Edit tour

Windows Analysis Report
https://forms.office.com/e/cKTtUPrCQw

Overview

General Information

Sample URL:	https://forms.office.com/e/cKTtUPrCQw
Analysis ID:	1672184
Infos:

Detection

Score:	0
Range:	0 - 100
Confidence:	100%

Signatures

No high impact signatures.

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6296 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6524 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2076,i,8663513068485825617,9074641674287346812,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5504 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://forms.office.com/e/cKTtUPrCQw" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.69.4:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.125.62.241:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.125.62.241:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.125.62.241:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.73.79:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.73.79:443 -> 192.168.2.16:49743 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.234.254
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.69
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.234.254
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.69
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /e/cKTtUPrCQw HTTP/1.1Host: forms.office.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturl HTTP/1.1Host: forms.office.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /formapi/api/730d681e-b6b9-41a0-b3f9-9e4a48f8f6b5/users/eee5f5fd-0405-46f1-9b64-5ec1b1f9dd8d/light/runtimeFormsWithResponses('HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u')?$expand=questions($expand=choices)&$top=1 HTTP/1.1Host: forms.office.comConnection: keep-aliveX-UserSessionId: 0f67ab2e-817f-475d-bf55-a350b06806a5sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: application/jsonsec-ch-ua-mobile: ?0__RequestVerificationToken: xmzLGVfwn4f6DjSIrV86d6OkeD3PyT_Mr3LpHIifcODkyfCWPgETKKZ7FMcKc3ARKAoE9nierau9kvf6LnzKE_ayUTAnWkW8hv9sWqOzFbY1Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
Source: global traffic	HTTP traffic detected: GET /cdn/scripts/dists/ls-response.en-us.b26195a5d.js HTTP/1.1Host: forms.office.comConnection: keep-aliveOrigin: https://forms.office.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
Source: global traffic	HTTP traffic detected: GET /cdn/scripts/dists/dll-dompurify.min.ea88d58.js HTTP/1.1Host: forms.office.comConnection: keep-aliveOrigin: https://forms.office.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
Source: global traffic	HTTP traffic detected: GET /cdn/scripts/dists/light-response-page.min.48f0da1.js HTTP/1.1Host: forms.office.comConnection: keep-aliveOrigin: https://forms.office.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
Source: global traffic	HTTP traffic detected: GET /formapi/api/730d681e-b6b9-41a0-b3f9-9e4a48f8f6b5/users/eee5f5fd-0405-46f1-9b64-5ec1b1f9dd8d/light/runtimeFormsWithResponses('HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u')?$expand=questions($expand=choices)&$top=1 HTTP/1.1Host: forms.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
Source: global traffic	HTTP traffic detected: GET /cdn/scripts/dists/light-response-page.chunk.lrp_ext.be5dfbd.js HTTP/1.1Host: forms.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
Source: global traffic	HTTP traffic detected: GET /cdn/scripts/dists/light-response-page.chunk.lrp_saveresponse.0286355.js HTTP/1.1Host: forms.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
Source: global traffic	HTTP traffic detected: GET /cdn/scripts/dists/light-response-page.chunk.lrp_cover.37daef8.js HTTP/1.1Host: forms.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
Source: global traffic	HTTP traffic detected: GET /cdn/scripts/dists/light-response-page.chunk.lrp_post.boot.2090f6d.js HTTP/1.1Host: forms.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
Source: global traffic	HTTP traffic detected: GET /cdn/scripts/dists/light-response-page.chunk.sw.a912249.js HTTP/1.1Host: forms.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
Source: global traffic	HTTP traffic detected: GET /cdn/images/microsoft365logo_v1.png HTTP/1.1Host: forms.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
Source: global traffic	HTTP traffic detected: GET /cdn/scripts/dists/light-response-page.chunk.utel.fa097bf.js HTTP/1.1Host: forms.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
Source: global traffic	HTTP traffic detected: GET /cdn/images/microsoft365logo_v1.png HTTP/1.1Host: forms.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
Source: global traffic	HTTP traffic detected: GET /sw.js?ring=Business HTTP/1.1Host: forms.office.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
Source: global traffic	HTTP traffic detected: GET /c.gif HTTP/1.1Host: c.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://forms.office.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /offline.aspx HTTP/1.1Host: forms.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://forms.office.com/sw.js?ring=BusinessAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81; MUID=27182357164C6E0D18C03680124C65A5
Source: global traffic	HTTP traffic detected: GET /c.gif?ctsa=mr&CtsSyncId=70A8AF966E244705BDB164130EDD155B&MUID=27182357164C6E0D18C03680124C65A5 HTTP/1.1Host: c.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://forms.office.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: SM=T; MUID=27182357164C6E0D18C03680124C65A5
Source: global traffic	HTTP traffic detected: GET /muid.gif?muid=27182357164C6E0D18C03680124C65A5 HTTP/1.1Host: forms.cloud.microsoftConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://forms.office.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c.gif?ctsa=mr&CtsSyncId=70A8AF966E244705BDB164130EDD155B&MUID=27182357164C6E0D18C03680124C65A5 HTTP/1.1Host: c.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: MUID=27182357164C6E0D18C03680124C65A5; SM=C; MR=0; ANONCHK=0
Source: global traffic	HTTP traffic detected: GET /pwa/en-us/app.webmanifest HTTP/1.1Host: forms.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn/images/favicon.ico HTTP/1.1Host: forms.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81; MUID=27182357164C6E0D18C03680124C65A5
Source: global traffic	HTTP traffic detected: GET /muid.gif?muid=27182357164C6E0D18C03680124C65A5 HTTP/1.1Host: forms.cloud.microsoftConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: MUID=27182357164C6E0D18C03680124C65A5
Source: global traffic	HTTP traffic detected: GET /images/pwa/forms-pwa-logo-192.png HTTP/1.1Host: cdn.forms.office.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://forms.office.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn/images/favicon.ico HTTP/1.1Host: forms.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81; MUID=27182357164C6E0D18C03680124C65A5
Source: global traffic	HTTP traffic detected: GET /images/pwa/forms-pwa-logo-192.png HTTP/1.1Host: cdn.forms.office.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: forms.office.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: c.office.com
Source: global traffic	DNS traffic detected: DNS query: forms.cloud.microsoft
Source: global traffic	DNS traffic detected: DNS query: cdn.forms.office.net

Source: chromecache_67.1.dr	String found in binary or memory: https://aka.ms/FormsConsumerElite.
Source: chromecache_82.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/dll-dompurify.min.ea88d58.js.map/eabe35a8
Source: chromecache_89.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.lrp_cover.37dae
Source: chromecache_69.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.lrp_ext.be5dfbd
Source: chromecache_85.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.lrp_post.boot.2
Source: chromecache_78.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.lrp_saverespons
Source: chromecache_79.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.sw.a912249.js.m
Source: chromecache_84.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.utel.fa097bf.js
Source: chromecache_80.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.min.48f0da1.js.map/1b
Source: chromecache_77.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/sw.js.map/0564851969f7b27313f7dbbfdc50e10
Source: chromecache_88.1.dr	String found in binary or memory: https://cdn.forms.office.net/images/pwa/forms-pwa-logo-192.png
Source: chromecache_88.1.dr	String found in binary or memory: https://cdn.forms.office.net/images/pwa/forms-pwa-logo-256.png
Source: chromecache_88.1.dr	String found in binary or memory: https://cdn.forms.office.net/images/pwa/forms-pwa-logo-512.png
Source: chromecache_71.1.dr	String found in binary or memory: https://www.notion.so/Laurence-Gauche-Plan-te-Communication-1de76edc52e8804181e5fd3610dc76d0?pvs=4

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.69.4:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.125.62.241:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.125.62.241:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.125.62.241:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.73.79:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.73.79:443 -> 192.168.2.16:49743 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@22/40@18/7

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2076,i,8663513068485825617,9074641674287346812,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://forms.office.com/e/cKTtUPrCQw"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2076,i,8663513068485825617,9074641674287346812,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://forms.office.com/e/cKTtUPrCQw	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
a1894.dscms.akamai.net	23.220.73.79	true	false	high
b-0039.b-msedge.net	13.107.6.194	true	false	high
c-msn-pme.trafficmanager.net	20.125.62.241	true	false	high
www.google.com	142.250.69.4	true	false	high
ax-0001.ax-msedge.net	150.171.28.10	true	false	high
forms.office.com	unknown	unknown	false	high
forms.cloud.microsoft	unknown	unknown	false	high
c.office.com	unknown	unknown	false	high
cdn.forms.office.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.lrp_cover.37daef8.js	false	high
https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.lrp_ext.be5dfbd.js	false	high
https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturl	false	high
https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.utel.fa097bf.js	false	high
https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.lrp_saveresponse.0286355.js	false	high
https://forms.office.com/cdn/images/microsoft365logo_v1.png	false	high
https://forms.office.com/e/cKTtUPrCQw	false	high
https://forms.office.com/cdn/scripts/dists/dll-dompurify.min.ea88d58.js	false	high
https://forms.office.com/sw.js?ring=Business	false	high
https://forms.office.com/cdn/scripts/dists/ls-response.en-us.b26195a5d.js	false	high
https://c.office.com/c.gif?ctsa=mr&CtsSyncId=70A8AF966E244705BDB164130EDD155B&MUID=27182357164C6E0D18C03680124C65A5	false	high
https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.sw.a912249.js	false	high
https://c.office.com/c.gif	false	high
https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.lrp_post.boot.2090f6d.js	false	high
https://forms.office.com/cdn/images/favicon.ico	false	high
https://forms.office.com/pwa/en-us/app.webmanifest	false	high
https://forms.office.com/offline.aspx	false	high
https://forms.office.com/cdn/scripts/dists/light-response-page.min.48f0da1.js	false	high
https://forms.cloud.microsoft/muid.gif?muid=27182357164C6E0D18C03680124C65A5	false	high
https://cdn.forms.office.net/images/pwa/forms-pwa-logo-192.png	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.lrp_cover.37dae	chromecache_89.1.dr	false	high
https://aka.ms/FormsConsumerElite.	chromecache_67.1.dr	false	high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.lrp_ext.be5dfbd	chromecache_69.1.dr	false	high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.sw.a912249.js.m	chromecache_79.1.dr	false	high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.lrp_saverespons	chromecache_78.1.dr	false	high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.utel.fa097bf.js	chromecache_84.1.dr	false	high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.lrp_post.boot.2	chromecache_85.1.dr	false	high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/sw.js.map/0564851969f7b27313f7dbbfdc50e10	chromecache_77.1.dr	false	high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.min.48f0da1.js.map/1b	chromecache_80.1.dr	false	high
https://cdn.forms.office.net/images/pwa/forms-pwa-logo-256.png	chromecache_88.1.dr	false	high
https://cdn.forms.office.net/images/pwa/forms-pwa-logo-512.png	chromecache_88.1.dr	false	high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/dll-dompurify.min.ea88d58.js.map/eabe35a8	chromecache_82.1.dr	false	high
https://www.notion.so/Laurence-Gauche-Plan-te-Communication-1de76edc52e8804181e5fd3610dc76d0?pvs=4	chromecache_71.1.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.69.4	www.google.com	United States	15169	GOOGLEUS	false
20.125.62.241	c-msn-pme.trafficmanager.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.6.194	b-0039.b-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.220.73.79	a1894.dscms.akamai.net	United States	13489	EPMTelecomunicacionesSAESPCO	false

Private

IP
192.168.2.16
192.168.2.18
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1672184
Start date and time:	2025-04-23 17:02:38 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://forms.office.com/e/cKTtUPrCQw
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@22/40@18/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.178.49.174, 192.178.49.195, 74.125.137.84, 142.250.69.14, 20.50.80.210, 52.178.17.233, 142.250.101.84, 4.175.87.197, 150.171.28.10, 184.29.183.29
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, clientservices.googleapis.com, eu.events.data.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, onedscolprdweu08.westeurope.cloudapp.azure.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, onedscolprdneu05.northeurope.cloudapp.azure.com, c.bing.com, update.googleapis.com, clients.l.google.com, eu-mobile.events.data.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://forms.office.com/e/cKTtUPrCQw

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (35296), with no line terminators
Category:	downloaded
Size (bytes):	35318
Entropy (8bit):	4.783693763527761
Encrypted:	false
SSDEEP:	768:ZpzfymM8C/I9ujl4wRsQuhl9/eQ0NR4a9WGYO6qxe1HUUVd2lHE1L4/OrRxk:Z4RA9+46shl9/eQ0NR4a9WGYOVx8HUEg
MD5:	6B3065D1A07299F78BEDA1836903C794
SHA1:	002AC4FE4E7EFFA7B90B24E28BB988A22A3CC54A
SHA-256:	755AE7F0722D0A106C0D43DE945B4DD4E100B178ED7AAB4885ADAFE43FC7F56F
SHA-512:	BF3C1A7DC9F27C177261CEAAF15643BC8DDEEF25AEE934B59A7B54135448C974B23480788953D91B4E45D7389319A02D6BC2829682F53F1E55A489FA8B2A815A
Malicious:	false
Reputation:	low
URL:	https://forms.office.com/cdn/scripts/dists/ls-response.en-us.b26195a5d.js
Preview:	window.FormsLsMap = (window.FormsLsMap \|\| {});window.FormsLsMap["en-us"]={"mdbicgo":"Required to answer","acmngdo":"This user is not currently restricted from using Microsoft Forms. No further action is needed..","pdnfcop":"Correct","gplbmcp":"Print response","pfjnaob":"Required","dlogacb":"Pause background music","oancfdj":"Play background music","pjgjcee":"Pause live background","dplcjia":"Play live background","giamlmc":"Please select at least {0} options.","ggbmbok":"Please select at most {0} options.","mbpambh":"Please select {0} options.","palclad":"Allow","pefpebc":"Back","ljngmfa":"Cancel","adhcmno":"Close","lelhaog":"Dismiss","lfignjp":",","ekdmdig":"More options","nekefda":"Next","fkcodff":"No","jljijgh":"Points","npbhaja":"Prefill","fookldf":"Preview","nfokege":"Skip","gacoblj":"Yes","glhpeoj":"Copilot Pro","nbfafnl":"Get Copilot Pro","jppmnpa":"Get started with ","jjkafmg":"Supercharge your creativity and productivity with Copilot, your everyday AI companion.","djeklgg":"

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	37
Entropy (8bit):	3.040403544317301
Encrypted:	false
SSDEEP:	3:CUXEcyv+L1pse:J/se
MD5:	3EACD0132310EA44CAD756B378A3BC07
SHA1:	E2216A7E9B73F5CB0279351C78CE61C33475CEA7
SHA-256:	BB229A48BEE31F5D54CA12DC9BD960C63A671F0D4BE86A054C1D324A44499D96
SHA-512:	BD9AB35DDE3A5242B04C159187732E13B0A6DA50DDCFF7015DFB78CDD68743E191EAF5CDDEDD49BEF7D2D5A642C217272A40E5BA603FE24CA676A53F8C417C5D
Malicious:	false
Reputation:	low
URL:	https://forms.cloud.microsoft/muid.gif?muid=27182357164C6E0D18C03680124C65A5
Preview:	GIF89a.......!.......,...........L..;

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (56644)
Category:	downloaded
Size (bytes):	419708
Entropy (8bit):	5.63648320012856
Encrypted:	false
SSDEEP:	6144:h7GSlZIZf7NLevKEspMKRo/mutfUQoZfHHKsQN3sai/VkWwENHNJNMF42OFOC52:tGSbIZf7NLei4aBHzI8neWhNHzNM5
MD5:	FFF7AB7BA12E929D3655E143DAF66255
SHA1:	1FDD2362550009C043743027279DC84999689C07
SHA-256:	D5E36AEBB84048C337F22491D3AE2A942A8DC41CF7BE3AE13F2F64A271C8E54C
SHA-512:	75BFF733F04EB6D6AEBF7D18C1AF737A298BEDE80A494F878B15871A0F36E4C6B88935898B4D01EE7705524AE30425302439382E19BDCBF96F1CAD6D417749E6
Malicious:	false
Reputation:	low
URL:	https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.lrp_ext.be5dfbd.js
Preview:	(self.webpackChunk=self.webpackChunk\|\|[]).push([[579],{60687:function(n,e,t){"use strict";t.d(e,{C6:function(){return i},Cl:function(){return o},YH:function(){return u},aN:function(){return c},sH:function(){return a}});./! @azure/msal-common v13.3.0 2023-08-24 /./! **************************************************************************.Copyright (c) Microsoft Corporation...Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH.REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY.AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,.INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM.LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR.OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR.PERFORMANCE OF THIS SOFTWARE..******

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	dropped
Size (bytes):	7886
Entropy (8bit):	3.973130033666625
Encrypted:	false
SSDEEP:	48:gzeweweQeQeQe2eWe+RjvChvL42Kcb/M96GgEfY86d:pNNttt3X8upiJvQFd
MD5:	9425D8E9313A692BB3F022E8055FAB82
SHA1:	EDDCF3EA767D4C3042D01AC88594D7E795D8615C
SHA-256:	F2A1ABCF12EBD0F329E5B66B811B0BD76C8E954CB283CE3B61E72FBF459EF6F1
SHA-512:	93B3EB3C4CE385D80D4A8F6902355BBD156AC1AA20B8869AF05C8E714E90E74C5630BB8DE34D5B8FC9F876AC44BE314F3A2A08B3163295ADADBC6DD7B8D23561
Malicious:	false
Reputation:	low
Preview:	...... .... .....6......... ............... .h...f...(... ...@..... .........................................................................................................................................................................................................................................................................................................................pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..................................pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..................................pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..................................ZV..ZV..ZV..ZV..ZV..ZV..ZV..ZV..^Z..pl..pl..pl..pl..................................\|x..pl..pl..................................QN..QN..QN..QN..QN..QN..QN..QN..QN..c`..pl..pl..pl..................................\|x..pl..pl............

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4777
Entropy (8bit):	5.266945992815685
Encrypted:	false
SSDEEP:	96:plDDx7H2YT7IwjpNsG+okiZfC3odrzPc7CLYXKyz:lKY3IwjQG+YZfC3odrzkuLc
MD5:	4AC3282551064F6C22AB79605C993E2B
SHA1:	174886E90298CFA78D8A354F9296D46AA70928F5
SHA-256:	D92EF2042FC89175970E45311995EFBB2AAF06C443563D33A47A7E58953D2CCD
SHA-512:	55827250CC6FE9F64404309BBAFBD5457782AC9F835E4E7CA8658396001D68E1A33F821BC58848FA4E8E785B8F2C09A783C3748F83F2112E6A4BE5560D86F1C6
Malicious:	false
Reputation:	low
URL:	https://forms.office.com/formapi/api/730d681e-b6b9-41a0-b3f9-9e4a48f8f6b5/users/eee5f5fd-0405-46f1-9b64-5ec1b1f9dd8d/light/runtimeFormsWithResponses('HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u')?$expand=questions($expand=choices)&$top=1
Preview:	{"responses":null,"form":{"description":null,"onlineSafetyLevel":0,"reputationTier":1,"background":{"altText":null,"contentType":null,"fileIdentifier":null,"originalFileName":null,"resourceId":null,"resourceUrl":null,"height":null,"width":null,"size":null},"header":{"altText":null,"contentType":null,"fileIdentifier":null,"originalFileName":null,"resourceId":null,"resourceUrl":null,"height":null,"width":null,"size":null},"logo":{"altText":null,"contentType":null,"fileIdentifier":null,"originalFileName":null,"resourceId":null,"resourceUrl":null,"height":null,"width":null,"size":null},"tableId":"T1VZVZVSDUTSPA90ZBPQZE4EI0","otherInfo":"{\"Theme\":{\"BackgroundColor\":\"#f5f5f5\",\"Name\":\"Teal_Gradient\",\"PrimaryColor\":\"#03787c\",\"SecondaryColor\":\"#014446\",\"Thumbnail\":\"/Images/Theme/teal-gradient-thumbnail.png\"}}","runtimeResponses":null,"permissions":[],"responderPermissions":[],"status":"Active","category":null,"localeInfo":"{\"TimezoneOffset\":120,\"Locale\":\"en-US\",\"Tim

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	37
Entropy (8bit):	3.040403544317301
Encrypted:	false
SSDEEP:	3:CUXEcyv+L1pse:J/se
MD5:	3EACD0132310EA44CAD756B378A3BC07
SHA1:	E2216A7E9B73F5CB0279351C78CE61C33475CEA7
SHA-256:	BB229A48BEE31F5D54CA12DC9BD960C63A671F0D4BE86A054C1D324A44499D96
SHA-512:	BD9AB35DDE3A5242B04C159187732E13B0A6DA50DDCFF7015DFB78CDD68743E191EAF5CDDEDD49BEF7D2D5A642C217272A40E5BA603FE24CA676A53F8C417C5D
Malicious:	false
Reputation:	low
Preview:	GIF89a.......!.......,...........L..;

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (5844), with CRLF line terminators
Category:	downloaded
Size (bytes):	7914
Entropy (8bit):	4.4735908000780045
Encrypted:	false
SSDEEP:	192:SpQxQDWiOYDOBazx3Vg+V77dk7wxQNy5Z3DVSe:SozYDPzx3Vz7dpdZzV7
MD5:	56F9CD8A07135E776326431C8560F8F2
SHA1:	FCFF27C475A9FB014661B045B59C8BB4799A0392
SHA-256:	0E1D105D6EE902B7279AEFD9E8AF21AB3E5D0CF058332A2A0E53A351524C75E6
SHA-512:	E75E2B65828CDE51CA880AEE30A74A3EE04B25B0FC0D2AF5B4BB675B62B592CF12D284771A0CE0A8174295F93C4D9007DA5C407C65229456EC0F1A18A6C8EE28
Malicious:	false
Reputation:	low
URL:	https://forms.office.com/offline.aspx
Preview:	<!DOCTYPE html>....<html xmlns="http://www.w3.org/1999/xhtml" lang="en-us">..<head>.. <meta charset="utf-8" />.. <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />.. <title>Microsoft Forms</title>.. <style>.. * {.. box-sizing: border-box;.. }.... body {.. height: 100vh;.. margin: 0 auto;.. background-color: #f3f2f1;.. font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;.. }.... .content-root {.. height: 100%;.. display: flex;.. align-items: center;.. justify-content: center;.. padding: 20px;.. }.... .offline-message {.. max-width: 600px;.. }.... .offline-title {.. font-size: 32px;.. line-height: 40px;.. margin-top: 24px;.. }...

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 192 x 192, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	1779
Entropy (8bit):	7.589819392147309
Encrypted:	false
SSDEEP:	24:zrait2296479bsDcRYPlA1yx91eaLHto1xrUU5sS8mR3VNADICk1bEk:HhtR9TUiWKaLHtUrt5sS8MAVsh
MD5:	4150A5D4F2B0284A9E62D247929DD2AA
SHA1:	97CA2D9ECE8F0855B2A93E6BFDFC4883685C51CB
SHA-256:	F058653DCBA7E8B00D4BDB9409E06817F098AB18125CE5A5821520F04030D176
SHA-512:	D034378E76D58A899047B4639115102CC8F89AEF3F300DDAF0C0B3EAE40C8381040D1656109632E9095ED3F399218F196087D070C099FD89B9605DFBC34FB585
Malicious:	false
Reputation:	low
URL:	https://cdn.forms.office.net/images/pwa/forms-pwa-logo-192.png
Preview:	.PNG........IHDR.............e..5....PLTE....pp......@...pp......8...jp...:...lp...6..9......mp...8...kp...6..8...lp.lp7..7...mp...7...lp...7...lp.......lp.lp.lp7......mp...7...lp...6..7...68.;=.@B.AC.IL.NQ.SV.X[.DF.JM.NP.UX.X[.]`._b.ei.fj.hl.il.lp.pt.y}.z}....os.os.rv....uy....hl.x\|.{.....{..~..............MP.......sx..............................................ch..........io.......ou... ..!..".."..#..#..#..$..%..%..&..'..'..'..(..(..)..........+..,..,..,..-........0..0..1..1..2..2..3..3..4..4..4..5..5..6..6..6..6..7..B..b....................1tRNS..... 000@PPP````pp...........................hX....sIDATx....{.E....(.9T@n.V@@"r..jLDR9.TlK...J....J.G-.j...vj..KS...fvwv.......k........n...B.!..B(..xjs.mX.p..W..)..1...I._m..@.2.....0.#..9_.....`[.C..../...q..i............Umd".....b;.[{..H..V..g*\...0T`.z+..X..O._!.....U.F.P)0....X...q....J.q...L....J."....x.....".W}~.Q...b~...,..'.2.#gZU.Q....1gJ7.j..81......K7..?.......i......5......x.o.g...Q..V..SZ.xe-..}..

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 490 x 180, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5895
Entropy (8bit):	7.720248605671278
Encrypted:	false
SSDEEP:	96:n40H7NhvmuFFBL413wHGfZ1rsrohnXcF1BN8+PrfUFd0abvPsrXf:nbRFmuxcJfLrvnXcFjNRUFd00Wv
MD5:	311274C8C9C66E894F5AFA51FACD72CD
SHA1:	386D1FA0B2924DF2C21545CF2FF1DDE2CD985D33
SHA-256:	BC3C029408DAB6B5CB676B990B2E21BDD474E4B2E45DAF87E70210539390BF49
SHA-512:	2117BC16AC878BCC307CEA0DEFA0638800715330E83E9C8C1CAD7398BBF207E9432391B851E004308FB75C20C2D6F587D015FA3FB13F8630FE3E0C7E194979FC
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............[.o.....IDATx......U.....xi.#..l.%3J.t.D\If5h.......>.Ft.....].8f..A...(../....D..1b.%.9:1y.LD.3...~Y....?..........(.s....~.nh........................................................................................................................................................................@...6`.W.....z.m..z....@.:.`..e.agn..w[-..}O.L...Gf.h.V....Wlu......n.....ek...z...Z...lu..AMP..@P...........&... ..j..AMP..@P..............3f.X).K._.J..+....d...5A.t..c._...R6K.2....@P.6A=}...'O...WZ[[{....;~..w[..7.x9.....uR~-.....7GB..0a..e?.........S...R&.<..X.2..r..}.>.hii.]......Q.N.iL..]..>y.r.\.."..U.g..A......K....'....q.LP..o..O..-.l...{....{)...+.....\N...9...P.d..+....B.[.Z..d.....e>...#i~%D.8Y&.E...L..M.+..OX..J1...\|.do&......9..+8.[......ady...P_.....m.....mA-.P...A......a.e.zW.w..EnbIX.3.j.....k....[..Y...q[.r4...xY.....+w.g....Sk\#F..;9&.....4....f...I.'X....n.r.$.APw.P.A....M..8=..).0_.h./...b.....g......e.S...

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	low
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (43703)
Category:	downloaded
Size (bytes):	43869
Entropy (8bit):	5.335509477963998
Encrypted:	false
SSDEEP:	768:H/B2Y7cFzx95J8VHrMM9jBxPCwJ/UECg0atkRQlbR6qTNKOyPUXVFVjfqTlg/SKf:H52fx94JDxPCu/Yg0ajb3T4WfA06fe1Z
MD5:	A85D658FF0CBD62DF9618C30088ECB9D
SHA1:	DF8006FEE096DD943A5CC6FFF725BFC51B2F6493
SHA-256:	2374CE566E5719390B6A32AD36AB4A4C3B4F4C7853397EFEA70D15CAF42C5B46
SHA-512:	096F134835DD4FB10E2D53140252531F9360F87334F7123BCE15E3487F1238E0A96CB152A2C76EC2890F7FADD8102917611EB8E307134058EBDC66D878C26E9A
Malicious:	false
Reputation:	low
URL:	https://forms.office.com/sw.js?ring=Business
Preview:	!function(){"use strict";var e={124:function(){try{self["workbox:core:6.1.0"]&&_()}catch(e){}},390:function(){try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},568:function(){try{self["workbox:core:6.4.0"]&&_()}catch(e){}},639:function(){try{self["workbox:navigation-preload:6.1.0"]&&_()}catch(e){}},695:function(){try{self["workbox:routing:6.1.0"]&&_()}catch(e){}},818:function(){try{self["workbox:strategies:6.1.0"]&&_()}catch(e){}}},t={};function n(r){var s=t[r];if(void 0!==s)return s.exports;var o=t[r]={exports:{}};return e[r](o,o.exports,n),o.exports}n(124);n(639);function r(){return Boolean(self.registration&&self.registration.navigationPreload)}const s=(e,...t)=>{let n=e;return t.length>0&&(n+=` :: ${JSON.stringify(t)}`),n};class o extends Error{constructor(e,t){super(s(e,t)),this.name=e,this.details=t}}const a={googleAnalytics:"googleAnalytics",precache:"precache-v2",prefix:"workbox",runtime:"runtime",suffix:"undefined"!=typeof registration?registration.scope:""},i=e=>[a.prefix

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32224)
Category:	downloaded
Size (bytes):	32486
Entropy (8bit):	5.530083925790618
Encrypted:	false
SSDEEP:	768:r2/6SMY6tYOrXopXE9VZpNHJ0eFXli9HUS9yt:rI6SMYxEXC09V5p0Qli9HUS9yt
MD5:	9A0447D8B053925C252B8685D242F711
SHA1:	95DAAEF6A21D9E2AE3134BAA1137DDF36E4587BC
SHA-256:	F86AA5C1DE6EFF0643E2A5964527718F99BB0FF0236B87A496213DF374362B1C
SHA-512:	2B8CA74F1B41C813BC9551754F0E2E64713A57A2934CF430DBF4004C3E19B6EE078C83B039406D8B08A6AB9E4B9DAC2E9D64D2BD30569C8A25E3230E73EAB808
Malicious:	false
Reputation:	low
URL:	https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.lrp_saveresponse.0286355.js
Preview:	"use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[188],{46887:function(n,e,i){i.d(e,{wh:function(){return o}});var t=i(9468),r=i(891);function o(n){var e=n.redirectURLAfterSignIn,i=n.idp,o=n.origin,a=n.authProvider,d=n.enableEmailHrd,s=void 0===d\|\|d,u=window.location.origin,c=[];if(e){var l=encodeURIComponent(e);c.push("redirecturl=".concat(l))}(0,r.h)(i)\|\|c.push("idp=".concat(i)),(0,r.h)(o)\|\|c.push("origin=".concat(o)),(0,r.h)(a)\|\|c.push("".concat(t.f0,"=").concat(a));var g=c.length?"/?".concat(c.join("&")):"";return s?"".concat(u).concat(g,"#Login=True"):"".concat(u).concat(g)}},26098:function(n,e,i){i.d(e,{v:function(){return r}});var t=i(39980),r=function(n){var e=void 0===n?{}:n,i=e.$tc,r=e.$ri,o=e.$sk,a=e.$fI,d=e.$hG,s=e.$hH,u=e.$ov,c=e.$iT,l=e.$nf,g=e.$ka,f=e.$u$,p=e.$mx,_=e.$jr,h=[];return i&&h.push("CollectionId=".concat(i)),r&&h.push("GroupId=".concat(r)),o&&h.push("Token=".concat(o)),c&&h.push("ResponseTime=".concat(c)),a&&h.push("SaveResponseFormId=".concat(a)),

