d 34 34 36 30 2d 42 31 30 46 2d 46 31 45 39 39 37 44 42 46 46 39 33 22 3a 31 2c 22 32 42 44 44 34 37 44 31 2d 46 39 45 42 2d 34 31 30 39 2d 41 36 45 31 2d 41 37 35 37 44 30 44 33 44 32 46 43 22 3a 31 2c 22 45 38 45 45 44 36 43 31 2d 42 33 32 44 2d 34 36 36 35 2d 39 38 31 30 2d 37 37 36 46 31 44 38 33 34 43 30 46 22 3a 31 2c 22 41 37 38 44 35 35 41 34 2d 33 Data Ascii: 5A399CB-E354-49C7-8C3E-965BC9777FDC":1,"0BE3E923-429B-49B5-9ABC-7A9841E27A0D":1,"1A427967-D7D3-4F2F-9BAA-F5D78FDC2A18":1,"2174EB69-6AA4-4460-B10F-F1E997DBFF93":1,"2BDD47D1-F9EB-4109-A6E1-A757D0D3D2FC":1,"E8EED6C1-B32D-4665-9810-776F1D834C0F":1,"A78D55A4-3
2024-07-04 19:43:48 UTC	8192	IN	Data Raw: 43 36 22 3a 31 2c 22 37 33 34 34 34 44 37 35 2d 34 44 38 44 2d 34 41 35 34 2d 38 45 46 45 2d 36 37 38 34 42 35 41 45 34 32 44 32 22 3a 31 2c 22 46 32 44 42 37 35 32 39 2d 36 41 31 33 2d 37 30 32 41 2d 41 41 41 43 2d 37 31 41 30 43 41 38 39 38 32 37 38 22 3a 31 2c 22 34 42 33 37 32 38 32 43 2d 42 45 45 46 2d 34 32 32 34 2d 41 42 37 43 2d 39 37 43 46 36 32 46 32 42 33 31 43 22 3a 31 2c 22 34 31 39 30 45 35 33 39 2d 41 38 34 30 2d 34 45 34 37 2d 41 38 31 37 2d 33 45 46 36 37 46 36 34 41 44 38 34 22 3a 31 2c 22 31 46 30 46 35 39 44 39 2d 42 33 36 46 2d 34 30 41 42 2d 41 39 45 34 2d 33 32 30 46 37 39 38 34 38 30 38 37 22 3a 31 2c 22 45 33 42 46 44 44 43 45 2d 42 42 45 32 2d 34 35 35 46 2d 42 42 34 41 2d 46 41 43 39 34 32 41 42 34 36 41 41 22 3a 31 2c 22 36 39 Data Ascii: C6":1,"73444D75-4D8D-4A54-8EFE-6784B5AE42D2":1,"F2DB7529-6A13-702A-AAAC-71A0CA898278":1,"4B37282C-BEEF-4224-AB7C-97CF62F2B31C":1,"4190E539-A840-4E47-A817-3EF67F64AD84":1,"1F0F59D9-B36F-40AB-A9E4-320F79848087":1,"E3BFDDCE-BBE2-455F-BB4A-FAC942AB46AA":1,"69
2024-07-04 19:43:48 UTC	8192	IN	Data Raw: 39 30 41 36 38 33 41 35 33 43 22 3a 31 2c 22 34 41 44 41 38 44 33 33 2d 34 37 46 35 2d 34 35 43 31 2d 41 35 36 42 2d 38 31 35 45 38 39 43 35 30 39 32 35 22 3a 31 2c 22 45 41 30 42 45 35 45 35 2d 31 33 36 31 2d 34 36 36 39 2d 39 41 37 45 2d 42 38 33 44 32 37 31 34 38 32 34 39 22 3a 31 2c 22 41 32 44 45 37 39 45 42 2d 41 30 38 41 2d 34 41 41 35 2d 38 46 30 32 2d 35 45 46 37 36 46 42 30 46 38 41 34 22 3a 31 2c 22 33 35 46 46 33 31 44 38 2d 37 34 44 30 2d 34 30 44 43 2d 38 42 36 31 2d 36 37 46 39 44 44 32 34 42 42 32 37 22 3a 31 2c 22 35 44 38 45 43 32 32 45 2d 32 35 34 39 2d 34 36 39 30 2d 38 46 32 45 2d 42 41 45 35 38 41 39 39 43 43 43 44 22 3a 31 2c 22 32 35 39 43 32 37 41 44 2d 38 35 30 39 2d 34 44 30 30 2d 42 37 44 33 2d 41 38 39 44 34 44 42 30 38 44 38 Data Ascii: 90A683A53C":1,"4ADA8D33-47F5-45C1-A56B-815E89C50925":1,"EA0BE5E5-1361-4669-9A7E-B83D27148249":1,"A2DE79EB-A08A-4AA5-8F02-5EF76FB0F8A4":1,"35FF31D8-74D0-40DC-8B61-67F9DD24BB27":1,"5D8EC22E-2549-4690-8F2E-BAE58A99CCCD":1,"259C27AD-8509-4D00-B7D3-A89D4DB08D8
2024-07-04 19:43:48 UTC	8192	IN	Data Raw: 2d 38 35 33 43 2d 42 36 32 31 33 38 44 33 41 44 39 37 22 3a 31 2c 22 39 44 35 31 35 33 32 38 2d 41 33 46 33 2d 34 32 42 44 2d 39 37 30 46 2d 46 42 41 41 42 43 31 43 46 31 31 38 22 3a 31 2c 22 45 33 45 36 41 37 44 41 2d 32 30 37 45 2d 34 34 44 35 2d 42 35 43 34 2d 32 34 32 33 41 30 36 37 36 45 30 42 22 3a 31 2c 22 44 30 42 37 34 37 34 44 2d 43 30 36 42 2d 34 41 43 45 2d 41 46 42 46 2d 41 35 36 32 45 35 30 43 32 32 43 31 22 3a 31 2c 22 35 45 31 42 31 46 45 38 2d 31 42 31 44 2d 34 38 30 31 2d 42 34 39 43 2d 38 31 34 32 31 43 46 42 37 37 35 38 22 3a 31 2c 22 37 34 38 35 33 34 43 36 2d 32 45 43 35 2d 34 46 41 38 2d 41 37 42 33 2d 43 44 35 46 33 45 33 30 45 33 30 37 22 3a 31 2c 22 42 34 38 34 38 34 35 37 2d 30 34 39 45 2d 34 34 38 35 2d 38 45 44 45 2d 41 33 38 Data Ascii: -853C-B62138D3AD97":1,"9D515328-A3F3-42BD-970F-FBAABC1CF118":1,"E3E6A7DA-207E-44D5-B5C4-2423A0676E0B":1,"D0B7474D-C06B-4ACE-AFBF-A562E50C22C1":1,"5E1B1FE8-1B1D-4801-B49C-81421CFB7758":1,"748534C6-2EC5-4FA8-A7B3-CD5F3E30E307":1,"B4848457-049E-4485-8EDE-A38

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49709	13.107.136.10	443	2148	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:43:48 UTC	1055	OUT	GET /_layouts/15/1033/styles/corev15.css?rev=tMQyIYuqg6gA5d4OhqkBpg%3D%3DTAG70 HTTP/1.1 Host: rjnmail-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 19:43:48 UTC	735	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 341640 Content-Type: text/css Last-Modified: Tue, 02 Jul 2024 09:18:20 GMT Accept-Ranges: bytes ETag: "55d8fdc760ccda1:0" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-NetworkStatistics: 0,2102272,5,26,4165292,0,1089685,6 SPRequestDuration: 5 SPIisLatency: 16 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25019 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: C877B5AABB8E4C21A2308264B279DF5F Ref B: EWR311000101047 Ref C: 2024-07-04T19:43:48Z Date: Thu, 04 Jul 2024 19:43:47 GMT Connection: close
2024-07-04 19:43:48 UTC	3412	IN	Data Raw: 2f 2a 20 5f 6c 63 69 64 3d 22 31 30 33 33 22 0d 0a 5f 4c 6f 63 61 6c 42 69 6e 64 69 6e 67 20 2a 2f 0d 0a 62 6f 64 79 2c 0d 0a 2e 6d 73 2d 63 6f 72 65 2d 64 65 66 61 75 6c 74 46 6f 6e 74 2c 0d 0a 23 70 61 67 65 53 74 61 74 75 73 42 61 72 2c 0d 0a 23 68 79 62 72 69 64 54 6f 6f 6c 74 69 70 53 74 61 74 75 73 42 61 72 2c 0d 0a 2e 6d 73 2d 73 74 61 74 75 73 2d 6d 73 67 2c 0d 0a 2e 6a 73 2d 63 61 6c 6c 6f 75 74 2d 62 6f 64 79 0d 0a 7b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 46 6f 6e 74 28 74 68 65 6d 65 46 6f 6e 74 3a 22 62 6f 64 79 22 29 5d 20 2a 2f 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 53 65 67 6f 65 20 55 49 22 2c 22 53 65 67 6f 65 22 2c 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 66 6f 6e 74 Data Ascii: /* _lcid="1033"_LocalBinding /body,.ms-core-defaultFont,#pageStatusBar,#hybridTooltipStatusBar,.ms-status-msg,.js-callout-body{/ [ReplaceFont(themeFont:"body")] */ font-family:"Segoe UI","Segoe",Tahoma,Helvetica,Arial,sans-serif;font
2024-07-04 19:43:48 UTC	8192	IN	Data Raw: 20 2a 2f 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 64 66 64 66 64 3b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 42 75 74 74 6f 6e 42 61 63 6b 67 72 6f 75 6e 64 22 29 5d 20 2a 2f 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 64 66 64 66 64 3b 0d 0a 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 31 30 70 78 3b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 46 6f 6e 74 28 74 68 65 6d 65 46 6f 6e 74 3a 22 62 6f 64 79 22 29 5d 20 2a 2f 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 53 65 67 6f 65 20 55 49 22 2c 22 53 65 67 6f 65 22 2c 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 66 6f 6e 74 2d 73 69 7a 65 3a 31 31 70 78 3b 0d 0a 2f 2a 20 5b Data Ascii: / background-color:#fdfdfd;/ [ReplaceColor(themeColor:"ButtonBackground")] / background-color:#fdfdfd;margin-left:10px;/ [ReplaceFont(themeFont:"body")] / font-family:"Segoe UI","Segoe",Tahoma,Helvetica,Arial,sans-serif;font-size:11px;/ [
2024-07-04 19:43:48 UTC	4167	IN	Data Raw: 70 78 3b 0d 0a 7d 0d 0a 23 74 69 74 6c 65 41 72 65 61 42 6f 78 0d 0a 7b 0d 0a 6d 61 72 67 69 6e 3a 61 75 74 6f 20 32 30 70 78 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 63 6f 72 65 2d 70 61 67 65 54 69 74 6c 65 2c 0d 0a 2e 6d 73 2d 63 6f 72 65 2d 70 61 67 65 54 69 74 6c 65 20 61 0d 0a 7b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 46 6f 6e 74 28 74 68 65 6d 65 46 6f 6e 74 3a 22 74 69 74 6c 65 22 29 5d 20 2a 2f 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 53 65 67 6f 65 20 55 49 20 4c 69 67 68 74 22 2c 22 53 65 67 6f 65 20 55 49 22 2c 22 53 65 67 6f 65 22 2c 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 53 69 74 65 54 69 74 6c 65 Data Ascii: px;}#titleAreaBox{margin:auto 20px;}.ms-core-pageTitle,.ms-core-pageTitle a{/* [ReplaceFont(themeFont:"title")] / font-family:"Segoe UI Light","Segoe UI","Segoe",Tahoma,Helvetica,Arial,sans-serif;/ [ReplaceColor(themeColor:"SiteTitle
2024-07-04 19:43:48 UTC	8192	IN	Data Raw: 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 63 6f 72 65 2d 68 65 61 64 65 72 20 2e 6d 73 2d 73 72 63 68 2d 73 62 0d 0a 7b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 48 65 61 64 65 72 42 61 63 6b 67 72 6f 75 6e 64 22 2c 6f 70 61 63 69 74 79 3a 22 31 22 29 5d 20 2a 2f 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 48 65 61 64 65 72 42 61 63 6b 67 72 6f 75 6e 64 22 29 5d 20 2a 2f 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 20 32 35 35 2c 32 35 35 2c 32 35 35 2c 30 2e 38 35 20 29 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 73 72 63 68 2d 73 Data Ascii: display:inline-block;}.ms-core-header .ms-srch-sb{/* [ReplaceColor(themeColor:"HeaderBackground",opacity:"1")] / background-color:#fff;/ [ReplaceColor(themeColor:"HeaderBackground")] */ background-color:rgba( 255,255,255,0.85 );}.ms-srch-s
2024-07-04 19:43:48 UTC	8192	IN	Data Raw: 63 6f 72 65 2d 6e 65 65 64 49 45 46 69 6c 74 65 72 20 2e 6d 73 2d 73 74 6f 72 65 66 72 6f 6e 74 2d 61 70 70 69 63 6f 6e 73 70 61 6e 0d 0a 7b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 45 6d 70 68 61 73 69 73 42 61 63 6b 67 72 6f 75 6e 64 22 29 5d 20 2a 2f 20 2d 6d 73 2d 66 69 6c 74 65 72 3a 22 70 72 6f 67 69 64 3a 44 58 49 6d 61 67 65 54 72 61 6e 73 66 6f 72 6d 2e 4d 69 63 72 6f 73 6f 66 74 2e 67 72 61 64 69 65 6e 74 28 47 72 61 64 69 65 6e 74 54 79 70 65 3d 30 2c 73 74 61 72 74 43 6f 6c 6f 72 73 74 72 3d 23 66 66 30 30 37 32 63 36 2c 65 6e 64 43 6f 6c 6f 72 73 74 72 3d 23 66 66 30 30 37 32 63 36 29 22 3b 0d 0a 7d Data Ascii: core-needIEFilter .ms-storefront-appiconspan{background-color:transparent;/* [ReplaceColor(themeColor:"EmphasisBackground")] */ -ms-filter:"progid:DXImageTransform.Microsoft.gradient(GradientType=0,startColorstr=#ff0072c6,endColorstr=#ff0072c6)";}