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (918)
Category:	downloaded
Size (bytes):	1152
Entropy (8bit):	5.358986431153826
Encrypted:	false
SSDEEP:	24:icYJSsfAIgaGn03sJKEDLbRlnMSrDDNGc2b7//8mbqdCu/pkGq:icvsfA/aGSMKuLFRDRunrbY+3
MD5:	BD81C01D8A77280C7A50F5D407D9D88F
SHA1:	772D84EAE30E3AB07B96F259DBBD96C1CB3CAC0E
SHA-256:	B59ACB533C93CC20A5EF0DDE32FF74743D182803A3EDE78F69AEDAF953B09817
SHA-512:	CF8549E78B28C3DBDBB40A30AEE160AFACFF1A7F5975CC74A91B745E40EE79CAAE152F2E42157D8316637A60769659E45E3ACD2DFD05233051F84BF8C3F838F7
Malicious:	false
Reputation:	low
URL:	https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.sw.a912249.js
Preview:	"use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[725],{36001:function(r,e,n){n.r(e),n.d(e,{register:function(){return f}});var t=n(34629),i=n(91676),s=n(17891),u=n(75187),c=n(18992),o=n(59198),a=n(98856);function f(r){return(0,t.sH)(this,void 0,void 0,(function(){var e,n;return(0,t.YH)(this,(function(t){switch(t.label){case 0:return t.trys.push([0,5,,6]),(0,a.hN)()?(0,o.K7)("UnregisterServiceWorker")?[4,navigator.serviceWorker.getRegistrations().then((function(r){return Promise.all(r.map((function(r){return r.unregister()})))}))]:[3,2]:[2];case 1:return t.sent(),[2];case 2:return(0,o.K7)("ServiceWorkerEnabled")\|\|"1"===(0,u.Db)().fsw?(e=r?"Business":(0,s.m1)().ring,[4,navigator.serviceWorker.register((0,i.ab)("/sw.js?ring=".concat(e)))]):[3,4];case 3:t.sent(),t.label=4;case 4:return[3,6];case 5:return n=t.sent(),(0,c.O7)("ServiceWorker.Registration.Error",n),[3,6];case 6:return[2]}}))}))}}}]);..//# sourceMappingURL=https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (39143)
Category:	downloaded
Size (bytes):	494029
Entropy (8bit):	5.476901594359762
Encrypted:	false
SSDEEP:	6144:wuy5ae8seYNJYcRqO4WW45BVl1FMSeg3ME1vzOZPWp4D:Q50ViV7WmME1rOZPWa
MD5:	C7E1D22AB57B42E0CF62BB6A5503C3BC
SHA1:	58FCEC61980708DE7DC470F004EB0DF722B13D97
SHA-256:	3AD24F083FDAD952034858C43FC0D8899CC8EC5199E4F8058737808874EFA00F
SHA-512:	2580397AA6D87765CFD7DFB658EC9FF6ACC8D20FF4E39E4C052C7574DE8336ACF9EB3E81AF72A6B4D621AD4342D664E67509B0A412E259B4C62A7F476200A3F4
Malicious:	false
Reputation:	low
URL:	https://forms.office.com/cdn/scripts/dists/light-response-page.min.48f0da1.js
Preview:	!function(){var n,t,r,e,i,o={94335:function(n,t,r){"use strict";r.d(t,{DU:function(){return o},Iy:function(){return a}});var e,i=r(35695);function o(n){e!==n&&(e=n)}function u(){return void 0===e&&(e="undefined"!=typeof document&&!!document.documentElement&&"rtl"===document.documentElement.getAttribute("dir")),e}function a(){return{rtl:u(),shadowConfig:i.ou}}e=u()},75265:function(n,t,r){"use strict";r.d(t,{b3:function(){return u},nr:function(){return f}});var e,i=r(34629),o=r(35695),u={none:0,insertNode:1,appendChild:2},a="undefined"!=typeof navigator&&/rv:11.0/.test(navigator.userAgent),c={};try{c=window\|\|{}}catch(n){}var f=function(){function n(n,t){var r,e,o,a,c,f;this._rules=[],this._preservedRules=[],this._counter=0,this._keyToClassName={},this._onInsertRuleCallbacks=[],this._onResetCallbacks=[],this._classNameToArgs={},this._config=(0,i.Cl)({injectionMode:"undefined"==typeof document?u.none:u.insertNode,defaultPrefix:"css",namespace:void 0,cspSettings:void 0},n),this._classNameTo

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 192 x 192, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1779
Entropy (8bit):	7.589819392147309
Encrypted:	false
SSDEEP:	24:zrait2296479bsDcRYPlA1yx91eaLHto1xrUU5sS8mR3VNADICk1bEk:HhtR9TUiWKaLHtUrt5sS8MAVsh
MD5:	4150A5D4F2B0284A9E62D247929DD2AA
SHA1:	97CA2D9ECE8F0855B2A93E6BFDFC4883685C51CB
SHA-256:	F058653DCBA7E8B00D4BDB9409E06817F098AB18125CE5A5821520F04030D176
SHA-512:	D034378E76D58A899047B4639115102CC8F89AEF3F300DDAF0C0B3EAE40C8381040D1656109632E9095ED3F399218F196087D070C099FD89B9605DFBC34FB585
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............e..5....PLTE....pp......@...pp......8...jp...:...lp...6..9......mp...8...kp...6..8...lp.lp7..7...mp...7...lp...7...lp.......lp.lp.lp7......mp...7...lp...6..7...68.;=.@B.AC.IL.NQ.SV.X[.DF.JM.NP.UX.X[.]`._b.ei.fj.hl.il.lp.pt.y}.z}....os.os.rv....uy....hl.x\|.{.....{..~..............MP.......sx..............................................ch..........io.......ou... ..!..".."..#..#..#..$..%..%..&..'..'..'..(..(..)..........+..,..,..,..-........0..0..1..1..2..2..3..3..4..4..4..5..5..6..6..6..6..7..B..b....................1tRNS..... 000@PPP````pp...........................hX....sIDATx....{.E....(.9T@n.V@@"r..jLDR9.TlK...J....J.G-.j...vj..KS...fvwv.......k........n...B.!..B(..xjs.mX.p..W..)..1...I._m..@.2.....0.#..9_.....`[.C..../...q..i............Umd".....b;.[{..H..V..g*\...0T`.z+..X..O._!.....U.F.P)0....X...q....J.q...L....J."....x.....".W}~.Q...b~...,..'.2.#gZU.Q....1gJ7.j..81......K7..?.......i......5......x.o.g...Q..V..SZ.xe-..}..

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (22285)
Category:	downloaded
Size (bytes):	44016
Entropy (8bit):	5.378857647537961
Encrypted:	false
SSDEEP:	768:rof57y3/9g570sl6SLaAbgyI1GTBqgrbpXpzd03eWjW8iQa9lCi/LnTnov8UMSjA:rA57y3/9g57/aAlp3pXpzo8mjf/YgN1G
MD5:	7BD5432D1B4C2CFD35B02089F5F50141
SHA1:	8386A842D6F088477EB77F51D22617CB48CC4C60
SHA-256:	72ABD4B9F2809054D0F0C0634A73E5BBCCBDBBCBDC1FE436E3FF09B05B9945D4
SHA-512:	8D712E0547551D621F1B826333FE3CF17D0A4A55B2BBFB4F65CC4FD09D4C0689D3A6D64945174064814382567EB193BF34DD2BEA34D3C0E7CA3143589073FD37
Malicious:	false
Reputation:	low
URL:	https://forms.office.com/cdn/scripts/dists/dll-dompurify.min.ea88d58.js
Preview:	var _dll_dompurify_e493b7c81bd1541deea5;(()=>{var t={21:(t,e,n)=>{"use strict";n.r(e),n.d(e,{TrustedTypeConfig:()=>_,TrustedTypePolicy:()=>u,TrustedTypePolicyFactory:()=>d,TrustedTypesEnforcer:()=>F,trustedTypes:()=>m});./*. @license. * Copyright 2017 Google Inc. All Rights Reserved.. . Licensed under the W3C SOFTWARE AND DOCUMENT NOTICE AND LICENSE.. . https://www.w3.org/Consortium/Legal/2015/copyright-software-and-document. */.const o=["onabort","onactivate","onactivateinvisible","onafterprint","onafterupdate","onanimationcancel","onanimationend","onanimationiteration","onanimationstart","onariarequest","onauxclick","onbeforeactivate","onbeforecopy","onbeforecut","onbeforedeactivate","onbeforeeditfocus","onbeforepaste","onbeforeprint","onbeforeunload","onbegin","onblur","onbounce","oncancel","oncanplay","oncanplaythrough","oncellchange","onchange","onclick","onclose","oncommand","oncontextmenu","oncontrolselect","oncopy","oncuechange","oncut","ondataavailable","ondatasetcha

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	downloaded
Size (bytes):	7886
Entropy (8bit):	3.973130033666625
Encrypted:	false
SSDEEP:	48:gzeweweQeQeQe2eWe+RjvChvL42Kcb/M96GgEfY86d:pNNttt3X8upiJvQFd
MD5:	9425D8E9313A692BB3F022E8055FAB82
SHA1:	EDDCF3EA767D4C3042D01AC88594D7E795D8615C
SHA-256:	F2A1ABCF12EBD0F329E5B66B811B0BD76C8E954CB283CE3B61E72FBF459EF6F1
SHA-512:	93B3EB3C4CE385D80D4A8F6902355BBD156AC1AA20B8869AF05C8E714E90E74C5630BB8DE34D5B8FC9F876AC44BE314F3A2A08B3163295ADADBC6DD7B8D23561
Malicious:	false
Reputation:	low
URL:	https://forms.office.com/cdn/images/favicon.ico
Preview:	...... .... .....6......... ............... .h...f...(... ...@..... .........................................................................................................................................................................................................................................................................................................................pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..................................pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..................................pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..................................ZV..ZV..ZV..ZV..ZV..ZV..ZV..ZV..^Z..pl..pl..pl..pl..................................\|x..pl..pl..................................QN..QN..QN..QN..QN..QN..QN..QN..QN..c`..pl..pl..pl..................................\|x..pl..pl............

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (34054)
Category:	downloaded
Size (bytes):	139624
Entropy (8bit):	5.4469162479340545
Encrypted:	false
SSDEEP:	1536:V77/OFM7P+a6hO192oPlkDnh+ZGopi63H8a5TCvt+lXAXLIGlR5+/9uvq3hNNHzc:V77/nWaaoPl+QlH8a51S5
MD5:	261803046AB8AC8FFC4959F06D4EE6E7
SHA1:	8C99FB59663B15163AF1D8D9EF80D1E56EF492B5
SHA-256:	E50CDCA94BB7AFEE03D45D3A7DE9CF9116761AB2726E49679665AC31DD0E797F
SHA-512:	1B0E2902E2CF5E1696FA717706BE265625F101F135759A8FA956DE4E55F84EE522ECC3862E2FE099ED32BB408077F324F81E4FA468ABAB8B61AB7070EB52EFBA
Malicious:	false
Reputation:	low
URL:	https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.utel.fa097bf.js
Preview:	"use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[231],{8730:function(n,e,t){t.d(e,{A:function(){return E}});var r=t(86783),i=t(25621),u=t(35091),o=t(1880),a=t(38805),f=t(75072),c=t(98090),s=t(98104),l=t(78984),v=t(82873),m=t(48832),d=500;function p(n,e,t){e&&(0,a.cy)(e)&&e[c.oI]>0&&(e=e.sort((function(n,e){return n[l.Vo]-e[l.Vo]})),(0,a.Iu)(e,(function(n){n[l.Vo]<d&&(0,a.$8)("Channel has invalid priority - "+n[c.Ju])})),n[c.y5]({queue:(0,a.N6)(e),chain:(0,v.PV)(e,t[c.GA],t)}))}var b=t(73214),y=t(62032),_=t(49759),h=function(n){function e(){var t,r,o=n.call(this)\|\|this;function s(){t=0,r=[]}return o.identifier="TelemetryInitializerPlugin",o.priority=199,s(),(0,i.A)(e,o,(function(n,e){n.addTelemetryInitializer=function(n){var e={id:t++,fn:n};return r[c.y5](e),{remove:function(){(0,a.Iu)(r,(function(n,t){if(n.id===e.id)return r[c.Ic](t,1),-1}))}}},n[l.qT]=function(e,t){for(var i=!1,o=r[c.oI],s=0;s<o;++s){var l=r[s];if(l)try{if(!1===l.fn[c.y9](null,[e])){i=!0;break}}catch(n){(

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (15336)
Category:	downloaded
Size (bytes):	15592
Entropy (8bit):	5.459192080353886
Encrypted:	false
SSDEEP:	192:SyWRHmilIG+1WbpzjQxE6UmSiMCq04kVJXIeuchHYfy9SlO9o9Iwmu:SyWRHmilIWzvV04YJXIeuchHGlgu
MD5:	202E54432F08F7F8F839EA273D31EEA4
SHA1:	8A70C0FC783E29B8543735F7E2DFED5245BBF6F8
SHA-256:	3EA2403B26C80BE4F290EF699E73A17DDBB6DD8C90F042DF0DFEC4AB9A1EEF04
SHA-512:	881D9ED79C144257B2F199A91D6F27EE7A62D7555B3278B4580AA1E11E3AB13DBCDE05573094CEC016CAFEC11C3764A2AFF443DB09D67BAB8772F9E2B5776C96
Malicious:	false
Reputation:	low
URL:	https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.lrp_post.boot.2090f6d.js
Preview:	"use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[294],{44330:function(n,e,r){function t(){return Date.now\|\|(Date.now=function(){return(new Date).getTime()}),Math.floor(Date.now())}r.d(e,{JY:function(){return t}})},96900:function(n,e,r){r.r(e),r.d(e,{BrandingFooter:function(){return N}});var t=r(34629),o=r(92831),i=r(48723),a=r(30062),u=r(97666),c=r(23084),l=r(70574),f=r(98765),s=r(83778),d=r(29383),p=r(38826),$=r(71201),_=r(44695),v=r(6134),m=r(97892),g=r(69455),h=r(18190),w=r(8484),b=r(70918),k=r(6637),x=function(n,e){return function(r,t){var o=t();return r((0,k.X)("Branding.Footer.M365.Click",{isShare:(0,m.Hc)(o),isPreview:(0,m.qx)(o),fullScreen:n,isFormRuntime:(0,b.G1)(o),pageType:e}))}},y=r(38599),M=r(17543),R=r(74371),S=r(32225),C=function(n,e,r,o){var i,u;return[{$r:{background:r,width:"100%","@media print":{background:d.O.$g,color:d.O.$i},paddingTop:0},$a:{width:"100%"},$cF:{width:"100%",lineHeight:"1.3",fontSize:12,color:d.O.$i,marginTop:0,marginBottom:4},$jy:{disp

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 490 x 180, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5895
Entropy (8bit):	7.720248605671278
Encrypted:	false
SSDEEP:	96:n40H7NhvmuFFBL413wHGfZ1rsrohnXcF1BN8+PrfUFd0abvPsrXf:nbRFmuxcJfLrvnXcFjNRUFd00Wv
MD5:	311274C8C9C66E894F5AFA51FACD72CD
SHA1:	386D1FA0B2924DF2C21545CF2FF1DDE2CD985D33
SHA-256:	BC3C029408DAB6B5CB676B990B2E21BDD474E4B2E45DAF87E70210539390BF49
SHA-512:	2117BC16AC878BCC307CEA0DEFA0638800715330E83E9C8C1CAD7398BBF207E9432391B851E004308FB75C20C2D6F587D015FA3FB13F8630FE3E0C7E194979FC
Malicious:	false
Reputation:	low
URL:	https://forms.office.com/cdn/images/microsoft365logo_v1.png
Preview:	.PNG........IHDR.............[.o.....IDATx......U.....xi.#..l.%3J.t.D\If5h.......>.Ft.....].8f..A...(../....D..1b.%.9:1y.LD.3...~Y....?..........(.s....~.nh........................................................................................................................................................................@...6`.W.....z.m..z....@.:.`..e.agn..w[-..}O.L...Gf.h.V....Wlu......n.....ek...z...Z...lu..AMP..@P...........&... ..j..AMP..@P..............3f.X).K._.J..+....d...5A.t..c._...R6K.2....@P.6A=}...'O...WZ[[{....;~..w[..7.x9.....uR~-.....7GB..0a..e?.........S...R&.<..X.2..r..}.>.hii.]......Q.N.iL..]..>y.r.\.."..U.g..A......K....'....q.LP..o..O..-.l...{....{)...+.....\N...9...P.d..+....B.[.Z..d.....e>...#i~%D.8Y&.E...L..M.+..OX..J1...\|.do&......9..+8.[......ady...P_.....m.....mA-.P...A......a.e.zW.w..EnbIX.3.j.....k....[..Y...q[.r4...xY.....+w.g....Sk\#F..;9&.....4....f...I.'X....n.r.$.APw.P.A....M..8=..).0_.h./...b.....g......e.S...

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4777
Entropy (8bit):	5.266945992815685
Encrypted:	false
SSDEEP:	96:plDDx7H2YT7IwjpNsG+okiZfC3odrzPc7CLYXKyz:lKY3IwjQG+YZfC3odrzkuLc
MD5:	4AC3282551064F6C22AB79605C993E2B
SHA1:	174886E90298CFA78D8A354F9296D46AA70928F5
SHA-256:	D92EF2042FC89175970E45311995EFBB2AAF06C443563D33A47A7E58953D2CCD
SHA-512:	55827250CC6FE9F64404309BBAFBD5457782AC9F835E4E7CA8658396001D68E1A33F821BC58848FA4E8E785B8F2C09A783C3748F83F2112E6A4BE5560D86F1C6
Malicious:	false
Reputation:	low
Preview:	{"responses":null,"form":{"description":null,"onlineSafetyLevel":0,"reputationTier":1,"background":{"altText":null,"contentType":null,"fileIdentifier":null,"originalFileName":null,"resourceId":null,"resourceUrl":null,"height":null,"width":null,"size":null},"header":{"altText":null,"contentType":null,"fileIdentifier":null,"originalFileName":null,"resourceId":null,"resourceUrl":null,"height":null,"width":null,"size":null},"logo":{"altText":null,"contentType":null,"fileIdentifier":null,"originalFileName":null,"resourceId":null,"resourceUrl":null,"height":null,"width":null,"size":null},"tableId":"T1VZVZVSDUTSPA90ZBPQZE4EI0","otherInfo":"{\"Theme\":{\"BackgroundColor\":\"#f5f5f5\",\"Name\":\"Teal_Gradient\",\"PrimaryColor\":\"#03787c\",\"SecondaryColor\":\"#014446\",\"Thumbnail\":\"/Images/Theme/teal-gradient-thumbnail.png\"}}","runtimeResponses":null,"permissions":[],"responderPermissions":[],"status":"Active","category":null,"localeInfo":"{\"TimezoneOffset\":120,\"Locale\":\"en-US\",\"Tim

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	512
Entropy (8bit):	4.87414360388021
Encrypted:	false
SSDEEP:	12:YQkMf5WwJJafjJs1JJamvIL1JJaide3s+Fwb8:Yaf5WwJJqiJJ7qJJ6snb8
MD5:	E4D13D7BA63E99DB4BD1E9CCB3E1ADFB
SHA1:	8BE689FC18B0371C1D4F09E24B0F26A53623AFF8
SHA-256:	51E04EF961060E208F78555C748F9760F5BAC34598BA5F3ACC25F0FD11BF4767
SHA-512:	6DC48715275F4A916D6212FAB2427B50BDCB803D90EF180871620C5028DCAEAA708D4A0D811F10334394F33D914271A479111C917DC3680752389DEE45890C84
Malicious:	false
Reputation:	low
URL:	https://forms.office.com/pwa/en-us/app.webmanifest
Preview:	{"lang":"en-us","name":"Microsoft Forms","short_name":"Forms","icons":[{"src":"https://cdn.forms.office.net/images/pwa/forms-pwa-logo-192.png","sizes":"192x192","type":"image/png"},{"src":"https://cdn.forms.office.net/images/pwa/forms-pwa-logo-256.png","sizes":"256x256","type":"image/png"},{"src":"https://cdn.forms.office.net/images/pwa/forms-pwa-logo-512.png","sizes":"512x512","type":"image/png"}],"scope":"/","start_url":"/?pwa=1","display":"minimal-ui","theme_color":"#03787c","background_color":"#ffffff"}

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	73103
Entropy (8bit):	5.4952806843293365
Encrypted:	false
SSDEEP:	768:sTSqFCRDDGgbtF6W09p3aN7l2YYYWiRwk2bowySATG1JZy5CgpVOIc/alixqn96d:Y0r772ro1j1DZ/hevkQ
MD5:	3AA851AE225143D8964962DFCBDCDC5D
SHA1:	F9BD518F78736F98BD4328A39B07767D16E621F8
SHA-256:	839692851C3E10FF7A27EF19E44F6D5C51CC197152E8727A9B5F385380359FD7
SHA-512:	015C186ED6736D0F2B05DEEDEB9957A4E8FBC14BE155CD8419EDCD15163435B83DBC8CB345E0396210AEDB1FE94BA5B8CD2DCCA6C6683FC7DFD4124FEC35E596
Malicious:	false
Reputation:	low
URL:	https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.lrp_cover.37daef8.js
Preview:	"use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[451],{1607:function(e,t,n){n.d(t,{p:function(){return i}});var o=n(33377);function i(e){for(var t=[],n=1;n<arguments.length;n++)t[n-1]=arguments[n];for(var i=[],r=0,_=t;r<_.length;r++){var a=_[r];a&&i.push("function"==typeof a?a(e):a)}return 1===i.length?i[0]:i.length?o.T.apply(void 0,i):{}}},3025:function(e,t,n){n.d(t,{n:function(){return _}});var o=n(94335),i=n(75265),r=n(34255);function _(e){var t=i.nr.getInstance(),n=(0,r.bz)((0,o.Iy)(),e);if(!t.classNameFromKey(n)){var _=t.getClassName();t.insertRule("@font-face{".concat(n,"}"),!0),t.cacheClassName(_,n,[],["font-face",n])}}},16880:function(e,t,n){n.r(t),n.d(t,{AnimationClassNames:function(){return Q},AnimationStyles:function(){return G},AnimationVariables:function(){return P},ColorClassNames:function(){return be},DefaultEffects:function(){return ct.W},DefaultFontStyles:function(){return J.d},DefaultPalette:function(){return ee.b},EdgeChromiumHighContrastSelector:functio

Static File Info

⊘No static file info

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 498
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2025 17:03:14.317239046 CEST	49705	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:14.317289114 CEST	443	49705	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:14.317393064 CEST	49705	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:14.317679882 CEST	49706	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:14.317708015 CEST	443	49706	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:14.317759037 CEST	49706	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:14.317828894 CEST	49705	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:14.317850113 CEST	443	49705	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:14.317926884 CEST	49706	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:14.317939997 CEST	443	49706	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:14.726931095 CEST	49705	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:14.727015972 CEST	49706	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:14.727399111 CEST	49707	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:14.727443933 CEST	443	49707	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:14.727514982 CEST	49707	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:14.728385925 CEST	49707	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:14.728401899 CEST	443	49707	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:14.768280029 CEST	443	49706	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:14.768282890 CEST	443	49705	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:14.772521019 CEST	443	49705	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:14.772613049 CEST	49705	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:14.772628069 CEST	49705	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:14.773144960 CEST	443	49706	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:14.773217916 CEST	49706	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:14.773233891 CEST	49706	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:15.177736998 CEST	443	49707	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:15.177812099 CEST	49707	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:15.181395054 CEST	49707	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:15.181406021 CEST	443	49707	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:15.181703091 CEST	443	49707	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:15.182064056 CEST	49707	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:15.228297949 CEST	443	49707	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:16.135694981 CEST	443	49707	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:16.135771990 CEST	443	49707	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:16.135879993 CEST	49707	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:16.136215925 CEST	49707	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:16.136233091 CEST	443	49707	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:16.138600111 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:16.138648987 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:16.138725996 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:16.138871908 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:16.138885975 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:16.595443010 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:16.598229885 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:16.598265886 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:16.598387003 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:16.598392963 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.064156055 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.064182997 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.064229965 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.064249039 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.064284086 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.064296961 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.064301014 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.064356089 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.064356089 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.064364910 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.064404964 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.064410925 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.064469099 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.064507008 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.064511061 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.064548016 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.064553022 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.064598083 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.064621925 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.064636946 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.064641953 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.064677954 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.065063000 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.065124035 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.065129995 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.065167904 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.071485043 CEST	49711	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.071533918 CEST	443	49711	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.071600914 CEST	49711	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.072238922 CEST	49711	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.072248936 CEST	443	49711	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.211524963 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.211600065 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.211602926 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.211616039 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.211644888 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.211673975 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.211677074 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.211683035 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.211716890 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.211726904 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.211766958 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.211766958 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.211775064 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.211812973 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.211817026 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.211824894 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.211858034 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.211862087 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.211909056 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.211986065 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.212044001 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.212073088 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.212076902 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.212086916 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.212126017 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.212322950 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.212371111 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.212376118 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.212379932 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.212410927 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.212430000 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.212434053 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.212457895 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.212464094 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.212502003 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.212507010 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.212578058 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.212622881 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.212686062 CEST	49710	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.212699890 CEST	443	49710	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.221232891 CEST	49713	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.221277952 CEST	443	49713	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.221339941 CEST	49713	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.221616030 CEST	49714	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.221653938 CEST	443	49714	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.221716881 CEST	49714	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.222235918 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.222265959 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.222336054 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.222445965 CEST	49713	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.222465038 CEST	443	49713	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.222644091 CEST	49714	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.222664118 CEST	443	49714	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.222897053 CEST	49716	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.222904921 CEST	443	49716	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.222955942 CEST	49716	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.223021030 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.223035097 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.223154068 CEST	49716	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.223165989 CEST	443	49716	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.522285938 CEST	443	49711	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.522356033 CEST	49711	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.545533895 CEST	49711	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.545551062 CEST	443	49711	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.545932055 CEST	443	49711	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.597238064 CEST	49711	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.671724081 CEST	443	49713	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.672014952 CEST	49713	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.672044992 CEST	443	49713	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.672264099 CEST	49713	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.672276020 CEST	443	49713	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.672934055 CEST	443	49716	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.673034906 CEST	443	49714	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.673233986 CEST	49716	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.673269987 CEST	443	49716	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.673360109 CEST	49714	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.673387051 CEST	443	49714	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.673475027 CEST	49716	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.673481941 CEST	443	49716	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.673531055 CEST	49714	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.673538923 CEST	443	49714	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.673763037 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.673924923 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.673935890 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.674093008 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.674098969 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.970045090 CEST	443	49716	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.970066071 CEST	443	49716	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.970081091 CEST	443	49716	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.970149040 CEST	49716	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.970174074 CEST	443	49716	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.970230103 CEST	49716	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.970230103 CEST	49716	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.970652103 CEST	443	49714	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.970673084 CEST	443	49714	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.970704079 CEST	443	49714	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.970722914 CEST	49714	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.970746040 CEST	443	49714	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.970763922 CEST	49714	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.970798016 CEST	49714	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.988379002 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.988394976 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.988410950 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.988446951 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.988461971 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:17.988482952 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:17.988509893 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.117252111 CEST	443	49716	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.117273092 CEST	443	49716	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.117331028 CEST	443	49716	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.117348909 CEST	49716	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.117374897 CEST	443	49716	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.117405891 CEST	49716	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.117420912 CEST	49716	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.117424965 CEST	443	49716	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.117436886 CEST	443	49716	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.117480040 CEST	49716	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.117790937 CEST	49716	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.117800951 CEST	443	49716	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.118633032 CEST	443	49714	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.118665934 CEST	443	49714	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.118700981 CEST	49714	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.118725061 CEST	443	49714	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.118755102 CEST	49714	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.118777037 CEST	49714	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.118801117 CEST	443	49714	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.118839025 CEST	443	49714	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.118861914 CEST	49714	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.118869066 CEST	443	49714	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.118894100 CEST	49714	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.118905067 CEST	443	49714	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.118949890 CEST	49714	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.121448994 CEST	49714	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.121459007 CEST	443	49714	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.135757923 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.135776997 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.135862112 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.135874987 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.135940075 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.135950089 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.135965109 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.136018991 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.136024952 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.136106014 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.136193991 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.136209965 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.136265039 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.136271000 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.136316061 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.284151077 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.284168959 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.284235954 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.284298897 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.284317970 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.284331083 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.284337044 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.284411907 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.284420967 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.284429073 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.284440994 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.284462929 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.284503937 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.284507990 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.284693003 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.284709930 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.284755945 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.284761906 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.316217899 CEST	443	49713	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.316284895 CEST	443	49713	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.316317081 CEST	443	49713	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.316369057 CEST	443	49713	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.316375971 CEST	49713	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.316406012 CEST	443	49713	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.316423893 CEST	49713	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.316493988 CEST	443	49713	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.316564083 CEST	49713	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.317320108 CEST	49713	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.317336082 CEST	443	49713	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.331172943 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.431467056 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.431499004 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.431596994 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.431629896 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.431669950 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.431683064 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.431689978 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.431705952 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.431720972 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.431727886 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.431757927 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.431777000 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.432029009 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.432049036 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.432082891 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.432090044 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.432132006 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.432158947 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.432375908 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.432399035 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.432434082 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.432440042 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.432465076 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.432483912 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.432531118 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.432545900 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.432590961 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.432598114 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.432643890 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.432861090 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.432876110 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.432925940 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.432934046 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.432980061 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.433146954 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.433163881 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.433223009 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.433229923 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.433284044 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.433521986 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.433547020 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.433600903 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.433609962 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.433648109 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.433697939 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.433720112 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.433760881 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.433769941 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.433813095 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.454416037 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.454442978 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.454518080 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.454549074 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.454595089 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.458314896 CEST	49718	443	192.168.2.16	142.250.69.4
Apr 23, 2025 17:03:18.458364010 CEST	443	49718	142.250.69.4	192.168.2.16
Apr 23, 2025 17:03:18.458481073 CEST	49718	443	192.168.2.16	142.250.69.4
Apr 23, 2025 17:03:18.458565950 CEST	49718	443	192.168.2.16	142.250.69.4
Apr 23, 2025 17:03:18.458575010 CEST	443	49718	142.250.69.4	192.168.2.16
Apr 23, 2025 17:03:18.482134104 CEST	49719	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.482197046 CEST	443	49719	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.482265949 CEST	49719	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.482387066 CEST	49719	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.482405901 CEST	443	49719	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.578943968 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.578964949 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.579046011 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.579061985 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.579107046 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.579127073 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.579144955 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.579194069 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.579200983 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.579241037 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.579401970 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.579418898 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.579452991 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.579457998 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.579497099 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.579507113 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.579561949 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.579582930 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.579628944 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.579634905 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.579651117 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.579673052 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.579772949 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.579788923 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.579842091 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.579849005 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.579889059 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.580091000 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.580113888 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.580163002 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.580168962 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.580194950 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.580213070 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.580473900 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.580492020 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.580547094 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.580548048 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.580560923 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.580579996 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.580595016 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.580627918 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.580632925 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.580673933 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.580828905 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.580845118 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.580897093 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.580903053 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.580921888 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.580941916 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.580943108 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.580955029 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.580976009 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.581007957 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.581942081 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.581959009 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.582010984 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.582015991 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.582022905 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.582062006 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.582092047 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.582256079 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.582266092 CEST	443	49715	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.582276106 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.582307100 CEST	49715	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.630987883 CEST	49720	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.631026030 CEST	443	49720	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.631112099 CEST	49720	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.631423950 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.631526947 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.631658077 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.632076025 CEST	49722	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.632108927 CEST	443	49722	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.632158995 CEST	49722	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.632368088 CEST	49720	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.632381916 CEST	443	49720	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.632479906 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.632514000 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.632805109 CEST	49723	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.632838964 CEST	443	49723	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.632947922 CEST	49722	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.632971048 CEST	443	49722	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.632978916 CEST	49723	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.633048058 CEST	49723	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.633060932 CEST	443	49723	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.777838945 CEST	443	49718	142.250.69.4	192.168.2.16
Apr 23, 2025 17:03:18.777945042 CEST	49718	443	192.168.2.16	142.250.69.4
Apr 23, 2025 17:03:18.778918028 CEST	49718	443	192.168.2.16	142.250.69.4
Apr 23, 2025 17:03:18.778923988 CEST	443	49718	142.250.69.4	192.168.2.16
Apr 23, 2025 17:03:18.779159069 CEST	443	49718	142.250.69.4	192.168.2.16
Apr 23, 2025 17:03:18.825179100 CEST	49718	443	192.168.2.16	142.250.69.4
Apr 23, 2025 17:03:18.932290077 CEST	443	49719	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.932367086 CEST	49719	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.932909966 CEST	49719	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.932924032 CEST	443	49719	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.933202028 CEST	443	49719	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:18.933459044 CEST	49719	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:18.980272055 CEST	443	49719	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.081965923 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.082365036 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.082392931 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.082535028 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.082540989 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.083246946 CEST	443	49720	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.083336115 CEST	443	49722	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.083453894 CEST	49720	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.083476067 CEST	443	49720	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.083606005 CEST	49722	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.083630085 CEST	443	49722	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.083712101 CEST	49720	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.083718061 CEST	443	49720	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.083826065 CEST	49722	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.083832979 CEST	443	49722	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.088553905 CEST	443	49723	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.088781118 CEST	49723	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.088805914 CEST	443	49723	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.088921070 CEST	49723	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.088927031 CEST	443	49723	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.381198883 CEST	443	49720	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.381221056 CEST	443	49720	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.381242990 CEST	443	49720	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.381380081 CEST	49720	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.381392956 CEST	443	49720	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.381449938 CEST	49720	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.381937027 CEST	443	49722	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.381956100 CEST	443	49722	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.381970882 CEST	443	49722	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.382034063 CEST	49722	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.382055044 CEST	443	49722	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.382107973 CEST	49722	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.394731045 CEST	443	49719	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.394781113 CEST	443	49719	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.394834995 CEST	443	49719	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.394849062 CEST	49719	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.394875050 CEST	443	49719	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.394895077 CEST	49719	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.394964933 CEST	443	49719	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.395018101 CEST	49719	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.395443916 CEST	49719	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.395456076 CEST	443	49719	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.478830099 CEST	443	49723	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.478852034 CEST	443	49723	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.478885889 CEST	443	49723	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.478924036 CEST	49723	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.478936911 CEST	443	49723	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.479123116 CEST	49723	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.479123116 CEST	49723	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.479687929 CEST	49723	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.479706049 CEST	443	49723	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.480993032 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.481005907 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.481035948 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.481127024 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.481178045 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.481218100 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.481240034 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.483238935 CEST	49725	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.483268976 CEST	443	49725	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.483349085 CEST	49725	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.483496904 CEST	49725	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.483510017 CEST	443	49725	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.528589010 CEST	443	49720	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.528614044 CEST	443	49720	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.528723001 CEST	49720	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.528738976 CEST	443	49720	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.528748989 CEST	443	49720	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.528775930 CEST	49720	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.528811932 CEST	49720	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.528842926 CEST	49720	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.529053926 CEST	49720	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.529073000 CEST	443	49720	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.529093981 CEST	443	49722	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.529114008 CEST	443	49722	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.529186010 CEST	49722	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.529197931 CEST	443	49722	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.529242039 CEST	49722	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.529469013 CEST	443	49722	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.529496908 CEST	443	49722	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.529550076 CEST	49722	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.529555082 CEST	443	49722	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.529597044 CEST	49722	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.529859066 CEST	443	49722	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.529877901 CEST	443	49722	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.529917002 CEST	49722	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.529922009 CEST	443	49722	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.529953003 CEST	49722	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.529964924 CEST	49722	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.529964924 CEST	443	49722	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.529975891 CEST	443	49722	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.530010939 CEST	49722	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.530038118 CEST	49722	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.530041933 CEST	443	49722	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.530080080 CEST	443	49722	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.530138016 CEST	49722	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.534622908 CEST	49726	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.534656048 CEST	443	49726	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.534730911 CEST	49726	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.534841061 CEST	49726	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.534852982 CEST	443	49726	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.534902096 CEST	49722	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.534912109 CEST	443	49722	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.628299952 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.628319979 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.628396988 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.628410101 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.628550053 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.628568888 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.628611088 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.628616095 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.628647089 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.628660917 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.628770113 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.628784895 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.628835917 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.628840923 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.629992962 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.775466919 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.775485992 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.775563002 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.775578022 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.775671959 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.775688887 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.775729895 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.775734901 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.775768042 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.775785923 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.775911093 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.775924921 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.775959015 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.775963068 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.775986910 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.775996923 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.776272058 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.776307106 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.776334047 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.776338100 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.776365995 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.776387930 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.776540041 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.776552916 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.776596069 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.776601076 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.777607918 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.923036098 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.923058033 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.923141003 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.923156977 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.923208952 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.923285961 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.923304081 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.923331022 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.923336983 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.923367977 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.923378944 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.923588037 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.923602104 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.923640966 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.923645020 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.923711061 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.923728943 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.923755884 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.923760891 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.923774004 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.923804045 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.928421974 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.928436041 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.928513050 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.928528070 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.928689957 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.928728104 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.928857088 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.928869963 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.928889036 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.928896904 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.928906918 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.928940058 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.929244041 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.929260969 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.929311991 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.929318905 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.929548979 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.929572105 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.929604053 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.929610968 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.929634094 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.932337046 CEST	443	49725	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.932694912 CEST	49725	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.932719946 CEST	443	49725	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.932857990 CEST	49725	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.932863951 CEST	443	49725	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.970577002 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.970602036 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.970674038 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:19.970688105 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:19.990305901 CEST	443	49726	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.008256912 CEST	49726	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.008280993 CEST	443	49726	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.008634090 CEST	49726	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.008641958 CEST	443	49726	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.013328075 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.070806980 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.070825100 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.070900917 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.070915937 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.070956945 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.071400881 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.071415901 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.071468115 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.071474075 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.071511030 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.071844101 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.071860075 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.071919918 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.071926117 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.071959019 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.071999073 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.072015047 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.072046995 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.072052956 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.072077036 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.072097063 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.072227955 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.072242975 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.072293043 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.072297096 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.072339058 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.072463989 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.072489023 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.072525024 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.072529078 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.072562933 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.072572947 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.072613955 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.072645903 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.072665930 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.072669983 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.072690964 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.072704077 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.072743893 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.073896885 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.076240063 CEST	49721	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.076258898 CEST	443	49721	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.169035912 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.169080019 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.169337034 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.169337034 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.169370890 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.230067015 CEST	49671	443	192.168.2.16	204.79.197.203
Apr 23, 2025 17:03:20.287508011 CEST	443	49726	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.287530899 CEST	443	49726	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.287581921 CEST	49726	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.287597895 CEST	443	49726	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.287607908 CEST	443	49726	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.287636042 CEST	49726	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.287668943 CEST	49726	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.290863037 CEST	49726	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.290885925 CEST	443	49726	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.309561014 CEST	443	49725	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.309664011 CEST	443	49725	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.309724092 CEST	49725	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.326407909 CEST	49725	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.326427937 CEST	443	49725	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.332577944 CEST	49728	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.332623005 CEST	443	49728	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.332679987 CEST	49728	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.332931042 CEST	49728	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.332948923 CEST	443	49728	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.335306883 CEST	49729	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.335366964 CEST	443	49729	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.335431099 CEST	49729	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.335966110 CEST	49729	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.335980892 CEST	443	49729	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.365557909 CEST	49730	443	192.168.2.16	20.125.62.241
Apr 23, 2025 17:03:20.365645885 CEST	443	49730	20.125.62.241	192.168.2.16
Apr 23, 2025 17:03:20.365741014 CEST	49730	443	192.168.2.16	20.125.62.241
Apr 23, 2025 17:03:20.365855932 CEST	49730	443	192.168.2.16	20.125.62.241
Apr 23, 2025 17:03:20.365881920 CEST	443	49730	20.125.62.241	192.168.2.16
Apr 23, 2025 17:03:20.541208982 CEST	49671	443	192.168.2.16	204.79.197.203
Apr 23, 2025 17:03:20.624583960 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.624882936 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.624900103 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.625036001 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.625041962 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.781708956 CEST	443	49728	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.781974077 CEST	49728	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.782011986 CEST	443	49728	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.782103062 CEST	49728	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.782109976 CEST	443	49728	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.784094095 CEST	443	49729	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.784274101 CEST	49729	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.784297943 CEST	443	49729	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.784352064 CEST	49729	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.784357071 CEST	443	49729	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.903894901 CEST	443	49730	20.125.62.241	192.168.2.16
Apr 23, 2025 17:03:20.903966904 CEST	49730	443	192.168.2.16	20.125.62.241
Apr 23, 2025 17:03:20.907983065 CEST	49730	443	192.168.2.16	20.125.62.241
Apr 23, 2025 17:03:20.907991886 CEST	443	49730	20.125.62.241	192.168.2.16
Apr 23, 2025 17:03:20.908222914 CEST	443	49730	20.125.62.241	192.168.2.16
Apr 23, 2025 17:03:20.908467054 CEST	49730	443	192.168.2.16	20.125.62.241
Apr 23, 2025 17:03:20.922652006 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.922689915 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.922705889 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.922740936 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.922760010 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:20.922784090 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.922823906 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:20.956278086 CEST	443	49730	20.125.62.241	192.168.2.16
Apr 23, 2025 17:03:21.069866896 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.069891930 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.069950104 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.069962025 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.069999933 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.070143938 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.070158958 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.070189953 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.070195913 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.070225000 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.070235014 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.070477009 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.070491076 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.070525885 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.070532084 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.070554972 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.070566893 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.078304052 CEST	443	49728	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.078321934 CEST	443	49728	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.078372955 CEST	49728	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.078397036 CEST	443	49728	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.078411102 CEST	443	49728	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.078433990 CEST	49728	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.078475952 CEST	49728	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.079344988 CEST	49728	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.079361916 CEST	443	49728	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.084820032 CEST	443	49730	20.125.62.241	192.168.2.16
Apr 23, 2025 17:03:21.084942102 CEST	443	49730	20.125.62.241	192.168.2.16
Apr 23, 2025 17:03:21.084991932 CEST	49730	443	192.168.2.16	20.125.62.241
Apr 23, 2025 17:03:21.086914062 CEST	49730	443	192.168.2.16	20.125.62.241
Apr 23, 2025 17:03:21.086932898 CEST	443	49730	20.125.62.241	192.168.2.16
Apr 23, 2025 17:03:21.086942911 CEST	49730	443	192.168.2.16	20.125.62.241
Apr 23, 2025 17:03:21.087239981 CEST	49730	443	192.168.2.16	20.125.62.241
Apr 23, 2025 17:03:21.089701891 CEST	443	49729	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.089740038 CEST	443	49729	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.089801073 CEST	49729	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.089816093 CEST	443	49729	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.089869976 CEST	49729	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.090039015 CEST	443	49729	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.090095043 CEST	443	49729	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.090097904 CEST	49729	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.090106010 CEST	443	49729	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.090141058 CEST	443	49729	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.090162992 CEST	49729	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.090167999 CEST	443	49729	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.090178967 CEST	443	49729	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.090193033 CEST	49729	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.090215921 CEST	49729	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.090224028 CEST	443	49729	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.090267897 CEST	49729	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.090293884 CEST	443	49729	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.090348959 CEST	49729	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.147176027 CEST	49671	443	192.168.2.16	204.79.197.203
Apr 23, 2025 17:03:21.217449903 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.217473984 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.217526913 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.217538118 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.217570066 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.217792034 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.217807055 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.217849016 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.217858076 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.217907906 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.218189001 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.218204021 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.218245029 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.218250990 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.218307972 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.218405962 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.218442917 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.218458891 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.218462944 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.218486071 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.218502998 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.218535900 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.218575954 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.218576908 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.218586922 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.218620062 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.218650103 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.218687057 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.218853951 CEST	49727	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.218867064 CEST	443	49727	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.237191916 CEST	443	49729	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.237240076 CEST	443	49729	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.237263918 CEST	49729	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.237272024 CEST	443	49729	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.237307072 CEST	49729	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.237334967 CEST	49729	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.237369061 CEST	443	49729	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.237415075 CEST	49729	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.237472057 CEST	443	49729	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.237514973 CEST	49729	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.237540960 CEST	443	49729	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.237590075 CEST	49729	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.237595081 CEST	443	49729	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.237618923 CEST	443	49729	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.237629890 CEST	49729	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.237659931 CEST	49729	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.237802982 CEST	49729	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.237811089 CEST	443	49729	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.260317087 CEST	49732	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.260344028 CEST	443	49732	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.260781050 CEST	49732	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.261046886 CEST	49732	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.261059999 CEST	443	49732	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.709882975 CEST	443	49732	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.710091114 CEST	49732	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.710105896 CEST	443	49732	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.710230112 CEST	49732	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:21.710235119 CEST	443	49732	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:21.978665113 CEST	49733	443	192.168.2.16	20.125.62.241
Apr 23, 2025 17:03:21.978713989 CEST	443	49733	20.125.62.241	192.168.2.16
Apr 23, 2025 17:03:21.979181051 CEST	49733	443	192.168.2.16	20.125.62.241
Apr 23, 2025 17:03:21.979331017 CEST	49733	443	192.168.2.16	20.125.62.241
Apr 23, 2025 17:03:21.979337931 CEST	443	49733	20.125.62.241	192.168.2.16
Apr 23, 2025 17:03:22.015120029 CEST	443	49732	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:22.015149117 CEST	443	49732	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:22.015196085 CEST	443	49732	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:22.015232086 CEST	49732	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:22.015250921 CEST	443	49732	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:22.015271902 CEST	49732	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:22.015589952 CEST	443	49732	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:22.015640020 CEST	49732	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:22.015646935 CEST	443	49732	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:22.015932083 CEST	49732	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:22.015959978 CEST	443	49732	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:22.016119957 CEST	443	49732	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:22.016161919 CEST	49732	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:22.016314030 CEST	49732	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:22.016329050 CEST	443	49732	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:22.358217955 CEST	49671	443	192.168.2.16	204.79.197.203
Apr 23, 2025 17:03:22.515299082 CEST	443	49733	20.125.62.241	192.168.2.16
Apr 23, 2025 17:03:22.515722990 CEST	49733	443	192.168.2.16	20.125.62.241
Apr 23, 2025 17:03:22.515748978 CEST	443	49733	20.125.62.241	192.168.2.16
Apr 23, 2025 17:03:22.515908957 CEST	49733	443	192.168.2.16	20.125.62.241
Apr 23, 2025 17:03:22.515914917 CEST	443	49733	20.125.62.241	192.168.2.16
Apr 23, 2025 17:03:22.692060947 CEST	443	49733	20.125.62.241	192.168.2.16
Apr 23, 2025 17:03:22.692142963 CEST	443	49733	20.125.62.241	192.168.2.16
Apr 23, 2025 17:03:22.692224026 CEST	49733	443	192.168.2.16	20.125.62.241
Apr 23, 2025 17:03:22.693743944 CEST	49733	443	192.168.2.16	20.125.62.241
Apr 23, 2025 17:03:22.693763018 CEST	443	49733	20.125.62.241	192.168.2.16
Apr 23, 2025 17:03:22.861686945 CEST	49734	443	192.168.2.16	20.125.62.241
Apr 23, 2025 17:03:22.861727953 CEST	443	49734	20.125.62.241	192.168.2.16
Apr 23, 2025 17:03:22.861845016 CEST	49734	443	192.168.2.16	20.125.62.241
Apr 23, 2025 17:03:22.862031937 CEST	49734	443	192.168.2.16	20.125.62.241
Apr 23, 2025 17:03:22.862046003 CEST	443	49734	20.125.62.241	192.168.2.16
Apr 23, 2025 17:03:22.863032103 CEST	49735	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:22.863140106 CEST	443	49735	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:22.863215923 CEST	49735	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:22.863333941 CEST	49735	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:22.863353014 CEST	443	49735	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:23.319658041 CEST	443	49735	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:23.319731951 CEST	49735	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:23.321111917 CEST	49735	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:23.321140051 CEST	443	49735	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:23.321393967 CEST	443	49735	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:23.321667910 CEST	49735	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:23.368268013 CEST	443	49735	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:23.395327091 CEST	443	49734	20.125.62.241	192.168.2.16
Apr 23, 2025 17:03:23.395395994 CEST	49734	443	192.168.2.16	20.125.62.241
Apr 23, 2025 17:03:23.395812988 CEST	49734	443	192.168.2.16	20.125.62.241
Apr 23, 2025 17:03:23.395821095 CEST	443	49734	20.125.62.241	192.168.2.16
Apr 23, 2025 17:03:23.396147013 CEST	443	49734	20.125.62.241	192.168.2.16
Apr 23, 2025 17:03:23.396395922 CEST	49734	443	192.168.2.16	20.125.62.241
Apr 23, 2025 17:03:23.440287113 CEST	443	49734	20.125.62.241	192.168.2.16
Apr 23, 2025 17:03:23.578752041 CEST	443	49734	20.125.62.241	192.168.2.16
Apr 23, 2025 17:03:23.578850985 CEST	443	49734	20.125.62.241	192.168.2.16
Apr 23, 2025 17:03:23.578898907 CEST	49734	443	192.168.2.16	20.125.62.241
Apr 23, 2025 17:03:23.579566002 CEST	49734	443	192.168.2.16	20.125.62.241
Apr 23, 2025 17:03:23.579580069 CEST	443	49734	20.125.62.241	192.168.2.16
Apr 23, 2025 17:03:23.623339891 CEST	443	49735	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:23.623476982 CEST	443	49735	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:23.623524904 CEST	49735	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:23.623985052 CEST	49735	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:23.624001026 CEST	443	49735	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:23.630664110 CEST	49711	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:23.631791115 CEST	49739	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:23.631829977 CEST	443	49739	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:23.631881952 CEST	49739	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:23.632247925 CEST	49739	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:23.632263899 CEST	443	49739	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:23.672271967 CEST	443	49711	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:23.768748999 CEST	49740	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:23.768788099 CEST	443	49740	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:23.768860102 CEST	49740	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:23.768995047 CEST	49740	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:23.769006014 CEST	443	49740	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:23.789242029 CEST	443	49711	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:23.789362907 CEST	443	49711	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:23.789443016 CEST	49711	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:23.790180922 CEST	49711	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:23.790191889 CEST	443	49711	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:23.933744907 CEST	49741	443	192.168.2.16	23.220.73.79
Apr 23, 2025 17:03:23.933782101 CEST	443	49741	23.220.73.79	192.168.2.16
Apr 23, 2025 17:03:23.933871031 CEST	49741	443	192.168.2.16	23.220.73.79
Apr 23, 2025 17:03:23.933984995 CEST	49741	443	192.168.2.16	23.220.73.79
Apr 23, 2025 17:03:23.933998108 CEST	443	49741	23.220.73.79	192.168.2.16
Apr 23, 2025 17:03:24.081415892 CEST	443	49739	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:24.081717014 CEST	49739	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:24.081742048 CEST	443	49739	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:24.081867933 CEST	49739	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:24.081872940 CEST	443	49739	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:24.218668938 CEST	443	49740	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:24.218883991 CEST	49740	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:24.219258070 CEST	49740	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:24.219265938 CEST	443	49740	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:24.219501972 CEST	443	49740	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:24.220222950 CEST	49740	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:24.232935905 CEST	443	49741	23.220.73.79	192.168.2.16
Apr 23, 2025 17:03:24.233319998 CEST	49741	443	192.168.2.16	23.220.73.79
Apr 23, 2025 17:03:24.234374046 CEST	49741	443	192.168.2.16	23.220.73.79
Apr 23, 2025 17:03:24.234385014 CEST	443	49741	23.220.73.79	192.168.2.16
Apr 23, 2025 17:03:24.234667063 CEST	443	49741	23.220.73.79	192.168.2.16
Apr 23, 2025 17:03:24.235091925 CEST	49741	443	192.168.2.16	23.220.73.79
Apr 23, 2025 17:03:24.264267921 CEST	443	49740	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:24.280275106 CEST	443	49741	23.220.73.79	192.168.2.16
Apr 23, 2025 17:03:24.377774000 CEST	443	49739	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:24.377804041 CEST	443	49739	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:24.377877951 CEST	443	49739	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:24.377902985 CEST	49739	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:24.378199100 CEST	49739	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:24.378684044 CEST	49739	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:24.378700018 CEST	443	49739	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:24.381386995 CEST	49742	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:24.381433010 CEST	443	49742	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:24.381514072 CEST	49742	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:24.381711006 CEST	49742	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:24.381724119 CEST	443	49742	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:24.507886887 CEST	443	49741	23.220.73.79	192.168.2.16
Apr 23, 2025 17:03:24.507905960 CEST	443	49741	23.220.73.79	192.168.2.16
Apr 23, 2025 17:03:24.508198023 CEST	49741	443	192.168.2.16	23.220.73.79
Apr 23, 2025 17:03:24.508212090 CEST	443	49741	23.220.73.79	192.168.2.16
Apr 23, 2025 17:03:24.508894920 CEST	443	49741	23.220.73.79	192.168.2.16
Apr 23, 2025 17:03:24.508948088 CEST	49741	443	192.168.2.16	23.220.73.79
Apr 23, 2025 17:03:24.508956909 CEST	443	49741	23.220.73.79	192.168.2.16
Apr 23, 2025 17:03:24.509011030 CEST	49741	443	192.168.2.16	23.220.73.79
Apr 23, 2025 17:03:24.512002945 CEST	49741	443	192.168.2.16	23.220.73.79
Apr 23, 2025 17:03:24.522074938 CEST	443	49740	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:24.522216082 CEST	443	49740	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:24.523722887 CEST	49740	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:24.523874044 CEST	49740	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:24.523889065 CEST	443	49740	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:24.666583061 CEST	49743	443	192.168.2.16	23.220.73.79
Apr 23, 2025 17:03:24.666619062 CEST	443	49743	23.220.73.79	192.168.2.16
Apr 23, 2025 17:03:24.666718006 CEST	49743	443	192.168.2.16	23.220.73.79
Apr 23, 2025 17:03:24.666851044 CEST	49743	443	192.168.2.16	23.220.73.79
Apr 23, 2025 17:03:24.666865110 CEST	443	49743	23.220.73.79	192.168.2.16
Apr 23, 2025 17:03:24.773200989 CEST	49671	443	192.168.2.16	204.79.197.203
Apr 23, 2025 17:03:24.836903095 CEST	443	49742	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:24.837268114 CEST	49742	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:24.837291002 CEST	443	49742	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:24.839926958 CEST	49742	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:24.839932919 CEST	443	49742	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:24.961919069 CEST	443	49743	23.220.73.79	192.168.2.16
Apr 23, 2025 17:03:24.962088108 CEST	49743	443	192.168.2.16	23.220.73.79
Apr 23, 2025 17:03:24.963912010 CEST	49743	443	192.168.2.16	23.220.73.79
Apr 23, 2025 17:03:24.963917971 CEST	443	49743	23.220.73.79	192.168.2.16
Apr 23, 2025 17:03:24.964195013 CEST	443	49743	23.220.73.79	192.168.2.16
Apr 23, 2025 17:03:24.966978073 CEST	49743	443	192.168.2.16	23.220.73.79
Apr 23, 2025 17:03:25.008274078 CEST	443	49743	23.220.73.79	192.168.2.16
Apr 23, 2025 17:03:25.133239031 CEST	443	49742	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:25.133269072 CEST	443	49742	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:25.133336067 CEST	49742	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:25.133337975 CEST	443	49742	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:25.133387089 CEST	49742	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:25.134171963 CEST	49742	443	192.168.2.16	13.107.6.194
Apr 23, 2025 17:03:25.134182930 CEST	443	49742	13.107.6.194	192.168.2.16
Apr 23, 2025 17:03:25.240914106 CEST	443	49743	23.220.73.79	192.168.2.16
Apr 23, 2025 17:03:25.240937948 CEST	443	49743	23.220.73.79	192.168.2.16
Apr 23, 2025 17:03:25.240987062 CEST	49743	443	192.168.2.16	23.220.73.79
Apr 23, 2025 17:03:25.241007090 CEST	443	49743	23.220.73.79	192.168.2.16
Apr 23, 2025 17:03:25.241579056 CEST	49743	443	192.168.2.16	23.220.73.79
Apr 23, 2025 17:03:25.241627932 CEST	443	49743	23.220.73.79	192.168.2.16
Apr 23, 2025 17:03:25.241676092 CEST	49743	443	192.168.2.16	23.220.73.79
Apr 23, 2025 17:03:28.650721073 CEST	49679	443	192.168.2.16	52.182.143.211
Apr 23, 2025 17:03:28.766726017 CEST	443	49718	142.250.69.4	192.168.2.16
Apr 23, 2025 17:03:28.766779900 CEST	443	49718	142.250.69.4	192.168.2.16
Apr 23, 2025 17:03:28.766828060 CEST	49718	443	192.168.2.16	142.250.69.4
Apr 23, 2025 17:03:28.954216957 CEST	49679	443	192.168.2.16	52.182.143.211
Apr 23, 2025 17:03:29.560209036 CEST	49679	443	192.168.2.16	52.182.143.211
Apr 23, 2025 17:03:29.576437950 CEST	49671	443	192.168.2.16	204.79.197.203
Apr 23, 2025 17:03:29.737581015 CEST	49718	443	192.168.2.16	142.250.69.4
Apr 23, 2025 17:03:29.737607956 CEST	443	49718	142.250.69.4	192.168.2.16
Apr 23, 2025 17:03:30.775213003 CEST	49679	443	192.168.2.16	52.182.143.211
Apr 23, 2025 17:03:33.182256937 CEST	49679	443	192.168.2.16	52.182.143.211
Apr 23, 2025 17:03:37.986329079 CEST	49679	443	192.168.2.16	52.182.143.211
Apr 23, 2025 17:03:39.184287071 CEST	49671	443	192.168.2.16	204.79.197.203
Apr 23, 2025 17:03:47.592391968 CEST	49679	443	192.168.2.16	52.182.143.211
Apr 23, 2025 17:03:57.093672991 CEST	49692	80	192.168.2.16	199.232.214.172
Apr 23, 2025 17:03:57.242875099 CEST	80	49692	199.232.214.172	192.168.2.16
Apr 23, 2025 17:03:57.242886066 CEST	80	49692	199.232.214.172	192.168.2.16
Apr 23, 2025 17:03:57.242943048 CEST	49692	80	192.168.2.16	199.232.214.172
Apr 23, 2025 17:04:18.378835917 CEST	49756	443	192.168.2.16	142.250.69.4
Apr 23, 2025 17:04:18.378875017 CEST	443	49756	142.250.69.4	192.168.2.16
Apr 23, 2025 17:04:18.378977060 CEST	49756	443	192.168.2.16	142.250.69.4
Apr 23, 2025 17:04:18.379192114 CEST	49756	443	192.168.2.16	142.250.69.4
Apr 23, 2025 17:04:18.379204988 CEST	443	49756	142.250.69.4	192.168.2.16
Apr 23, 2025 17:04:18.693314075 CEST	443	49756	142.250.69.4	192.168.2.16
Apr 23, 2025 17:04:18.693671942 CEST	49756	443	192.168.2.16	142.250.69.4
Apr 23, 2025 17:04:18.693706036 CEST	443	49756	142.250.69.4	192.168.2.16
Apr 23, 2025 17:04:28.727106094 CEST	443	49756	142.250.69.4	192.168.2.16
Apr 23, 2025 17:04:28.727193117 CEST	443	49756	142.250.69.4	192.168.2.16
Apr 23, 2025 17:04:28.727320910 CEST	49756	443	192.168.2.16	142.250.69.4
Apr 23, 2025 17:04:28.738455057 CEST	49756	443	192.168.2.16	142.250.69.4
Apr 23, 2025 17:04:28.738502026 CEST	443	49756	142.250.69.4	192.168.2.16
Apr 23, 2025 17:04:47.906841040 CEST	49695	80	192.168.2.16	72.247.234.254
Apr 23, 2025 17:04:47.906840086 CEST	49693	443	192.168.2.16	20.190.151.69
Apr 23, 2025 17:04:48.055527925 CEST	80	49695	72.247.234.254	192.168.2.16
Apr 23, 2025 17:04:48.055634975 CEST	49695	80	192.168.2.16	72.247.234.254
Apr 23, 2025 17:04:48.117888927 CEST	443	49693	20.190.151.69	192.168.2.16
Apr 23, 2025 17:04:48.117953062 CEST	49693	443	192.168.2.16	20.190.151.69
Apr 23, 2025 17:04:59.439810038 CEST	443	49694	2.23.227.208	192.168.2.16
Apr 23, 2025 17:04:59.439847946 CEST	443	49694	2.23.227.208	192.168.2.16
Apr 23, 2025 17:04:59.439964056 CEST	49694	443	192.168.2.16	2.23.227.208
Apr 23, 2025 17:04:59.440020084 CEST	49694	443	192.168.2.16	2.23.227.208

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2025 17:03:13.700263023 CEST	53	49218	1.1.1.1	192.168.2.16
Apr 23, 2025 17:03:13.712151051 CEST	53	61467	1.1.1.1	192.168.2.16
Apr 23, 2025 17:03:14.171088934 CEST	60468	53	192.168.2.16	1.1.1.1
Apr 23, 2025 17:03:14.171282053 CEST	54795	53	192.168.2.16	1.1.1.1
Apr 23, 2025 17:03:14.311342001 CEST	53	60468	1.1.1.1	192.168.2.16
Apr 23, 2025 17:03:14.316513062 CEST	53	54795	1.1.1.1	192.168.2.16
Apr 23, 2025 17:03:14.855088949 CEST	53	56809	1.1.1.1	192.168.2.16
Apr 23, 2025 17:03:14.880697012 CEST	53	63881	1.1.1.1	192.168.2.16
Apr 23, 2025 17:03:18.316262007 CEST	52393	53	192.168.2.16	1.1.1.1
Apr 23, 2025 17:03:18.316529989 CEST	63910	53	192.168.2.16	1.1.1.1
Apr 23, 2025 17:03:18.340447903 CEST	57813	53	192.168.2.16	1.1.1.1
Apr 23, 2025 17:03:18.340591908 CEST	60310	53	192.168.2.16	1.1.1.1
Apr 23, 2025 17:03:18.456744909 CEST	53	63910	1.1.1.1	192.168.2.16
Apr 23, 2025 17:03:18.457566977 CEST	53	52393	1.1.1.1	192.168.2.16
Apr 23, 2025 17:03:18.480578899 CEST	53	57813	1.1.1.1	192.168.2.16
Apr 23, 2025 17:03:18.481731892 CEST	53	60310	1.1.1.1	192.168.2.16
Apr 23, 2025 17:03:20.177881956 CEST	56554	53	192.168.2.16	1.1.1.1
Apr 23, 2025 17:03:20.178138971 CEST	56937	53	192.168.2.16	1.1.1.1
Apr 23, 2025 17:03:20.320614100 CEST	53	56554	1.1.1.1	192.168.2.16
Apr 23, 2025 17:03:20.389239073 CEST	53	56937	1.1.1.1	192.168.2.16
Apr 23, 2025 17:03:22.698293924 CEST	62997	53	192.168.2.16	1.1.1.1
Apr 23, 2025 17:03:22.698472977 CEST	57033	53	192.168.2.16	1.1.1.1
Apr 23, 2025 17:03:22.699682951 CEST	49336	53	192.168.2.16	1.1.1.1
Apr 23, 2025 17:03:22.699884892 CEST	62658	53	192.168.2.16	1.1.1.1
Apr 23, 2025 17:03:22.841603994 CEST	53	62997	1.1.1.1	192.168.2.16
Apr 23, 2025 17:03:22.848368883 CEST	53	62658	1.1.1.1	192.168.2.16
Apr 23, 2025 17:03:22.861069918 CEST	53	49336	1.1.1.1	192.168.2.16
Apr 23, 2025 17:03:22.862415075 CEST	53	57033	1.1.1.1	192.168.2.16
Apr 23, 2025 17:03:23.626513958 CEST	53786	53	192.168.2.16	1.1.1.1
Apr 23, 2025 17:03:23.626838923 CEST	60878	53	192.168.2.16	1.1.1.1
Apr 23, 2025 17:03:23.767021894 CEST	53	60878	1.1.1.1	192.168.2.16
Apr 23, 2025 17:03:23.768234015 CEST	53	53786	1.1.1.1	192.168.2.16
Apr 23, 2025 17:03:23.792911053 CEST	57066	53	192.168.2.16	1.1.1.1
Apr 23, 2025 17:03:23.793126106 CEST	57093	53	192.168.2.16	1.1.1.1
Apr 23, 2025 17:03:23.933088064 CEST	53	57066	1.1.1.1	192.168.2.16
Apr 23, 2025 17:03:23.933123112 CEST	53	57093	1.1.1.1	192.168.2.16
Apr 23, 2025 17:03:24.512352943 CEST	50120	53	192.168.2.16	1.1.1.1
Apr 23, 2025 17:03:24.512542009 CEST	54640	53	192.168.2.16	1.1.1.1
Apr 23, 2025 17:03:24.652837038 CEST	53	54640	1.1.1.1	192.168.2.16
Apr 23, 2025 17:03:24.666022062 CEST	53	50120	1.1.1.1	192.168.2.16
Apr 23, 2025 17:03:31.808537960 CEST	53	57511	1.1.1.1	192.168.2.16
Apr 23, 2025 17:03:50.734895945 CEST	53	62361	1.1.1.1	192.168.2.16
Apr 23, 2025 17:04:13.252479076 CEST	53	62121	1.1.1.1	192.168.2.16
Apr 23, 2025 17:04:13.632203102 CEST	53	50916	1.1.1.1	192.168.2.16
Apr 23, 2025 17:04:14.877959013 CEST	53	64283	1.1.1.1	192.168.2.16
Apr 23, 2025 17:04:17.030973911 CEST	53	57662	1.1.1.1	192.168.2.16
Apr 23, 2025 17:04:26.264182091 CEST	138	138	192.168.2.16	192.168.2.255
Apr 23, 2025 17:04:43.770150900 CEST	53	65280	1.1.1.1	192.168.2.16
Apr 23, 2025 17:05:15.886779070 CEST	53	49174	1.1.1.1	192.168.2.16