2024-07-04 19:43:48 UTC	8192	IN	Data Raw: 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 63 6f 72 65 2d 66 6f 72 6d 2d 65 72 72 6f 72 2c 0d 0a 2e 6d 73 2d 65 72 72 6f 72 2c 0d 0a 2e 6d 73 2d 66 6f 72 6d 76 61 6c 69 64 61 74 69 6f 6e 2c 0d 0a 2e 6d 73 2d 64 69 66 66 64 65 6c 65 74 65 6e 6f 73 74 72 69 6b 65 2c 0d 0a 2e 6d 73 2d 64 69 66 66 64 65 6c 65 74 65 0d 0a 7b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 45 72 72 6f 72 54 65 78 74 22 29 5d 20 2a 2f 20 63 6f 6c 6f 72 3a 23 62 66 30 30 30 30 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 74 6f 6f 6c 74 69 70 0d 0a 7b 0d 0a 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 0d 0a 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 64 6f 74 74 65 64 3b 0d 0a 7d 0d 0a 2e 6d 73 2d Data Ascii: er-style:none;}.ms-core-form-error,.ms-error,.ms-formvalidation,.ms-diffdeletenostrike,.ms-diffdelete{/* [ReplaceColor(themeColor:"ErrorText")] */ color:#bf0000;}.ms-tooltip{text-decoration:none;border-bottom:1px dotted;}.ms-
2024-07-04 19:43:48 UTC	8192	IN	Data Raw: 65 6e 74 0d 0a 7b 0d 0a 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 30 70 78 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 69 6e 64 65 6e 74 0d 0a 7b 0d 0a 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 35 70 78 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 68 69 67 68 43 6f 6e 74 72 61 73 74 42 6f 72 64 65 72 0d 0a 7b 0d 0a 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 63 75 72 73 6f 72 44 65 66 61 75 6c 74 0d 0a 7b 0d 0a 63 75 72 73 6f 72 3a 64 65 66 61 75 6c 74 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 63 75 72 73 6f 72 50 6f 69 6e 74 65 72 0d 0a 7b 0d 0a 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 73 68 61 64 6f 77 0d 0a 7b 0d 0a 62 6f 78 2d 73 68 61 64 6f 77 3a 30 70 78 20 30 70 78 20 37 70 78 20 30 70 78 20 72 Data Ascii: ent{margin-left:20px;}.ms-indent{margin-left:25px;}.ms-highContrastBorder{border:1px solid transparent;}.ms-cursorDefault{cursor:default;}.ms-cursorPointer{cursor:pointer;}.ms-shadow{box-shadow:0px 0px 7px 0px r
2024-07-04 19:43:48 UTC	8192	IN	Data Raw: 68 65 6d 65 43 6f 6c 6f 72 3a 22 43 6f 6e 74 65 6e 74 41 63 63 65 6e 74 33 22 2c 6f 70 61 63 69 74 79 3a 22 31 22 29 5d 20 2a 2f 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 32 38 38 30 35 34 3b 7d 0d 0a 2e 6d 73 2d 43 6f 6e 74 65 6e 74 41 63 63 65 6e 74 34 2d 62 6f 72 64 65 72 43 6f 6c 6f 72 7b 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 43 6f 6e 74 65 6e 74 41 63 63 65 6e 74 34 22 2c 6f 70 61 63 69 74 79 3a 22 31 22 29 5d 20 2a 2f 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 37 36 37 39 35 36 3b 7d 0d 0a 2e 6d 73 2d 43 6f 6e 74 65 6e 74 41 63 63 65 6e 74 35 2d 62 6f 72 64 65 72 43 6f 6c 6f 72 7b 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 43 6f 6e 74 65 6e 74 41 63 63 Data Ascii: hemeColor:"ContentAccent3",opacity:"1")] / border-color:#288054;}.ms-ContentAccent4-borderColor{/ [ReplaceColor(themeColor:"ContentAccent4",opacity:"1")] / border-color:#767956;}.ms-ContentAccent5-borderColor{/ [ReplaceColor(themeColor:"ContentAcc
2024-07-04 19:43:48 UTC	8192	IN	Data Raw: 63 65 6e 74 20 31 20 4c 69 67 68 74 65 73 74 22 3b 0d 0a 2f 2a 20 5b 43 6f 6c 6f 72 4e 61 6d 65 5d 20 2a 2f 20 2d 6d 73 2d 63 6f 6c 6f 72 3a 22 4c 69 67 68 74 20 42 6c 75 65 22 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 72 74 65 54 68 65 6d 65 46 6f 72 65 43 6f 6c 6f 72 2d 36 2d 31 0d 0a 7b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 43 6f 6e 74 65 6e 74 41 63 63 65 6e 74 32 2d 4c 69 67 68 74 65 73 74 22 2c 6f 70 61 63 69 74 79 3a 22 31 22 29 5d 20 2a 2f 20 63 6f 6c 6f 72 3a 23 44 35 46 36 46 46 3b 0d 0a 2d 6d 73 2d 6e 61 6d 65 3a 22 41 63 63 65 6e 74 20 32 20 4c 69 67 68 74 65 73 74 22 3b 0d 0a 2f 2a 20 5b 43 6f 6c 6f 72 4e 61 6d 65 5d 20 2a 2f 20 2d 6d 73 2d 63 6f 6c 6f 72 3a 22 50 69 6e 6b 22 3b 0d 0a 7d 0d 0a 2e 6d Data Ascii: cent 1 Lightest";/* [ColorName] / -ms-color:"Light Blue";}.ms-rteThemeForeColor-6-1{/ [ReplaceColor(themeColor:"ContentAccent2-Lightest",opacity:"1")] / color:#D5F6FF;-ms-name:"Accent 2 Lightest";/ [ColorName] */ -ms-color:"Pink";}.m
2024-07-04 19:43:48 UTC	8192	IN	Data Raw: 3a 22 41 63 63 65 6e 74 20 34 20 44 61 72 6b 65 73 74 22 3b 0d 0a 2f 2a 20 5b 43 6f 6c 6f 72 4e 61 6d 65 5d 20 2a 2f 20 2d 6d 73 2d 63 6f 6c 6f 72 3a 22 42 72 6f 77 6e 22 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 72 74 65 54 68 65 6d 65 46 6f 72 65 43 6f 6c 6f 72 2d 39 2d 35 0d 0a 7b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 43 6f 6e 74 65 6e 74 41 63 63 65 6e 74 35 2d 44 61 72 6b 65 73 74 22 2c 6f 70 61 63 69 74 79 3a 22 31 22 29 5d 20 2a 2f 20 63 6f 6c 6f 72 3a 23 37 36 30 30 31 39 3b 0d 0a 2d 6d 73 2d 6e 61 6d 65 3a 22 41 63 63 65 6e 74 20 35 20 44 61 72 6b 65 73 74 22 3b 0d 0a 2f 2a 20 5b 43 6f 6c 6f 72 4e 61 6d 65 5d 20 2a 2f 20 2d 6d 73 2d 63 6f 6c 6f 72 3a 22 44 61 72 6b 20 47 72 65 65 6e 22 3b 0d 0a 7d 0d 0a Data Ascii: :"Accent 4 Darkest";/* [ColorName] / -ms-color:"Brown";}.ms-rteThemeForeColor-9-5{/ [ReplaceColor(themeColor:"ContentAccent5-Darkest",opacity:"1")] / color:#760019;-ms-name:"Accent 5 Darkest";/ [ColorName] */ -ms-color:"Dark Green";}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49712	13.107.136.10	443	2148	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:43:48 UTC	1053	OUT	GET /_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG70 HTTP/1.1 Host: rjnmail-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 19:43:48 UTC	734	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 622 Content-Type: text/css Last-Modified: Tue, 02 Jul 2024 09:18:20 GMT Accept-Ranges: bytes ETag: "d63dc2c760ccda1:0" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-NetworkStatistics: 0,8409600,0,120,16413763,0,6346051,6 SPRequestDuration: 5 SPIisLatency: 41 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25019 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 023FD69006DC4BFD986771F54DCBEDA2 Ref B: EWR311000107017 Ref C: 2024-07-04T19:43:48Z Date: Thu, 04 Jul 2024 19:43:47 GMT Connection: close
2024-07-04 19:43:48 UTC	622	IN	Data Raw: 2f 2a 20 5f 6c 63 69 64 3d 22 31 30 33 33 22 0d 0a 5f 4c 6f 63 61 6c 42 69 6e 64 69 6e 67 20 2a 2f 0d 0a 23 6d 73 2d 65 72 72 6f 72 2d 68 65 61 64 65 72 0d 0a 7b 0d 0a 6d 61 72 67 69 6e 3a 31 31 38 70 78 20 30 70 78 20 31 36 70 78 3b 0d 0a 6d 69 6e 2d 68 65 69 67 68 74 3a 35 30 70 78 3b 0d 0a 7d 0d 0a 23 6d 73 2d 65 72 72 6f 72 2d 67 6f 62 61 63 6b 63 6f 6e 74 0d 0a 7b 0d 0a 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 38 70 78 3b 0d 0a 7d 0d 0a 23 6d 73 2d 61 63 63 65 73 73 44 65 6e 69 65 64 2d 72 65 71 44 69 61 6c 6f 67 0d 0a 7b 0d 0a 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 0d 0a 7d 0d 0a 23 6d 73 2d 65 72 72 6f 72 2d 62 6f 64 79 0d 0a 7b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 61 75 74 6f 3b 0d 0a 6f 76 65 72 66 6c 6f 77 3a 61 75 74 6f 3b 0d Data Ascii: /* _lcid="1033"_LocalBinding */#ms-error-header{margin:118px 0px 16px;min-height:50px;}#ms-error-gobackcont{margin-top:28px;}#ms-accessDenied-reqDialog{max-width:100%;}#ms-error-body{background-size:auto;overflow:auto;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49713	13.107.136.10	443	2148	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:43:49 UTC	1193	OUT	GET /ScriptResource.axd?d=m0jG364j4NGS2YAs366ZrZDboV4Z4bFzITp5H7GFyGl5jl65Lbpu-UrJGNYkJiyMKh_2o8DlLjj2JCb-mjtO9VW3kGmOPrqQt-uz2hmCl3mvyRBTYzSNC0LScv0k4JPTUCKJ93XWl7YzfH_wwkM9o132ph7t7ADI0-vM90YnialpRvumW-KQRu8tslYSpNAz0&t=74258c30 HTTP/1.1 Host: rjnmail-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 19:43:49 UTC	784	IN	HTTP/1.1 200 OK Cache-Control: public Content-Length: 25609 Content-Type: application/x-javascript Content-Encoding: gzip Expires: Fri, 04 Jul 2025 19:43:49 GMT Last-Modified: Thu, 04 Jul 2024 19:43:49 GMT P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-NetworkStatistics: 0,1051136,0,24,5652304,0,1051136,6 X-AspNet-Version: 4.0.30319 SPRequestDuration: 13 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25019 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: D3A3D39D74AB4E3694EA895D8E767A67 Ref B: EWR311000104011 Ref C: 2024-07-04T19:43:49Z Date: Thu, 04 Jul 2024 19:43:48 GMT Connection: close
2024-07-04 19:43:49 UTC	3511	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed bd d9 72 1b 49 92 28 fa 3e 66 f3 0f 64 8e 8a 42 36 92 20 29 55 2f 05 28 c5 d1 da a5 1e 6d 47 52 75 77 0d c9 96 e5 06 20 49 10 c9 42 02 92 58 04 be ec 3c dc 4f ba bf 70 7d 89 3d 23 01 50 aa 3e 73 8f 59 97 95 a4 44 2c 1e 11 1e 1e 1e 1e 1e ee 1e ff ef ff fe 7f 0e 0e f6 bf fa bf 7f ff b7 83 83 9d 27 d5 d5 f5 ac 1c 8d e7 3b 9d 27 e1 ce ab 32 9b 55 75 35 9c 43 fa ec aa 9a 25 f3 b2 9a f6 76 1e 4d 26 3b 54 a8 de 99 15 75 31 fb 54 e4 3d ac fd 8d 6d ab d6 1e 9d 27 5f 7a e7 f5 bf ff db f3 c5 34 a3 26 3f 7e 9c 5f 5f 15 af 93 cb 22 0e 64 62 30 30 b2 b3 49 52 d7 f1 7c b6 28 74 6a 36 2b 92 79 f1 24 99 4c d2 24 bb 88 87 22 bd 93 46 49 78 33 2b e6 8b d9 74 47 25 86 37 9f 92 d9 4e 11 27 b3 d1 e2 b2 98 ce eb de a4 98 8e e6 e3 41 39 ec 14 0f Data Ascii: rI(>fdB6 )U/(mGRuw IBX<Op}=#P>sYD,';'2Uu5C%vM&;Tu1T=m'_z4&?~__"db00IR\|(tj6+y$L$"FIx3+tG%7N'A9