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 23, 2025 17:03:14.854686975 CEST	192.168.2.16	1.1.1.1	c205	(Port unreachable)	Destination Unreachable
Apr 23, 2025 17:03:20.389316082 CEST	192.168.2.16	1.1.1.1	c266	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 23, 2025 17:03:14.171088934 CEST	192.168.2.16	1.1.1.1	0x1b68	Standard query (0)	forms.office.com	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:03:14.171282053 CEST	192.168.2.16	1.1.1.1	0x2c6e	Standard query (0)	forms.office.com	65	IN (0x0001)	false
Apr 23, 2025 17:03:18.316262007 CEST	192.168.2.16	1.1.1.1	0x4cac	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:03:18.316529989 CEST	192.168.2.16	1.1.1.1	0xf931	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 23, 2025 17:03:18.340447903 CEST	192.168.2.16	1.1.1.1	0x2f72	Standard query (0)	forms.office.com	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:03:18.340591908 CEST	192.168.2.16	1.1.1.1	0x426a	Standard query (0)	forms.office.com	65	IN (0x0001)	false
Apr 23, 2025 17:03:20.177881956 CEST	192.168.2.16	1.1.1.1	0x7ae7	Standard query (0)	c.office.com	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:03:20.178138971 CEST	192.168.2.16	1.1.1.1	0xd7af	Standard query (0)	c.office.com	65	IN (0x0001)	false
Apr 23, 2025 17:03:22.698293924 CEST	192.168.2.16	1.1.1.1	0xf06b	Standard query (0)	forms.cloud.microsoft	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:03:22.698472977 CEST	192.168.2.16	1.1.1.1	0x9693	Standard query (0)	forms.cloud.microsoft	65	IN (0x0001)	false
Apr 23, 2025 17:03:22.699682951 CEST	192.168.2.16	1.1.1.1	0xd153	Standard query (0)	c.office.com	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:03:22.699884892 CEST	192.168.2.16	1.1.1.1	0x6349	Standard query (0)	c.office.com	65	IN (0x0001)	false
Apr 23, 2025 17:03:23.626513958 CEST	192.168.2.16	1.1.1.1	0x883e	Standard query (0)	forms.cloud.microsoft	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:03:23.626838923 CEST	192.168.2.16	1.1.1.1	0x2a0a	Standard query (0)	forms.cloud.microsoft	65	IN (0x0001)	false
Apr 23, 2025 17:03:23.792911053 CEST	192.168.2.16	1.1.1.1	0xd7d4	Standard query (0)	cdn.forms.office.net	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:03:23.793126106 CEST	192.168.2.16	1.1.1.1	0x2d5	Standard query (0)	cdn.forms.office.net	65	IN (0x0001)	false
Apr 23, 2025 17:03:24.512352943 CEST	192.168.2.16	1.1.1.1	0x861a	Standard query (0)	cdn.forms.office.net	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:03:24.512542009 CEST	192.168.2.16	1.1.1.1	0xae1e	Standard query (0)	cdn.forms.office.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 23, 2025 17:03:14.311342001 CEST	1.1.1.1	192.168.2.16	0x1b68	No error (0)	forms.office.com	forms.office.com.b-0039.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:14.311342001 CEST	1.1.1.1	192.168.2.16	0x1b68	No error (0)	forms.office.com.b-0039.b-msedge.net	b-0039.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:14.311342001 CEST	1.1.1.1	192.168.2.16	0x1b68	No error (0)	b-0039.b-msedge.net		13.107.6.194	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:03:14.316513062 CEST	1.1.1.1	192.168.2.16	0x2c6e	No error (0)	forms.office.com	forms.office.com.b-0039.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:18.456744909 CEST	1.1.1.1	192.168.2.16	0xf931	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 23, 2025 17:03:18.457566977 CEST	1.1.1.1	192.168.2.16	0x4cac	No error (0)	www.google.com		142.250.69.4	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:03:18.480578899 CEST	1.1.1.1	192.168.2.16	0x2f72	No error (0)	forms.office.com	forms.office.com.b-0039.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:18.480578899 CEST	1.1.1.1	192.168.2.16	0x2f72	No error (0)	forms.office.com.b-0039.b-msedge.net	b-0039.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:18.480578899 CEST	1.1.1.1	192.168.2.16	0x2f72	No error (0)	b-0039.b-msedge.net		13.107.6.194	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:03:18.481731892 CEST	1.1.1.1	192.168.2.16	0x426a	No error (0)	forms.office.com	forms.office.com.b-0039.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:20.320614100 CEST	1.1.1.1	192.168.2.16	0x7ae7	No error (0)	c.office.com	c.msn.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:20.320614100 CEST	1.1.1.1	192.168.2.16	0x7ae7	No error (0)	c.msn.com	c-msn-pme.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:20.320614100 CEST	1.1.1.1	192.168.2.16	0x7ae7	No error (0)	c-msn-pme.trafficmanager.net		20.125.62.241	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:03:20.389239073 CEST	1.1.1.1	192.168.2.16	0xd7af	No error (0)	c.office.com	c.msn.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:20.389239073 CEST	1.1.1.1	192.168.2.16	0xd7af	No error (0)	c.msn.com	c-msn-pme.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:21.228092909 CEST	1.1.1.1	192.168.2.16	0x665	No error (0)	c-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:21.228092909 CEST	1.1.1.1	192.168.2.16	0x665	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:03:21.228092909 CEST	1.1.1.1	192.168.2.16	0x665	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:03:22.841603994 CEST	1.1.1.1	192.168.2.16	0xf06b	No error (0)	forms.cloud.microsoft	forms-cloud-microsoft.b-0039.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:22.841603994 CEST	1.1.1.1	192.168.2.16	0xf06b	No error (0)	forms-cloud-microsoft.b-0039.b-msedge.net	b-0039.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:22.841603994 CEST	1.1.1.1	192.168.2.16	0xf06b	No error (0)	b-0039.b-msedge.net		13.107.6.194	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:03:22.848368883 CEST	1.1.1.1	192.168.2.16	0x6349	No error (0)	c.office.com	c.msn.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:22.848368883 CEST	1.1.1.1	192.168.2.16	0x6349	No error (0)	c.msn.com	c-msn-pme.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:22.861069918 CEST	1.1.1.1	192.168.2.16	0xd153	No error (0)	c.office.com	c.msn.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:22.861069918 CEST	1.1.1.1	192.168.2.16	0xd153	No error (0)	c.msn.com	c-msn-pme.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:22.861069918 CEST	1.1.1.1	192.168.2.16	0xd153	No error (0)	c-msn-pme.trafficmanager.net		20.125.62.241	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:03:22.862415075 CEST	1.1.1.1	192.168.2.16	0x9693	No error (0)	forms.cloud.microsoft	forms-cloud-microsoft.b-0039.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:23.767021894 CEST	1.1.1.1	192.168.2.16	0x2a0a	No error (0)	forms.cloud.microsoft	forms-cloud-microsoft.b-0039.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:23.768234015 CEST	1.1.1.1	192.168.2.16	0x883e	No error (0)	forms.cloud.microsoft	forms-cloud-microsoft.b-0039.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:23.768234015 CEST	1.1.1.1	192.168.2.16	0x883e	No error (0)	forms-cloud-microsoft.b-0039.b-msedge.net	b-0039.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:23.768234015 CEST	1.1.1.1	192.168.2.16	0x883e	No error (0)	b-0039.b-msedge.net		13.107.6.194	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:03:23.933088064 CEST	1.1.1.1	192.168.2.16	0xd7d4	No error (0)	cdn.forms.office.net	cdn.forms.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:23.933088064 CEST	1.1.1.1	192.168.2.16	0xd7d4	No error (0)	cdn.forms.office.net.edgesuite.net	a1894.dscms.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:23.933088064 CEST	1.1.1.1	192.168.2.16	0xd7d4	No error (0)	a1894.dscms.akamai.net		23.220.73.79	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:03:23.933088064 CEST	1.1.1.1	192.168.2.16	0xd7d4	No error (0)	a1894.dscms.akamai.net		23.220.73.78	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:03:23.933123112 CEST	1.1.1.1	192.168.2.16	0x2d5	No error (0)	cdn.forms.office.net	cdn.forms.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:23.933123112 CEST	1.1.1.1	192.168.2.16	0x2d5	No error (0)	cdn.forms.office.net.edgesuite.net	a1894.dscms.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:24.652837038 CEST	1.1.1.1	192.168.2.16	0xae1e	No error (0)	cdn.forms.office.net	cdn.forms.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:24.652837038 CEST	1.1.1.1	192.168.2.16	0xae1e	No error (0)	cdn.forms.office.net.edgesuite.net	a1894.dscms.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:24.666022062 CEST	1.1.1.1	192.168.2.16	0x861a	No error (0)	cdn.forms.office.net	cdn.forms.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:24.666022062 CEST	1.1.1.1	192.168.2.16	0x861a	No error (0)	cdn.forms.office.net.edgesuite.net	a1894.dscms.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:03:24.666022062 CEST	1.1.1.1	192.168.2.16	0x861a	No error (0)	a1894.dscms.akamai.net		23.220.73.79	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:03:24.666022062 CEST	1.1.1.1	192.168.2.16	0x861a	No error (0)	a1894.dscms.akamai.net		23.220.73.78	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

forms.office.com

c.office.com

forms.cloud.microsoft

cdn.forms.office.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49707	13.107.6.194	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:15 UTC	678	OUT	GET /e/cKTtUPrCQw HTTP/1.1 Host: forms.office.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:03:16 UTC	834	IN	HTTP/1.1 301 Moved Permanently Cache-Control: no-cache Pragma: no-cache Expires: -1 Location: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturl P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" X-CorrelationId: 8e1b19d3-d209-4237-9b28-64f8dc954a10 X-UserSessionId: 8e1b19d3-d209-4237-9b28-64f8dc954a10 X-OfficeFE: FormIntelligenceService_IN_1 X-OfficeVersion: 16.0.18821.42501 X-OfficeCluster: frc-101.forms.office.com X-Content-Type-Options: nosniff X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 9F591FF51237467AAF53CA30DA31082F Ref B: LAX311000114021 Ref C: 2025-04-23T15:03:15Z Date: Wed, 23 Apr 2025 15:03:15 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49710	13.107.6.194	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:16 UTC	788	OUT	GET /pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturl HTTP/1.1 Host: forms.office.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:03:17 UTC	1993	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Transfer-Encoding: chunked Content-Type: text/html; charset=utf-8 Expires: 0 Set-Cookie: FormsWebSessionId=383e07ad-4d78-4518-9219-a4c8cb42cc8c; max-age=2592000; path=/; secure; samesite=none; httponly Set-Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; max-age=2592000; path=/; secure; samesite=none; httponly Set-Cookie: __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81; path=/; secure; samesite=none; httponly Strict-Transport-Security: max-age=2592000; includeSubDomains X-RoutingOfficeCluster: wus-101.forms.office.com X-RoutingOfficeCluster: neu-101.forms.office.com X-RoutingOfficeFE: FormsSingleBox_IN_0 X-RoutingOfficeFE: FormsSingleBox_IN_9 X-RoutingOfficeVersion: 16.0.18821.42501 X-RoutingOfficeVersion: 16.0.18821.42501 X-RoutingSessionId: 0f67ab2e-817f-475d-bf55-a350b06806a5 X-RoutingCorrelationId: 286b08d8-62c9-4d0c-b9e2-ecd486453e33 X-CorrelationId: 286b08d8-62c9-4d0c-b9e2-ecd486453e33 X-OfficeCluster: neu-100.forms.office.com X-OfficeFE: FormsSingleBox_IN_8 X-OfficeVersion: 16.0.18821.42501 X-UserSessionId: 0f67ab2e-817f-475d-bf55-a350b06806a5 Report-To: { "group": "endpoint-1", "max_age": 108864000, "endpoints": [ { "url": "https://csp.microsoft.com/report/Forms-PROD" }] } Content-Security-Policy: object-src 'none';script-src 'nonce-9db1d84a-1253-4907-8e12-9f8c573d9740' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https:;base-uri 'none';require-trusted-types-for 'script'; report-uri https://csp.microsoft.com/report/Forms-PROD;report-to endpoint-1; X-Robots-Tag: noindex, nofollow Link: <https://forms.office.com/cdn>; rel=preconnect; crossorigin=anonymous X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 084457963AC74B6A97A9944CAAF6FF7B Ref B: LAX311000115021 Ref C: 2025-04-23T15:03:16Z Date: Wed, 23 Apr 2025 15:03:16 GMT Connection: close
2025-04-23 15:03:17 UTC	2128	IN	Data Raw: 38 34 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 Data Ascii: 849<!DOCTYPE html><html dir="ltr" xmlns="http://www.w3.org/1999/xhtml" lang="en-us"><head> <meta charset="utf-8" /> <meta http-equiv="x-ua-compatible" content="IE=edge" /> <meta name="viewport" content="width=device-widt
2025-04-23 15:03:17 UTC	435	IN	Data Raw: 31 61 63 0d 0a 20 20 20 20 20 20 20 73 68 6f 77 50 72 6f 63 65 73 73 69 6e 67 4d 65 73 73 61 67 65 73 3a 20 66 61 6c 73 65 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 65 73 73 61 67 65 53 74 79 6c 65 3a 20 22 6e 6f 6e 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 6b 69 70 53 74 61 72 74 75 70 54 79 70 65 73 65 74 3a 20 74 72 75 65 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 65 78 74 65 6e 73 69 6f 6e 73 3a 20 5b 22 74 6f 4d 61 74 68 4d 4c 2e 6a 73 22 5d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 32 6a 61 78 3a 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 6e 6c 69 6e 65 4d 61 74 68 3a 20 5b 5b 27 24 27 2c 20 27 24 27 5d 2c 20 5b 27 5c 5c 28 27 2c 20 27 5c Data Ascii: 1ac showProcessingMessages: false, messageStyle: "none", skipStartupTypeset: true, extensions: ["toMathML.js"], tex2jax: { inlineMath: [['$', '$'], ['\\(', '\
2025-04-23 15:03:17 UTC	1364	IN	Data Raw: 35 34 64 0d 0a 65 72 6d 65 73 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 62 72 65 61 6b 73 3a 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 61 75 74 6f 6d 61 74 69 63 3a 20 66 61 6c 73 65 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 3b 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 39 64 62 31 64 38 34 61 2d 31 32 35 33 2d 34 39 30 37 2d 38 65 31 32 2d 39 66 38 63 35 37 33 64 39 37 34 30 22 3e 0d 0a 20 Data Ascii: 54dermes", linebreaks: { automatic: false } } }; </script> <script type="text/javascript" nonce="9db1d84a-1253-4907-8e12-9f8c573d9740">
2025-04-23 15:03:17 UTC	2739	IN	Data Raw: 61 61 63 0d 0a 30 25 32 32 2c 25 32 32 44 65 6c 61 79 55 70 64 61 74 65 4d 61 73 74 65 72 73 25 32 32 3a 25 32 32 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 25 32 32 2c 25 32 32 43 75 73 74 6f 6d 65 72 56 6f 69 63 65 55 72 6c 25 32 32 3a 25 32 32 68 74 74 70 73 3a 2f 2f 63 75 73 74 6f 6d 65 72 76 6f 69 63 65 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 25 32 32 2c 25 32 32 43 75 73 74 6f 6d 65 72 56 6f 69 63 65 54 72 61 6e 73 69 74 69 6f 6e 43 6f 6d 70 6c 65 74 69 6f 6e 44 61 74 65 25 32 32 3a 25 32 32 30 39 2f 33 30 2f 32 30 32 30 25 32 32 2c 25 32 32 49 67 6e 6f 72 65 64 43 6c 69 65 6e 74 45 72 72 6f 72 5f 50 72 6f 64 25 32 32 3a 25 32 32 5b 25 35 43 75 30 30 32 32 69 2d 46 49 4c 54 45 52 25 35 43 75 30 30 32 32 2c 25 35 Data Ascii: aac0%22,%22DelayUpdateMasters%22:%22abcdefghijklmnopqrstuvwxyz%22,%22CustomerVoiceUrl%22:%22https://customervoice.microsoft.com%22,%22CustomerVoiceTransitionCompletionDate%22:%2209/30/2020%22,%22IgnoredClientError_Prod%22:%22[%5Cu0022i-FILTER%5Cu0022,%5
2025-04-23 15:03:17 UTC	4048	IN	Data Raw: 66 63 39 0d 0a 30 32 37 25 32 30 6f 66 25 32 30 75 6e 64 65 66 69 6e 65 64 25 35 43 75 30 30 32 32 2c 25 35 43 75 30 30 32 32 75 6e 64 65 66 69 6e 65 64 25 32 30 68 61 73 25 32 30 6e 6f 25 32 30 70 72 6f 70 65 72 74 69 65 73 25 35 43 75 30 30 32 32 2c 25 35 43 75 30 30 32 32 43 61 6e 6e 6f 74 25 32 30 72 65 61 64 25 32 30 70 72 6f 70 65 72 74 79 25 32 30 25 35 43 75 30 30 32 37 67 65 74 52 65 61 64 4d 6f 64 65 45 78 74 72 61 63 74 25 35 43 75 30 30 32 37 25 32 30 6f 66 25 32 30 75 6e 64 65 66 69 6e 65 64 25 35 43 75 30 30 32 32 2c 25 35 43 75 30 30 32 32 43 61 6e 6e 6f 74 25 32 30 72 65 61 64 25 32 30 70 72 6f 70 65 72 74 79 25 32 30 25 35 43 75 30 30 32 37 67 65 74 52 65 61 64 4d 6f 64 65 52 65 6e 64 65 72 25 35 43 75 30 30 32 37 25 32 30 6f 66 25 32 30 Data Ascii: fc9027%20of%20undefined%5Cu0022,%5Cu0022undefined%20has%20no%20properties%5Cu0022,%5Cu0022Cannot%20read%20property%20%5Cu0027getReadModeExtract%5Cu0027%20of%20undefined%5Cu0022,%5Cu0022Cannot%20read%20property%20%5Cu0027getReadModeRender%5Cu0027%20of%20
2025-04-23 15:03:17 UTC	41	IN	Data Raw: 32 33 0d 0a 6a 33 2e 6d 69 6e 2e 6a 73 22 3a 22 31 34 65 35 39 61 30 22 2c 22 76 65 6e 64 6f 72 73 2f 63 6f 6d 62 69 0d 0a Data Ascii: 23j3.min.js":"14e59a0","vendors/combi
2025-04-23 15:03:17 UTC	4048	IN	Data Raw: 66 63 39 0d 0a 6e 65 64 6d 69 6e 2f 64 65 73 69 67 6e 5f 76 33 2e 6d 69 6e 2e 6a 73 22 3a 22 65 37 36 38 61 30 62 22 2c 22 76 65 6e 64 6f 72 73 2f 63 6f 6d 62 69 6e 65 64 6d 69 6e 2f 72 65 73 70 6f 6e 73 65 5f 76 32 2e 6d 69 6e 2e 6a 73 22 3a 22 61 64 31 63 34 66 36 22 2c 22 76 65 6e 64 6f 72 73 2f 64 33 2f 64 33 2e 6d 69 6e 2e 6a 73 22 3a 22 32 38 37 35 39 65 63 22 2c 22 76 65 6e 64 6f 72 73 2f 64 61 74 61 74 61 62 6c 65 73 2e 6d 69 6e 2e 6a 73 22 3a 22 31 32 64 33 34 32 36 22 2c 22 76 65 6e 64 6f 72 73 2f 69 6d 6d 65 72 73 69 76 65 72 65 61 64 65 72 2f 69 6d 6d 65 72 73 69 76 65 2d 72 65 61 64 65 72 2d 73 64 6b 2e 30 2e 30 2e 32 2e 6d 69 6e 2e 6a 73 22 3a 22 62 30 35 31 37 32 61 22 2c 22 76 65 6e 64 6f 72 73 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2d Data Ascii: fc9nedmin/design_v3.min.js":"e768a0b","vendors/combinedmin/response_v2.min.js":"ad1c4f6","vendors/d3/d3.min.js":"28759ec","vendors/datatables.min.js":"12d3426","vendors/immersivereader/immersive-reader-sdk.0.0.2.min.js":"b05172a","vendors/jquery/jquery-
2025-04-23 15:03:17 UTC	42	IN	Data Raw: 32 34 0d 0a 39 65 36 63 22 2c 22 64 65 73 69 67 6e 2d 70 61 67 65 2d 70 72 6f 2e 6d 69 6e 2e 6a 73 22 3a 22 32 32 63 32 0d 0a Data Ascii: 249e6c","design-page-pro.min.js":"22c2
2025-04-23 15:03:17 UTC	1202	IN	Data Raw: 34 61 62 0d 0a 30 64 61 22 2c 22 64 65 73 69 67 6e 2d 70 61 67 65 2d 70 72 6f 2e 63 61 63 68 65 67 72 6f 75 70 2d 70 72 6f 64 65 70 65 6e 64 65 6e 63 69 65 73 2e 6d 69 6e 2e 6a 73 22 3a 22 38 33 65 34 63 37 30 22 2c 22 64 65 73 69 67 6e 2d 70 61 67 65 2d 70 72 6f 2e 63 61 63 68 65 67 72 6f 75 70 2d 6e 65 72 76 65 2e 6d 69 6e 2e 6a 73 22 3a 22 30 31 63 66 35 66 32 22 2c 22 64 65 73 69 67 6e 2d 70 61 67 65 2e 6d 69 6e 2e 6a 73 22 3a 22 32 33 62 65 39 37 36 22 2c 22 64 65 73 69 67 6e 2d 70 61 67 65 2e 63 61 63 68 65 67 72 6f 75 70 2d 6e 65 72 76 65 2e 6d 69 6e 2e 6a 73 22 3a 22 30 37 61 63 62 34 64 22 2c 22 64 69 73 74 72 69 62 75 74 69 6f 6e 2d 74 65 73 74 2d 70 61 67 65 2e 6d 69 6e 2e 63 73 73 22 3a 22 65 32 63 34 32 30 61 22 2c 22 64 69 73 74 72 69 62 75 Data Ascii: 4ab0da","design-page-pro.cachegroup-prodependencies.min.js":"83e4c70","design-page-pro.cachegroup-nerve.min.js":"01cf5f2","design-page.min.js":"23be976","design-page.cachegroup-nerve.min.js":"07acb4d","distribution-test-page.min.css":"e2c420a","distribu
2025-04-23 15:03:17 UTC	2846	IN	Data Raw: 62 31 37 0d 0a 30 31 64 30 63 22 2c 22 66 6f 72 6d 73 66 6f 72 65 78 63 65 6c 2d 70 61 67 65 2e 6d 69 6e 2e 6a 73 22 3a 22 37 62 35 63 61 63 31 22 2c 22 69 6d 70 6f 72 74 2d 70 61 67 65 2e 6d 69 6e 2e 6a 73 22 3a 22 30 61 62 32 30 61 65 22 2c 22 69 6d 70 6f 72 74 2d 70 61 67 65 2e 63 61 63 68 65 67 72 6f 75 70 2d 6e 65 72 76 65 2e 6d 69 6e 2e 6a 73 22 3a 22 61 33 62 38 64 64 33 22 2c 22 6c 69 67 68 74 2d 61 73 73 69 67 6e 6d 65 6e 74 2d 72 65 73 70 6f 6e 73 65 2d 70 61 67 65 2e 6d 69 6e 2e 6a 73 22 3a 22 37 38 66 34 62 66 39 22 2c 22 6c 69 67 68 74 2d 61 73 73 69 67 6e 6d 65 6e 74 73 2d 70 72 65 66 65 74 63 68 65 72 2e 6d 69 6e 2e 6a 73 22 3a 22 62 66 66 34 38 63 66 22 2c 22 6c 69 67 68 74 2d 63 76 2d 72 65 73 70 6f 6e 73 65 2d 70 61 67 65 2e 6d 69 6e 2e Data Ascii: b1701d0c","formsforexcel-page.min.js":"7b5cac1","import-page.min.js":"0ab20ae","import-page.cachegroup-nerve.min.js":"a3b8dd3","light-assignment-response-page.min.js":"78f4bf9","light-assignments-prefetcher.min.js":"bff48cf","light-cv-response-page.min.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49713	13.107.6.194	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:17 UTC	1317	OUT	GET /formapi/api/730d681e-b6b9-41a0-b3f9-9e4a48f8f6b5/users/eee5f5fd-0405-46f1-9b64-5ec1b1f9dd8d/light/runtimeFormsWithResponses('HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u')?$expand=questions($expand=choices)&$top=1 HTTP/1.1 Host: forms.office.com Connection: keep-alive X-UserSessionId: 0f67ab2e-817f-475d-bf55-a350b06806a5 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/json sec-ch-ua-mobile: ?0 __RequestVerificationToken: xmzLGVfwn4f6DjSIrV86d6OkeD3PyT_Mr3LpHIifcODkyfCWPgETKKZ7FMcKc3ARKAoE9nierau9kvf6LnzKE_ayUTAnWkW8hv9sWqOzFbY1 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturl Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
2025-04-23 15:03:18 UTC	982	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8 Strict-Transport-Security: max-age=2592000; includeSubDomains X-RoutingOfficeCluster: wus-100.forms.office.com X-RoutingOfficeCluster: weu-101.forms.office.com X-RoutingOfficeFE: FormsSingleBox_IN_1 X-RoutingOfficeFE: FormsSingleBox_IN_7 X-RoutingOfficeVersion: 16.0.18821.42502 X-RoutingOfficeVersion: 16.0.18821.42501 X-RoutingSessionId: 0f67ab2e-817f-475d-bf55-a350b06806a5 X-RoutingCorrelationId: 35ef2e6b-1e54-4caa-adda-79660734766e X-CorrelationId: 35ef2e6b-1e54-4caa-adda-79660734766e X-OfficeCluster: weu-101.forms.office.com X-OfficeFE: FormsSingleBox_IN_7 X-OfficeVersion: 16.0.18821.42501 X-UserSessionId: 0f67ab2e-817f-475d-bf55-a350b06806a5 X-Robots-Tag: noindex, nofollow X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: BC0D84CF6F984787B5E32F74530C8B76 Ref B: LAX311000109019 Ref C: 2025-04-23T15:03:17Z Date: Wed, 23 Apr 2025 15:03:17 GMT Connection: close
2025-04-23 15:03:18 UTC	147	IN	Data Raw: 38 64 0d 0a 7b 22 72 65 73 70 6f 6e 73 65 73 22 3a 6e 75 6c 6c 2c 22 66 6f 72 6d 22 3a 7b 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 53 61 66 65 74 79 4c 65 76 65 6c 22 3a 30 2c 22 72 65 70 75 74 61 74 69 6f 6e 54 69 65 72 22 3a 31 2c 22 62 61 63 6b 67 72 6f 75 6e 64 22 3a 7b 22 61 6c 74 54 65 78 74 22 3a 6e 75 6c 6c 2c 22 63 6f 6e 74 65 6e 74 54 79 70 65 22 3a 6e 75 6c 6c 2c 22 66 69 6c 65 49 64 0d 0a Data Ascii: 8d{"responses":null,"form":{"description":null,"onlineSafetyLevel":0,"reputationTier":1,"background":{"altText":null,"contentType":null,"fileId
2025-04-23 15:03:18 UTC	1358	IN	Data Raw: 35 34 37 0d 0a 65 6e 74 69 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 6f 72 69 67 69 6e 61 6c 46 69 6c 65 4e 61 6d 65 22 3a 6e 75 6c 6c 2c 22 72 65 73 6f 75 72 63 65 49 64 22 3a 6e 75 6c 6c 2c 22 72 65 73 6f 75 72 63 65 55 72 6c 22 3a 6e 75 6c 6c 2c 22 68 65 69 67 68 74 22 3a 6e 75 6c 6c 2c 22 77 69 64 74 68 22 3a 6e 75 6c 6c 2c 22 73 69 7a 65 22 3a 6e 75 6c 6c 7d 2c 22 68 65 61 64 65 72 22 3a 7b 22 61 6c 74 54 65 78 74 22 3a 6e 75 6c 6c 2c 22 63 6f 6e 74 65 6e 74 54 79 70 65 22 3a 6e 75 6c 6c 2c 22 66 69 6c 65 49 64 65 6e 74 69 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 6f 72 69 67 69 6e 61 6c 46 69 6c 65 4e 61 6d 65 22 3a 6e 75 6c 6c 2c 22 72 65 73 6f 75 72 63 65 49 64 22 3a 6e 75 6c 6c 2c 22 72 65 73 6f 75 72 63 65 55 72 6c 22 3a 6e 75 6c 6c 2c 22 68 65 69 67 68 74 Data Ascii: 547entifier":null,"originalFileName":null,"resourceId":null,"resourceUrl":null,"height":null,"width":null,"size":null},"header":{"altText":null,"contentType":null,"fileIdentifier":null,"originalFileName":null,"resourceId":null,"resourceUrl":null,"height
2025-04-23 15:03:18 UTC	2200	IN	Data Raw: 38 39 31 0d 0a 32 35 32 33 20 3a 2d 5c 6e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6e 6f 74 69 6f 6e 2e 73 6f 2f 4c 61 75 72 65 6e 63 65 2d 47 61 75 63 68 65 2d 50 6c 61 6e 2d 74 65 2d 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 2d 31 64 65 37 36 65 64 63 35 32 65 38 38 30 34 31 38 31 65 35 66 64 33 36 31 30 64 63 37 36 64 30 3f 70 76 73 3d 34 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c Data Ascii: 8912523 :-\nhttps://www.notion.so/Laurence-Gauche-Plan-te-Communication-1de76edc52e8804181e5fd3610dc76d0?pvs=4\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\
2025-04-23 15:03:18 UTC	1099	IN	Data Raw: 34 34 34 0d 0a 72 65 73 55 6e 69 71 75 65 52 65 73 70 6f 6e 73 65 5c 22 3a 66 61 6c 73 65 2c 5c 22 49 73 41 6e 6f 6e 79 6d 6f 75 73 5c 22 3a 74 72 75 65 2c 5c 22 4e 6f 74 52 65 63 6f 72 64 49 64 65 6e 74 69 74 79 5c 22 3a 66 61 6c 73 65 2c 5c 22 49 73 51 75 69 7a 4d 6f 64 65 5c 22 3a 66 61 6c 73 65 2c 5c 22 50 65 72 6d 69 73 73 69 6f 6e 46 6f 72 52 65 73 70 6f 6e 64 65 72 5c 22 3a 31 2c 5c 22 53 68 75 66 66 6c 65 51 75 65 73 74 69 6f 6e 4f 72 64 65 72 5c 22 3a 66 61 6c 73 65 7d 22 2c 22 64 65 73 65 72 69 61 6c 69 7a 65 64 53 65 74 74 69 6e 67 73 22 3a 6e 75 6c 6c 2c 22 73 6f 66 74 44 65 6c 65 74 65 64 22 3a 30 2c 22 74 68 61 6e 6b 59 6f 75 4d 65 73 73 61 67 65 22 3a 6e 75 6c 6c 2c 22 66 6c 61 67 73 22 3a 34 2c 22 65 6d 61 69 6c 52 65 63 65 69 70 74 45 6e Data Ascii: 444resUniqueResponse\":false,\"IsAnonymous\":true,\"NotRecordIdentity\":false,\"IsQuizMode\":false,\"PermissionForResponder\":1,\"ShuffleQuestionOrder\":false}","deserializedSettings":null,"softDeleted":0,"thankYouMessage":null,"flags":4,"emailReceiptEn
2025-04-23 15:03:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49716	13.107.6.194	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:17 UTC	926	OUT	GET /cdn/scripts/dists/ls-response.en-us.b26195a5d.js HTTP/1.1 Host: forms.office.com Connection: keep-alive Origin: https://forms.office.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturl Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
2025-04-23 15:03:17 UTC	572	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 35318 Content-Type: application/javascript Last-Modified: Mon, 21 Apr 2025 04:58:44 GMT Accept-Ranges: bytes ETag: "0x8DD809131963724" X-Cache: TCP_HIT x-ms-request-id: c01ec568-701e-0053-7981-b27405000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * X-CID: 7 X-MSEdge-Ref: Ref A: DE8048092A86413BBC95C89DC07E4B98 Ref B: LAX311000111047 Ref C: 2025-04-23T15:03:17Z Date: Wed, 23 Apr 2025 15:03:17 GMT Connection: close
2025-04-23 15:03:17 UTC	15812	IN	Data Raw: 77 69 6e 64 6f 77 2e 46 6f 72 6d 73 4c 73 4d 61 70 20 3d 20 28 77 69 6e 64 6f 77 2e 46 6f 72 6d 73 4c 73 4d 61 70 20 7c 7c 20 7b 7d 29 3b 77 69 6e 64 6f 77 2e 46 6f 72 6d 73 4c 73 4d 61 70 5b 22 65 6e 2d 75 73 22 5d 3d 7b 22 6d 64 62 69 63 67 6f 22 3a 22 52 65 71 75 69 72 65 64 20 74 6f 20 61 6e 73 77 65 72 22 2c 22 61 63 6d 6e 67 64 6f 22 3a 22 54 68 69 73 20 75 73 65 72 20 69 73 20 6e 6f 74 20 63 75 72 72 65 6e 74 6c 79 20 72 65 73 74 72 69 63 74 65 64 20 66 72 6f 6d 20 75 73 69 6e 67 20 4d 69 63 72 6f 73 6f 66 74 20 46 6f 72 6d 73 2e 20 4e 6f 20 66 75 72 74 68 65 72 20 61 63 74 69 6f 6e 20 69 73 20 6e 65 65 64 65 64 2e e2 80 8b 22 2c 22 70 64 6e 66 63 6f 70 22 3a 22 43 6f 72 72 65 63 74 22 2c 22 67 70 6c 62 6d 63 70 22 3a 22 50 72 69 6e 74 20 72 65 73 Data Ascii: window.FormsLsMap = (window.FormsLsMap \|\| {});window.FormsLsMap["en-us"]={"mdbicgo":"Required to answer","acmngdo":"This user is not currently restricted from using Microsoft Forms. No further action is needed.","pdnfcop":"Correct","gplbmcp":"Print res
2025-04-23 15:03:18 UTC	16384	IN	Data Raw: 73 73 2c 20 6f 72 20 73 69 67 6e 20 69 6e 20 77 69 74 68 20 61 20 64 69 66 66 65 72 65 6e 74 20 61 63 63 6f 75 6e 74 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 22 2c 22 65 63 67 66 65 63 64 22 3a 22 59 6f 75 72 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 20 68 61 73 20 6e 6f 74 20 65 6e 61 62 6c 65 64 20 4d 69 63 72 6f 73 6f 66 74 20 46 6f 72 6d 73 20 66 6f 72 20 79 6f 75 72 20 63 75 72 72 65 6e 74 20 61 63 63 6f 75 6e 74 22 2c 22 67 63 61 65 70 68 65 22 3a 22 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 66 6f 72 20 61 63 63 65 73 73 2c 20 6f 72 20 73 69 67 6e 20 69 6e 20 77 69 74 68 20 61 20 64 69 66 66 65 72 65 6e 74 20 61 63 63 6f 75 6e 74 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 22 2c 22 68 64 Data Ascii: ss, or sign in with a different account and try again.","ecgfecd":"Your organization has not enabled Microsoft Forms for your current account","gcaephe":"Please contact your administrator for access, or sign in with a different account and try again.","hd
2025-04-23 15:03:18 UTC	3122	IN	Data Raw: 65 20 46 6f 72 6d 73 20 74 6f 20 65 61 73 69 6c 79 20 63 72 65 61 74 65 20 73 75 72 76 65 79 73 20 6f 72 20 71 75 69 7a 7a 65 73 2c 20 61 6e 64 20 67 65 74 20 64 61 74 61 20 69 6e 73 69 67 68 74 73 20 69 6e 73 74 61 6e 74 6c 79 2e 22 2c 22 61 66 67 70 63 63 6d 22 3a 22 53 69 6d 70 6c 69 66 79 20 64 61 74 61 20 63 6f 6c 6c 65 63 74 69 6f 6e 20 61 6e 64 20 67 61 69 6e 20 73 6d 61 72 74 20 69 6e 73 69 67 68 74 73 20 74 6f 64 61 79 21 22 2c 22 69 67 6d 70 68 6a 70 22 3a 22 54 68 61 6e 6b 20 59 6f 75 22 2c 22 66 6c 6f 61 6e 68 6c 22 3a 22 53 74 61 72 74 20 6e 6f 77 22 2c 22 6f 69 6b 6b 6b 66 62 22 3a 22 47 65 74 20 73 65 74 20 66 6f 72 20 79 6f 75 72 20 65 76 65 6e 74 20 69 6e 76 69 74 61 74 69 6f 6e 21 22 2c 22 66 61 70 6d 6f 64 63 22 3a 22 47 65 74 20 73 65 Data Ascii: e Forms to easily create surveys or quizzes, and get data insights instantly.","afgpccm":"Simplify data collection and gain smart insights today!","igmphjp":"Thank You","floanhl":"Start now","oikkkfb":"Get set for your event invitation!","fapmodc":"Get se