2024-07-04 19:43:49 UTC	8192	IN	Data Raw: 6c e9 6c a4 d8 54 24 33 0b b9 12 68 7c a8 cb 80 68 e5 8a 1b aa 58 1c ab 03 f1 09 5e fe 9c 59 7a 22 d1 2b 6a 17 a7 96 8e 34 b6 b2 63 8d 82 48 1e bd 31 e3 a1 ee 50 5e b8 f8 50 d5 d4 45 8e 2c 0b 0c e4 59 92 19 37 04 69 84 a6 05 37 86 b2 3a 42 05 80 ef 78 01 22 ae 10 6c fd d7 62 21 6b db c8 fe 82 90 2a 1b 15 fd b6 d8 7c fb d8 32 63 3e 00 1f c5 cc da 1f 52 5c 71 09 c9 0c 19 5e f1 1f 46 99 2a ed 08 6a 9f d0 92 84 66 67 97 3f e5 bc a8 15 48 52 0e e7 49 18 b3 e2 b2 fa 64 1b 83 ca 55 6c f5 33 95 f6 e6 30 11 61 2a fb 93 44 47 fa c4 6e 4c 11 43 7d 34 6f d0 a1 1a c7 91 e4 35 0d 64 21 97 b1 64 5a 47 47 25 87 b5 7f a4 14 4a da 8e 3b 93 a6 76 c9 fe 21 19 3e 82 c4 fc 1a 08 24 c4 5b 09 32 a8 a4 c4 e7 a8 ee 28 38 3d d9 4f be a3 4b 81 e4 c1 21 fc 64 53 f8 e4 0b 88 36 59 17 Data Ascii: llT$3h\|hX^Yz"+j4cH1P^PE,Y7i7:Bx"lb!k\|2c>R\q^Fjfg?HRIdUl30a*DGnLC}4o5d!dZGG%J;v!>$[2(8=OK!dS6Y
2024-07-04 19:43:49 UTC	4019	IN	Data Raw: c3 b3 55 68 44 75 fc f8 31 33 b4 12 71 1c 54 f4 5c 49 20 1e 0c 6b bd d0 69 93 a7 2c 78 e1 20 2f 26 c5 bc b0 5b 61 5d f5 d7 81 57 e2 5a 31 dd ff e9 fd 3f 4b 66 23 cd fa ff 94 d0 76 e7 5f f2 da bf e4 b5 7f c9 6b 1c c8 e6 9f 27 b0 09 11 2a 62 81 68 cc c2 d6 ce 7c be 46 66 b3 aa 78 85 36 0b cc ff a0 d8 76 b0 4e 68 c3 4e 72 0f ff af 10 db 10 69 0a e5 ff 92 db fe af 96 db c4 c6 fa 2f c1 ed 6b 05 b7 75 ef 99 be 2f 66 f4 10 48 c2 01 ba 07 8d b4 de 5f 92 4f c9 fb 6c 56 5e cd 65 ba ef 49 8d cd 75 bc af 6d 6f ac b5 75 97 e8 a9 91 59 fd a1 7a 56 67 c9 15 47 71 a0 77 d9 bf aa fa 6d 2a e2 6e 4a cd c5 46 ac 88 bb 9d 7f 2c 4f fe 81 41 8c ce c2 d3 53 8a 66 74 80 ac ed f4 b4 d3 d9 3f 3e 21 33 d7 b0 73 dc 3f 49 f6 7f 7d b4 ff df 67 cb 0e 06 8b e9 2e f7 43 ca c3 a0 3b c7 a7 Data Ascii: UhDu13qT\I ki,x /&[a]WZ1?Kf#v_k'bh\|Ffx6vNhNri/ku/fH_OlV^eIumouYzVgGqwmnJF,OASft?>!3s?I}g.C;
2024-07-04 19:43:49 UTC	8192	IN	Data Raw: 99 0c f5 06 e7 1f 83 5c cb df 30 bf 7a c1 ba c4 49 f6 4b da 6e 7c 03 09 bc 4f 86 c9 ac dc 76 f9 0a e3 ee 1e 9f 2d f7 f6 e4 17 00 cd 96 cb cc 5a ce 9b 57 4f 4e 56 58 c0 f9 e5 23 e8 23 fe 27 15 af c4 67 83 64 70 1e 27 51 67 14 c3 9e a6 b4 26 6f 89 12 c3 b0 f5 6c 25 e2 c1 bc 9f 5f 4f c8 14 4c 2e f6 79 32 c2 9d ef 58 7d d9 61 0c fb 92 8e 3b b2 25 5e 85 f2 17 ae aa bd 3d 3a 0f 05 8f df 3c fd 19 68 9a e4 e1 51 ef 8a a2 85 b0 0e 30 49 eb 6a b2 98 17 68 be 78 93 77 63 13 d6 a0 d0 bf 71 0e f9 21 02 0f 9d 3f 8c ef 53 65 fd ec 0d 50 33 ae 1b 84 42 b4 19 22 ac 46 36 00 e5 dc d5 6a 2b e4 64 8c 9c 71 9c 1e a7 6a 14 0a 0f bb b0 2f 8f ed 31 89 89 31 38 31 cc 11 4e 8d 4e 80 63 d7 2d 70 ad b1 c9 26 ee c1 8f 1f 5e bd 84 ef 4e 62 71 c2 c4 e0 6c 80 99 fd d8 ce 3e 1c 14 3a 89 Data Ascii: \0zIKn\|Ov-ZWONVX##'gdp'Qg&ol%_OL.y2X}a;%^=:<hQ0Ijhxwcq!?SeP3B"F6j+dqj/1181NNc-p&^Nbql>:
2024-07-04 19:43:49 UTC	1695	IN	Data Raw: 5f 66 9e 57 d8 29 04 89 6a df ac dc 63 ef 6c 23 8c fb d7 23 1b eb 1a 8d e6 3b 0d 04 06 61 98 89 d6 d8 91 51 3c e7 b7 d3 a8 a9 3d bb 54 0d f8 25 8b cb 24 db 2b 51 d8 03 c1 84 10 11 5c f8 fb 8c fd 10 16 a4 d1 38 be c0 19 40 f6 41 93 39 e6 77 21 a1 c9 cd eb 2d 93 eb 0d be f4 fa 81 1f d6 ca 89 b2 70 e5 1f a1 17 37 bb 99 92 1c b2 5e ee 88 d5 59 1f d2 b0 9b c3 07 c0 1b 96 cb e1 c3 f8 3e fe 3b 96 6c 82 ec f0 61 bf 19 6f 35 80 db 71 09 7a ce d0 58 fa 43 58 fa 99 67 e9 8b 34 75 49 55 0e 14 05 4a c3 5a 20 bc 32 be 05 b7 16 24 b2 b1 8a dd 61 c9 c8 d7 21 c2 ed 57 54 46 41 00 ff 87 62 60 f2 7a a5 5d 28 fa 38 42 25 09 46 8e 80 59 cb 61 3d d4 40 4c 99 e5 61 a8 5f 39 74 5c f3 d3 d0 79 58 10 c5 33 7a 06 0d 37 09 96 6b 3f ce d9 48 4f 9c b8 59 7c 3f 6c ef 8e 90 8a e2 83 7f Data Ascii: _fW)jcl##;aQ<=T%$+Q\8@A9w!-p7^Y>;lao5qzXCXg4uIUJZ 2$a!WTFAb`z](8B%FYa=@La_9t\yX3z7k?HOY\|?l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49719	13.107.136.10	443	2148	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:43:49 UTC	1193	OUT	GET /ScriptResource.axd?d=sFKYt98rkOEepMD8HaYdQxw0MdI8XppwKu-u05zm-jrdxw_0lu_7y2XSfk2fjigBSMiXa-lE5A34AyUu4bGg1HoWgo42ZIBCrXE8VVmtBgVmQ72TbUOinfYqW44dx5TAwOn4gaZ14vXlYqMzaycjq_il_bbHsGdSivnjJD1G3gQv2-7SLslJ_DcgLBUXY2VD0&t=74258c30 HTTP/1.1 Host: rjnmail-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 19:43:49 UTC	782	IN	HTTP/1.1 200 OK Cache-Control: public Content-Length: 9984 Content-Type: application/x-javascript Content-Encoding: gzip Expires: Fri, 04 Jul 2025 19:43:49 GMT Last-Modified: Thu, 04 Jul 2024 19:43:49 GMT P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-NetworkStatistics: 0,2102272,0,29,4354418,0,1310195,6 X-AspNet-Version: 4.0.30319 SPRequestDuration: 9 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25019 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 0662360589FC4CB7BE9E22676AEF422F Ref B: EWR311000102027 Ref C: 2024-07-04T19:43:49Z Date: Thu, 04 Jul 2024 19:43:48 GMT Connection: close
2024-07-04 19:43:49 UTC	1971	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e5 7d 6b 73 db 48 92 e0 f7 89 98 ff 40 61 7b 65 62 55 86 e4 de bd b8 08 d2 68 85 5e 9e d6 9e 5f 61 cb d3 33 21 6b 15 05 a0 48 42 02 01 1a 00 6d ab 25 fe b2 fb b0 3f 69 ff c2 65 d6 0b 55 40 81 a4 e4 9e bd 8b b8 89 1e 99 a8 77 65 66 65 66 65 66 55 fd d7 ff fe cf fd fd e7 4f fe df 9f ff b4 bf 3f 38 29 16 77 65 3a 9d d5 83 e1 89 3f 78 93 c6 65 51 15 93 1a d2 cb 45 51 d2 3a 2d f2 60 70 94 65 03 5e a8 1a 94 ac 62 e5 57 96 04 58 fb 07 fb d6 bd 1d dd d0 ef bf b1 e8 55 51 ce ab e0 a6 fa f3 9f 2e ee 16 2c b8 2e d9 34 ad 6a 56 7e 8c cb 74 51 0f bd be f2 1e b9 b4 f3 60 f0 8c a7 db c9 1f 59 99 d2 2c fd 5d cc aa 9b ff 96 d5 df 8a f2 d6 91 73 52 cc 17 45 ce f2 fa 4d 91 b0 0c 0b 5c f9 63 3e 48 35 c6 b7 74 ce aa 05 8d d9 d0 fb 78 57 05 6a 74 Data Ascii: }ksH@a{ebUh^_a3!kHBm%?ieU@wefefefUO?8)we:?xeQEQ:-`pe^bWXUQ.,.4jV~tQ`Y,]sREM\c>H5txWjt
2024-07-04 19:43:49 UTC	8013	IN	Data Raw: 5f 39 95 ab e0 ab b4 ec a7 84 a6 35 25 d6 cd dc b4 3a 29 8b aa c2 8e 2c c2 50 80 fc c8 6a b4 d1 59 dd 2a 37 89 35 59 a4 64 31 61 07 e8 44 b6 e4 9f 9c 0e 9d 85 7e e3 8a c0 a7 1c f5 1f 17 02 4c 1a 91 8a 82 65 b0 52 24 71 51 bc 02 b6 dd 46 7a 91 65 50 99 a3 d0 c2 79 59 c4 a8 ab e4 53 b9 04 2d 38 08 62 11 52 9d 55 a1 76 19 d6 25 cd 2b 24 ae 57 29 cb 12 40 ad 77 7d fd d7 f3 b3 df 3e 5e 1c 5d 9c 9d bd 3d f9 f0 f7 f7 17 67 a7 c0 e7 8c e4 57 e7 67 af 4f 4f de 7d 7a 7b e1 29 42 c0 dd 22 fa db ab 70 ff 3f 86 f8 f1 b0 00 1d e3 5b 51 26 0f b3 34 49 58 fe 50 81 52 14 cf 1e 6a 96 3d 2c cb ec 81 cd 81 93 3e e4 cb 79 c4 ca 07 18 c3 94 3d c4 45 56 94 0f b8 1a 51 33 e2 3f 1e e6 00 8a d9 c3 37 c6 6e 1f 74 22 fe 78 9e 15 31 cd fc 9f f6 d3 8d 2c c8 b4 41 5e 73 7f 24 1a 0c 25 Data Ascii: _95%:),PjY*75Yd1aD~LeR$qQFzePyYS-8bRUv%+$W)@w}>^]=gWgOO}z{)B"p?[Q&4IXPRj=,>y=EVQ3?7nt"x1,A^s$%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49718	13.107.136.10	443	2148	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:43:49 UTC	1115	OUT	GET /WebResource.axd?d=cJDku4LPR0hyEjv_M8Kns8-LnsNih-hW-uLOSr1zW1jQmNRW7lEiJ5sSjrYld8ki7UcxJbybV3H2_HmR_ribQxD8ZBjx1xRfOab_Fx2WmQs1&t=638533172441064469 HTTP/1.1 Host: rjnmail-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 19:43:49 UTC	756	IN	HTTP/1.1 200 OK Cache-Control: public Content-Length: 23063 Content-Type: application/x-javascript Expires: Fri, 04 Jul 2025 05:31:58 GMT Last-Modified: Fri, 07 Jun 2024 07:34:04 GMT P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-NetworkStatistics: 0,525568,0,597,979,0,119916,196 X-AspNet-Version: 4.0.30319 SPRequestDuration: 4 SPIisLatency: 0 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25019 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 24E1617F92724F6C96944F101C53582C Ref B: EWR311000102045 Ref C: 2024-07-04T19:43:49Z Date: Thu, 04 Jul 2024 19:43:48 GMT Connection: close
2024-07-04 19:43:49 UTC	3391	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 57 65 62 46 6f 72 6d 5f 50 6f 73 74 42 61 63 6b 4f 70 74 69 6f 6e 73 28 65 76 65 6e 74 54 61 72 67 65 74 2c 20 65 76 65 6e 74 41 72 67 75 6d 65 6e 74 2c 20 76 61 6c 69 64 61 74 69 6f 6e 2c 20 76 61 6c 69 64 61 74 69 6f 6e 47 72 6f 75 70 2c 20 61 63 74 69 6f 6e 55 72 6c 2c 20 74 72 61 63 6b 46 6f 63 75 73 2c 20 63 6c 69 65 6e 74 53 75 62 6d 69 74 29 20 7b 0d 0a 20 20 20 20 74 68 69 73 2e 65 76 65 6e 74 54 61 72 67 65 74 20 3d 20 65 76 65 6e 74 54 61 72 67 65 74 3b 0d 0a 20 20 20 20 74 68 69 73 2e 65 76 65 6e 74 41 72 67 75 6d 65 6e 74 20 3d 20 65 76 65 6e 74 41 72 67 75 6d 65 6e 74 3b 0d 0a 20 20 20 20 74 68 69 73 2e 76 61 6c 69 64 61 74 69 6f 6e 20 3d 20 76 61 6c 69 64 61 74 69 6f 6e 3b 0d 0a 20 20 20 20 74 68 69 73 2e 76 61 6c Data Ascii: function WebForm_PostBackOptions(eventTarget, eventArgument, validation, validationGroup, actionUrl, trackFocus, clientSubmit) { this.eventTarget = eventTarget; this.eventArgument = eventArgument; this.validation = validation; this.val