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49714	13.107.6.194	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:17 UTC	924	OUT	GET /cdn/scripts/dists/dll-dompurify.min.ea88d58.js HTTP/1.1 Host: forms.office.com Connection: keep-alive Origin: https://forms.office.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturl Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
2025-04-23 15:03:17 UTC	572	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 44016 Content-Type: application/javascript Last-Modified: Tue, 22 Apr 2025 05:04:09 GMT Accept-Ranges: bytes ETag: "0x8DD815B1D9DAD85" X-Cache: TCP_HIT x-ms-request-id: c988d15c-901e-0029-189e-b36945000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * X-CID: 7 X-MSEdge-Ref: Ref A: 584A6077B01B4CE7BCF83DC3D9A68BCC Ref B: LAX311000111049 Ref C: 2025-04-23T15:03:17Z Date: Wed, 23 Apr 2025 15:03:17 GMT Connection: close
2025-04-23 15:03:17 UTC	15812	IN	Data Raw: 76 61 72 20 5f 64 6c 6c 5f 64 6f 6d 70 75 72 69 66 79 5f 65 34 39 33 62 37 63 38 31 62 64 31 35 34 31 64 65 65 61 35 3b 28 28 29 3d 3e 7b 76 61 72 20 74 3d 7b 32 31 3a 28 74 2c 65 2c 6e 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 72 28 65 29 2c 6e 2e 64 28 65 2c 7b 54 72 75 73 74 65 64 54 79 70 65 43 6f 6e 66 69 67 3a 28 29 3d 3e 5f 2c 54 72 75 73 74 65 64 54 79 70 65 50 6f 6c 69 63 79 3a 28 29 3d 3e 75 2c 54 72 75 73 74 65 64 54 79 70 65 50 6f 6c 69 63 79 46 61 63 74 6f 72 79 3a 28 29 3d 3e 64 2c 54 72 75 73 74 65 64 54 79 70 65 73 45 6e 66 6f 72 63 65 72 3a 28 29 3d 3e 46 2c 74 72 75 73 74 65 64 54 79 70 65 73 3a 28 29 3d 3e 6d 7d 29 3b 0a 2f 2a 2a 0a 20 2a 20 40 6c 69 63 65 6e 73 65 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 37 20 Data Ascii: var _dll_dompurify_e493b7c81bd1541deea5;(()=>{var t={21:(t,e,n)=>{"use strict";n.r(e),n.d(e,{TrustedTypeConfig:()=>_,TrustedTypePolicy:()=>u,TrustedTypePolicyFactory:()=>d,TrustedTypesEnforcer:()=>F,trustedTypes:()=>m});/** * @license * Copyright 2017
2025-04-23 15:03:18 UTC	16384	IN	Data Raw: 49 29 3b 69 66 28 72 26 26 4e 28 44 2c 6a 2c 5b 72 5d 29 29 72 65 74 75 72 6e 20 74 68 69 73 2e 65 6e 66 6f 72 63 65 5f 28 74 2c 22 73 65 74 41 74 74 72 69 62 75 74 65 22 2c 6a 5b 72 5d 2c 65 2c 31 2c 6e 29 7d 72 65 74 75 72 6e 20 4e 28 65 2c 74 2c 6e 29 7d 73 65 74 41 74 74 72 69 62 75 74 65 4e 53 57 72 61 70 70 65 72 5f 28 74 2c 65 2c 2e 2e 2e 6e 29 7b 69 66 28 6e 75 6c 6c 21 3d 3d 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 26 26 74 68 69 73 2e 69 6e 73 74 61 6e 63 65 4f 66 44 6f 6d 50 72 6f 70 65 72 74 79 28 74 2c 22 45 6c 65 6d 65 6e 74 22 29 29 7b 63 6f 6e 73 74 20 6f 3d 6e 5b 30 5d 3f 53 74 72 69 6e 67 28 6e 5b 30 5d 29 3a 6e 75 6c 6c 3b 6e 5b 30 5d 3d 6f 3b 63 6f 6e 73 74 20 72 3d 28 6e 5b 31 5d 3d 53 74 72 69 6e 67 28 6e 5b 31 5d 29 29 2e 74 6f 4c 6f Data Ascii: I);if(r&&N(D,j,[r]))return this.enforce_(t,"setAttribute",j[r],e,1,n)}return N(e,t,n)}setAttributeNSWrapper_(t,e,...n){if(null!==t.constructor&&this.instanceOfDomProperty(t,"Element")){const o=n[0]?String(n[0]):null;n[0]=o;const r=(n[1]=String(n[1])).toLo
2025-04-23 15:03:18 UTC	11820	IN	Data Raw: 21 30 2c 6b 74 3d 21 31 2c 49 74 3d 21 30 2c 46 74 3d 21 31 2c 48 74 3d 21 31 2c 55 74 3d 21 31 2c 7a 74 3d 21 31 2c 57 74 3d 21 31 2c 42 74 3d 21 31 2c 47 74 3d 21 30 2c 24 74 3d 21 31 3b 63 6f 6e 73 74 20 59 74 3d 22 75 73 65 72 2d 63 6f 6e 74 65 6e 74 2d 22 3b 6c 65 74 20 58 74 3d 21 30 2c 71 74 3d 21 31 2c 4b 74 3d 7b 7d 2c 56 74 3d 6e 75 6c 6c 3b 63 6f 6e 73 74 20 4a 74 3d 52 28 7b 7d 2c 5b 22 61 6e 6e 6f 74 61 74 69 6f 6e 2d 78 6d 6c 22 2c 22 61 75 64 69 6f 22 2c 22 63 6f 6c 67 72 6f 75 70 22 2c 22 64 65 73 63 22 2c 22 66 6f 72 65 69 67 6e 6f 62 6a 65 63 74 22 2c 22 68 65 61 64 22 2c 22 69 66 72 61 6d 65 22 2c 22 6d 61 74 68 22 2c 22 6d 69 22 2c 22 6d 6e 22 2c 22 6d 6f 22 2c 22 6d 73 22 2c 22 6d 74 65 78 74 22 2c 22 6e 6f 65 6d 62 65 64 22 2c 22 6e Data Ascii: !0,kt=!1,It=!0,Ft=!1,Ht=!1,Ut=!1,zt=!1,Wt=!1,Bt=!1,Gt=!0,$t=!1;const Yt="user-content-";let Xt=!0,qt=!1,Kt={},Vt=null;const Jt=R({},["annotation-xml","audio","colgroup","desc","foreignobject","head","iframe","math","mi","mn","mo","ms","mtext","noembed","n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49715	13.107.6.194	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:17 UTC	930	OUT	GET /cdn/scripts/dists/light-response-page.min.48f0da1.js HTTP/1.1 Host: forms.office.com Connection: keep-alive Origin: https://forms.office.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturl Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
2025-04-23 15:03:17 UTC	574	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 494029 Content-Type: application/javascript Last-Modified: Mon, 21 Apr 2025 04:58:40 GMT Accept-Ranges: bytes ETag: "0x8DD80912EE8E196" X-Cache: TCP_MISS x-ms-request-id: e558e866-301e-0052-4860-b42bd9000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * X-CID: 7 X-MSEdge-Ref: Ref A: 65DD111E6E50464B93F8BE3CD5BD9055 Ref B: LAX311000115033 Ref C: 2025-04-23T15:03:17Z Date: Wed, 23 Apr 2025 15:03:16 GMT Connection: close
2025-04-23 15:03:17 UTC	15810	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 74 2c 72 2c 65 2c 69 2c 6f 3d 7b 39 34 33 33 35 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 72 2e 64 28 74 2c 7b 44 55 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 2c 49 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 7d 29 3b 76 61 72 20 65 2c 69 3d 72 28 33 35 36 39 35 29 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 65 21 3d 3d 6e 26 26 28 65 3d 6e 29 7d 66 75 6e 63 74 69 6f 6e 20 75 28 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 65 26 26 28 65 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 64 6f 63 75 6d 65 6e 74 26 26 21 21 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e Data Ascii: !function(){var n,t,r,e,i,o={94335:function(n,t,r){"use strict";r.d(t,{DU:function(){return o},Iy:function(){return a}});var e,i=r(35695);function o(n){e!==n&&(e=n)}function u(){return void 0===e&&(e="undefined"!=typeof document&&!!document.documentElemen
2025-04-23 15:03:18 UTC	16384	IN	Data Raw: 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 7d 29 3b 76 61 72 20 65 3d 72 28 39 32 38 33 31 29 3b 66 75 6e 63 74 69 6f 6e 20 69 28 2e 2e 2e 6e 29 7b 63 6f 6e 73 74 20 74 3d 65 2e 75 73 65 43 61 6c 6c 62 61 63 6b 28 28 72 3d 3e 7b 74 2e 63 75 72 72 65 6e 74 3d 72 3b 66 6f 72 28 63 6f 6e 73 74 20 74 20 6f 66 20 6e 29 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 3f 74 28 72 29 3a 74 26 26 28 74 2e 63 75 72 72 65 6e 74 3d 72 29 7d 29 2c 5b 2e 2e 2e 6e 5d 29 3b 72 65 74 75 72 6e 20 74 7d 7d 2c 35 36 34 33 32 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 72 2e 64 28 74 2c 7b 4a 39 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 73 7d 7d 29 3b 76 61 72 20 65 3d 72 28 37 35 32 36 35 29 2c 69 3d 21 31 Data Ascii: n(){return i}});var e=r(92831);function i(...n){const t=e.useCallback((r=>{t.current=r;for(const t of n)"function"==typeof t?t(r):t&&(t.current=r)}),[...n]);return t}},56432:function(n,t,r){"use strict";r.d(t,{J9:function(){return s}});var e=r(75265),i=!1
2025-04-23 15:03:18 UTC	16384	IN	Data Raw: 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 53 79 6d 62 6f 6c 2e 66 6f 72 26 26 53 79 6d 62 6f 6c 2e 66 6f 72 28 22 72 65 61 63 74 2e 66 6f 72 77 61 72 64 5f 72 65 66 22 29 7c 7c 33 39 31 31 3b 66 75 6e 63 74 69 6f 6e 20 79 6e 28 6e 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 74 2c 72 29 7b 76 61 72 20 65 3d 6d 6e 28 7b 7d 2c 74 29 3b 72 65 74 75 72 6e 20 64 65 6c 65 74 65 20 65 2e 72 65 66 2c 6e 28 65 2c 28 72 3d 74 2e 72 65 66 7c 7c 72 29 26 26 28 22 6f 62 6a 65 63 74 22 21 3d 74 79 70 65 6f 66 20 72 7c 7c 22 63 75 72 72 65 6e 74 22 69 6e 20 72 29 3f 72 3a 6e 75 6c 6c 29 7d 72 65 74 75 72 6e 20 74 2e 24 24 74 79 70 65 6f 66 3d 77 6e 2c 74 2e 72 65 6e 64 65 72 3d 74 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 52 65 61 63 74 Data Ascii: ndefined"!=typeof Symbol&&Symbol.for&&Symbol.for("react.forward_ref")\|\|3911;function yn(n){function t(t,r){var e=mn({},t);return delete e.ref,n(e,(r=t.ref\|\|r)&&("object"!=typeof r\|\|"current"in r)?r:null)}return t.$$typeof=wn,t.render=t,t.prototype.isReact
2025-04-23 15:03:18 UTC	16384	IN	Data Raw: 72 20 6f 2c 75 2c 61 2c 63 2c 66 2c 73 3d 69 2e 61 72 65 53 74 61 74 65 73 45 71 75 61 6c 2c 6c 3d 69 2e 61 72 65 4f 77 6e 50 72 6f 70 73 45 71 75 61 6c 2c 5f 3d 69 2e 61 72 65 53 74 61 74 65 50 72 6f 70 73 45 71 75 61 6c 2c 64 3d 21 31 3b 66 75 6e 63 74 69 6f 6e 20 24 28 69 2c 64 29 7b 76 61 72 20 24 2c 76 2c 6d 3d 21 6c 28 64 2c 75 29 2c 70 3d 21 73 28 69 2c 6f 29 3b 72 65 74 75 72 6e 20 6f 3d 69 2c 75 3d 64 2c 6d 26 26 70 3f 28 61 3d 6e 28 6f 2c 75 29 2c 74 2e 64 65 70 65 6e 64 73 4f 6e 4f 77 6e 50 72 6f 70 73 26 26 28 63 3d 74 28 65 2c 75 29 29 2c 66 3d 72 28 61 2c 63 2c 75 29 29 3a 6d 3f 28 6e 2e 64 65 70 65 6e 64 73 4f 6e 4f 77 6e 50 72 6f 70 73 26 26 28 61 3d 6e 28 6f 2c 75 29 29 2c 74 2e 64 65 70 65 6e 64 73 4f 6e 4f 77 6e 50 72 6f 70 73 26 26 28 Data Ascii: r o,u,a,c,f,s=i.areStatesEqual,l=i.areOwnPropsEqual,_=i.areStatePropsEqual,d=!1;function $(i,d){var $,v,m=!l(d,u),p=!s(i,o);return o=i,u=d,m&&p?(a=n(o,u),t.dependsOnOwnProps&&(c=t(e,u)),f=r(a,c,u)):m?(n.dependsOnOwnProps&&(a=n(o,u)),t.dependsOnOwnProps&&(
2025-04-23 15:03:18 UTC	16384	IN	Data Raw: 69 6f 6e 20 6c 28 6e 29 7b 76 61 72 20 74 3d 75 28 63 28 6e 29 29 3b 72 65 74 75 72 6e 20 6f 28 61 28 7b 48 3a 74 2e 48 2c 53 3a 74 2e 53 2c 56 3a 74 2e 56 3e 3d 2e 31 3f 74 2e 56 2d 2e 31 3a 30 7d 29 29 7d 66 75 6e 63 74 69 6f 6e 20 5f 28 6e 29 7b 76 61 72 20 74 2c 72 3d 75 28 63 28 6e 29 29 3b 72 65 74 75 72 6e 20 74 3d 72 2e 53 3e 2e 30 35 3f 2e 30 35 3a 30 2c 6f 28 61 28 7b 48 3a 72 2e 48 2c 53 3a 74 2c 56 3a 2e 39 35 7d 29 29 7d 76 61 72 20 64 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 2f 5e 23 3f 28 5b 30 2d 39 41 2d 46 61 2d 66 5d 7b 33 7d 29 7b 31 2c 32 7d 24 2f 69 2e 74 65 73 74 28 6e 29 7d 7d 2c 33 30 30 36 32 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 72 2e 64 28 74 2c 7b 41 6c 3a 66 Data Ascii: ion l(n){var t=u(c(n));return o(a({H:t.H,S:t.S,V:t.V>=.1?t.V-.1:0}))}function _(n){var t,r=u(c(n));return t=r.S>.05?.05:0,o(a({H:r.H,S:t,V:.95}))}var d=function(n){return/^#?([0-9A-Fa-f]{3}){1,2}$/i.test(n)}},30062:function(n,t,r){"use strict";r.d(t,{Al:f
2025-04-23 15:03:18 UTC	16384	IN	Data Raw: 28 7b 7d 2c 6e 2c 7b 24 24 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 76 67 22 2c 7b 78 6d 6c 6e 73 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 2c 76 69 65 77 42 6f 78 3a 22 30 20 30 20 32 34 20 32 34 22 7d 2c 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 70 61 74 68 22 2c 7b 66 69 6c 6c 3a 22 23 66 66 66 22 2c 64 3a 22 4d 31 32 20 32 31 2e 35 61 39 2e 35 20 39 2e 35 20 30 20 31 20 30 20 30 2d 31 39 20 39 2e 35 20 39 2e 35 20 30 20 30 20 30 20 30 20 31 39 5a 22 7d 29 29 7d 29 29 7d 2c 61 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 6f 2e 78 2c 28 30 2c 65 2e 43 6c 29 28 7b 7d 2c 6e 2c 7b 24 24 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d Data Ascii: ({},n,{$$:i.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},i.createElement("path",{fill:"#fff",d:"M12 21.5a9.5 9.5 0 1 0 0-19 9.5 9.5 0 0 0 0 19Z"}))}))},a=function(n){return i.createElement(o.x,(0,e.Cl)({},n,{$$:i.createElem
2025-04-23 15:03:18 UTC	16384	IN	Data Raw: 63 6b 65 72 7c 70 6f 63 6b 65 74 7c 70 73 70 7c 73 65 72 69 65 73 28 34 7c 36 29 30 7c 73 79 6d 62 69 61 6e 7c 74 72 65 6f 7c 75 70 5c 2e 28 62 72 6f 77 73 65 72 7c 6c 69 6e 6b 29 7c 76 6f 64 61 66 6f 6e 65 7c 77 61 70 7c 77 69 6e 64 6f 77 73 20 63 65 7c 78 64 61 7c 78 69 69 6e 6f 2f 69 2e 74 65 73 74 28 6e 29 7c 7c 2f 31 32 30 37 7c 36 33 31 30 7c 36 35 39 30 7c 33 67 73 6f 7c 34 74 68 70 7c 35 30 5b 31 2d 36 5d 69 7c 37 37 30 73 7c 38 30 32 73 7c 61 20 77 61 7c 61 62 61 63 7c 61 63 28 65 72 7c 6f 6f 7c 73 5c 2d 29 7c 61 69 28 6b 6f 7c 72 6e 29 7c 61 6c 28 61 76 7c 63 61 7c 63 6f 29 7c 61 6d 6f 69 7c 61 6e 28 65 78 7c 6e 79 7c 79 77 29 7c 61 70 74 75 7c 61 72 28 63 68 7c 67 6f 29 7c 61 73 28 74 65 7c 75 73 29 7c 61 74 74 77 7c 61 75 28 64 69 7c 5c 2d 6d Data Ascii: cker\|pocket\|psp\|series(4\|6)0\|symbian\|treo\|up\.(browser\|link)\|vodafone\|wap\|windows ce\|xda\|xiino/i.test(n)\|\|/1207\|6310\|6590\|3gso\|4thp\|50[1-6]i\|770s\|802s\|a wa\|abac\|ac(er\|oo\|s\-)\|ai(ko\|rn)\|al(av\|ca\|co)\|amoi\|an(ex\|ny\|yw)\|aptu\|ar(ch\|go)\|as(te\|us)\|attw\|au(di\|\-m
2025-04-23 15:03:18 UTC	15936	IN	Data Raw: 22 3a 22 73 76 22 2c 22 74 68 2d 74 68 22 3a 22 74 68 22 2c 22 74 72 2d 74 72 22 3a 22 74 72 22 2c 22 75 6b 2d 75 61 22 3a 22 75 6b 22 2c 22 76 69 2d 76 6e 22 3a 22 76 69 22 2c 22 7a 68 2d 68 61 6e 73 22 3a 22 7a 68 2d 48 61 6e 73 22 2c 22 7a 68 2d 63 6e 22 3a 22 7a 68 2d 48 61 6e 73 22 2c 22 7a 68 2d 68 61 6e 74 22 3a 22 7a 68 2d 48 61 6e 74 22 2c 22 7a 68 2d 74 77 22 3a 22 7a 68 2d 48 61 6e 74 22 7d 3b 72 65 74 75 72 6e 20 74 5b 6e 5d 3f 74 5b 6e 5d 3a 6e 7d 7d 2c 33 33 34 37 31 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 72 2e 64 28 74 2c 7b 5f 4b 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 2c 62 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 3b 76 61 72 20 65 3d Data Ascii: ":"sv","th-th":"th","tr-tr":"tr","uk-ua":"uk","vi-vn":"vi","zh-hans":"zh-Hans","zh-cn":"zh-Hans","zh-hant":"zh-Hant","zh-tw":"zh-Hant"};return t[n]?t[n]:n}},33471:function(n,t,r){"use strict";r.d(t,{_K:function(){return i},bd:function(){return o}});var e=
2025-04-23 15:03:18 UTC	16384	IN	Data Raw: 73 65 28 6e 29 2c 72 3d 36 30 2a 6e 65 77 20 44 61 74 65 28 74 29 2e 67 65 74 54 69 6d 65 7a 6f 6e 65 4f 66 66 73 65 74 28 29 2a 31 65 33 3b 72 65 74 75 72 6e 20 6e 65 77 20 44 61 74 65 28 74 2b 72 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 6e 2c 74 2c 72 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 6e 2e 74 6f 4c 6f 63 61 6c 65 44 61 74 65 53 74 72 69 6e 67 28 74 2c 72 29 7d 63 61 74 63 68 28 74 29 7b 72 65 74 75 72 6e 20 6e 2e 74 6f 4c 6f 63 61 6c 65 44 61 74 65 53 74 72 69 6e 67 28 22 65 6e 2d 75 73 22 2c 72 29 7d 7d 7d 2c 33 32 32 31 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 72 2e 64 28 74 2c 7b 6e 53 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 7d 2c 57 6c 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 Data Ascii: se(n),r=60new Date(t).getTimezoneOffset()1e3;return new Date(t+r)}function l(n,t,r){try{return n.toLocaleDateString(t,r)}catch(t){return n.toLocaleDateString("en-us",r)}}},3221:function(n,t,r){"use strict";r.d(t,{nS:function(){return u},Wl:function(){re
2025-04-23 15:03:18 UTC	16384	IN	Data Raw: 6e 2e 6c 65 6e 67 74 68 3e 3d 74 29 72 65 74 75 72 6e 20 6e 3b 66 6f 72 28 76 61 72 20 65 3d 74 2d 6e 2e 6c 65 6e 67 74 68 2c 69 3d 22 22 2c 6f 3d 30 3b 6f 3c 65 3b 6f 2b 2b 29 69 2b 3d 72 3b 72 65 74 75 72 6e 22 22 2e 63 6f 6e 63 61 74 28 69 29 2e 63 6f 6e 63 61 74 28 6e 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 6e 29 7b 72 65 74 75 72 6e 20 6e 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6e 2e 6e 6f 72 6d 61 6c 69 7a 65 3f 6e 2e 6e 6f 72 6d 61 6c 69 7a 65 28 22 4e 46 43 22 29 3a 6e 7d 76 61 72 20 63 3d 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 72 65 74 75 72 6e 21 28 21 6e 7c 7c 21 74 7c 7c 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 6e 7c 7c 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 74 29 26 26 6e 2e 74 6f 4c 6f 77 65 72 Data Ascii: n.length>=t)return n;for(var e=t-n.length,i="",o=0;o<e;o++)i+=r;return"".concat(i).concat(n)}function a(n){return n&&"function"==typeof n.normalize?n.normalize("NFC"):n}var c=function(n,t){return!(!n\|\|!t\|\|"string"!=typeof n\|\|"string"!=typeof t)&&n.toLower

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49719	13.107.6.194	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:18 UTC	830	OUT	GET /formapi/api/730d681e-b6b9-41a0-b3f9-9e4a48f8f6b5/users/eee5f5fd-0405-46f1-9b64-5ec1b1f9dd8d/light/runtimeFormsWithResponses('HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u')?$expand=questions($expand=choices)&$top=1 HTTP/1.1 Host: forms.office.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
2025-04-23 15:03:19 UTC	983	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8 Strict-Transport-Security: max-age=2592000; includeSubDomains X-RoutingOfficeCluster: wus-101.forms.office.com X-RoutingOfficeCluster: weu-101.forms.office.com X-RoutingOfficeFE: FormsSingleBox_IN_3 X-RoutingOfficeFE: FormsSingleBox_IN_11 X-RoutingOfficeVersion: 16.0.18821.42501 X-RoutingOfficeVersion: 16.0.18821.42501 X-RoutingSessionId: 4a4ca705-1b33-4e5a-a7d4-525b89836b7b X-RoutingCorrelationId: 25b39b37-bb75-43e5-8001-3433a83dc640 X-CorrelationId: 25b39b37-bb75-43e5-8001-3433a83dc640 X-OfficeCluster: weu-101.forms.office.com X-OfficeFE: FormsSingleBox_IN_7 X-OfficeVersion: 16.0.18821.42501 X-UserSessionId: 4a4ca705-1b33-4e5a-a7d4-525b89836b7b X-Robots-Tag: noindex, nofollow X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: A4A6D29991064160A7D0DDC90BBB5B1D Ref B: LAX311000110019 Ref C: 2025-04-23T15:03:19Z Date: Wed, 23 Apr 2025 15:03:18 GMT Connection: close
2025-04-23 15:03:19 UTC	739	IN	Data Raw: 32 64 63 0d 0a 7b 22 72 65 73 70 6f 6e 73 65 73 22 3a 6e 75 6c 6c 2c 22 66 6f 72 6d 22 3a 7b 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 53 61 66 65 74 79 4c 65 76 65 6c 22 3a 30 2c 22 72 65 70 75 74 61 74 69 6f 6e 54 69 65 72 22 3a 31 2c 22 62 61 63 6b 67 72 6f 75 6e 64 22 3a 7b 22 61 6c 74 54 65 78 74 22 3a 6e 75 6c 6c 2c 22 63 6f 6e 74 65 6e 74 54 79 70 65 22 3a 6e 75 6c 6c 2c 22 66 69 6c 65 49 64 65 6e 74 69 66 69 65 72 22 3a 6e 75 6c 6c 2c 22 6f 72 69 67 69 6e 61 6c 46 69 6c 65 4e 61 6d 65 22 3a 6e 75 6c 6c 2c 22 72 65 73 6f 75 72 63 65 49 64 22 3a 6e 75 6c 6c 2c 22 72 65 73 6f 75 72 63 65 55 72 6c 22 3a 6e 75 6c 6c 2c 22 68 65 69 67 68 74 22 3a 6e 75 6c 6c 2c 22 77 69 64 74 68 22 3a 6e 75 6c 6c 2c 22 73 69 7a 65 22 Data Ascii: 2dc{"responses":null,"form":{"description":null,"onlineSafetyLevel":0,"reputationTier":1,"background":{"altText":null,"contentType":null,"fileIdentifier":null,"originalFileName":null,"resourceId":null,"resourceUrl":null,"height":null,"width":null,"size"
2025-04-23 15:03:19 UTC	2848	IN	Data Raw: 62 31 39 0d 0a 30 33 37 38 37 63 5c 22 2c 5c 22 53 65 63 6f 6e 64 61 72 79 43 6f 6c 6f 72 5c 22 3a 5c 22 23 30 31 34 34 34 36 5c 22 2c 5c 22 54 68 75 6d 62 6e 61 69 6c 5c 22 3a 5c 22 2f 49 6d 61 67 65 73 2f 54 68 65 6d 65 2f 74 65 61 6c 2d 67 72 61 64 69 65 6e 74 2d 74 68 75 6d 62 6e 61 69 6c 2e 70 6e 67 5c 22 7d 7d 22 2c 22 72 75 6e 74 69 6d 65 52 65 73 70 6f 6e 73 65 73 22 3a 6e 75 6c 6c 2c 22 70 65 72 6d 69 73 73 69 6f 6e 73 22 3a 5b 5d 2c 22 72 65 73 70 6f 6e 64 65 72 50 65 72 6d 69 73 73 69 6f 6e 73 22 3a 5b 5d 2c 22 73 74 61 74 75 73 22 3a 22 41 63 74 69 76 65 22 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 6c 6f 63 61 6c 65 49 6e 66 6f 22 3a 22 7b 5c 22 54 69 6d 65 7a 6f 6e 65 4f 66 66 73 65 74 5c 22 3a 31 32 30 2c 5c 22 4c 6f 63 61 6c 65 Data Ascii: b1903787c\",\"SecondaryColor\":\"#014446\",\"Thumbnail\":\"/Images/Theme/teal-gradient-thumbnail.png\"}}","runtimeResponses":null,"permissions":[],"responderPermissions":[],"status":"Active","category":null,"localeInfo":"{\"TimezoneOffset\":120,\"Locale
2025-04-23 15:03:19 UTC	76	IN	Data Raw: 34 36 0d 0a 65 65 35 66 35 66 64 2d 30 34 30 35 2d 34 36 66 31 2d 39 62 36 34 2d 35 65 63 31 62 31 66 39 64 64 38 64 22 2c 22 6f 77 6e 65 72 54 65 6e 61 6e 74 49 64 22 3a 22 37 33 30 64 36 38 31 65 2d 62 36 62 39 2d 34 31 0d 0a Data Ascii: 46ee5f5fd-0405-46f1-9b64-5ec1b1f9dd8d","ownerTenantId":"730d681e-b6b9-41
2025-04-23 15:03:19 UTC	1141	IN	Data Raw: 34 36 65 0d 0a 61 30 2d 62 33 66 39 2d 39 65 34 61 34 38 66 38 66 36 62 35 22 2c 22 73 65 74 74 69 6e 67 73 22 3a 22 7b 5c 22 52 65 71 75 69 72 65 73 55 6e 69 71 75 65 52 65 73 70 6f 6e 73 65 5c 22 3a 66 61 6c 73 65 2c 5c 22 49 73 41 6e 6f 6e 79 6d 6f 75 73 5c 22 3a 74 72 75 65 2c 5c 22 4e 6f 74 52 65 63 6f 72 64 49 64 65 6e 74 69 74 79 5c 22 3a 66 61 6c 73 65 2c 5c 22 49 73 51 75 69 7a 4d 6f 64 65 5c 22 3a 66 61 6c 73 65 2c 5c 22 50 65 72 6d 69 73 73 69 6f 6e 46 6f 72 52 65 73 70 6f 6e 64 65 72 5c 22 3a 31 2c 5c 22 53 68 75 66 66 6c 65 51 75 65 73 74 69 6f 6e 4f 72 64 65 72 5c 22 3a 66 61 6c 73 65 7d 22 2c 22 64 65 73 65 72 69 61 6c 69 7a 65 64 53 65 74 74 69 6e 67 73 22 3a 6e 75 6c 6c 2c 22 73 6f 66 74 44 65 6c 65 74 65 64 22 3a 30 2c 22 74 68 61 6e 6b Data Ascii: 46ea0-b3f9-9e4a48f8f6b5","settings":"{\"RequiresUniqueResponse\":false,\"IsAnonymous\":true,\"NotRecordIdentity\":false,\"IsQuizMode\":false,\"PermissionForResponder\":1,\"ShuffleQuestionOrder\":false}","deserializedSettings":null,"softDeleted":0,"thank
2025-04-23 15:03:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49721	13.107.6.194	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:19 UTC	1059	OUT	GET /cdn/scripts/dists/light-response-page.chunk.lrp_ext.be5dfbd.js HTTP/1.1 Host: forms.office.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Purpose: prefetch Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturl Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
2025-04-23 15:03:19 UTC	574	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 419708 Content-Type: application/javascript Last-Modified: Mon, 21 Apr 2025 04:58:40 GMT Accept-Ranges: bytes ETag: "0x8DD80912ED646BA" X-Cache: TCP_MISS x-ms-request-id: 277e0dee-b01e-0001-2360-b408ed000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * X-CID: 7 X-MSEdge-Ref: Ref A: 1A29997A72AC41559DE6839874B91630 Ref B: LAX311000114033 Ref C: 2025-04-23T15:03:19Z Date: Wed, 23 Apr 2025 15:03:19 GMT Connection: close
2025-04-23 15:03:19 UTC	15810	IN	Data Raw: 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 35 37 39 5d 2c 7b 36 30 36 38 37 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 2e 64 28 65 2c 7b 43 36 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 2c 43 6c 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 2c 59 48 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 7d 2c 61 4e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 2c 73 48 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 7d 29 3b 0a 2f 2a 21 20 40 61 7a 75 72 65 2f 6d 73 61 6c 2d 63 6f 6d 6d 6f 6e 20 76 31 33 2e 33 2e 30 20 32 30 32 33 Data Ascii: (self.webpackChunk=self.webpackChunk\|\|[]).push([[579],{60687:function(n,e,t){"use strict";t.d(e,{C6:function(){return i},Cl:function(){return o},YH:function(){return u},aN:function(){return c},sH:function(){return a}});/*! @azure/msal-common v13.3.0 2023
2025-04-23 15:03:19 UTC	16384	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 65 7d 2c 68 69 64 64 65 6e 43 6f 6e 74 65 6e 74 53 74 79 6c 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6b 6e 7d 2c 6b 65 79 66 72 61 6d 65 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 2e 69 7d 2c 6c 6f 61 64 54 68 65 6d 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 77 6e 7d 2c 6d 65 72 67 65 53 74 79 6c 65 53 65 74 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 45 65 2e 6c 7d 2c 6d 65 72 67 65 53 74 79 6c 65 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 2e 5a 7d 2c 6e 6f 57 72 61 70 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 73 65 7d 2c 6e 6f 72 6d 61 6c 69 7a 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 Data Ascii: :function(){return ue},hiddenContentStyle:function(){return kn},keyframes:function(){return o.i},loadTheme:function(){return wn},mergeStyleSets:function(){return Ee.l},mergeStyles:function(){return r.Z},noWrap:function(){return se},normalize:function(){re
2025-04-23 15:03:19 UTC	16384	IN	Data Raw: 23 66 66 66 66 66 66 22 2c 77 68 69 74 65 54 72 61 6e 73 6c 75 63 65 6e 74 34 30 3a 22 72 67 62 61 28 32 35 35 2c 32 35 35 2c 32 35 35 2c 2e 34 29 22 2c 79 65 6c 6c 6f 77 44 61 72 6b 3a 22 23 64 32 39 32 30 30 22 2c 79 65 6c 6c 6f 77 3a 22 23 66 66 62 39 30 30 22 2c 79 65 6c 6c 6f 77 4c 69 67 68 74 3a 22 23 66 66 66 31 30 30 22 2c 6f 72 61 6e 67 65 3a 22 23 64 38 33 62 30 31 22 2c 6f 72 61 6e 67 65 4c 69 67 68 74 3a 22 23 65 61 34 33 30 30 22 2c 6f 72 61 6e 67 65 4c 69 67 68 74 65 72 3a 22 23 66 66 38 63 30 30 22 2c 72 65 64 44 61 72 6b 3a 22 23 61 34 32 36 32 63 22 2c 72 65 64 3a 22 23 65 38 31 31 32 33 22 2c 6d 61 67 65 6e 74 61 44 61 72 6b 3a 22 23 35 63 30 30 35 63 22 2c 6d 61 67 65 6e 74 61 3a 22 23 62 34 30 30 39 65 22 2c 6d 61 67 65 6e 74 61 4c 69 Data Ascii: #ffffff",whiteTranslucent40:"rgba(255,255,255,.4)",yellowDark:"#d29200",yellow:"#ffb900",yellowLight:"#fff100",orange:"#d83b01",orangeLight:"#ea4300",orangeLighter:"#ff8c00",redDark:"#a4262c",red:"#e81123",magentaDark:"#5c005c",magenta:"#b4009e",magentaLi
2025-04-23 15:03:19 UTC	16384	IN	Data Raw: 6e 74 73 2e 6c 65 6e 67 74 68 3b 74 3c 72 3b 74 2b 2b 29 66 6f 72 28 76 61 72 20 69 20 69 6e 20 65 3d 61 72 67 75 6d 65 6e 74 73 5b 74 5d 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 65 2c 69 29 26 26 28 6e 5b 69 5d 3d 65 5b 69 5d 29 3b 72 65 74 75 72 6e 20 6e 7d 2c 72 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 2c 65 2e 63 6c 6f 73 65 3d 65 2e 72 65 73 65 74 4c 6f 61 64 69 6e 67 46 6f 72 54 65 73 74 3d 65 2e 6c 61 75 6e 63 68 57 69 74 68 6f 75 74 43 6f 6e 74 65 6e 74 41 73 79 6e 63 3d 65 2e 6c 61 75 6e 63 68 41 73 79 Data Ascii: nts.length;t<r;t++)for(var i in e=arguments[t])Object.prototype.hasOwnProperty.call(e,i)&&(n[i]=e[i]);return n},r.apply(this,arguments)};Object.defineProperty(e,"__esModule",{value:!0}),e.close=e.resetLoadingForTest=e.launchWithoutContentAsync=e.launchAsy
2025-04-23 15:03:19 UTC	16384	IN	Data Raw: 6c 7d 2c 4b 4a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 7d 2c 4b 7a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 7d 2c 4d 75 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 24 7d 2c 4d 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 67 7d 2c 4e 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6d 7d 2c 4f 44 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 2c 54 41 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 68 7d 2c 61 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 76 7d 2c 71 77 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 7d 2c 72 68 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 64 7d 7d 29 3b 76 61 72 20 72 3d 74 28 31 32 Data Ascii: l},KJ:function(){return f},Kz:function(){return b},Mu:function(){return $},My:function(){return g},Nn:function(){return m},OD:function(){return c},TA:function(){return h},ay:function(){return v},qw:function(){return _},rh:function(){return d}});var r=t(12
2025-04-23 15:03:19 UTC	16384	IN	Data Raw: 64 61 74 61 3a 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 7b 7d 2c 74 2e 64 61 74 61 2c 65 2e 64 61 74 61 29 7d 29 3a 65 2c 6e 7d 29 2c 7b 7d 29 3b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 2e 6d 61 70 28 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 65 5b 6e 5d 7d 29 29 7d 28 5b 5d 2e 63 6f 6e 63 61 74 28 69 2c 63 2e 6f 70 74 69 6f 6e 73 2e 6d 6f 64 69 66 69 65 72 73 29 29 29 3b 72 65 74 75 72 6e 20 63 2e 6f 72 64 65 72 65 64 4d 6f 64 69 66 69 65 72 73 3d 75 2e 66 69 6c 74 65 72 28 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 6e 2e 65 6e 61 62 6c 65 64 7d 29 29 2c 63 2e 6f 72 64 65 72 65 64 4d 6f 64 69 66 69 65 72 73 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 65 3d 6e 2e Data Ascii: data:Object.assign({},t.data,e.data)}):e,n}),{});return Object.keys(e).map((function(n){return e[n]}))}([].concat(i,c.options.modifiers)));return c.orderedModifiers=u.filter((function(n){return n.enabled})),c.orderedModifiers.forEach((function(n){var e=n.
2025-04-23 15:03:19 UTC	16384	IN	Data Raw: 74 69 6f 6e 28 6e 29 7b 76 61 72 20 65 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 31 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3f 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3a 6e 75 6c 6c 2c 74 3d 63 28 6e 29 3b 72 65 74 75 72 6e 20 31 3d 3d 3d 74 2e 6c 65 6e 67 74 68 26 26 74 5b 30 5d 2e 69 73 4c 69 6e 6b 26 26 28 21 65 7c 7c 74 5b 30 5d 2e 74 79 70 65 3d 3d 3d 65 29 7d 2c 65 2e 74 6f 6b 65 6e 69 7a 65 3d 63 7d 2c 32 32 30 38 34 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 65 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3d 21 30 2c 65 2e 73 74 61 72 74 3d 65 2e 72 75 6e 3d 65 2e 54 4f 4b 45 4e 53 3d 65 2e 53 74 61 74 65 3d 76 6f 69 64 20 30 3b 76 61 72 20 72 3d 74 28 36 38 30 33 30 29 2c 69 Data Ascii: tion(n){var e=arguments.length>1&&void 0!==arguments[1]?arguments[1]:null,t=c(n);return 1===t.length&&t[0].isLink&&(!e\|\|t[0].type===e)},e.tokenize=c},22084:function(n,e,t){"use strict";e.__esModule=!0,e.start=e.run=e.TOKENS=e.State=void 0;var r=t(68030),i
2025-04-23 15:03:19 UTC	15936	IN	Data Raw: 6e 20 69 6e 73 74 61 6e 63 65 6f 66 20 65 7d 7d 29 3b 65 2e 43 68 61 72 61 63 74 65 72 53 74 61 74 65 3d 6f 2c 65 2e 54 6f 6b 65 6e 53 74 61 74 65 3d 61 2c 65 2e 73 74 61 74 65 69 66 79 3d 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 74 2c 72 29 7b 66 6f 72 28 76 61 72 20 69 3d 30 2c 61 3d 6e 2e 6c 65 6e 67 74 68 2c 75 3d 65 2c 63 3d 5b 5d 2c 73 3d 76 6f 69 64 20 30 3b 69 3c 61 26 26 28 73 3d 75 2e 6e 65 78 74 28 6e 5b 69 5d 29 29 3b 29 75 3d 73 2c 69 2b 2b 3b 69 66 28 69 3e 3d 61 29 72 65 74 75 72 6e 5b 5d 3b 66 6f 72 28 3b 69 3c 61 2d 31 3b 29 73 3d 6e 65 77 20 6f 28 72 29 2c 63 2e 70 75 73 68 28 73 29 2c 75 2e 6f 6e 28 6e 5b 69 5d 2c 73 29 2c 75 3d 73 2c 69 2b 2b 3b 72 65 74 75 72 6e 20 73 3d 6e 65 77 20 6f 28 74 29 2c 63 2e 70 75 73 68 28 73 29 2c 75 2e 6f Data Ascii: n instanceof e}});e.CharacterState=o,e.TokenState=a,e.stateify=function(n,e,t,r){for(var i=0,a=n.length,u=e,c=[],s=void 0;i<a&&(s=u.next(n[i]));)u=s,i++;if(i>=a)return[];for(;i<a-1;)s=new o(r),c.push(s),u.on(n[i],s),u=s,i++;return s=new o(t),c.push(s),u.o
2025-04-23 15:03:19 UTC	16384	IN	Data Raw: 24 3d 74 28 35 34 30 32 34 29 3b 66 75 6e 63 74 69 6f 6e 20 62 28 6e 2c 65 29 7b 76 61 72 20 74 3d 6e 2e 24 66 78 2c 75 3d 76 6f 69 64 20 30 3d 3d 3d 74 3f 7b 7d 3a 74 2c 64 3d 75 2e 24 61 2c 76 3d 76 6f 69 64 20 30 3d 3d 3d 64 3f 63 3a 64 2c 70 3d 75 2e 24 24 53 2c 5f 3d 75 2e 24 61 79 2c 6d 3d 75 2e 24 79 2c 67 3d 6e 2e 24 62 6d 2c 62 3d 6e 2e 24 24 53 2c 77 3d 6e 2e 24 61 79 2c 78 3d 6e 2e 24 79 2c 79 3d 6e 2e 24 6a 2c 43 3d 28 6e 2e 24 64 62 2c 6e 2e 24 68 46 29 2c 6b 3d 28 6e 2e 24 62 72 2c 6e 2e 24 65 62 2c 6e 2e 24 6b 51 2c 6e 2e 24 65 4d 2c 6e 2e 24 66 79 2c 6e 2e 24 66 64 2c 6e 2e 24 78 2c 6e 2e 24 64 49 2c 6e 2e 24 6a 70 2c 6e 2e 24 65 63 2c 28 30 2c 72 2e 54 74 29 28 6e 2c 5b 22 24 66 78 22 2c 22 24 62 6d 22 2c 22 24 24 53 22 2c 22 24 61 79 22 Data Ascii: $=t(54024);function b(n,e){var t=n.$fx,u=void 0===t?{}:t,d=u.$a,v=void 0===d?c:d,p=u.$$S,_=u.$ay,m=u.$y,g=n.$bm,b=n.$$S,w=n.$ay,x=n.$y,y=n.$j,C=(n.$db,n.$hF),k=(n.$br,n.$eb,n.$kQ,n.$eM,n.$fy,n.$fd,n.$x,n.$dI,n.$jp,n.$ec,(0,r.Tt)(n,["$fx","$bm","$$S","$ay"
2025-04-23 15:03:19 UTC	16384	IN	Data Raw: 74 69 6f 6e 20 66 6e 28 65 29 7b 69 66 28 21 52 2e 69 73 54 6f 75 63 68 7c 7c 21 4f 26 26 22 6d 6f 75 73 65 64 6f 77 6e 22 21 3d 3d 65 2e 74 79 70 65 29 7b 76 61 72 20 74 3d 65 2e 63 6f 6d 70 6f 73 65 64 50 61 74 68 26 26 65 2e 63 6f 6d 70 6f 73 65 64 50 61 74 68 28 29 5b 30 5d 7c 7c 65 2e 74 61 72 67 65 74 3b 69 66 28 21 71 2e 70 72 6f 70 73 2e 69 6e 74 65 72 61 63 74 69 76 65 7c 7c 21 54 28 47 2c 74 29 29 7b 69 66 28 76 28 71 2e 70 72 6f 70 73 2e 74 72 69 67 67 65 72 54 61 72 67 65 74 7c 7c 6e 29 2e 73 6f 6d 65 28 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 54 28 6e 2c 74 29 7d 29 29 29 7b 69 66 28 52 2e 69 73 54 6f 75 63 68 29 72 65 74 75 72 6e 3b 69 66 28 71 2e 73 74 61 74 65 2e 69 73 56 69 73 69 62 6c 65 26 26 71 2e 70 72 6f 70 73 2e Data Ascii: tion fn(e){if(!R.isTouch\|\|!O&&"mousedown"!==e.type){var t=e.composedPath&&e.composedPath()[0]\|\|e.target;if(!q.props.interactive\|\|!T(G,t)){if(v(q.props.triggerTarget\|\|n).some((function(n){return T(n,t)}))){if(R.isTouch)return;if(q.state.isVisible&&q.props.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49720	13.107.6.194	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:19 UTC	1068	OUT	GET /cdn/scripts/dists/light-response-page.chunk.lrp_saveresponse.0286355.js HTTP/1.1 Host: forms.office.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Purpose: prefetch Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturl Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
2025-04-23 15:03:19 UTC	572	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 32486 Content-Type: application/javascript Last-Modified: Mon, 21 Apr 2025 04:58:40 GMT Accept-Ranges: bytes ETag: "0x8DD80912EDC8760" X-Cache: TCP_HIT x-ms-request-id: a9d70514-401e-0015-4b3e-b44082000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * X-CID: 7 X-MSEdge-Ref: Ref A: B5925FE4F4174404BF047F9184311EBE Ref B: LAX311000113047 Ref C: 2025-04-23T15:03:19Z Date: Wed, 23 Apr 2025 15:03:19 GMT Connection: close
2025-04-23 15:03:19 UTC	15812	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 31 38 38 5d 2c 7b 34 36 38 38 37 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 69 29 7b 69 2e 64 28 65 2c 7b 77 68 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 3b 76 61 72 20 74 3d 69 28 39 34 36 38 29 2c 72 3d 69 28 38 39 31 29 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 76 61 72 20 65 3d 6e 2e 72 65 64 69 72 65 63 74 55 52 4c 41 66 74 65 72 53 69 67 6e 49 6e 2c 69 3d 6e 2e 69 64 70 2c 6f 3d 6e 2e 6f 72 69 67 69 6e 2c 61 3d 6e 2e 61 75 74 68 50 72 6f 76 69 64 65 72 2c 64 3d 6e 2e 65 6e 61 62 6c 65 45 6d 61 69 6c 48 72 64 2c 73 3d 76 6f 69 64 20 30 3d Data Ascii: "use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[188],{46887:function(n,e,i){i.d(e,{wh:function(){return o}});var t=i(9468),r=i(891);function o(n){var e=n.redirectURLAfterSignIn,i=n.idp,o=n.origin,a=n.authProvider,d=n.enableEmailHrd,s=void 0=
2025-04-23 15:03:19 UTC	16384	IN	Data Raw: 38 33 32 35 36 29 2c 53 3d 69 28 32 35 38 31 33 29 2c 43 3d 69 28 33 32 37 32 38 29 2c 49 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 7b 24 72 3a 28 30 2c 64 2e 43 6c 29 28 28 30 2c 64 2e 43 6c 29 28 28 30 2c 64 2e 43 6c 29 28 28 30 2c 64 2e 43 6c 29 28 7b 7d 2c 5f 2e 68 29 2c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 68 2e 4f 2e 24 67 2c 7a 49 6e 64 65 78 3a 32 7d 29 2c 28 30 2c 70 2e 55 29 28 7b 24 64 3a 22 73 74 72 65 74 63 68 22 2c 24 6b 3a 22 63 65 6e 74 65 72 22 7d 29 29 2c 7b 77 69 64 74 68 3a 34 34 30 2c 70 61 64 64 69 6e 67 54 6f 70 3a 36 30 2c 22 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 31 31 38 34 70 78 29 22 3a 7b 6f 76 65 72 66 6c 6f 77 59 3a 22 61 75 74 6f 22 7d 2c 22 40 6d 65 64 69 61 Data Ascii: 83256),S=i(25813),C=i(32728),I=function(n){return{$r:(0,d.Cl)((0,d.Cl)((0,d.Cl)((0,d.Cl)({},_.h),{background:h.O.$g,zIndex:2}),(0,p.U)({$d:"stretch",$k:"center"})),{width:440,paddingTop:60,"@media screen and (min-width: 1184px)":{overflowY:"auto"},"@media
2025-04-23 15:03:19 UTC	290	IN	Data Raw: 28 30 2c 6f 2e 56 47 29 28 65 29 7d 2c 69 29 29 7d 2c 65 7d 28 61 29 7d 7d 5d 29 3b 0a 0a 2f 2f 23 20 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 3d 68 74 74 70 73 3a 2f 2f 61 72 74 69 66 61 63 74 73 2e 64 65 76 2e 61 7a 75 72 65 2e 63 6f 6d 2f 6f 66 66 69 63 65 2f 5f 61 70 69 73 2f 73 79 6d 62 6f 6c 2f 73 79 6d 73 72 76 2f 6c 69 67 68 74 2d 72 65 73 70 6f 6e 73 65 2d 70 61 67 65 2e 63 68 75 6e 6b 2e 6c 72 70 5f 73 61 76 65 72 65 73 70 6f 6e 73 65 2e 30 32 38 36 33 35 35 2e 6a 73 2e 6d 61 70 2f 31 36 65 36 36 37 38 32 30 65 30 35 31 39 31 36 30 32 36 35 39 35 63 32 63 64 39 66 31 36 64 61 32 63 64 34 34 35 30 30 64 66 64 32 36 64 39 63 65 39 66 34 66 38 66 63 35 62 33 65 35 30 38 36 2f 6c 69 67 68 74 2d 72 65 73 70 6f 6e 73 65 2d 70 61 67 65 2e 63 68 Data Ascii: (0,o.VG)(e)},i))},e}(a)}}]);//# sourceMappingURL=https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.lrp_saveresponse.0286355.js.map/16e667820e051916026595c2cd9f16da2cd44500dfd26d9ce9f4f8fc5b3e5086/light-response-page.ch

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49722	13.107.6.194	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:19 UTC	1061	OUT	GET /cdn/scripts/dists/light-response-page.chunk.lrp_cover.37daef8.js HTTP/1.1 Host: forms.office.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Purpose: prefetch Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturl Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
2025-04-23 15:03:19 UTC	572	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 73103 Content-Type: application/javascript Last-Modified: Mon, 21 Apr 2025 04:58:40 GMT Accept-Ranges: bytes ETag: "0x8DD80912ED312E4" X-Cache: TCP_HIT x-ms-request-id: ef796b7e-d01e-0017-5c3e-b4fe3a000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * X-CID: 7 X-MSEdge-Ref: Ref A: C6ED1910823746878441E54769C09223 Ref B: LAX311000112031 Ref C: 2025-04-23T15:03:19Z Date: Wed, 23 Apr 2025 15:03:19 GMT Connection: close
2025-04-23 15:03:19 UTC	15812	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 34 35 31 5d 2c 7b 31 36 30 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 70 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 7d 29 3b 76 61 72 20 6f 3d 6e 28 33 33 33 37 37 29 3b 66 75 6e 63 74 69 6f 6e 20 69 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6e 3d 31 3b 6e 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 74 5b 6e 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 3b 66 6f 72 28 76 61 72 20 69 3d 5b 5d 2c 72 3d 30 2c 5f 3d 74 3b 72 3c 5f 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 7b 76 61 72 20 61 3d 5f 5b Data Ascii: "use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[451],{1607:function(e,t,n){n.d(t,{p:function(){return i}});var o=n(33377);function i(e){for(var t=[],n=1;n<arguments.length;n++)t[n-1]=arguments[n];for(var i=[],r=0,_=t;r<_.length;r++){var a=_[
2025-04-23 15:03:19 UTC	16384	IN	Data Raw: 65 3f 22 68 6f 72 69 7a 6f 6e 74 61 6c 22 3d 3d 3d 74 3f 32 30 3a 22 31 30 30 25 22 3a 22 76 65 72 74 69 63 61 6c 22 3d 3d 3d 74 3f 22 35 30 25 22 3a 22 31 30 30 25 22 7d 66 75 6e 63 74 69 6f 6e 20 64 74 28 65 29 7b 72 65 74 75 72 6e 7b 73 65 6c 65 63 74 6f 72 73 3a 7b 22 3a 3a 70 6c 61 63 65 68 6f 6c 64 65 72 22 3a 65 2c 22 3a 2d 6d 73 2d 69 6e 70 75 74 2d 70 6c 61 63 65 68 6f 6c 64 65 72 22 3a 65 2c 22 3a 3a 2d 6d 73 2d 69 6e 70 75 74 2d 70 6c 61 63 65 68 6f 6c 64 65 72 22 3a 65 7d 7d 7d 76 61 72 20 63 74 3d 6e 28 33 39 32 39 32 29 2c 73 74 3d 6e 28 38 38 32 38 34 29 2c 66 74 3d 6e 28 38 36 39 37 37 29 2c 67 74 3d 6e 28 38 38 36 36 34 29 2c 68 74 3d 6e 28 38 36 36 36 39 29 2c 76 74 3d 6e 28 33 30 32 35 29 2c 70 74 3d 67 74 2e 68 2e 67 65 74 56 61 6c 75 Data Ascii: e?"horizontal"===t?20:"100%":"vertical"===t?"50%":"100%"}function dt(e){return{selectors:{"::placeholder":e,":-ms-input-placeholder":e,"::-ms-input-placeholder":e}}}var ct=n(39292),st=n(88284),ft=n(86977),gt=n(88664),ht=n(86669),vt=n(3025),pt=gt.h.getValu
2025-04-23 15:03:19 UTC	16384	IN	Data Raw: 7c 65 2e 5f 72 61 69 73 65 43 68 61 6e 67 65 28 29 7d 2c 65 2e 6f 62 73 65 72 76 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 61 2e 70 75 73 68 28 65 29 7d 2c 65 2e 75 6e 6f 62 73 65 72 76 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 61 3d 61 2e 66 69 6c 74 65 72 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 21 3d 3d 65 7d 29 29 7d 2c 65 2e 5f 72 61 69 73 65 43 68 61 6e 67 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 65 2e 5f 73 75 70 70 72 65 73 73 55 70 64 61 74 65 73 7c 7c 61 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 28 29 7d 29 29 7d 2c 65 7d 28 29 7d 2c 36 36 31 36 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 41 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e Data Ascii: \|e._raiseChange()},e.observe=function(e){a.push(e)},e.unobserve=function(e){a=a.filter((function(t){return t!==e}))},e._raiseChange=function(){e._suppressUpdates\|\|a.forEach((function(e){return e()}))},e}()},66162:function(e,t,n){n.d(t,{A:function(){return
2025-04-23 15:03:19 UTC	16384	IN	Data Raw: 66 6f 6e 74 57 65 69 67 68 74 3a 34 30 30 2c 77 69 64 74 68 3a 22 31 30 30 25 22 2c 63 6f 6c 6f 72 3a 67 2e 4e 75 7d 2c 24 55 3a 28 30 2c 74 65 2e 73 50 29 28 29 2c 24 77 3a 28 30 2c 6f 2e 43 6c 29 28 28 30 2c 6f 2e 43 6c 29 28 7b 7d 2c 28 30 2c 74 65 2e 4c 36 29 28 29 29 2c 7b 74 65 78 74 41 6c 69 67 6e 3a 22 63 65 6e 74 65 72 22 7d 29 7d 2c 7b 24 71 3a 63 2e 24 56 2e 43 6f 6e 74 61 69 6e 65 72 2c 24 62 3a 28 30 2c 6f 2e 43 6c 29 28 7b 7d 2c 28 30 2c 57 2e 55 29 28 7b 24 64 3a 22 63 65 6e 74 65 72 22 2c 24 6b 3a 22 63 65 6e 74 65 72 22 7d 29 29 2c 24 68 62 3a 5b 32 5d 2c 24 75 3a 5b 7b 24 71 3a 63 2e 24 56 2e 42 75 74 74 6f 6e 2c 24 62 3a 7b 68 65 69 67 68 74 3a 34 38 2c 6d 69 6e 57 69 64 74 68 3a 32 30 30 2c 66 6f 6e 74 53 69 7a 65 3a 63 2e 62 64 2e 53 Data Ascii: fontWeight:400,width:"100%",color:g.Nu},$U:(0,te.sP)(),$w:(0,o.Cl)((0,o.Cl)({},(0,te.L6)()),{textAlign:"center"})},{$q:c.$V.Container,$b:(0,o.Cl)({},(0,W.U)({$d:"center",$k:"center"})),$hb:[2],$u:[{$q:c.$V.Button,$b:{height:48,minWidth:200,fontSize:c.bd.S
2025-04-23 15:03:19 UTC	8139	IN	Data Raw: 77 3a 28 30 2c 74 65 2e 4c 36 29 28 63 2e 62 64 2e 50 72 69 6d 61 72 79 43 6f 6c 6f 72 29 2c 24 5f 77 3a 7b 22 61 72 69 61 2d 6c 65 76 65 6c 22 3a 31 2c 72 6f 6c 65 3a 22 68 65 61 64 69 6e 67 22 7d 7d 2c 7b 24 71 3a 63 2e 24 56 2e 54 65 78 74 2c 24 48 3a 31 2c 24 62 3a 28 30 2c 6f 2e 43 6c 29 28 7b 7a 49 6e 64 65 78 3a 32 2c 77 69 64 74 68 3a 22 31 30 30 25 22 2c 6f 76 65 72 66 6c 6f 77 3a 22 68 69 64 64 65 6e 22 2c 63 6f 6c 6f 72 3a 63 2e 62 64 2e 50 72 69 6d 61 72 79 43 6f 6c 6f 72 2c 66 6f 6e 74 57 65 69 67 68 74 3a 36 30 30 2c 66 6f 6e 74 53 69 7a 65 3a 31 36 2c 6c 69 6e 65 48 65 69 67 68 74 3a 32 31 2c 6d 69 6e 48 65 69 67 68 74 3a 32 37 7d 2c 28 30 2c 57 2e 55 29 28 7b 24 64 3a 22 63 65 6e 74 65 72 22 7d 29 29 2c 24 55 3a 28 30 2c 74 65 2e 57 46 29 Data Ascii: w:(0,te.L6)(c.bd.PrimaryColor),$_w:{"aria-level":1,role:"heading"}},{$q:c.$V.Text,$H:1,$b:(0,o.Cl)({zIndex:2,width:"100%",overflow:"hidden",color:c.bd.PrimaryColor,fontWeight:600,fontSize:16,lineHeight:21,minHeight:27},(0,W.U)({$d:"center"})),$U:(0,te.WF)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49723	13.107.6.194	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:19 UTC	1065	OUT	GET /cdn/scripts/dists/light-response-page.chunk.lrp_post.boot.2090f6d.js HTTP/1.1 Host: forms.office.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Purpose: prefetch Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturl Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
2025-04-23 15:03:19 UTC	573	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 15592 Content-Type: application/javascript Last-Modified: Mon, 21 Apr 2025 04:58:40 GMT Accept-Ranges: bytes ETag: "0x8DD80912EDA16BA" X-Cache: TCP_MISS x-ms-request-id: ee979af9-001e-002b-3460-b4d7fd000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * X-CID: 7 X-MSEdge-Ref: Ref A: 1837AFBBE52A4EB4BF4E2E00C3F328FC Ref B: LAX311000109021 Ref C: 2025-04-23T15:03:19Z Date: Wed, 23 Apr 2025 15:03:18 GMT Connection: close
2025-04-23 15:03:19 UTC	15592	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 32 39 34 5d 2c 7b 34 34 33 33 30 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 72 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 72 65 74 75 72 6e 20 44 61 74 65 2e 6e 6f 77 7c 7c 28 44 61 74 65 2e 6e 6f 77 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 7d 29 2c 4d 61 74 68 2e 66 6c 6f 6f 72 28 44 61 74 65 2e 6e 6f 77 28 29 29 7d 72 2e 64 28 65 2c 7b 4a 59 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 7d 7d 29 7d 2c 39 36 39 30 30 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 72 29 7b 72 2e 72 28 65 29 Data Ascii: "use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[294],{44330:function(n,e,r){function t(){return Date.now\|\|(Date.now=function(){return(new Date).getTime()}),Math.floor(Date.now())}r.d(e,{JY:function(){return t}})},96900:function(n,e,r){r.r(e)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49725	13.107.6.194	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:19 UTC	904	OUT	GET /cdn/scripts/dists/light-response-page.chunk.sw.a912249.js HTTP/1.1 Host: forms.office.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturl Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
2025-04-23 15:03:20 UTC	572	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 1152 Content-Type: application/javascript Last-Modified: Wed, 23 Apr 2025 04:41:46 GMT Accept-Ranges: bytes ETag: "0x8DD822127B241EE" X-Cache: TCP_MISS x-ms-request-id: 3542b3cf-201e-0003-5660-b4b655000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * X-CID: 7 X-MSEdge-Ref: Ref A: D854858040804BBDBDD3ED206F65BCE3 Ref B: LAX311000111017 Ref C: 2025-04-23T15:03:20Z Date: Wed, 23 Apr 2025 15:03:19 GMT Connection: close
2025-04-23 15:03:20 UTC	1152	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 37 32 35 5d 2c 7b 33 36 30 30 31 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 65 2c 6e 29 7b 6e 2e 72 28 65 29 2c 6e 2e 64 28 65 2c 7b 72 65 67 69 73 74 65 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 7d 7d 29 3b 76 61 72 20 74 3d 6e 28 33 34 36 32 39 29 2c 69 3d 6e 28 39 31 36 37 36 29 2c 73 3d 6e 28 31 37 38 39 31 29 2c 75 3d 6e 28 37 35 31 38 37 29 2c 63 3d 6e 28 31 38 39 39 32 29 2c 6f 3d 6e 28 35 39 31 39 38 29 2c 61 3d 6e 28 39 38 38 35 36 29 3b 66 75 6e 63 74 69 6f 6e 20 66 28 72 29 7b 72 65 74 75 72 6e 28 30 2c 74 2e 73 48 29 28 74 68 69 73 2c 76 6f 69 64 Data Ascii: "use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[725],{36001:function(r,e,n){n.r(e),n.d(e,{register:function(){return f}});var t=n(34629),i=n(91676),s=n(17891),u=n(75187),c=n(18992),o=n(59198),a=n(98856);function f(r){return(0,t.sH)(this,void

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49726	13.107.6.194	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:20 UTC	941	OUT	GET /cdn/images/microsoft365logo_v1.png HTTP/1.1 Host: forms.office.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturl Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
2025-04-23 15:03:20 UTC	558	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 5895 Content-Type: image/png Last-Modified: Fri, 18 Apr 2025 06:41:03 GMT Accept-Ranges: bytes ETag: "0x8DD7E43FD6F17B9" X-Cache: TCP_HIT x-ms-request-id: 4c896406-d01e-0065-59ae-b1f975000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * X-CID: 7 X-MSEdge-Ref: Ref A: B7CD6F44EC6D43B58767C7FE2C328926 Ref B: LAX311000109033 Ref C: 2025-04-23T15:03:20Z Date: Wed, 23 Apr 2025 15:03:19 GMT Connection: close
2025-04-23 15:03:20 UTC	5895	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 ea 00 00 00 b4 08 06 00 00 00 5b 9e 6f 09 00 00 16 ce 49 44 41 54 78 da ed dd 0b b4 96 55 9d c7 f1 e3 e4 78 69 1a 23 a7 8c 6c 0c 25 33 4a a5 74 d4 44 5c 49 66 35 68 c6 a1 c4 f2 1c 81 c3 fd 3e 1e 46 74 a9 a1 9c 00 15 5d c5 38 66 96 a9 41 11 ae e9 28 e1 0d 2f 90 a1 9e a8 44 83 cc 31 62 9c 25 a8 39 3a 31 79 04 4c 44 85 33 ff ff cc 7e 59 af 8f cf 7f 3f fb b9 bd e7 c0 fb fd ac b5 17 28 ef 73 bf fc 9e cb 7e f6 6e 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: PNGIHDR[oIDATxUxi#l%3JtD\If5h>Ft]8fA(/D1b%9:1yLD3~Y?(s~nh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49727	13.107.6.194	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:20 UTC	906	OUT	GET /cdn/scripts/dists/light-response-page.chunk.utel.fa097bf.js HTTP/1.1 Host: forms.office.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturl Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
2025-04-23 15:03:20 UTC	573	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 139624 Content-Type: application/javascript Last-Modified: Tue, 22 Apr 2025 05:04:13 GMT Accept-Ranges: bytes ETag: "0x8DD815B1FB58FDE" X-Cache: TCP_HIT x-ms-request-id: a315bac2-c01e-0079-3365-b3ab15000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * X-CID: 7 X-MSEdge-Ref: Ref A: 6588C91E68A04B6DB309D2314B5271D7 Ref B: LAX311000109017 Ref C: 2025-04-23T15:03:20Z Date: Wed, 23 Apr 2025 15:03:20 GMT Connection: close
2025-04-23 15:03:20 UTC	15811	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 32 33 31 5d 2c 7b 38 37 33 30 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 74 29 7b 74 2e 64 28 65 2c 7b 41 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 45 7d 7d 29 3b 76 61 72 20 72 3d 74 28 38 36 37 38 33 29 2c 69 3d 74 28 32 35 36 32 31 29 2c 75 3d 74 28 33 35 30 39 31 29 2c 6f 3d 74 28 31 38 38 30 29 2c 61 3d 74 28 33 38 38 30 35 29 2c 66 3d 74 28 37 35 30 37 32 29 2c 63 3d 74 28 39 38 30 39 30 29 2c 73 3d 74 28 39 38 31 30 34 29 2c 6c 3d 74 28 37 38 39 38 34 29 2c 76 3d 74 28 38 32 38 37 33 29 2c 6d 3d 74 28 34 38 38 33 32 29 2c 64 3d 35 30 30 3b 66 75 6e 63 Data Ascii: "use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[231],{8730:function(n,e,t){t.d(e,{A:function(){return E}});var r=t(86783),i=t(25621),u=t(35091),o=t(1880),a=t(38805),f=t(75072),c=t(98090),s=t(98104),l=t(78984),v=t(82873),m=t(48832),d=500;func
2025-04-23 15:03:21 UTC	16384	IN	Data Raw: 29 7b 72 65 74 75 72 6e 21 21 6e 26 26 28 72 2e 70 75 73 68 28 6e 29 2c 75 7c 7c 28 75 3d 45 28 6e 29 29 2c 21 30 29 7d 2c 69 2e 73 70 6c 69 74 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 69 29 7b 76 61 72 20 6f 3b 69 66 28 74 3c 72 2e 6c 65 6e 67 74 68 29 7b 76 61 72 20 61 3d 72 2e 6c 65 6e 67 74 68 2d 74 3b 28 30 2c 63 2e 68 58 29 28 69 29 7c 7c 28 61 3d 69 3c 61 3f 69 3a 61 29 2c 6f 3d 72 2e 73 70 6c 69 63 65 28 74 2c 61 29 2c 75 3d 77 28 72 29 7d 72 65 74 75 72 6e 20 6e 65 77 20 6e 28 65 2c 6f 29 7d 7d 72 65 74 75 72 6e 20 6e 2e 63 72 65 61 74 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 6e 28 65 2c 74 29 7d 2c 6e 7d 28 29 2c 52 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 76 61 72 20 65 3d 21 Data Ascii: ){return!!n&&(r.push(n),u\|\|(u=E(n)),!0)},i.split=function(t,i){var o;if(t<r.length){var a=r.length-t;(0,c.hX)(i)\|\|(a=i<a?i:a),o=r.splice(t,a),u=w(r)}return new n(e,o)}}return n.create=function(e,t){return new n(e,t)},n}(),R=function(){function n(){var e=!
2025-04-23 15:03:21 UTC	16384	IN	Data Raw: 66 28 77 7c 7c 4e 29 6e 2e 6c 61 74 65 6e 63 79 3d 33 2c 6e 2e 73 79 6e 63 3d 21 31 3b 65 6c 73 65 20 69 66 28 70 29 72 65 74 75 72 6e 20 4c 26 26 28 6e 3d 28 30 2c 63 2e 68 57 29 28 6e 29 29 2c 76 6f 69 64 20 70 2e 73 65 6e 64 53 79 6e 63 68 72 6f 6e 6f 75 73 42 61 74 63 68 28 4d 2e 63 72 65 61 74 65 28 6e 2e 69 4b 65 79 2c 5b 6e 5d 29 2c 21 30 3d 3d 3d 6e 2e 73 79 6e 63 3f 31 3a 6e 2e 73 79 6e 63 2c 33 29 3b 76 61 72 20 74 3d 6e 2e 6c 61 74 65 6e 63 79 2c 72 3d 43 2c 69 3d 46 3b 34 3d 3d 3d 74 26 26 28 72 3d 55 2c 69 3d 24 29 3b 76 61 72 20 75 3d 21 31 3b 69 66 28 72 3c 69 29 75 3d 21 6e 6e 28 6e 2c 65 29 3b 65 6c 73 65 7b 76 61 72 20 6f 3d 31 2c 61 3d 32 30 3b 34 3d 3d 3d 74 26 26 28 6f 3d 34 2c 61 3d 31 29 2c 75 3d 21 30 2c 66 75 6e 63 74 69 6f 6e 28 Data Ascii: f(w\|\|N)n.latency=3,n.sync=!1;else if(p)return L&&(n=(0,c.hW)(n)),void p.sendSynchronousBatch(M.create(n.iKey,[n]),!0===n.sync?1:n.sync,3);var t=n.latency,r=C,i=F;4===t&&(r=U,i=$);var u=!1;if(r<i)u=!nn(n,e);else{var o=1,a=20;4===t&&(o=4,a=1),u=!0,function(
2025-04-23 15:03:21 UTC	16384	IN	Data Raw: 4e 6f 74 69 66 69 65 64 3a 70 2c 50 47 5f 45 76 65 6e 74 73 49 67 6e 6f 72 65 64 3a 62 2c 50 47 5f 45 76 65 6e 74 73 49 6e 73 70 65 63 74 65 64 3a 79 2c 50 47 5f 46 69 65 6c 64 73 49 6e 73 70 65 63 74 65 64 3a 5f 7d 3a 7b 43 6f 6e 63 65 72 6e 73 4e 6f 74 69 66 69 65 64 3a 70 2c 45 76 65 6e 74 73 49 67 6e 6f 72 65 64 3a 62 2c 45 76 65 6e 74 73 49 6e 73 70 65 63 74 65 64 3a 79 2c 46 69 65 6c 64 73 49 6e 73 70 65 63 74 65 64 3a 5f 7d 7d 66 75 6e 63 74 69 6f 6e 20 55 28 29 7b 72 3d 6e 75 6c 6c 2c 66 3d 6e 75 6c 6c 2c 63 3d 6e 75 6c 6c 2c 73 3d 22 50 72 69 76 61 63 79 43 6f 6e 63 65 72 6e 22 2c 6c 3d 22 50 72 69 76 61 63 79 47 75 61 72 64 53 75 6d 6d 61 72 79 22 2c 76 3d 21 30 2c 6d 3d 21 31 2c 70 3d 30 2c 62 3d 30 2c 79 3d 30 2c 5f 3d 30 7d 66 75 6e 63 74 69 Data Ascii: Notified:p,PG_EventsIgnored:b,PG_EventsInspected:y,PG_FieldsInspected:_}:{ConcernsNotified:p,EventsIgnored:b,EventsInspected:y,FieldsInspected:_}}function U(){r=null,f=null,c=null,s="PrivacyConcern",l="PrivacyGuardSummary",v=!0,m=!1,p=0,b=0,y=0,_=0}functi
2025-04-23 15:03:21 UTC	16384	IN	Data Raw: 76 6f 69 64 20 30 3d 3d 3d 75 26 26 28 75 3d 21 31 29 3b 76 61 72 20 61 3d 21 31 3b 69 66 28 6e 29 74 72 79 7b 76 61 72 20 66 3d 67 28 65 2c 69 29 3b 69 66 28 61 3d 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 74 2c 69 29 7b 76 61 72 20 75 3d 21 31 3b 72 65 74 75 72 6e 20 6e 26 26 65 26 26 65 5b 72 2e 51 4d 5d 26 26 74 26 26 28 6e 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 28 6e 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 65 5b 72 2e 51 4d 5d 2c 74 2c 69 29 2c 75 3d 21 30 29 3a 6e 2e 61 74 74 61 63 68 45 76 65 6e 74 26 26 28 6e 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 22 2b 65 5b 72 2e 51 4d 5d 2c 74 29 2c 75 3d 21 30 29 29 2c 75 7d 28 6e 2c 66 2c 74 2c 75 29 2c 61 26 26 68 2e 61 63 63 65 70 74 28 6e 29 29 7b 76 61 72 20 63 3d 28 28 Data Ascii: void 0===u&&(u=!1);var a=!1;if(n)try{var f=g(e,i);if(a=function(n,e,t,i){var u=!1;return n&&e&&e[r.QM]&&t&&(n.addEventListener?(n.addEventListener(e[r.QM],t,i),u=!0):n.attachEvent&&(n.attachEvent("on"+e[r.QM],t),u=!0)),u}(n,f,t,u),a&&h.accept(n)){var c=((
2025-04-23 15:03:21 UTC	16384	IN	Data Raw: 24 2f 69 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 6e 29 7b 72 65 74 75 72 6e 20 6f 28 6e 2c 33 32 2c 69 29 7d 66 75 6e 63 74 69 6f 6e 20 66 28 6e 29 7b 72 65 74 75 72 6e 20 6f 28 6e 2c 31 36 2c 75 29 7d 7d 2c 39 38 30 39 30 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 74 29 7b 74 2e 64 28 65 2c 7b 24 34 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4c 7d 2c 24 35 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 64 7d 2c 24 6f 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 45 7d 2c 41 50 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 54 7d 2c 44 69 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 7d 2c 45 58 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 49 7d 2c 45 6b 3a 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: $/i)}function a(n){return o(n,32,i)}function f(n){return o(n,16,u)}},98090:function(n,e,t){t.d(e,{$4:function(){return L},$5:function(){return d},$o:function(){return E},AP:function(){return T},Di:function(){return _},EX:function(){return I},Ek:function()
2025-04-23 15:03:21 UTC	16384	IN	Data Raw: 65 72 73 6f 6e 61 6c 44 61 74 61 3a 35 31 32 2c 53 75 70 70 6f 72 74 44 61 74 61 3a 31 30 32 34 2c 44 69 72 65 63 74 4d 65 61 73 75 72 65 6d 65 6e 74 44 61 74 61 3a 32 30 34 38 2c 45 76 65 72 79 74 68 69 6e 67 3a 36 35 35 33 35 7d 2c 6e 2e 44 61 74 61 46 69 65 6c 64 54 79 70 65 3d 7b 53 74 72 69 6e 67 3a 30 2c 42 6f 6f 6c 65 61 6e 3a 31 2c 49 6e 74 36 34 3a 32 2c 44 6f 75 62 6c 65 3a 33 2c 47 75 69 64 3a 34 7d 2c 6e 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 3d 7b 4e 6f 74 53 65 74 3a 30 2c 4d 65 61 73 75 72 65 3a 31 2c 44 69 61 67 6e 6f 73 74 69 63 73 3a 32 2c 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 3a 31 39 31 2c 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 3a 31 39 32 2c 43 72 69 74 69 63 61 6c 45 78 70 65 72 69 6d 65 6e 74 61 Data Ascii: ersonalData:512,SupportData:1024,DirectMeasurementData:2048,Everything:65535},n.DataFieldType={String:0,Boolean:1,Int64:2,Double:3,Guid:4},n.SamplingPolicy={NotSet:0,Measure:1,Diagnostics:2,CriticalBusinessImpact:191,CriticalCensus:192,CriticalExperimenta
2025-04-23 15:03:21 UTC	15935	IN	Data Raw: 6e 3d 7b 7d 2c 65 3d 22 44 72 61 66 74 20 51 75 69 7a 22 2c 74 3d 64 6e 28 65 29 3b 72 65 74 75 72 6e 20 6e 5b 22 44 65 73 69 67 6e 50 61 67 65 2e 43 6f 70 69 6c 6f 74 51 75 69 7a 44 72 61 66 74 2e 46 65 61 74 75 72 65 45 6e 61 62 6c 65 64 22 5d 3d 7b 66 65 61 74 75 72 65 41 63 74 69 6f 6e 54 79 70 65 3a 76 2e 54 41 2e 46 65 61 74 75 72 65 41 63 74 69 6f 6e 54 79 70 65 2e 49 73 45 6e 61 62 6c 65 64 2c 69 73 55 73 65 72 49 6e 69 74 69 61 74 65 64 3a 21 31 2c 66 65 61 74 75 72 65 4e 61 6d 65 3a 65 2c 73 75 62 46 65 61 74 75 72 65 4e 61 6d 65 3a 22 46 65 61 74 75 72 65 45 6e 61 62 6c 65 64 22 2c 69 73 54 68 75 6d 62 73 55 70 3a 6e 75 6c 6c 2c 65 6e 74 72 79 50 6f 69 6e 74 3a 76 2e 54 41 2e 45 6e 74 72 79 50 6f 69 6e 74 2e 43 61 6e 76 61 73 2c 76 65 72 62 3a Data Ascii: n={},e="Draft Quiz",t=dn(e);return n["DesignPage.CopilotQuizDraft.FeatureEnabled"]={featureActionType:v.TA.FeatureActionType.IsEnabled,isUserInitiated:!1,featureName:e,subFeatureName:"FeatureEnabled",isThumbsUp:null,entryPoint:v.TA.EntryPoint.Canvas,verb:
2025-04-23 15:03:21 UTC	9574	IN	Data Raw: 2e 41 67 67 72 65 67 61 74 65 51 75 69 7a 44 61 74 61 2e 53 75 63 63 65 73 73 22 5d 3d 7b 24 65 3a 21 30 7d 2c 6e 5b 22 41 6e 61 6c 79 73 69 73 2e 41 67 67 72 65 67 61 74 65 53 75 72 76 65 79 44 61 74 61 2e 53 75 63 63 65 73 73 22 5d 3d 7b 24 65 3a 21 30 7d 2c 6e 5b 22 41 6e 61 6c 79 73 69 73 2e 52 65 73 75 6c 74 53 68 61 72 69 6e 67 41 67 67 72 65 67 61 74 65 51 75 69 7a 44 61 74 61 2e 53 75 63 63 65 73 73 22 5d 3d 7b 24 65 3a 21 30 7d 2c 6e 5b 22 41 6e 61 6c 79 73 69 73 2e 52 65 73 75 6c 74 53 68 61 72 69 6e 67 41 67 67 72 65 67 61 74 65 53 75 72 76 65 79 44 61 74 61 2e 53 75 63 63 65 73 73 22 5d 3d 7b 24 65 3a 21 30 7d 2c 6e 5b 22 41 6e 61 6c 79 73 69 73 46 6f 72 6d 2e 47 65 74 2e 53 75 63 63 65 73 73 22 5d 3d 7b 24 65 3a 21 30 7d 2c 6e 5b 22 43 68 6f Data Ascii: .AggregateQuizData.Success"]={$e:!0},n["Analysis.AggregateSurveyData.Success"]={$e:!0},n["Analysis.ResultSharingAggregateQuizData.Success"]={$e:!0},n["Analysis.ResultSharingAggregateSurveyData.Success"]={$e:!0},n["AnalysisForm.Get.Success"]={$e:!0},n["Cho

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49728	13.107.6.194	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:20 UTC	615	OUT	GET /cdn/images/microsoft365logo_v1.png HTTP/1.1 Host: forms.office.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
2025-04-23 15:03:21 UTC	558	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 5895 Content-Type: image/png Last-Modified: Fri, 18 Apr 2025 06:41:03 GMT Accept-Ranges: bytes ETag: "0x8DD7E43FD6F17B9" X-Cache: TCP_HIT x-ms-request-id: 4c896406-d01e-0065-59ae-b1f975000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * X-CID: 7 X-MSEdge-Ref: Ref A: F0AC8083247344A884EAA63D62613005 Ref B: LAX311000109045 Ref C: 2025-04-23T15:03:20Z Date: Wed, 23 Apr 2025 15:03:20 GMT Connection: close
2025-04-23 15:03:21 UTC	5895	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 ea 00 00 00 b4 08 06 00 00 00 5b 9e 6f 09 00 00 16 ce 49 44 41 54 78 da ed dd 0b b4 96 55 9d c7 f1 e3 e4 78 69 1a 23 a7 8c 6c 0c 25 33 4a a5 74 d4 44 5c 49 66 35 68 c6 a1 c4 f2 1c 81 c3 fd 3e 1e 46 74 a9 a1 9c 00 15 5d c5 38 66 96 a9 41 11 ae e9 28 e1 0d 2f 90 a1 9e a8 44 83 cc 31 62 9c 25 a8 39 3a 31 79 04 4c 44 85 33 ff ff cc 7e 59 af 8f cf 7f 3f fb b9 bd e7 c0 fb fd ac b5 17 28 ef 73 bf fc 9e cb 7e f6 6e 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: PNGIHDR[oIDATxUxi#l%3JtD\If5h>Ft]8fA(/D1b%9:1yLD3~Y?(s~nh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49729	13.107.6.194	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:20 UTC	796	OUT	GET /sw.js?ring=Business HTTP/1.1 Host: forms.office.com Connection: keep-alive Cache-Control: max-age=0 Accept: / Service-Worker: script Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: serviceworker Referer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturl User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81
2025-04-23 15:03:21 UTC	927	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=86400 Content-Length: 43869 Content-Type: text/javascript Last-Modified: Mon, 21 Apr 2025 15:16:40 GMT Accept-Ranges: bytes ETag: "1dbb2d061b8175d" Strict-Transport-Security: max-age=2592000; includeSubDomains X-RoutingOfficeCluster: wus-100.forms.office.com X-RoutingOfficeFE: FormsSingleBox_IN_1 X-RoutingOfficeVersion: 16.0.18821.42502 X-RoutingSessionId: 48ac0071-c3a4-49f7-8239-54a50c17a07b X-RoutingCorrelationId: 2e7dca6b-0c04-4a56-b594-ff647d3a128a X-CorrelationId: 2e7dca6b-0c04-4a56-b594-ff647d3a128a X-OfficeCluster: wus-100.forms.office.com X-OfficeFE: FormsSingleBox_IN_1 X-OfficeVersion: 16.0.18821.42502 X-UserSessionId: 48ac0071-c3a4-49f7-8239-54a50c17a07b X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 930AA1E518C94D6DBFC761ED2ACE0B7F Ref B: LAX311000115031 Ref C: 2025-04-23T15:03:20Z Date: Wed, 23 Apr 2025 15:03:20 GMT Connection: close
2025-04-23 15:03:21 UTC	1143	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 7b 31 32 34 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 73 65 6c 66 5b 22 77 6f 72 6b 62 6f 78 3a 63 6f 72 65 3a 36 2e 31 2e 30 22 5d 26 26 5f 28 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 2c 33 39 30 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 73 65 6c 66 5b 22 77 6f 72 6b 62 6f 78 3a 65 78 70 69 72 61 74 69 6f 6e 3a 36 2e 34 2e 30 22 5d 26 26 5f 28 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 2c 35 36 38 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 73 65 6c 66 5b 22 77 6f 72 6b 62 6f 78 3a 63 6f 72 65 3a 36 2e 34 2e 30 22 5d 26 26 5f 28 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 2c 36 33 39 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 73 65 6c 66 5b 22 77 6f 72 Data Ascii: !function(){"use strict";var e={124:function(){try{self["workbox:core:6.1.0"]&&_()}catch(e){}},390:function(){try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},568:function(){try{self["workbox:core:6.4.0"]&&_()}catch(e){}},639:function(){try{self["wor
2025-04-23 15:03:21 UTC	2176	IN	Data Raw: 65 28 65 29 3b 72 65 74 75 72 6e 20 6e 2e 68 72 65 66 7d 63 6c 61 73 73 20 6c 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 2c 74 2c 7b 6f 6e 75 70 67 72 61 64 65 6e 65 65 64 65 64 3a 6e 2c 6f 6e 76 65 72 73 69 6f 6e 63 68 61 6e 67 65 3a 72 7d 3d 7b 7d 29 7b 74 68 69 73 2e 5f 64 62 3d 6e 75 6c 6c 2c 74 68 69 73 2e 5f 6e 61 6d 65 3d 65 2c 74 68 69 73 2e 5f 76 65 72 73 69 6f 6e 3d 74 2c 74 68 69 73 2e 5f 6f 6e 75 70 67 72 61 64 65 6e 65 65 64 65 64 3d 6e 2c 74 68 69 73 2e 5f 6f 6e 76 65 72 73 69 6f 6e 63 68 61 6e 67 65 3d 72 7c 7c 28 28 29 3d 3e 74 68 69 73 2e 63 6c 6f 73 65 28 29 29 7d 67 65 74 20 64 62 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 64 62 7d 61 73 79 6e 63 20 6f 70 65 6e 28 29 7b 69 66 28 21 74 68 69 73 2e 5f 64 62 29 72 65 74 75 72 6e 20 74 Data Ascii: e(e);return n.href}class l{constructor(e,t,{onupgradeneeded:n,onversionchange:r}={}){this._db=null,this._name=e,this._version=t,this._onupgradeneeded=n,this._onversionchange=r\|\|(()=>this.close())}get db(){return this._db}async open(){if(!this._db)return t
2025-04-23 15:03:21 UTC	4096	IN	Data Raw: 28 28 74 3d 3e 73 65 74 54 69 6d 65 6f 75 74 28 74 2c 65 29 29 29 7d 6e 28 36 39 35 29 3b 63 6f 6e 73 74 20 6d 3d 65 3d 3e 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 3f 65 3a 7b 68 61 6e 64 6c 65 3a 65 7d 3b 63 6c 61 73 73 20 79 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 2c 74 2c 6e 3d 22 47 45 54 22 29 7b 74 68 69 73 2e 68 61 6e 64 6c 65 72 3d 6d 28 74 29 2c 74 68 69 73 2e 6d 61 74 63 68 3d 65 2c 74 68 69 73 2e 6d 65 74 68 6f 64 3d 6e 7d 73 65 74 43 61 74 63 68 48 61 6e 64 6c 65 72 28 65 29 7b 74 68 69 73 2e 63 61 74 63 68 48 61 6e 64 6c 65 72 3d 6d 28 65 29 7d 7d 63 6c 61 73 73 20 67 20 65 78 74 65 6e 64 73 20 79 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 2c 74 2c 6e 29 7b 73 75 70 65 72 28 28 28 7b 75 72 6c 3a 74 7d 29 3d 3e 7b 63 6f Data Ascii: ((t=>setTimeout(t,e)))}n(695);const m=e=>e&&"object"==typeof e?e:{handle:e};class y{constructor(e,t,n="GET"){this.handler=m(t),this.match=e,this.method=n}setCatchHandler(e){this.catchHandler=m(e)}}class g extends y{constructor(e,t,n){super((({url:t})=>{co
2025-04-23 15:03:21 UTC	4096	IN	Data Raw: 6f 78 79 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 52 65 71 75 69 72 65 64 3d 34 30 37 5d 3d 22 50 72 6f 78 79 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 52 65 71 75 69 72 65 64 22 2c 65 5b 65 2e 52 65 71 75 65 73 74 54 69 6d 65 6f 75 74 3d 34 30 38 5d 3d 22 52 65 71 75 65 73 74 54 69 6d 65 6f 75 74 22 2c 65 5b 65 2e 43 6f 6e 66 6c 69 63 74 3d 34 30 39 5d 3d 22 43 6f 6e 66 6c 69 63 74 22 2c 65 5b 65 2e 47 6f 6e 65 3d 34 31 30 5d 3d 22 47 6f 6e 65 22 2c 65 5b 65 2e 4c 65 6e 67 74 68 52 65 71 75 69 72 65 64 3d 34 31 31 5d 3d 22 4c 65 6e 67 74 68 52 65 71 75 69 72 65 64 22 2c 65 5b 65 2e 50 72 65 63 6f 6e 64 69 74 69 6f 6e 46 61 69 6c 65 64 3d 34 31 32 5d 3d 22 50 72 65 63 6f 6e 64 69 74 69 6f 6e 46 61 69 6c 65 64 22 2c 65 5b 65 2e 52 65 71 75 65 73 74 45 6e Data Ascii: oxyAuthenticationRequired=407]="ProxyAuthenticationRequired",e[e.RequestTimeout=408]="RequestTimeout",e[e.Conflict=409]="Conflict",e[e.Gone=410]="Gone",e[e.LengthRequired=411]="LengthRequired",e[e.PreconditionFailed=412]="PreconditionFailed",e[e.RequestEn
2025-04-23 15:03:21 UTC	4096	IN	Data Raw: 65 64 3d 35 35 31 30 5d 3d 22 43 72 65 61 74 65 50 65 72 6d 69 73 73 69 6f 6e 4c 69 6d 69 74 52 65 61 63 68 65 64 22 2c 65 5b 65 2e 43 72 65 61 74 65 47 72 6f 75 70 50 65 72 6d 69 73 73 69 6f 6e 4c 69 6d 69 74 52 65 61 63 68 65 64 3d 35 35 31 31 5d 3d 22 43 72 65 61 74 65 47 72 6f 75 70 50 65 72 6d 69 73 73 69 6f 6e 4c 69 6d 69 74 52 65 61 63 68 65 64 22 2c 65 5b 65 2e 46 61 69 6c 65 64 54 6f 43 72 65 61 74 65 50 65 72 6d 69 73 73 69 6f 6e 49 6e 76 61 6c 69 64 3d 35 35 31 32 5d 3d 22 46 61 69 6c 65 64 54 6f 43 72 65 61 74 65 50 65 72 6d 69 73 73 69 6f 6e 49 6e 76 61 6c 69 64 22 2c 65 5b 65 2e 43 6f 70 79 4e 6f 74 41 6c 6c 6f 77 65 64 3d 35 35 35 30 5d 3d 22 43 6f 70 79 4e 6f 74 41 6c 6c 6f 77 65 64 22 2c 65 5b 65 2e 46 61 69 6c 65 64 54 6f 54 75 72 6e 4f Data Ascii: ed=5510]="CreatePermissionLimitReached",e[e.CreateGroupPermissionLimitReached=5511]="CreateGroupPermissionLimitReached",e[e.FailedToCreatePermissionInvalid=5512]="FailedToCreatePermissionInvalid",e[e.CopyNotAllowed=5550]="CopyNotAllowed",e[e.FailedToTurnO
2025-04-23 15:03:21 UTC	777	IN	Data Raw: 6e 67 3d 31 30 32 32 31 5d 3d 22 4f 70 65 6e 49 6e 45 78 63 65 6c 53 6f 6d 65 74 68 69 6e 67 57 65 6e 74 57 72 6f 6e 67 22 2c 65 5b 65 2e 4f 70 65 6e 49 6e 45 78 63 65 6c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 46 61 69 6c 65 64 3d 31 30 32 32 32 5d 3d 22 4f 70 65 6e 49 6e 45 78 63 65 6c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 46 61 69 6c 65 64 22 2c 65 5b 65 2e 4f 70 65 6e 49 6e 45 78 63 65 6c 4d 69 73 73 69 6e 67 3d 31 30 32 32 33 5d 3d 22 4f 70 65 6e 49 6e 45 78 63 65 6c 4d 69 73 73 69 6e 67 22 2c 65 5b 65 2e 4f 70 65 6e 49 6e 45 78 63 65 6c 46 6f 72 62 69 64 64 65 6e 3d 31 30 32 32 34 5d 3d 22 4f 70 65 6e 49 6e 45 78 63 65 6c 46 6f 72 62 69 64 64 65 6e 22 2c 65 5b 65 2e 4f 70 65 6e 49 6e 45 78 63 65 6c 4f 6e 65 44 72 69 76 65 46 75 6c 6c 3d 31 30 Data Ascii: ng=10221]="OpenInExcelSomethingWentWrong",e[e.OpenInExcelAuthenticationFailed=10222]="OpenInExcelAuthenticationFailed",e[e.OpenInExcelMissing=10223]="OpenInExcelMissing",e[e.OpenInExcelForbidden=10224]="OpenInExcelForbidden",e[e.OpenInExcelOneDriveFull=10
2025-04-23 15:03:21 UTC	4096	IN	Data Raw: 45 6d 70 74 79 55 55 49 44 22 2c 65 5b 65 2e 4e 65 74 77 6f 72 6b 49 73 73 75 65 3d 31 35 30 30 31 5d 3d 22 4e 65 74 77 6f 72 6b 49 73 73 75 65 22 2c 65 5b 65 2e 47 65 74 47 72 61 70 68 41 50 49 54 6f 6b 65 6e 46 61 69 6c 65 64 3d 31 35 30 30 32 5d 3d 22 47 65 74 47 72 61 70 68 41 50 49 54 6f 6b 65 6e 46 61 69 6c 65 64 22 2c 65 5b 65 2e 4c 6f 67 69 6e 4e 6f 74 53 75 70 70 6f 72 74 49 6e 43 75 72 72 65 6e 74 42 72 6f 77 73 65 72 3d 31 35 30 30 33 5d 3d 22 4c 6f 67 69 6e 4e 6f 74 53 75 70 70 6f 72 74 49 6e 43 75 72 72 65 6e 74 42 72 6f 77 73 65 72 22 2c 65 5b 65 2e 41 6e 73 77 65 72 56 69 6f 6c 61 74 69 6f 6e 73 3d 31 35 30 30 34 5d 3d 22 41 6e 73 77 65 72 56 69 6f 6c 61 74 69 6f 6e 73 22 2c 65 5b 65 2e 53 65 6e 73 69 74 69 76 65 41 6e 73 77 65 72 56 69 6f Data Ascii: EmptyUUID",e[e.NetworkIssue=15001]="NetworkIssue",e[e.GetGraphAPITokenFailed=15002]="GetGraphAPITokenFailed",e[e.LoginNotSupportInCurrentBrowser=15003]="LoginNotSupportInCurrentBrowser",e[e.AnswerViolations=15004]="AnswerViolations",e[e.SensitiveAnswerVio
2025-04-23 15:03:21 UTC	4096	IN	Data Raw: 22 7d 28 49 7c 7c 28 49 3d 7b 7d 29 29 3b 63 6f 6e 73 74 20 55 3d 5b 7b 73 74 61 72 74 75 70 3a 49 2e 52 65 73 70 6f 6e 73 65 50 61 67 65 2c 70 61 74 68 6e 61 6d 65 3a 41 2e 52 65 73 70 6f 6e 73 65 50 61 67 65 7d 2c 7b 73 74 61 72 74 75 70 3a 49 2e 41 73 73 69 67 6e 6d 65 6e 74 73 52 65 73 70 6f 6e 73 65 50 61 67 65 2c 70 61 74 68 6e 61 6d 65 3a 41 2e 41 73 73 69 67 6e 6d 65 6e 74 73 52 65 73 70 6f 6e 73 65 50 61 67 65 7d 2c 7b 6d 61 74 63 68 3a 65 3d 3e 2f 5b 26 3f 5d 73 75 62 70 61 67 65 3d 64 65 73 69 67 6e 2f 69 2e 74 65 73 74 28 65 2e 73 65 61 72 63 68 29 2c 70 61 74 68 6e 61 6d 65 3a 41 2e 4e 65 6f 44 65 73 69 67 6e 50 61 67 65 2c 73 74 61 72 74 75 70 3a 49 2e 4e 65 6f 44 65 73 69 67 6e 50 61 67 65 7d 2c 7b 73 74 61 72 74 75 70 3a 49 2e 54 65 61 6d Data Ascii: "}(I\|\|(I={}));const U=[{startup:I.ResponsePage,pathname:A.ResponsePage},{startup:I.AssignmentsResponsePage,pathname:A.AssignmentsResponsePage},{match:e=>/[&?]subpage=design/i.test(e.search),pathname:A.NeoDesignPage,startup:I.NeoDesignPage},{startup:I.Team
2025-04-23 15:03:21 UTC	4096	IN	Data Raw: 63 61 74 63 68 28 28 28 29 3d 3e 7b 7d 29 29 7d 28 65 29 7d 29 29 7d 63 6f 6e 73 74 20 68 65 3d 22 31 2e 30 2e 35 22 2c 64 65 3d 61 73 79 6e 63 28 29 3d 3e 68 65 3b 63 6f 6e 73 74 20 66 65 3d 61 73 79 6e 63 20 65 3d 3e 7b 63 6f 6e 73 74 7b 72 65 71 75 65 73 74 3a 74 2c 75 72 6c 3a 6e 7d 3d 65 3b 69 66 28 74 26 26 22 6e 61 76 69 67 61 74 65 22 3d 3d 3d 74 2e 6d 6f 64 65 26 26 73 65 6c 66 2e 6f 72 69 67 69 6e 3d 3d 3d 6e 2e 6f 72 69 67 69 6e 26 26 21 7a 28 6e 29 26 26 21 24 28 6e 29 26 26 21 51 28 6e 29 29 74 72 79 7b 72 65 74 75 72 6e 20 61 77 61 69 74 20 58 28 29 7c 7c 52 65 73 70 6f 6e 73 65 2e 65 72 72 6f 72 28 29 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 20 52 65 73 70 6f 6e 73 65 2e 65 72 72 6f 72 28 29 7d 7d 3b 66 75 6e 63 74 69 6f 6e 20 70 65 Data Ascii: catch((()=>{}))}(e)}))}const he="1.0.5",de=async()=>he;const fe=async e=>{const{request:t,url:n}=e;if(t&&"navigate"===t.mode&&self.origin===n.origin&&!z(n)&&!$(n)&&!Q(n))try{return await X()\|\|Response.error()}catch(e){return Response.error()}};function pe
2025-04-23 15:03:21 UTC	4096	IN	Data Raw: 75 65 3b 6e 2e 63 61 63 68 65 4e 61 6d 65 3d 3d 3d 74 68 69 73 2e 5f 63 61 63 68 65 4e 61 6d 65 26 26 28 65 26 26 6e 2e 74 69 6d 65 73 74 61 6d 70 3c 65 7c 7c 74 26 26 6f 3e 3d 74 3f 73 2e 70 75 73 68 28 72 2e 76 61 6c 75 65 29 3a 6f 2b 2b 29 2c 72 3d 61 77 61 69 74 20 72 2e 63 6f 6e 74 69 6e 75 65 28 29 7d 63 6f 6e 73 74 20 61 3d 5b 5d 3b 66 6f 72 28 63 6f 6e 73 74 20 65 20 6f 66 20 73 29 61 77 61 69 74 20 6e 2e 64 65 6c 65 74 65 28 4f 65 2c 65 2e 69 64 29 2c 61 2e 70 75 73 68 28 65 2e 75 72 6c 29 3b 72 65 74 75 72 6e 20 61 7d 5f 67 65 74 49 64 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 63 61 63 68 65 4e 61 6d 65 2b 22 7c 22 2b 50 65 28 65 29 7d 61 73 79 6e 63 20 67 65 74 44 62 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 64 62 7c 7c 28 74 68 Data Ascii: ue;n.cacheName===this._cacheName&&(e&&n.timestamp<e\|\|t&&o>=t?s.push(r.value):o++),r=await r.continue()}const a=[];for(const e of s)await n.delete(Oe,e.id),a.push(e.url);return a}_getId(e){return this._cacheName+"\|"+Pe(e)}async getDb(){return this._db\|\|(th

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49730	20.125.62.241	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:20 UTC	583	OUT	GET /c.gif HTTP/1.1 Host: c.office.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://forms.office.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:03:21 UTC	657	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=70A8AF966E244705BDB164130EDD155B&RedC=c.office.com&MXFR=27182357164C6E0D18C03680124C65A5 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.office.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=27182357164C6E0D18C03680124C65A5; domain=.office.com; expires=Mon, 18-May-2026 15:03:20 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Wed, 23 Apr 2025 15:03:20 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49732	13.107.6.194	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:21 UTC	660	OUT	GET /offline.aspx HTTP/1.1 Host: forms.office.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://forms.office.com/sw.js?ring=Business Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81; MUID=27182357164C6E0D18C03680124C65A5
2025-04-23 15:03:22 UTC	1227	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Content-Type: text/html; charset=utf-8 Strict-Transport-Security: max-age=2592000; includeSubDomains X-RoutingOfficeCluster: wus-100.forms.office.com X-RoutingOfficeFE: FormsSingleBox_IN_5 X-RoutingOfficeVersion: 16.0.18821.42502 X-RoutingSessionId: 4514a865-e5ca-42cb-b69b-1d50273aa743 X-RoutingCorrelationId: c5d532ce-ec02-4faa-aaac-c1718686f724 X-CorrelationId: c5d532ce-ec02-4faa-aaac-c1718686f724 X-OfficeCluster: wus-100.forms.office.com X-OfficeFE: FormsSingleBox_IN_5 X-OfficeVersion: 16.0.18821.42502 X-UserSessionId: 4514a865-e5ca-42cb-b69b-1d50273aa743 Report-To: { "group": "endpoint-1", "max_age": 108864000, "endpoints": [ { "url": "https://csp.microsoft.com/report/Forms-PROD" }] } Content-Security-Policy: object-src 'none';script-src 'nonce-aa97ad2a-16a0-465c-8569-c78d55151fb1' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https:;base-uri 'none';require-trusted-types-for 'script'; report-uri https://csp.microsoft.com/report/Forms-PROD;report-to endpoint-1; X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 06CFD80612CA44B0B312518CC8286E44 Ref B: LAX311000109047 Ref C: 2025-04-23T15:03:21Z Date: Wed, 23 Apr 2025 15:03:21 GMT Connection: close
2025-04-23 15:03:22 UTC	3021	IN	Data Raw: 62 63 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 76 69 65 77 70 6f 72 74 2d 66 69 74 3d 63 6f 76 65 72 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 69 63 72 6f 73 6f 66 74 20 46 6f 72 6d 73 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 Data Ascii: bc6<!DOCTYPE html><html xmlns="http://www.w3.org/1999/xhtml" lang="en-us"><head> <meta charset="utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" /> <title>Microsoft Forms</title>
2025-04-23 15:03:22 UTC	321	IN	Data Raw: 31 33 61 0d 0a 37 35 20 33 31 2e 39 31 30 32 20 33 39 2e 32 30 34 31 20 33 31 2e 30 36 32 35 20 33 38 2e 38 36 32 33 20 33 30 2e 32 36 39 35 43 33 38 2e 35 32 30 35 20 32 39 2e 34 37 36 36 20 33 38 2e 30 34 38 38 20 32 38 2e 37 38 36 31 20 33 37 2e 34 34 37 33 20 32 38 2e 31 39 38 32 43 33 36 2e 38 34 35 37 20 32 37 2e 36 31 30 34 20 33 36 2e 31 34 38 34 20 32 37 2e 31 33 38 37 20 33 35 2e 33 35 35 35 20 32 36 2e 37 38 33 32 43 33 34 2e 35 36 32 35 20 32 36 2e 34 32 37 37 20 33 33 2e 37 31 34 38 20 32 36 2e 32 35 20 33 32 2e 38 31 32 35 20 32 36 2e 32 35 43 33 32 2e 31 36 39 39 20 32 36 2e 32 35 20 33 31 2e 35 34 31 20 32 36 2e 33 33 38 39 20 33 30 2e 39 32 35 38 20 32 36 2e 35 31 36 36 43 33 30 2e 33 31 30 35 20 32 36 2e 36 39 34 33 20 32 39 2e 37 33 36 Data Ascii: 13a75 31.9102 39.2041 31.0625 38.8623 30.2695C38.5205 29.4766 38.0488 28.7861 37.4473 28.1982C36.8457 27.6104 36.1484 27.1387 35.3555 26.7832C34.5625 26.4277 33.7148 26.25 32.8125 26.25C32.1699 26.25 31.541 26.3389 30.9258 26.5166C30.3105 26.6943 29.736
2025-04-23 15:03:22 UTC	822	IN	Data Raw: 33 32 66 0d 0a 38 20 33 39 2e 34 37 37 35 20 32 33 2e 30 34 33 39 20 33 39 2e 39 34 39 32 20 32 33 2e 33 39 39 34 20 34 30 2e 34 30 30 34 43 32 33 2e 37 35 34 39 20 34 30 2e 38 35 31 36 20 32 34 2e 31 34 34 35 20 34 31 2e 32 37 35 34 20 32 34 2e 35 36 38 34 20 34 31 2e 36 37 31 39 43 32 33 2e 39 38 30 35 20 34 31 2e 37 38 31 32 20 32 33 2e 33 39 32 36 20 34 31 2e 38 36 33 33 20 32 32 2e 38 30 34 37 20 34 31 2e 39 31 38 43 32 32 2e 32 31 36 38 20 34 31 2e 39 37 32 37 20 32 31 2e 36 31 35 32 20 34 32 20 32 31 20 34 32 43 31 39 2e 30 37 32 33 20 34 32 20 31 37 2e 32 31 32 39 20 34 31 2e 37 35 33 39 20 31 35 2e 34 32 31 39 20 34 31 2e 32 36 31 37 43 31 33 2e 36 33 30 39 20 34 30 2e 37 36 39 35 20 31 31 2e 39 36 32 39 20 34 30 2e 30 35 38 36 20 31 30 2e 34 31 Data Ascii: 32f8 39.4775 23.0439 39.9492 23.3994 40.4004C23.7549 40.8516 24.1445 41.2754 24.5684 41.6719C23.9805 41.7812 23.3926 41.8633 22.8047 41.918C22.2168 41.9727 21.6152 42 21 42C19.0723 42 17.2129 41.7539 15.4219 41.2617C13.6309 40.7695 11.9629 40.0586 10.41
2025-04-23 15:03:22 UTC	3282	IN	Data Raw: 63 63 62 0d 0a 20 33 2e 38 30 30 37 38 20 33 34 2e 35 34 32 20 34 2e 38 39 34 35 33 20 33 35 2e 38 32 37 31 20 36 2e 31 35 32 33 34 43 33 37 2e 31 31 32 33 20 37 2e 34 31 30 31 36 20 33 38 2e 32 31 32 39 20 38 2e 38 32 35 32 20 33 39 2e 31 32 38 39 20 31 30 2e 33 39 37 35 43 34 30 2e 30 34 34 39 20 31 31 2e 39 36 39 37 20 34 30 2e 37 34 39 20 31 33 2e 36 34 34 35 20 34 31 2e 32 34 31 32 20 31 35 2e 34 32 31 39 43 34 31 2e 37 33 33 34 20 31 37 2e 31 39 39 32 20 34 31 2e 39 38 36 33 20 31 39 2e 30 35 38 36 20 34 32 20 32 31 43 34 32 20 32 31 2e 36 30 31 36 20 34 31 2e 39 37 32 37 20 32 32 2e 31 39 36 33 20 34 31 2e 39 31 38 20 32 32 2e 37 38 34 32 43 34 31 2e 38 36 33 33 20 32 33 2e 33 37 32 31 20 34 31 2e 37 38 31 32 20 32 33 2e 39 36 36 38 20 34 31 2e 36 Data Ascii: ccb 3.80078 34.542 4.89453 35.8271 6.15234C37.1123 7.41016 38.2129 8.8252 39.1289 10.3975C40.0449 11.9697 40.749 13.6445 41.2412 15.4219C41.7334 17.1992 41.9863 19.0586 42 21C42 21.6016 41.9727 22.1963 41.918 22.7842C41.8633 23.3721 41.7812 23.9668 41.6
2025-04-23 15:03:22 UTC	11	IN	Data Raw: 36 0d 0a 34 35 20 31 32 2e 0d 0a Data Ascii: 645 12.
2025-04-23 15:03:22 UTC	497	IN	Data Raw: 31 65 61 0d 0a 36 33 32 38 20 33 33 2e 38 33 37 39 43 31 32 2e 33 33 32 20 33 33 2e 30 33 31 32 20 31 32 2e 30 36 35 34 20 33 32 2e 32 30 34 31 20 31 31 2e 38 33 33 20 33 31 2e 33 35 36 34 43 31 31 2e 36 30 30 36 20 33 30 2e 35 30 38 38 20 31 31 2e 34 30 32 33 20 32 39 2e 36 38 31 36 20 31 31 2e 32 33 38 33 20 32 38 2e 38 37 35 48 34 2e 34 32 39 36 39 5a 22 20 66 69 6c 6c 3d 22 23 36 31 36 31 36 31 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 73 76 67 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 66 66 6c 69 6e 65 2d 74 69 74 6c 65 22 20 3e 59 6f 75 26 23 78 32 37 3b 72 65 20 6e 6f 74 20 63 6f 6e 6e 65 63 74 65 64 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 Data Ascii: 1ea6328 33.8379C12.332 33.0312 12.0654 32.2041 11.833 31.3564C11.6006 30.5088 11.4023 29.6816 11.2383 28.875H4.42969Z" fill="#616161" /> </svg> <div class="offline-title" >You're not connected</div> <div class
2025-04-23 15:03:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49733	20.125.62.241	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:22 UTC	726	OUT	GET /c.gif?ctsa=mr&CtsSyncId=70A8AF966E244705BDB164130EDD155B&MUID=27182357164C6E0D18C03680124C65A5 HTTP/1.1 Host: c.office.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://forms.office.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: SM=T; MUID=27182357164C6E0D18C03680124C65A5
2025-04-23 15:03:22 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 09 Apr 2025 17:36:29 GMT Accept-Ranges: bytes ETag: "e8cf83ed75a9db1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.office.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=27182357164C6E0D18C03680124C65A5; domain=.office.com; expires=Mon, 18-May-2026 15:03:22 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=c.office.com; expires=Wed, 30-Apr-2025 15:03:22 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.office.com; expires=Wed, 23-Apr-2025 15:13:22 GMT; path=/; SameSite=None; Secure; Date: Wed, 23 Apr 2025 15:03:22 GMT Connection: close Content-Length: 42
2025-04-23 15:03:22 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49735	13.107.6.194	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:23 UTC	668	OUT	GET /muid.gif?muid=27182357164C6E0D18C03680124C65A5 HTTP/1.1 Host: forms.cloud.microsoft Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://forms.office.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:03:23 UTC	674	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Content-Type: image/gif Set-Cookie: MUID=27182357164C6E0D18C03680124C65A5; max-age=33696000; path=/; secure; samesite=none Strict-Transport-Security: max-age=2592000; includeSubDomains X-RoutingOfficeCluster: wus-101.forms.office.com X-RoutingOfficeFE: FormsSingleBox_IN_3 X-RoutingOfficeVersion: 16.0.18821.42501 X-RoutingSessionId: fedc018c-3d4d-4ec7-90b6-bc675a11e876 X-RoutingCorrelationId: 670c5a1c-c2b9-4274-adf4-40fa5b06509e X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 9FBE0EA20E54491CB6690413A641A49E Ref B: LAX311000112031 Ref C: 2025-04-23T15:03:23Z Date: Wed, 23 Apr 2025 15:03:23 GMT Connection: close
2025-04-23 15:03:23 UTC	43	IN	Data Raw: 32 35 0d 0a 47 49 46 38 39 61 01 00 01 00 00 00 00 21 f9 04 01 0a 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b 0d 0a Data Ascii: 25GIF89a!,L;
2025-04-23 15:03:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49734	20.125.62.241	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:23 UTC	540	OUT	GET /c.gif?ctsa=mr&CtsSyncId=70A8AF966E244705BDB164130EDD155B&MUID=27182357164C6E0D18C03680124C65A5 HTTP/1.1 Host: c.office.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: MUID=27182357164C6E0D18C03680124C65A5; SM=C; MR=0; ANONCHK=0
2025-04-23 15:03:23 UTC	516	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 09 Apr 2025 17:36:29 GMT Accept-Ranges: bytes ETag: "e8cf83ed75a9db1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: ANONCHK=0; domain=c.office.com; expires=Wed, 23-Apr-2025 15:13:23 GMT; path=/; SameSite=None; Secure; Date: Wed, 23 Apr 2025 15:03:23 GMT Connection: close Content-Length: 42
2025-04-23 15:03:23 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49711	13.107.6.194	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:23 UTC	670	OUT	GET /pwa/en-us/app.webmanifest HTTP/1.1 Host: forms.office.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: manifest Referer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturl Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:03:23 UTC	811	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Content-Type: application/manifest+json Strict-Transport-Security: max-age=2592000; includeSubDomains X-RoutingOfficeCluster: wus-100.forms.office.com X-RoutingOfficeFE: FormsSingleBox_IN_2 X-RoutingOfficeVersion: 16.0.18821.42502 X-RoutingSessionId: 06359c56-592b-44f9-847c-1d8be1526515 X-RoutingCorrelationId: c698f1df-d82e-41d0-9a27-3766c2f671f6 X-CorrelationId: c698f1df-d82e-41d0-9a27-3766c2f671f6 X-OfficeCluster: wus-100.forms.office.com X-OfficeFE: FormsSingleBox_IN_2 X-OfficeVersion: 16.0.18821.42502 X-UserSessionId: 06359c56-592b-44f9-847c-1d8be1526515 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: A96A5C558627401ABC6ACB9F87DEA1E1 Ref B: LAX311000113051 Ref C: 2025-04-23T15:03:23Z Date: Wed, 23 Apr 2025 15:03:23 GMT Connection: close
2025-04-23 15:03:23 UTC	519	IN	Data Raw: 32 30 30 0d 0a 7b 22 6c 61 6e 67 22 3a 22 65 6e 2d 75 73 22 2c 22 6e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 46 6f 72 6d 73 22 2c 22 73 68 6f 72 74 5f 6e 61 6d 65 22 3a 22 46 6f 72 6d 73 22 2c 22 69 63 6f 6e 73 22 3a 5b 7b 22 73 72 63 22 3a 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 66 6f 72 6d 73 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 69 6d 61 67 65 73 2f 70 77 61 2f 66 6f 72 6d 73 2d 70 77 61 2d 6c 6f 67 6f 2d 31 39 32 2e 70 6e 67 22 2c 22 73 69 7a 65 73 22 3a 22 31 39 32 78 31 39 32 22 2c 22 74 79 70 65 22 3a 22 69 6d 61 67 65 2f 70 6e 67 22 7d 2c 7b 22 73 72 63 22 3a 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 66 6f 72 6d 73 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 69 6d 61 67 65 73 2f 70 77 61 2f 66 6f 72 6d 73 2d 70 77 61 2d 6c 6f 67 6f 2d 32 35 36 2e 70 6e Data Ascii: 200{"lang":"en-us","name":"Microsoft Forms","short_name":"Forms","icons":[{"src":"https://cdn.forms.office.net/images/pwa/forms-pwa-logo-192.png","sizes":"192x192","type":"image/png"},{"src":"https://cdn.forms.office.net/images/pwa/forms-pwa-logo-256.pn
2025-04-23 15:03:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	49739	13.107.6.194	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:24 UTC	968	OUT	GET /cdn/images/favicon.ico HTTP/1.1 Host: forms.office.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://forms.office.com/pages/responsepage.aspx?id=HmgNc7m2oEGz-Z5KSPj2tf315e4FBPFGm2RewbH53Y1UMVZaVlpWU0RVVFNQQTkwWkJQUVpFNEVJMC4u&route=shorturl Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81; MUID=27182357164C6E0D18C03680124C65A5
2025-04-23 15:03:24 UTC	561	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 7886 Content-Type: image/x-icon Last-Modified: Fri, 18 Apr 2025 06:41:02 GMT Accept-Ranges: bytes ETag: "0x8DD7E43FCE080D4" X-Cache: TCP_HIT x-ms-request-id: 601353d6-d01e-0065-7aea-b0f975000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * X-CID: 7 X-MSEdge-Ref: Ref A: 70B316EF763842D9B6D3C5BA21BB7BF9 Ref B: LAX311000111035 Ref C: 2025-04-23T15:03:24Z Date: Wed, 23 Apr 2025 15:03:23 GMT Connection: close
2025-04-23 15:03:24 UTC	7886	IN	Data Raw: 00 00 01 00 03 00 20 20 00 00 01 00 20 00 a8 10 00 00 36 00 00 00 18 18 00 00 01 00 20 00 88 09 00 00 de 10 00 00 10 10 00 00 01 00 20 00 68 04 00 00 66 1a 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 80 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6 hf( @

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	49740	13.107.6.194	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:24 UTC	478	OUT	GET /muid.gif?muid=27182357164C6E0D18C03680124C65A5 HTTP/1.1 Host: forms.cloud.microsoft Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: MUID=27182357164C6E0D18C03680124C65A5
2025-04-23 15:03:24 UTC	674	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Content-Type: image/gif Set-Cookie: MUID=27182357164C6E0D18C03680124C65A5; max-age=33696000; path=/; secure; samesite=none Strict-Transport-Security: max-age=2592000; includeSubDomains X-RoutingOfficeCluster: wus-100.forms.office.com X-RoutingOfficeFE: FormsSingleBox_IN_4 X-RoutingOfficeVersion: 16.0.18821.42502 X-RoutingSessionId: 8bcd5ff0-4d7b-4b16-aee8-71ace906e48c X-RoutingCorrelationId: 469d8c13-8374-497e-8904-3a756c4398b3 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 86E32E2E19FE43158636E15A7F7752FE Ref B: LAX311000110045 Ref C: 2025-04-23T15:03:24Z Date: Wed, 23 Apr 2025 15:03:23 GMT Connection: close
2025-04-23 15:03:24 UTC	43	IN	Data Raw: 32 35 0d 0a 47 49 46 38 39 61 01 00 01 00 00 00 00 21 f9 04 01 0a 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b 0d 0a Data Ascii: 25GIF89a!,L;
2025-04-23 15:03:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.16	49741	23.220.73.79	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:24 UTC	654	OUT	GET /images/pwa/forms-pwa-logo-192.png HTTP/1.1 Host: cdn.forms.office.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://forms.office.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:03:24 UTC	580	IN	HTTP/1.1 200 OK Content-Length: 1779 Content-Type: image/png Content-MD5: QVCl1PKwKEqeYtJHkp3Sqg== Last-Modified: Fri, 06 Dec 2024 05:23:50 GMT Accept-Ranges: bytes ETag: "0x8DD15B62AD41C7D" Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 58260208-f01e-0000-5285-485731000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * Cache-Control: max-age=31536000 Expires: Thu, 23 Apr 2026 15:03:24 GMT Date: Wed, 23 Apr 2025 15:03:24 GMT Connection: close Timing-Allow-Origin: *
2025-04-23 15:03:24 UTC	1779	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c0 00 00 00 c0 08 03 00 00 00 65 02 9c 35 00 00 01 fe 50 4c 54 45 00 00 00 00 70 70 00 80 80 10 80 80 40 cf cf 00 70 70 00 80 87 08 80 87 38 c7 cf 00 6a 70 05 85 8a 3a ca cf 04 6c 70 03 83 86 36 c6 cf 39 c6 cf 03 82 87 05 6d 70 1d 9a 9f 38 c5 cf 02 6b 70 02 84 89 36 c7 d1 38 c7 d1 04 6c 70 04 6c 70 37 c5 cf 37 c6 cf 03 6d 70 03 84 88 37 c7 d0 03 6c 70 03 83 87 37 c6 d0 03 6c 70 03 83 87 03 84 88 04 6c 70 02 6c 70 04 6c 70 37 c6 d0 02 84 87 03 6d 70 03 84 87 37 c6 d0 03 6c 70 03 83 88 36 c5 d0 37 c6 d0 02 36 38 02 3b 3d 02 40 42 02 41 43 02 49 4c 02 4e 51 02 53 56 02 58 5b 03 44 46 03 4a 4d 03 4e 50 03 55 58 03 58 5b 03 5d 60 03 5f 62 03 65 69 03 66 6a 03 68 6c 03 69 6c 03 6c 70 03 70 74 03 79 7d 03 Data Ascii: PNGIHDRe5PLTEpp@pp8jp:lp69mp8kp68lplp77mp7lp7lplplplp7mp7lp6768;=@BACILNQSVX[DFJMNPUXX[]`_beifjhlillppty}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.16	49742	13.107.6.194	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:24 UTC	642	OUT	GET /cdn/images/favicon.ico HTTP/1.1 Host: forms.office.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FormsWebSessionId=e65c9feb-24a4-4516-bd28-01c452fd89f2; __RequestVerificationToken=vx9DCOzzG5MKtms22Pz7A6clw70Eao5MB_X3xmMA1L6LmgdzyMRH6Lsh2_Wj6urGC7CvPuIVxtsdriwtyQ9iKAEzAhVOS6Fk6a9jwiNO0g81; MUID=27182357164C6E0D18C03680124C65A5
2025-04-23 15:03:25 UTC	561	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 7886 Content-Type: image/x-icon Last-Modified: Fri, 18 Apr 2025 06:41:02 GMT Accept-Ranges: bytes ETag: "0x8DD7E43FCE080D4" X-Cache: TCP_HIT x-ms-request-id: 18aed21b-101e-007a-34ff-b04a71000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * X-CID: 7 X-MSEdge-Ref: Ref A: 2C9A5247B80344929E74F3C134CA0E59 Ref B: LAX311000115019 Ref C: 2025-04-23T15:03:25Z Date: Wed, 23 Apr 2025 15:03:24 GMT Connection: close
2025-04-23 15:03:25 UTC	7886	IN	Data Raw: 00 00 01 00 03 00 20 20 00 00 01 00 20 00 a8 10 00 00 36 00 00 00 18 18 00 00 01 00 20 00 88 09 00 00 de 10 00 00 10 10 00 00 01 00 20 00 68 04 00 00 66 1a 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 80 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6 hf( @

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.16	49743	23.220.73.79	443	6524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:03:24 UTC	417	OUT	GET /images/pwa/forms-pwa-logo-192.png HTTP/1.1 Host: cdn.forms.office.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:03:25 UTC	580	IN	HTTP/1.1 200 OK Content-Length: 1779 Content-Type: image/png Content-MD5: QVCl1PKwKEqeYtJHkp3Sqg== Last-Modified: Fri, 06 Dec 2024 05:23:50 GMT Accept-Ranges: bytes ETag: "0x8DD15B62AD41C7D" Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 58260208-f01e-0000-5285-485731000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * Cache-Control: max-age=31536000 Expires: Thu, 23 Apr 2026 15:03:25 GMT Date: Wed, 23 Apr 2025 15:03:25 GMT Connection: close Timing-Allow-Origin: *
2025-04-23 15:03:25 UTC	1779	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c0 00 00 00 c0 08 03 00 00 00 65 02 9c 35 00 00 01 fe 50 4c 54 45 00 00 00 00 70 70 00 80 80 10 80 80 40 cf cf 00 70 70 00 80 87 08 80 87 38 c7 cf 00 6a 70 05 85 8a 3a ca cf 04 6c 70 03 83 86 36 c6 cf 39 c6 cf 03 82 87 05 6d 70 1d 9a 9f 38 c5 cf 02 6b 70 02 84 89 36 c7 d1 38 c7 d1 04 6c 70 04 6c 70 37 c5 cf 37 c6 cf 03 6d 70 03 84 88 37 c7 d0 03 6c 70 03 83 87 37 c6 d0 03 6c 70 03 83 87 03 84 88 04 6c 70 02 6c 70 04 6c 70 37 c6 d0 02 84 87 03 6d 70 03 84 87 37 c6 d0 03 6c 70 03 83 88 36 c5 d0 37 c6 d0 02 36 38 02 3b 3d 02 40 42 02 41 43 02 49 4c 02 4e 51 02 53 56 02 58 5b 03 44 46 03 4a 4d 03 4e 50 03 55 58 03 58 5b 03 5d 60 03 5f 62 03 65 69 03 66 6a 03 68 6c 03 69 6c 03 6c 70 03 70 74 03 79 7d 03 Data Ascii: PNGIHDRe5PLTEpp@pp8jp:lp69mp8kp68lplp77mp7lp7lplplplp7mp7lp6768;=@BACILNQSVX[DFJMNPUXX[]`_beifjhlillppty}

Statistics

CPU Usage

• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Memory Usage

• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 6296, Parent PID: 1864

Function Logs

General

Target ID:	0
Start time:	11:03:11
Start date:	23/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff77eaf0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

File Activities

File Opened

Show Windows behavior

Registry Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

COM Activities

WMI Operations

Show Windows behavior

Process Activities

Process Created

Process Terminated

Show Windows behavior

Thread Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Memory Activities

Memory Usage Statistics

Show Windows behavior

Timing Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Windows UI Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Process Token Activities

Token Adjusted

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6524, Parent PID: 6296

Function Logs

General

Target ID:	1
Start time:	11:03:12
Start date:	23/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2076,i,8663513068485825617,9074641674287346812,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:3
Imagebase:	0x7ff77eaf0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

File Activities

File Opened

Show Windows behavior

Thread Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Memory Activities

Memory Usage Statistics

Show Windows behavior

Timing Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 5504, Parent PID: 1864

Function Logs

General

Target ID:	2
Start time:	11:03:13
Start date:	23/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://forms.office.com/e/cKTtUPrCQw"
Imagebase:	0x7ff77eaf0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

File Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Process Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Memory Activities

Memory Usage Statistics

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://forms.office.com/e/cKTtUPrCQw

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

Windows Analysis Report
https://forms.office.com/e/cKTtUPrCQw