2024-07-04 19:43:49 UTC	8192	IN	Data Raw: 73 74 61 74 65 63 68 61 6e 67 65 20 3d 20 57 65 62 46 6f 72 6d 5f 43 61 6c 6c 62 61 63 6b 43 6f 6d 70 6c 65 74 65 3b 0d 0a 20 20 20 20 20 20 20 20 63 61 6c 6c 62 61 63 6b 2e 78 6d 6c 52 65 71 75 65 73 74 20 3d 20 78 6d 6c 52 65 71 75 65 73 74 3b 0d 0a 20 20 20 20 20 20 20 20 2f 2f 20 65 2e 67 2e 20 68 74 74 70 3a 0d 0a 20 20 20 20 20 20 20 20 76 61 72 20 61 63 74 69 6f 6e 20 3d 20 74 68 65 46 6f 72 6d 2e 61 63 74 69 6f 6e 20 7c 7c 20 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 2c 20 66 72 61 67 6d 65 6e 74 49 6e 64 65 78 20 3d 20 61 63 74 69 6f 6e 2e 69 6e 64 65 78 4f 66 28 27 23 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 69 66 20 28 66 72 61 67 6d 65 6e 74 49 6e 64 65 78 20 21 3d 3d 20 2d 31 29 20 7b 0d 0a 20 20 20 20 20 20 Data Ascii: statechange = WebForm_CallbackComplete; callback.xmlRequest = xmlRequest; // e.g. http: var action = theForm.action \|\| document.location.pathname, fragmentIndex = action.indexOf('#'); if (fragmentIndex !== -1) {
2024-07-04 19:43:49 UTC	4167	IN	Data Raw: 20 20 20 20 72 65 74 75 72 6e 20 69 3b 0d 0a 7d 0d 0a 76 61 72 20 5f 5f 6e 6f 6e 4d 53 44 4f 4d 42 72 6f 77 73 65 72 20 3d 20 28 77 69 6e 64 6f 77 2e 6e 61 76 69 67 61 74 6f 72 2e 61 70 70 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2e 69 6e 64 65 78 4f 66 28 27 65 78 70 6c 6f 72 65 72 27 29 20 3d 3d 20 2d 31 29 3b 0d 0a 76 61 72 20 5f 5f 74 68 65 46 6f 72 6d 50 6f 73 74 44 61 74 61 20 3d 20 22 22 3b 0d 0a 76 61 72 20 5f 5f 74 68 65 46 6f 72 6d 50 6f 73 74 43 6f 6c 6c 65 63 74 69 6f 6e 20 3d 20 6e 65 77 20 41 72 72 61 79 28 29 3b 0d 0a 76 61 72 20 5f 5f 63 61 6c 6c 62 61 63 6b 54 65 78 74 54 79 70 65 73 20 3d 20 2f 5e 28 74 65 78 74 7c 70 61 73 73 77 6f 72 64 7c 68 69 64 64 65 6e 7c 73 65 61 72 63 68 7c 74 65 6c 7c 75 72 6c 7c 65 6d 61 69 6c 7c Data Ascii: return i;}var __nonMSDOMBrowser = (window.navigator.appName.toLowerCase().indexOf('explorer') == -1);var __theFormPostData = "";var __theFormPostCollection = new Array();var __callbackTextTypes = /^(text\|password\|hidden\|search\|tel\|url\|email\|
2024-07-04 19:43:49 UTC	7313	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 64 65 66 61 75 6c 74 42 75 74 74 6f 6e 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 5b 74 61 72 67 65 74 5d 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 69 66 20 28 64 65 66 61 75 6c 74 42 75 74 74 6f 6e 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 57 65 62 46 6f 72 6d 5f 53 69 6d 75 6c 61 74 65 43 6c 69 63 6b 28 64 65 66 61 75 6c 74 42 75 74 74 6f 6e 2c 20 65 76 65 6e 74 29 3b 0d 0a 20 20 20 20 20 20 20 20 7d 20 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 72 65 74 75 72 6e 20 74 72 75 65 3b 0d 0a 7d 0d 0a 66 75 6e 63 74 69 6f 6e 20 57 65 62 46 6f 72 6d 5f 47 65 74 53 63 72 6f 6c 6c 58 28 29 20 7b 0d 0a 20 20 20 20 69 66 20 28 5f 5f 6e 6f 6e 4d 53 44 4f 4d 42 72 6f 77 73 65 72 29 Data Ascii: defaultButton = document.all[target]; } if (defaultButton) { return WebForm_SimulateClick(defaultButton, event); } } return true;}function WebForm_GetScrollX() { if (__nonMSDOMBrowser)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49724	13.107.136.10	443	2148	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:43:50 UTC	1065	OUT	GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1 Host: rjnmail-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 19:43:50 UTC	735	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 7886 Content-Type: image/x-icon Last-Modified: Fri, 28 Jun 2024 04:06:51 GMT Accept-Ranges: bytes ETag: "da70ce9a10c9da1:0" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-NetworkStatistics: 0,1051136,5,18,3255234,0,933470,6 SPRequestDuration: 6 SPIisLatency: 2 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25019 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 94F10A282C4B47FBA75855A056FDF274 Ref B: EWR311000103021 Ref C: 2024-07-04T19:43:50Z Date: Thu, 04 Jul 2024 19:43:49 GMT Connection: close
2024-07-04 19:43:50 UTC	1230	IN	Data Raw: 00 00 01 00 03 00 20 20 00 00 01 00 20 00 a8 10 00 00 36 00 00 00 18 18 00 00 01 00 20 00 88 09 00 00 de 10 00 00 10 10 00 00 01 00 20 00 68 04 00 00 66 1a 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 c6 37 30 d0 c6 37 af d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 af d0 c6 37 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6 hf( @ 7077777770
2024-07-04 19:43:50 UTC	6656	IN	Data Raw: a1 9b 1a ff a1 9b 1a cf a1 9b 1a 10 00 00 00 00 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 78 72 1f ff bb b2 31 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff cd c3 35 ff a4 9e 1c ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a bf 00 00 00 00 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 78 72 1f ff bb b2 31 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff b0 a8 23 ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a Data Ascii: xr17775xr1777#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49726	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:43:51 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-04 19:43:51 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0758) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=40811 Date: Thu, 04 Jul 2024 19:43:51 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49727	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:43:52 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-04 19:43:52 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=40831 Date: Thu, 04 Jul 2024 19:43:52 GMT Content-Length: 55 Connection: close X-CID: 2
2024-07-04 19:43:52 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49729	13.107.136.10	443	2148	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:43:52 UTC	386	OUT	GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1 Host: rjnmail-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 19:43:52 UTC	740	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 7886 Content-Type: image/x-icon Last-Modified: Fri, 28 Jun 2024 04:06:51 GMT Accept-Ranges: bytes ETag: "da70ce9a10c9da1:0" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-NetworkStatistics: 0,4204800,328,49,7970485,0,4204800,6 SPRequestDuration: 19 SPIisLatency: 42 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25019 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 961F549F35824E63935E11C636FF0E18 Ref B: EWR311000104031 Ref C: 2024-07-04T19:43:52Z Date: Thu, 04 Jul 2024 19:43:52 GMT Connection: close
2024-07-04 19:43:52 UTC	2113	IN	Data Raw: 00 00 01 00 03 00 20 20 00 00 01 00 20 00 a8 10 00 00 36 00 00 00 18 18 00 00 01 00 20 00 88 09 00 00 de 10 00 00 10 10 00 00 01 00 20 00 68 04 00 00 66 1a 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 c6 37 30 d0 c6 37 af d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 af d0 c6 37 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6 hf( @ 7077777770
2024-07-04 19:43:52 UTC	5773	IN	Data Raw: ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff cb c9 91 ff ff ff ff ff ff ff ff ff ff ff ff ff d2 d1 a1 ff 9e 9a 32 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 5d 59 0e ff 91 8b 17 ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a cf 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff ff ff ff ff ff ff ff ff da d8 b0 ff 96 93 23 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 87 83 03 ff 54 51 0a ff 91 8b 17 ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b 1a ff a1 9b Data Ascii: 2]Y#TQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49730	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:44:03 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=shRHyYyVrawGE2l&MD=B1B9KYW5 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-04 19:44:03 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 6ef9af74-e4ef-4b89-a31d-8e089bece57f MS-RequestId: eb2f5220-b350-4fa6-ba72-4935c004eedd MS-CV: cRTSifpeskG2th/z.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 04 Jul 2024 19:44:02 GMT Connection: close Content-Length: 24490
2024-07-04 19:44:03 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-07-04 19:44:03 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49737	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:44:41 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=shRHyYyVrawGE2l&MD=B1B9KYW5 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-04 19:44:41 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: a02ce9aa-b9ff-467d-912d-c9d3c4126c27 MS-RequestId: 45338169-25df-4880-9b0c-21f367e44cb6 MS-CV: RdHtEIj0+E+ZY465.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 04 Jul 2024 19:44:40 GMT Connection: close Content-Length: 30005
2024-07-04 19:44:41 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-07-04 19:44:41 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Target ID:	0
Start time:	15:43:41
Start date:	04/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	15:43:44
Start date:	04/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2224,i,9236425076649525401,17373768222617990273,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	15:43:45
Start date:	04/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3d"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets