Edit tour

Windows Analysis Report
Duo Security Enrollment.eml

Overview

General Information

Sample name:	Duo Security Enrollment.eml
Analysis ID:	1523559
MD5:	a823771b83c9451ab6b1c3b57e15edeb
SHA1:	5957ec904005784156339142e6f1305f0d56792a
SHA256:	5edce20c3c33e8f7b2f4f0f1c0b9c08ec6cf464c1bfe88851574b43a2871d200
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Creates a window with clipboard capturing capabilities

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Sigma detected: Office Macro File Download

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 1540 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Duo Security Enrollment.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 6528 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "D425C529-60C1-490C-80E7-D928799F2E41" "042A5341-4343-4029-B74A-D1D0E548CAF2" "1540" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 6344 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3600 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1856,i,8083216875807871860,9760922534198285399,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 1540, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\SearchToolbarsDisabled

Sigma detected: Office Macro File Download

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 1540, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm

Sigma detected: Office Macro File Creation

Source: File created

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV	HTTP Parser: No favicon
Source: https://api-5092fa72.duosecurity.com/frame/enroll?sid=frameless	HTTP Parser: No favicon

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.16:49710 version: TLS 1.2

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=KzKDlhYekoLUXpa&MD=gPr39eHA HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /frame/static/v4/Portal.css HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYVAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/shared/js/errors.js?v=d10d2 HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYVAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/v4/Portal.js?v=cfaf2 HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYVAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/shared/js/errors.js?v=d10d2 HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/v4/Portal.js?v=cfaf2 HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/css/normalize.css?v=a674e HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYVAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/fonts/ss-standard/ss-standard.css?v=a8885 HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYVAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/css/fonts/duo-admin.css?v=50a8a HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYVAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/css/v3/base.css?v=9a14c HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYVAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/css/tipsy.css?v=4217a HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYVAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/shared/lib/jquery/jquery-prologue.js?v=400dc HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYVAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/img/duo-cisco-logo-green.png?v=437f1 HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYVAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/fonts/duo-admin/duo-admin.woff HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://api-5092fa72.duosecurity.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://api-5092fa72.duosecurity.com/frame/static/css/fonts/duo-admin.css?v=50a8aAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/shared/lib/jquery/jquery.min.js?v=ff152 HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYVAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/shared/lib/jquery/jquery-prologue.js?v=400dc HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/shared/lib/he/he.min.js?v=aaa33 HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYVAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/js/lib/jquery-postmessage.min.js?v=98c73 HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYVAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/shared/lib/lodash/lodash.min.js?v=6585f HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYVAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/img/duo-cisco-logo-green.png?v=437f1 HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/shared/lib/backbone/backbone-min.js?v=e0ff6 HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYVAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/js/lib/jquery-postmessage.min.js?v=98c73 HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/js/page/v3/frame.js?v=aaf8c HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYVAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/js/page/v3/base.js?v=fff81 HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYVAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/shared/lib/jquery/jquery.min.js?v=ff152 HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/shared/lib/validator/validator.min.js?v=9a068 HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYVAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/shared/lib/jquery/jquery-epilogue.js?v=c4ac5 HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYVAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/shared/lib/he/he.min.js?v=aaa33 HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/shared/lib/lodash/lodash.min.js?v=6585f HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/js/page/v3/trigger-endpointhealth-verification.js?v=e90e7 HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYVAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/js/lib/jquery.tipsy.js?v=c0432 HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYVAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/shared/lib/backbone/backbone-min.js?v=e0ff6 HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/js/page/v3/frame.js?v=aaf8c HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/js/page/v3/prompt.js?v=69acc HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYVAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/shared/lib/validator/validator.min.js?v=9a068 HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/shared/lib/jquery/jquery-epilogue.js?v=c4ac5 HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/js/page/v3/base.js?v=fff81 HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/js/lib/jquery.tipsy.js?v=c0432 HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/js/page/v3/trigger-endpointhealth-verification.js?v=e90e7 HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/static/js/page/v3/prompt.js?v=69acc HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /frame/enroll?sid=frameless HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYVAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: api-5092fa72.duosecurity.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://api-5092fa72.duosecurity.com/frame/enroll?sid=framelessAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"

Source: global traffic	DNS traffic detected: DNS query: api-5092fa72.duosecurity.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4762Host: login.live.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Duo/1.0Date: Tue, 01 Oct 2024 17:04:00 GMTContent-Type: text/htmlContent-Length: 550Connection: close

Source: chromecache_157.12.dr, chromecache_189.12.dr	String found in binary or memory: http://benalman.com/about/license/
Source: chromecache_157.12.dr, chromecache_189.12.dr	String found in binary or memory: http://benalman.com/projects/jquery-postmessage-plugin/
Source: chromecache_186.12.dr	String found in binary or memory: http://nicolasgallagher.com/micro-clearfix-hack/
Source: chromecache_168.12.dr, chromecache_178.12.dr	String found in binary or memory: http://underscorejs.org/LICENSE
Source: Duo Security Enrollment.eml, ~WRS{AC2E539E-9AB7-437E-89C7-6EA6311180E7}.tmp.0.dr	String found in binary or memory: https://aka.ms/LearnAboutSenderIdentification
Source: Duo Security Enrollment.eml	String found in binary or memory: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?c=
Source: ~WRS{AC2E539E-9AB7-437E-89C7-6EA6311180E7}.tmp.0.dr	String found in binary or memory: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54
Source: Duo Security Enrollment.eml	String found in binary or memory: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3D3183a500=
Source: chromecache_186.12.dr	String found in binary or memory: https://css-tricks.com/snippets/css/retina-display-media-query/
Source: chromecache_160.12.dr, chromecache_173.12.dr	String found in binary or memory: https://github.com/jaz303/tipsy/pull/169
Source: Duo Security Enrollment.eml	String found in binary or memory: https://guide.duo.com/enrol=
Source: ~WRS{AC2E539E-9AB7-437E-89C7-6EA6311180E7}.tmp.0.dr	String found in binary or memory: https://guide.duo.com/enrollment
Source: chromecache_168.12.dr, chromecache_178.12.dr	String found in binary or memory: https://lodash.com/
Source: chromecache_168.12.dr, chromecache_178.12.dr	String found in binary or memory: https://lodash.com/license
Source: chromecache_168.12.dr, chromecache_178.12.dr	String found in binary or memory: https://npms.io/search?q=ponyfill.
Source: chromecache_168.12.dr, chromecache_178.12.dr	String found in binary or memory: https://openjsf.org/
Source: Duo Security Enrollment.eml	String found in binary or memory: https://www.cisco.com/c/en/=
Source: Duo Security Enrollment.eml, ~WRS{AC2E539E-9AB7-437E-89C7-6EA6311180E7}.tmp.0.dr	String found in binary or memory: https://www.cisco.com/c/en/us/about/legal/privacy.html

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.16:49710 version: TLS 1.2

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: classification engine

Classification label: clean3.winEML@17/92@6/6

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241001T1303450010-1540.etl

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Duo Security Enrollment.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "D425C529-60C1-490C-80E7-D928799F2E41" "042A5341-4343-4029-B74A-D1D0E548CAF2" "1540" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1856,i,8083216875807871860,9760922534198285399,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "D425C529-60C1-490C-80E7-D928799F2E41" "042A5341-4343-4029-B74A-D1D0E548CAF2" "1540" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1856,i,8083216875807871860,9760922534198285399,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Jump to behavior

Source: Google Drive.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	2 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	1 Clipboard Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
https://npms.io/search?q=ponyfill.	0%	URL Reputation	safe
https://lodash.com/	0%	URL Reputation	safe
http://underscorejs.org/LICENSE	0%	URL Reputation	safe
https://lodash.com/license	0%	URL Reputation	safe
https://openjsf.org/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api-5092fa72.duosecurity.com	52.32.63.141	true	false		unknown
www.google.com	142.250.186.164	true	false		unknown

Contacted URLs

Name	Malicious	Reputation
https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV	false	unknown
https://api-5092fa72.duosecurity.com/frame/static/css/normalize.css?v=a674e	false	unknown
https://api-5092fa72.duosecurity.com/frame/static/shared/js/errors.js?v=d10d2	false	unknown
https://api-5092fa72.duosecurity.com/frame/static/shared/lib/he/he.min.js?v=aaa33	false	unknown
https://api-5092fa72.duosecurity.com/frame/static/shared/lib/lodash/lodash.min.js?v=6585f	false	unknown
https://api-5092fa72.duosecurity.com/favicon.ico	false	unknown
https://api-5092fa72.duosecurity.com/frame/static/shared/lib/validator/validator.min.js?v=9a068	false	unknown
https://api-5092fa72.duosecurity.com/frame/static/js/lib/jquery.tipsy.js?v=c0432	false	unknown
https://api-5092fa72.duosecurity.com/frame/static/js/page/v3/prompt.js?v=69acc	false	unknown
https://api-5092fa72.duosecurity.com/frame/static/shared/lib/jquery/jquery-epilogue.js?v=c4ac5	false	unknown
https://api-5092fa72.duosecurity.com/frame/static/css/v3/base.css?v=9a14c	false	unknown
https://api-5092fa72.duosecurity.com/frame/static/fonts/duo-admin/duo-admin.woff	false	unknown
https://api-5092fa72.duosecurity.com/frame/static/img/duo-cisco-logo-green.png?v=437f1	false	unknown
https://api-5092fa72.duosecurity.com/frame/static/shared/lib/jquery/jquery.min.js?v=ff152	false	unknown
https://api-5092fa72.duosecurity.com/frame/static/js/page/v3/base.js?v=fff81	false	unknown
https://api-5092fa72.duosecurity.com/frame/static/v4/Portal.js?v=cfaf2	false	unknown
https://api-5092fa72.duosecurity.com/frame/static/v4/Portal.css	false	unknown
https://api-5092fa72.duosecurity.com/frame/static/fonts/ss-standard/ss-standard.css?v=a8885	false	unknown
https://api-5092fa72.duosecurity.com/frame/static/js/page/v3/frame.js?v=aaf8c	false	unknown
https://api-5092fa72.duosecurity.com/frame/static/css/fonts/duo-admin.css?v=50a8a	false	unknown
https://api-5092fa72.duosecurity.com/frame/static/shared/lib/backbone/backbone-min.js?v=e0ff6	false	unknown
https://api-5092fa72.duosecurity.com/frame/static/css/tipsy.css?v=4217a	false	unknown
https://api-5092fa72.duosecurity.com/frame/static/js/page/v3/trigger-endpointhealth-verification.js?v=e90e7	false	unknown
https://api-5092fa72.duosecurity.com/frame/static/shared/lib/jquery/jquery-prologue.js?v=400dc	false	unknown
https://api-5092fa72.duosecurity.com/frame/static/js/lib/jquery-postmessage.min.js?v=98c73	false	unknown
https://api-5092fa72.duosecurity.com/frame/enroll?sid=frameless	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://npms.io/search?q=ponyfill.	chromecache_168.12.dr, chromecache_178.12.dr	false	URL Reputation: safe	unknown
https://guide.duo.com/enrol=	Duo Security Enrollment.eml	false		unknown
https://github.com/jaz303/tipsy/pull/169	chromecache_160.12.dr, chromecache_173.12.dr	false		unknown
https://lodash.com/	chromecache_168.12.dr, chromecache_178.12.dr	false	URL Reputation: safe	unknown
http://benalman.com/projects/jquery-postmessage-plugin/	chromecache_157.12.dr, chromecache_189.12.dr	false		unknown
https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?c=	Duo Security Enrollment.eml	false		unknown
https://guide.duo.com/enrollment	~WRS{AC2E539E-9AB7-437E-89C7-6EA6311180E7}.tmp.0.dr	false		unknown
https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3D3183a500=	Duo Security Enrollment.eml	false		unknown
http://benalman.com/about/license/	chromecache_157.12.dr, chromecache_189.12.dr	false		unknown
https://aka.ms/LearnAboutSenderIdentification	Duo Security Enrollment.eml, ~WRS{AC2E539E-9AB7-437E-89C7-6EA6311180E7}.tmp.0.dr	false		unknown
http://underscorejs.org/LICENSE	chromecache_168.12.dr, chromecache_178.12.dr	false	URL Reputation: safe	unknown
https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54	~WRS{AC2E539E-9AB7-437E-89C7-6EA6311180E7}.tmp.0.dr	false		unknown
https://css-tricks.com/snippets/css/retina-display-media-query/	chromecache_186.12.dr	false		unknown
https://lodash.com/license	chromecache_168.12.dr, chromecache_178.12.dr	false	URL Reputation: safe	unknown
https://www.cisco.com/c/en/=	Duo Security Enrollment.eml	false		unknown
http://nicolasgallagher.com/micro-clearfix-hack/	chromecache_186.12.dr	false		unknown
https://openjsf.org/	chromecache_168.12.dr, chromecache_178.12.dr	false	URL Reputation: safe	unknown
https://www.cisco.com/c/en/us/about/legal/privacy.html	Duo Security Enrollment.eml, ~WRS{AC2E539E-9AB7-437E-89C7-6EA6311180E7}.tmp.0.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.145.240.82	unknown	United States	16509	AMAZON-02US	false
52.32.63.141	api-5092fa72.duosecurity.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523559
Start date and time:	2024-10-01 19:03:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Duo Security Enrollment.eml
Detection:	CLEAN
Classification:	clean3.winEML@17/92@6/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .eml

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, SgrmBroker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.113.194.132, 2.19.126.151, 2.19.126.160, 142.250.186.131, 108.177.15.84, 172.217.18.110, 34.104.35.123, 20.42.65.93, 20.189.173.24
Excluded domains from analysis (whitelisted): ecs.office.com, omex.cdn.office.net, fs.microsoft.com, accounts.google.com, onedscolprdeus20.eastus.cloudapp.azure.com, slscr.update.microsoft.com, clientservices.googleapis.com, s-0005-office.config.skype.com, mobile.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, ecs-office.s-0005.s-msedge.net, clients2.google.com, edgedl.me.gvt1.com, s-0005.s-msedge.net, onedscolprdwus23.westus.cloudapp.azure.com, ecs.office.trafficmanager.net, clients.l.google.com, omex.cdn.office.net.akamaized.net, mobile.events.data.trafficmanager.net, a1864.dscd.akamai.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Duo Security Enrollment.eml

Input	Output
URL: https://api-5092fa72.duosecurity.com/frame/enroll?sid=frameless Model: jbxai	{ "brand":["CISCO", "Duo"], "contains_trigger_text":true, "trigger_text":"Protect Your MSPITP Internal Account", "prominent_button_name":"Start setup", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: Email Model: jbxai	{ "brand":["Duo Security"], "contains_trigger_text":true, "trigger_text":"To begin, click this link to enroll a phone, tablet, or other device:", "prominent_button_name":"enroll", "text_input_field_labels":["phone", "tablet", "other device"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	file.exe	Get hash	malicious	Credential Flusher	Browse
	moba-24.2-installer_M64ZB-1.exe	Get hash	malicious	PureLog Stealer	Browse
	Audio_Msg..00299229202324Transcript.html	Get hash	malicious	Unknown	Browse
	https://bit.ly/4eqfXtg	Get hash	malicious	Unknown	Browse
	$R3ET6JM.htm	Get hash	malicious	Unknown	Browse
	moba-24.2-installer_M64ZB-1.exe	Get hash	malicious	PureLog Stealer	Browse
	https://wetransfer.com/downloads/fc718a7028ccd1e273879a61c0883fe420241001145250/8110e2eb5f5a56cc2015d1b3243d9b3120241001145309/33d289?trk=TRN_TDL_01&utm_campaign=TRN_TDL_01&utm_medium=email&utm_source=sendgrid	Get hash	malicious	HTMLPhisher	Browse
	https://k7qo.sarnerholz.cam/APRjVfmk	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	ELECTRONIC RECEIPT_Opcsa.html	Get hash	malicious	EvilProxy, HTMLPhisher	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	moba-24.2-installer_M64ZB-1.exe	Get hash	malicious	PureLog Stealer	Browse	52.30.160.207
	Audio_Msg..00299229202324Transcript.html	Get hash	malicious	Unknown	Browse	3.71.149.231
	moba-24.2-installer_M64ZB-1.exe	Get hash	malicious	PureLog Stealer	Browse	52.213.197.159
	https://wetransfer.com/downloads/fc718a7028ccd1e273879a61c0883fe420241001145250/8110e2eb5f5a56cc2015d1b3243d9b3120241001145309/33d289?trk=TRN_TDL_01&utm_campaign=TRN_TDL_01&utm_medium=email&utm_source=sendgrid	Get hash	malicious	HTMLPhisher	Browse	18.245.46.109
	https://www.dropbox.com/l/scl/AADL_v5DzsoHwkyegIhk6J0bQm3A7UWklCA	Get hash	malicious	Unknown	Browse	52.28.39.231
	https://k7qo.sarnerholz.cam/APRjVfmk	Get hash	malicious	Unknown	Browse	18.195.235.189
	https://pt9w4x.nauleacepr.com/9QLzRhIr/#Ygovernment.relations@rolls-royce.com	Get hash	malicious	HTMLPhisher	Browse	18.245.86.73
	https://vwkugoia0yciq0buttompanj2.ntvultra.com/viciorhthvgh/forhwural/coupletri/QdhahVchT/yEjbKM/anNhbGFzQGhvbGxhbmRjby5jb20=	Get hash	malicious	HTMLPhisher	Browse	13.33.187.96
	document.exe	Get hash	malicious	FormBook	Browse	13.248.252.114
	https://links.rasa.io/v1/t/eJx1kM2OgjAUhV_FsB6kpUXQ1bzAuJp9c2mvTI1Q0tvGEMO7DzCKC51t73d-em5J9JfksEl-QujpkGXR19A13sUet9q1W4iZJko-NkmLAQwEmOhbQi56jbPwiFe6YAjoXyBswS7mBiwN2nVXGCSTn838PrvPCg8EqkUiaFCFoV9Na2_x9I0Uvv6OK0yxPqMO6tlhsmpjZ8OgppCTbaKHYF33IFflk7Nm1u3LUgDjp5QXRqZ1qU0KOYNUij0T1U7ntaxeOhJ2Rk1_XJJzlsuUs5TxlfOonTf3BF5UohBl9aZCj56mjv9wjzQfV0TIXck5E_I9RBTxjh5dt8wFtQrTgMr18xzrZRzHX-Cephc=#a2FyZW4ubW9vbmV5QGJhbGxhcmRkZXNpZ25zLm5ldA==	Get hash	malicious	HTMLPhisher	Browse	3.5.130.130
AMAZON-02US	moba-24.2-installer_M64ZB-1.exe	Get hash	malicious	PureLog Stealer	Browse	52.30.160.207
	Audio_Msg..00299229202324Transcript.html	Get hash	malicious	Unknown	Browse	3.71.149.231
	moba-24.2-installer_M64ZB-1.exe	Get hash	malicious	PureLog Stealer	Browse	52.213.197.159
	https://wetransfer.com/downloads/fc718a7028ccd1e273879a61c0883fe420241001145250/8110e2eb5f5a56cc2015d1b3243d9b3120241001145309/33d289?trk=TRN_TDL_01&utm_campaign=TRN_TDL_01&utm_medium=email&utm_source=sendgrid	Get hash	malicious	HTMLPhisher	Browse	18.245.46.109
	https://www.dropbox.com/l/scl/AADL_v5DzsoHwkyegIhk6J0bQm3A7UWklCA	Get hash	malicious	Unknown	Browse	52.28.39.231
	https://k7qo.sarnerholz.cam/APRjVfmk	Get hash	malicious	Unknown	Browse	18.195.235.189
	https://pt9w4x.nauleacepr.com/9QLzRhIr/#Ygovernment.relations@rolls-royce.com	Get hash	malicious	HTMLPhisher	Browse	18.245.86.73
	https://vwkugoia0yciq0buttompanj2.ntvultra.com/viciorhthvgh/forhwural/coupletri/QdhahVchT/yEjbKM/anNhbGFzQGhvbGxhbmRjby5jb20=	Get hash	malicious	HTMLPhisher	Browse	13.33.187.96
	document.exe	Get hash	malicious	FormBook	Browse	13.248.252.114
	https://links.rasa.io/v1/t/eJx1kM2OgjAUhV_FsB6kpUXQ1bzAuJp9c2mvTI1Q0tvGEMO7DzCKC51t73d-em5J9JfksEl-QujpkGXR19A13sUet9q1W4iZJko-NkmLAQwEmOhbQi56jbPwiFe6YAjoXyBswS7mBiwN2nVXGCSTn838PrvPCg8EqkUiaFCFoV9Na2_x9I0Uvv6OK0yxPqMO6tlhsmpjZ8OgppCTbaKHYF33IFflk7Nm1u3LUgDjp5QXRqZ1qU0KOYNUij0T1U7ntaxeOhJ2Rk1_XJJzlsuUs5TxlfOonTf3BF5UohBl9aZCj56mjv9wjzQfV0TIXck5E_I9RBTxjh5dt8wFtQrTgMr18xzrZRzHX-Cephc=#a2FyZW4ubW9vbmV5QGJhbGxhcmRkZXNpZ25zLm5ldA==	Get hash	malicious	HTMLPhisher	Browse	3.5.130.130

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Credential Flusher	Browse	184.28.90.27 40.126.32.68 20.114.59.183
	https://bit.ly/4eqfXtg	Get hash	malicious	Unknown	Browse	184.28.90.27 40.126.32.68 20.114.59.183
	$R3ET6JM.htm	Get hash	malicious	Unknown	Browse	184.28.90.27 40.126.32.68 20.114.59.183
	https://k7qo.sarnerholz.cam/APRjVfmk	Get hash	malicious	Unknown	Browse	184.28.90.27 40.126.32.68 20.114.59.183
	file.exe	Get hash	malicious	Credential Flusher	Browse	184.28.90.27 40.126.32.68 20.114.59.183
	ELECTRONIC RECEIPT_Opcsa.html	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	184.28.90.27 40.126.32.68 20.114.59.183
	file.exe	Get hash	malicious	Credential Flusher	Browse	184.28.90.27 40.126.32.68 20.114.59.183
	Play_VM-Now(Tina.lawvey)CQDM.html	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 40.126.32.68 20.114.59.183
	https://www.dropbox.com/l/scl/AADL_v5DzsoHwkyegIhk6J0bQm3A7UWklCA	Get hash	malicious	Unknown	Browse	184.28.90.27 40.126.32.68 20.114.59.183
	https://k7qo.sarnerholz.cam/APRjVfmk	Get hash	malicious	Unknown	Browse	184.28.90.27 40.126.32.68 20.114.59.183

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	245980
Entropy (8bit):	4.206818358329128
Encrypted:	false
SSDEEP:	3072:XEIgT7jgBmiGu2jqoQort0Fv4OLvvAD1v:UTImi22TLvvADB
MD5:	ED5B6D9B99D825B986AF7590D90A612F
SHA1:	57E73DD9DC9816F58A7A644D3CFFA814E45132B7
SHA-256:	7A7943E273894EC7C4FF6C99E24B091A001E82A36C99B1DED46374C15AC83BB5
SHA-512:	A1572EC33B407A8628725F6AE3FFEF663137DC8B0D6EAE13AFE653DB657CD49DF6FC649F20F933A3DC8CF839A464F7B200C00A9CA2F4AC057189C1565031D850
Malicious:	false
Reputation:	low
Preview:	TH02...... .@^{.#.......SM01........0...#...........IPM.TaskRequest.Decline........h...............h............H..h........B....h........hI..H..h\cal ...pDat...h.?..0...@......h+Y.............h........_`Pk...hgZ..H...I.lw...h....P...8.Uk...0....\...............l.........2h...............k .............!h.............. h..G.....X.....#h....8.........$hhI......@....."h@.............'h..............1h+Y............0h.........Uk../h..........UkH..hx... ........-h ...0.........+h.Y..4...................... ..............FS..............FIPM.TaskRequest.Decline.Form.d.dStandard.PM.Task Decline.PM.IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1111110000000000.icrMicrosoft.isThis form is used to decline a task request.........kf...... ..........&...........(.......(... ...@...............................................................................................................................D@..............D@x.............DG...p..........DH..www.wwp.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	322260
Entropy (8bit):	4.000299760592446
Encrypted:	false
SSDEEP:	6144:dztCFLNyoAHq5Rv2SCtUTnRe4N2+A/3oKBL37GZbTSB+pMZIrh:HMLgvKz9CtgRemO3oUHi3SBSMZIl
MD5:	CC90D669144261B198DEAD45AA266572
SHA1:	EF164048A8BC8BD3A015CF63E78BDAC720071305
SHA-256:	89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
SHA-512:	16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.6464393446710157
Encrypted:	false
SSDEEP:	3:LCXXG:m2
MD5:	1A3516F197F1DB5BC512F725A0597988
SHA1:	E46627A882C955A41734D98E855FE1F7825DE9D3
SHA-256:	87D80FB0C1A3749A0D456C2F6C5405576C363F230AAA71C6D84C880CAFAFDF93
SHA-512:	3BD1CEAC6092DF55E4F62212BCC2254BC86AD213A6682A56365BB81D7D22D53255A6E995A9B6602304087B5D6A9D9765D83A2B40D10964CB2BE2D43697912CDD
Malicious:	false
Reputation:	low
Preview:	1727802234

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.CampaignStates.json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	1538
Entropy (8bit):	5.170046666246265
Encrypted:	false
SSDEEP:	48:YZVrmf/x1AUzXemmf/x14Uz6QA/x1prTyzx:xfp1AUzuZfp14UzFAp1prTyzx
MD5:	F903C4A051E8AA36E9E085B08D1BC55E
SHA1:	FF9AF9BBA28D4F3FF2238A64425CABE8123250AB
SHA-256:	59D97433D58543D3CAE4BFDF9AC0DC6990A99BFB10D118B0D62D32DA15D30968
SHA-512:	7B9A526C71B8DF94CF6556AB827C07E2265ACF6F81B4A12B3303ACCD6601C92735ECAA0F4AD5DC054FD1E7EA19B29FC220F41213822CD04E71DC27FDA8C9027B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{"CampaignStates":[{"CampaignId":"398f8b35-ef06-4a2b-a5dc-d85540d6fff3","LastNominationTimeUtc":"2023-10-06T09:25:18Z","LastNominationBuildNumber":"16.0.16827.20130","DeleteAfterSecondsWhenStale":31536000,"ForceCandidacy":false,"IsCandidate":true,"DidCandidateTriggerSurvey":false,"LastSurveyActivatedTimeUtc":"1601-01-01T00:00:00Z","LastSurveyId":"7e1f72bd-2c13-423b-93cf-2786588bccbb","LastSurveyStartTimeUtc":"2023-10-06T09:25:18Z","LastSurveyExpirationTimeUtc":"2024-10-05T09:25:18Z","LastCooldownEndTimeUtc":"1601-01-01T00:00:00Z"},{"CampaignId":"8a42827d-29d2-473e-998e-3217724c5b68","LastNominationTimeUtc":"2023-10-06T09:25:18Z","LastNominationBuildNumber":"16.0.16827.20130","DeleteAfterSecondsWhenStale":31536000,"ForceCandidacy":false,"IsCandidate":true,"DidCandidateTriggerSurvey":false,"LastSurveyActivatedTimeUtc":"1601-01-01T00:00:00Z","LastSurveyId":"0bb7f335-0b8a-4926-bb93-540e4e5b86c8","LastSurveyStartTimeUtc":"2023-10-06T09:25:18Z","LastSurveyExpirationTimeUtc":"2024-10-05T09:25

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.GovernedChannelStates.json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	4.578658879460996
Encrypted:	false
SSDEEP:	12:Ym6dnG20cYIyJG20c6IfG20c6IGG20cDIZG20cdI2ayG20cgaIbnG20cIQPIKG2X:YddnUcYIyJUc6IfUc6IGUcDIZUcdIFy0
MD5:	439A34DE8DA5C04AF25AADB84A2120D4
SHA1:	F12F9FF6E03A5762BD03061557029446680B1DAE
SHA-256:	32B560C75C25C6F56C0439F67A3FA7D4F271F07B435EE41575A3D82C6C612880
SHA-512:	BE704CD0DF8041945D16B8103135650B33D5E97D6F7C202E9C9499C3AE57E33855C2CC3A8F73B578DB482F47026C756F1FAA411A2CC58B5E53CE23CD24229834
Malicious:	false
Preview:	{"ChannelStates":[{"ChannelType":0,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":1209600},{"ChannelType":1,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":0},{"ChannelType":2,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":0},{"ChannelType":3,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":3600},{"ChannelType":4,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":10800},{"ChannelType":5,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":7776000},{"ChannelType":6,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":1800},{"ChannelType":7,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":0},{"ChannelType":8,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":1209600}]}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.Settings.json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	87
Entropy (8bit):	4.576828956814449
Encrypted:	false
SSDEEP:	3:Y2NKbNCOAqui32B0fkWbSpgLGwHY:Y2YZOUU0ffogaw4
MD5:	E4E83F8123E9740B8AA3C3DFA77C1C04
SHA1:	5281EAE96EFDE7B0E16A1D977F005F0D3BD7AAD0
SHA-256:	6034F27B0823B2A6A76FE296E851939FD05324D0AF9D55F249C79AF118B0EB31
SHA-512:	BD6B33FD2BBCE4A46991BC0D877695D16F7E60B1959A0DEFC79B627E569E5C6CAC7B4AD4E3E1D8389A08584602A51CF84D44CF247F03BEB95F7D307FBBA12BB9
Malicious:	false
Preview:	{"ShouldFloodgateTakePrecedenceOverRateAndReview":false,"AreRatingSurveysEnabled":true}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.SurveyEventActivityStats.json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.SurveyHistoryStats.json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.045666606901247804
Encrypted:	false
SSDEEP:	3:Gtlxtjlk+bjb4lxtjlk+bjDtljR9//8l1lvlll1lllwlvlllglbelDbllAlldl+l:GtE+fkE+fJ9X01PH4l942wU
MD5:	85719662C6ECE7EEEF86FB75993FB02A
SHA1:	8AA5BFA12CE8A735CBF6B10A54E6B0E2DC3CCF3D
SHA-256:	60B4A686330672D21F43F57D419461FBC81A55979E2F0607F07E0E4929C46CC3
SHA-512:	C4937B56F674A639C81F45BF0500F73DE98611F1FD95F185EDBCE8E883F2507CBD73CD95E67F68A1A543A0C2ED55600D5F1E01B40D0AD11E3BEF6AF066036E9E
Malicious:	false
Preview:	..-......................l..U.$.u..^...G..$....-......................l..U.$.u..^...G..$..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	49472
Entropy (8bit):	0.48562418017439174
Encrypted:	false
SSDEEP:	48:zCQ1OsUll7DYM1zO8VFDYMn2BO8VFDYML:J4fll4ijVGCcjVGC
MD5:	A67BFB4F5234E1302C8E57E08360476F
SHA1:	6C27DCC6EA5598B71B3E8DAA514063494F4A8856
SHA-256:	14C308453568834AC6E27A4A5577082FD9BEF9DE8BBFA076E6607C3555D0413B
SHA-512:	9BDA27A04D70FB29F81AF7A8CECF63CFF1E413E1F0A15FB2AFA02AAFD66561442706356E49A731F48FF5C5199CBCB52DEF0B2CA7F6D1B4425C4E8A9ECE0A67DA
Malicious:	false
Preview:	7....-..........u..^....{.6...........u..^..."6......SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{AC2E539E-9AB7-437E-89C7-6EA6311180E7}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	4052
Entropy (8bit):	3.4728065781827966
Encrypted:	false
SSDEEP:	96:cKV257GdHe4LbLcsLKaDStKXVStKxzirc:9C7/UX7OtKstKac
MD5:	5DBAC2D1525007D5D1679F9588CBDF0A
SHA1:	EA75458AFAABF9B3C04AC3065E52388BA09C1EA9
SHA-256:	37A7C13D9092EE0295730556D4234E88B4A52D802530273656C47405E4B043FE
SHA-512:	B8AD13EBFD39071C8B6571E91D46A43E8F26F5CDF5D16A7D5413B7D3317DC2457E3AB41628985A6166E9114AAED838A71A6E70B19EBF88453716BAE8DD648C18
Malicious:	false
Preview:	......Y.o.u. .d.o.n.'.t. .o.f.t.e.n. .g.e.t. .e.m.a.i.l. .f.r.o.m. .n.o.-.r.e.p.l.y.@.d.u.o.s.e.c.u.r.i.t.y...c.o.m... .H.Y.P.E.R.L.I.N.K. .".h.t.t.p.s.:././.a.k.a...m.s./.L.e.a.r.n.A.b.o.u.t.S.e.n.d.e.r.I.d.e.n.t.i.f.i.c.a.t.i.o.n.".......................................................................................................................................................................................................................................................................................................................................B.............................................................................................................................................................................................................................................................................................................$..$.If....:V.......t.....6......4........4........a.............$..dh...a$.*...$..$.If........!v..h.#v....:V.......t.....6......5.......4

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1727802231175321100_C07B0954-4273-4D4D-922B-457ADD72F429.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (28779), with CRLF line terminators
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.17658256338567027
Encrypted:	false
SSDEEP:	1536:zSiu7DT+T33G/y8c+iku2Cj1XZuedAj6bE6FxM/BJOT9hHBFWZ3NOw:GDi7G/UAwRHOjJNO
MD5:	C667BC925461619D078F053245B24F55
SHA1:	480099ACED92E6F61B41B41F949971A7F746FDC3
SHA-256:	CC18DCCEC0CB3684D0F72956967C4E67890FDE0D9FE67194F976352BC8A39A4F
SHA-512:	70484B0B096D715E9553EFEC84953A32E3A78C020F142F8AA4F3530F5883B6A04F92CE45B4872ED49CEF8C6FEB090FE6D2744D18B7FF51AE233C19F7684EEED4
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/01/2024 17:03:51.197.OUTLOOK (0x604).0x728.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":27,"Time":"2024-10-01T17:03:51.197Z","Contract":"Office.System.Activity","Activity.CV":"VAl7wHNCTU2SK0V63XL0KQ.4.11","Activity.Duration":12,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...10/01/2024 17:03:51.229.OUTLOOK (0x604).0x728.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":29,"Time":"2024-10-01T17:03:51.229Z","Contract":"Office.System.Activity","Activity.CV":"VAl7wHNCTU2SK0V63XL0KQ.4.12","Activity.Duration":10072,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorVers

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1727802231175906200_C07B0954-4273-4D4D-922B-457ADD72F429.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241001T1303450010-1540.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	4.463176453726215
Encrypted:	false
SSDEEP:	768:N6xSHQkIBJsfftu8E24rIAofsZ9xjSj+/PxXawPOwPCDs:ogK24FZ9xjSiXxX7Pp
MD5:	C1791E07974B6E6B902B1FF69FCB1936
SHA1:	51BEBEA0AFF0754469123055803AF75D06CE70B9
SHA-256:	7BB37D39455AD74D01FE6E9AA0830085528AA26E5B659FFCE7F2DE8907193E83
SHA-512:	940A5C638DE8C512BE8594FA80298B4D1C1C2896E0A1BEC01E1B6E646094F24DDF0A7DAB6127AB0E429BB276404BC9F272AC50C66DF714DB3939BB223FDFE031
Malicious:	false
Preview:	............................................................................^...(...........#...................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1.............................................................`..Y..............#...........v.2._.O.U.T.L.O.O.K.:.6.0.4.:.2.9.1.4.7.2.1.7.f.b.9.f.4.2.0.6.b.c.9.3.d.9.5.4.a.a.9.e.5.e.1.d...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.0.1.T.1.3.0.3.4.5.0.0.1.0.-.1.5.4.0...e.t.l.........P.P.(...........#...........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF4DFD3A9C0D157725.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3613836054883338
Encrypted:	false
SSDEEP:	3:YmsalTlLPltl2N81HRQjlORGt7RQ//W1XR9//3R9//3R9//:rl912N0xs+CFQXCB9Xh9Xh9X
MD5:	679672A5004E0AF50529F33DB5469699
SHA1:	427A4EC3281C9C4FAEB47A22FFBE7CA3E928AFB0
SHA-256:	205D000AA762F3A96AC3AD4B25D791B5F7FC8EFB9056B78F299F671A02B9FD21
SHA-512:	F8615C5E5CF768A94E06961C7C8BEF99BEB43E004A882A4E384F5DD56E047CA59B963A59971F78DCF4C35D1BB92D3A9BC7055BFA3A0D597635DE1A9CE06A3476
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF56DDA899FBEA8372.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:	3:X6s7v:qs7
MD5:	DC5367560160634BE77013ACFFA6A35F
SHA1:	1D0D2C32BE7EE5D332EA31AA17A21219ACB6599D
SHA-256:	C405D2D40F1311038478C5F3563EF39F5640BA6CA31F3CE835FB94D252D90189
SHA-512:	514A6A0156015B2C6CA8D5914CB4FC0731D888CEE1D41E1B03FFA76CFCCE2B1D339249276FAC8F095AF184A76A17CC28DCB421211002A81C3201E9FDECE1D3D1
Malicious:	false
Preview:	.... .........................

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.0229276291886724
Encrypted:	false
SSDEEP:	12:rl3baF+cqLKeTy2MyheC8T23BMyhe+S7wzQe9zNMyhe+S7xMyheCJCp5wXl:rtvmnq1Pj961kzkl
MD5:	B99C5442C3A635CE5D8DD8A128192337
SHA1:	DC2548E695E3E797AC2EBBB294C35CD85F6AC07B
SHA-256:	A209B7BF9528A9BEA6C361E2B60A561B5CB8819CDBDA29EA7055B4466D337C61
SHA-512:	5694463BE1B1E7676722019DC6A46CDC9A006FDD6A122C79944DFA4FB8E22B93B4D6A48A3C6898AFC98429E2165D110B08E400D35FD74BF989623CBC5AC59107
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Templates\NormalEmail.dotm (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	19606
Entropy (8bit):	7.476177758321446
Encrypted:	false
SSDEEP:	384:Jrt+xRLymSajsy0aqtVzSCw/vhB7nGUPWeBAFY91:VywGvHqtVNwBtGU+eh1
MD5:	FA61033B570558E89A6C7FBAEDA02FEE
SHA1:	B5521CEAD6AAF3A0E4B9CC2BB15BD9C8094B0261
SHA-256:	792D4E3E504E929C0197EFE14503CD543A52961B861027DC996F97701BCA0E36
SHA-512:	BFDC6216DBFE139BF6FE2D3D1CBC26664AE7E9DE2250D16B7E87AA21B14506F96869E67FCA8F7E19219B68072BF8EDC5F81C0BE8FE75653CA7073D51A282317C
Malicious:	false
Preview:	PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R.D.g..3.H....M!`.l.....J.j;...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	modified
Size (bytes):	162
Entropy (8bit):	3.7097579621477075
Encrypted:	false
SSDEEP:	3:8lZlYlQkne9H7eIlKXjl/dA9Yh/l78Nf1fA6/:0Zi+SaeYWh58V1fA6/
MD5:	4F1443BE8030A976A2EB71D46B7C2747
SHA1:	D91FC349ED24FCC3FD0A4C0ABDA95B886F0EE123
SHA-256:	A787D29404264EECEEE3EEA898735B6F9F85C380C76A912D0C7DAE41604BE7FD
SHA-512:	BBD10819FE40BDF198639631D38561BE441C5C15038EB90015B6FDF24DE38FE31D90EA1013786F83DC1A0FBD038CA4491BFEDFF973861149F274CD6ABE2A78E2
Malicious:	false
Preview:	.user...................................................c.a.l.i...4G...<.u....x13...{..]..Xz@dM....G.....b....x13...{..n......#...#..M............#..x13.H]...n..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	19606
Entropy (8bit):	7.476177758321446
Encrypted:	false
SSDEEP:	384:Jrt+xRLymSajsy0aqtVzSCw/vhB7nGUPWeBAFY91:VywGvHqtVNwBtGU+eh1
MD5:	FA61033B570558E89A6C7FBAEDA02FEE
SHA1:	B5521CEAD6AAF3A0E4B9CC2BB15BD9C8094B0261
SHA-256:	792D4E3E504E929C0197EFE14503CD543A52961B861027DC996F97701BCA0E36
SHA-512:	BFDC6216DBFE139BF6FE2D3D1CBC26664AE7E9DE2250D16B7E87AA21B14506F96869E67FCA8F7E19219B68072BF8EDC5F81C0BE8FE75653CA7073D51A282317C
Malicious:	false
Preview:	PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R.D.g..3.H....M!`.l.....J.j;...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 16:04:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9874002281853804
Encrypted:	false
SSDEEP:	48:8EdeT4LSgHiidAKZdA1FehwiZUklqehYy+3:8JcmRHy
MD5:	EEDE1DB179546FFA9E840B26C6BE0FA0
SHA1:	9746C042374E2C75495E379F374F9CD300E6D994
SHA-256:	5A74D90D7CDC4B4DD4A6AC24E136719737886DD5FE277A18688A55ECA88492BF
SHA-512:	CA2C3EE3CD4083126D61C29297C2396C9E155BB4F935A9717F9FF2BCC06C6799C68ED1FC95CC624CC10877094628D165F21BD1BF7196E8BDBB959A410555F2CA
Malicious:	false
Preview:	L..................F.@.. ...$+.,....3.3.#...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAYl.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAY}.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAY}.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAY}............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VAY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............I&......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 16:04:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.003625133175215
Encrypted:	false
SSDEEP:	48:8K0deT4LSgHiidAKZdA1seh/iZUkAQkqeh3y+2:8QcmH9QWy
MD5:	A4A65845ADBF90DDBAE50217AED839D0
SHA1:	85DD2617C6AACE891A7F29956476B37F29EC7841
SHA-256:	265CCA921A6063461753343326EB1747507ACA1A23DAEBF6748EF5A6CBE6EE70
SHA-512:	67151798EE3701BF805D1C16D01DBE00BDC5E2EA0EF2700136A86CE929D732B78CCD1B6CD2673203108FE39570672FAFDA12F583CA1AAF118F4E2D0E12BCA3FB
Malicious:	false
Preview:	L..................F.@.. ...$+.,....%.".#...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAYl.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAY}.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAY}.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAY}............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VAY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............I&......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.008992485436958
Encrypted:	false
SSDEEP:	48:8udeT4LSAHiidAKZdA14meh7sFiZUkmgqeh7s1y+BX:8zcmznDy
MD5:	3606440FCB8A3F5850AC46AD5FBF4DCB
SHA1:	DDF665780E63ACD2AF74CEA46936195D0769CF5F
SHA-256:	B32C93016C30DA6E068C5E1E77049CB64123EEADD44D6A88F60863B53416F4F1
SHA-512:	914A894DF6565D784593FB50E826503762231963910544387DDF316415AD51720338FCC1E6F33463958C36E79646197256859ACAEB1F7BAC26D63A0AF36395E4
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAYl.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAY}.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAY}.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAY}............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............I&......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 16:04:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.001080435377808
Encrypted:	false
SSDEEP:	48:8VdeT4LSgHiidAKZdA1TehDiZUkwqeh7y+R:8mcm0Ny
MD5:	4334E78C1811AC2CA7188864B7CCE1C5
SHA1:	7169247AED9679526095D423C9DF291A3DB243C2
SHA-256:	AB9EF5B7B1A7EA255A9A0B1AF9B15F2642143C966B4D3BDB0342413B8AD57945
SHA-512:	8831E9C1E178C2D6D2605C7F933B65504892DBA754791B70069576FA02ADB1244415E2D5DC1E5784F8D14C095CCB89799F60AA1B8C59C98CA6FAD8EA1DB679F5
Malicious:	false
Preview:	L..................F.@.. ...$+.,........#...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAYl.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAY}.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAY}.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAY}............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VAY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............I&......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 16:04:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9884576303092296
Encrypted:	false
SSDEEP:	48:89deT4LSgHiidAKZdA1dehBiZUk1W1qehxy+C:8Ocm09Ry
MD5:	2071BF988D62F4C23CD81A1238B0FE27
SHA1:	EDEC43247CE3497BC261EA3F52330BD60BDE6CC3
SHA-256:	2CFE4B1D240B9691B6AD83234E4B05FBFD3CFC49983A9EAE352178EDF7CAED7E
SHA-512:	413515CE50DABDBF816D25DFB9F3F1A30E921C6D41AAC75F1D72889CB3C3B17835646D53AAA6A2C6A3F4D93F0D1EA5DB60DA1DE6DD6F72EC0CA16F8F93EC4824
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....+.#...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAYl.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAY}.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAY}.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAY}............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VAY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............I&......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 16:04:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9980355961099256
Encrypted:	false
SSDEEP:	48:85deT4LSgHiidAKZdA1duTeehOuTbbiZUk5OjqehOuTbDy+yT+:8ScmGTfTbxWOvTbDy7T
MD5:	72A8AA3F95F2EAD70F1DB8B209EBA2AF
SHA1:	3C4BE07B86C8BC897A1AB92626C6E80E549D4017
SHA-256:	2EF2B55B15940F784F740E06ACB5CAE540BD2911E6B849971F8A7C1DAEB8F70F
SHA-512:	E84951B8F81DA123A690992D83A2CA556016BCDE29C5432C5141333E1668229F58231A824E884D94A0998F530E2F0CBC99766EE38B3391F10A159EB209FD164D
Malicious:	false
Preview:	L..................F.@.. ...$+.,....@H..#...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAYl.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAY}.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAY}.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAY}............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VAY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............I&......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	271360
Entropy (8bit):	1.4338868758541452
Encrypted:	false
SSDEEP:	1536:rTuuSH4LkExG3jDOoW53jEpEHP4qQ10PAwr1:nuvYL2mqp9
MD5:	C8D854922F7D66D683ACAB169527185F
SHA1:	AA1979F2085166C2C81D852061FD412648110C26
SHA-256:	68A33DC1FC78E24A59DF568B1D6FB5F3912A0A385600FE82CDA9203BFA93F523
SHA-512:	F7F03489CAEBA37130CD2BAB331F806569A4B03A2B98C762591589F88D1E2EACD5CC660361E85D92ACE6F7EA97C7FC77CEB86CF7E91D617BBA919E1C8CEBEB4F
Malicious:	false
Preview:	!BDNy..6SM......\...2...........\|.......T................@...........@...@...................................@...........................................................................$.......D.......(..............r........l......{...........................................................................................................................................................................................................................................................................................8........j.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	2.290879350234996
Encrypted:	false
SSDEEP:	1536:eO2BTQ3LAcGW53jEpEHP4qQ10PAwr1T9DO4:4gLAc0p9EU
MD5:	FE63FE8C8695D21D841378D3F8E9F340
SHA1:	3851E53DD17B6845777B90D748AC071FC639D0AC
SHA-256:	60F036CD3FB430E82F1F341E67DAA1033E796D81472B610CC338EA2A820C8DB1
SHA-512:	AA039A217DD3D75D0F0F8A76F464A95615AFA28D6E166F11D885BAECD3F309650104BB2638CD90A0D8D7EC019866E77BF1AD096C110EB5F1B33A7C0BFD2FC80E
Malicious:	false
Preview:	$...0...i............=..#........D............#.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................".Q$.D......H.Z.0...j............=..#........B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 153

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5613), with no line terminators
Category:	downloaded
Size (bytes):	5613
Entropy (8bit):	5.274360237354372
Encrypted:	false
SSDEEP:	96:fSTavNfV9inn87RcKssf1N7iPcztAtIVn67tDZXxSba/clU1rUcTI:fS2fDin87RcKsAN7iPe+6Vn67lMa/cld
MD5:	74345F6D79317E3A560C19367735259F
SHA1:	D2D20ADADC74001A24F26109E984AA168F4CA580
SHA-256:	9A0686D53A8640702855DB51E9B58A32F7EA2E076AD91373D1A67DD30C62DC80
SHA-512:	A3C9225A4AADD53752762AC07B6D95CBC4B20CD6A55C60B1F0959B1396549F8EBF5EF8FCBA91C4DCB25E02745593B371472C89F364C97C634E8112C808366B13
Malicious:	false
URL:	https://api-5092fa72.duosecurity.com/frame/static/shared/lib/validator/validator.min.js?v=9a068
Preview:	/! validatorjs - v1.3.2 - https://github.com/skaterdav85/validatorjs - 2015-02-11 /!function(){function a(){for(var b,c,d,e,f,g=arguments[0]\|\|{},h=1,i=arguments.length;i>h;h++)if(null!=(e=arguments[h]))for(d in e)b=g[d],c=e[d],g!==c&&(c&&"object"==typeof c?(f=b&&"object"==typeof b?b:{},g[d]=a(f,c)):void 0!==c&&(g[d]=c));return g}var b={accepted:"The :attribute must be accepted.",alpha:"The :attribute field must contain only alphabetic characters.",alpha_dash:"The :attribute field may only contain alpha-numeric characters, as well as dashes and underscores.",alpha_num:"The :attribute field must be alphanumeric.",confirmed:"The :attribute confirmation does not match.",email:"The :attribute format is invalid.",def:"The :attribute attribute has errors.",digits:"The :attribute must be :digits digits.",different:"The :attribute and :different must be different.","in":"The selected :attribute is invalid.",integer:"The :attribute must be an integer.",min:{numeric:"The :attribute must be at l

Chrome Cache Entry: 154

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19413)
Category:	dropped
Size (bytes):	19414
Entropy (8bit):	5.066655217952398
Encrypted:	false
SSDEEP:	384:dttVLP2seb444J3q0TophLZL+D9VVkxmGuhtQ9d7zavoDvWyvct:dtr/jametQt
MD5:	752B6162850F33D9F6BB715D39E5BC3B
SHA1:	12E3591409B341727CCBA4E1CF515B8EC84E79D4
SHA-256:	E0FF6C99C8C33330448F0E977F2FE67636ED3EA77481833CEACF2303819F0C7B
SHA-512:	065D4044A9D09A54020F8A4AE9C1E9A4407D8832BC27A8BDB6B264EC8F9383BE8A13B50B437E576E3C8CB855AB1DEFCC299CBDB81493701B71D5DECAF0146C12
Malicious:	false
Preview:	(function(){var t=this;var e=t.Backbone;var i=[];var r=i.push;var s=i.slice;var n=i.splice;var a;if(typeof exports!=="undefined"){a=exports}else{a=t.Backbone={}}a.VERSION="1.0.0";var h=t._;if(!h&&typeof require!=="undefined")h=require("underscore");a.$=t.jQuery\|\|t.Zepto\|\|t.ender\|\|t.$;a.noConflict=function(){t.Backbone=e;return this};a.emulateHTTP=false;a.emulateJSON=false;var o=a.Events={on:function(t,e,i){if(!l(this,"on",t,[e,i])\|\|!e)return this;this._events\|\|(this._events={});var r=this._events[t]\|\|(this._events[t]=[]);r.push({callback:e,context:i,ctx:i\|\|this});return this},once:function(t,e,i){if(!l(this,"once",t,[e,i])\|\|!e)return this;var r=this;var s=h.once(function(){r.off(t,s);e.apply(this,arguments)});s._callback=e;return this.on(t,s,i)},off:function(t,e,i){var r,s,n,a,o,u,c,f;if(!this._events\|\|!l(this,"off",t,[e,i]))return this;if(!t&&!e&&!i){this._events={};return this}a=t?[t]:h.keys(this._events);for(o=0,u=a.length;o<u;o++){t=a[o];if(n=this._events[t]){this._events[t]=r=[];i

Chrome Cache Entry: 156

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65472)
Category:	downloaded
Size (bytes):	205504
Entropy (8bit):	5.437528172152205
Encrypted:	false
SSDEEP:	3072:po2aHi/2Vgwii0tAUwaxEG7tMVeOLk0SttjU7K4/:pOC4ivdMVbic
MD5:	1D209866D7DBA41E07ED46D5EB8198C2
SHA1:	7D60132965AAB7EC7B4DD6FCEBE58B814086961D
SHA-256:	CFAF23F3FDEEC8B45055BD4CD378678BCA123A4B6305B3A7B676BC67B1763103
SHA-512:	BE53D31A02447B37B5CF29B598A629CA1F85DABD6F6A56E663CE4E936DFC07EDC063B1167A668F1D1EB678AA98E355A4A8F71D4EFA0D7368A23DE4F58FE594DE
Malicious:	false
URL:	https://api-5092fa72.duosecurity.com/frame/static/v4/Portal.js?v=cfaf2
Preview:	/! For license information please see Portal.js.LICENSE.txt /.!function(){var __webpack_modules__={1571:function(module,__unused_webpack_exports,__webpack_require__){"use strict";var aa=__webpack_require__(733),m=__webpack_require__(3943),q=__webpack_require__(710);function t(a){for(var b=a.message,c="https://reactjs.org/docs/error-decoder.html?invariant="+b,d=1;d<arguments.length;d++)c+="&args[]="+encodeURIComponent(arguments[d]);return a.message="Minified React error #"+b+"; visit "+c+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings. ",a}if(!aa)throw t(Error(227));var ba=null,ca={};function da(){if(ba)for(var a in ca){var b=ca[a],c=ba.indexOf(a);if(!(-1<c))throw t(Error(96),a);if(!ea[c]){if(!b.extractEvents)throw t(Error(97),a);for(var d in ea[c]=b,c=b.eventTypes){var e=void 0,f=c[d],h=b,g=d;if(fa.hasOwnProperty(g))throw t(Error(99),g);fa[g]=f;var k=f.phasedRegistrationNames;if(k){for(e in k)k.hasOwnProperty(e)&&ha(k[e],

Chrome Cache Entry: 157

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (783)
Category:	downloaded
Size (bytes):	1022
Entropy (8bit):	5.430604463503323
Encrypted:	false
SSDEEP:	24:+hB+qX/ozBGvCdcEaNUh0K3kNwwX0fLiFKvKE1tc49n:+hB+fsvC6u3kNwbWFKvKEEI
MD5:	15C30F572A0037D4FCA9A3370BC113AA
SHA1:	659DA683E0E46218ED1E9B89E53F0A304D57C9D0
SHA-256:	98C73AFA645104DA58E115405D99DFCE14731266F2F3F6DAA2DFAE8C59652A44
SHA-512:	7D2D0DA087227D8E4194285E419B78E91A5FDBB995FD58EC2DA6C9DE3B131D42E71377FA1D93E78F1E26A6D4E3E9E32DF8910358532C4835EAAF094DC561C64E
Malicious:	false
URL:	https://api-5092fa72.duosecurity.com/frame/static/js/lib/jquery-postmessage.min.js?v=98c73
Preview:	/. jQuery postMessage - v0.5 - 9/11/2009. * http://benalman.com/projects/jquery-postmessage-plugin/. * . * Copyright (c) 2009 "Cowboy" Ben Alman. * Dual licensed under the MIT and GPL licenses.. * http://benalman.com/about/license/. /.(function($){var g,d,j=1,a,b=this,f=!1,h="postMessage",e="addEventListener",c,i=b[h];$[h]=function(k,l,m){if(!l){return}k=typeof k==="string"?k:$.param(k);m=m\|\|parent;if(i){m[h](k,l.replace(/([^:]+:\/\/[^\/]+)./,"$1"))}else{if(l){m.location=l.replace(/#.*$/,"")+"#"+(+new Date)+(j++)+"&"+k}}};$.receiveMessage=c=function(l,m,k){if(i){if(l){a&&c();a=function(n){if((typeof m==="string"&&n.origin!==m)\|\|($.isFunction(m)&&m(n.origin)===f)){return f}l(n)}}if(b[e]){b[l?e:"removeEventListener"]("message",a,f)}else{b[l?"attachEvent":"detachEvent"]("onmessage",a)}}else{g&&clearInterval(g);g=null;if(l){k=typeof m==="number"?m:typeof k==="number"?k:100;g=setInterval(function(){var o=document.location.hash,n=/^#?\d+&/;if(o!==d&&n.test(o)){d=o;l({data:o.replace(n,""

Chrome Cache Entry: 158

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2285
Entropy (8bit):	4.675968688249796
Encrypted:	false
SSDEEP:	48:Ps/kmO2DzshZMbYNszu5vE/J/e24Bft4cC5i:nszokcszu5vE/J/e2SVxCi
MD5:	D23690918B28913BEE97165F2A5A0CBD
SHA1:	CF550486B3571CF7088F1B8D0537DD753F5706DC
SHA-256:	4217ABBC58C1778361BE1393FAFBDB648DF139A44444CCD372F72377834CDAA8
SHA-512:	68B971C22E2270EC5865728BDB6C71814AEF1F5152B15888352B6080078BE77B4E32707E4C60CAB075B39F1DF147B4DC6DD822D14DF690ECDB46D96D54B5924B
Malicious:	false
URL:	https://api-5092fa72.duosecurity.com/frame/static/css/tipsy.css?v=4217a
Preview:	.tipsy { font-size: 10px; position: absolute; padding: 5px; z-index: 100000; }. .tipsy-inner { background-color: #000; color: #FFF; max-width: 200px; padding: 5px 8px 4px 8px; text-align: center; }.. /* Rounded corners /. .tipsy-inner { border-radius: 3px; -moz-border-radius: 3px; -webkit-border-radius: 3px; }.. / Uncomment for shadow /. /.tipsy-inner { box-shadow: 0 0 5px #000000; -webkit-box-shadow: 0 0 5px #000000; -moz-box-shadow: 0 0 5px #000000; }/.. .tipsy-arrow { position: absolute; width: 0; height: 0; line-height: 0; border: 5px dashed #000; }.. / Rules to colour arrows */. .tipsy-arrow-n { border-bottom-color: #000; }. .tipsy-arrow-s { border-top-color: #000; }. .tipsy-arrow-e { border-left-color: #000; }. .tipsy-arrow-w { border-right-color: #000; }....tipsy-n .tipsy-arrow { top: 0px; left: 50%; margin-left: -5px; border-bottom-style: solid; border-top: none; border-left-color: transparent; border-right-color: transparent; }. .tipsy-nw .tipsy-arrow { top

Chrome Cache Entry: 159

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65472)
Category:	dropped
Size (bytes):	205504
Entropy (8bit):	5.437528172152205
Encrypted:	false
SSDEEP:	3072:po2aHi/2Vgwii0tAUwaxEG7tMVeOLk0SttjU7K4/:pOC4ivdMVbic
MD5:	1D209866D7DBA41E07ED46D5EB8198C2
SHA1:	7D60132965AAB7EC7B4DD6FCEBE58B814086961D
SHA-256:	CFAF23F3FDEEC8B45055BD4CD378678BCA123A4B6305B3A7B676BC67B1763103
SHA-512:	BE53D31A02447B37B5CF29B598A629CA1F85DABD6F6A56E663CE4E936DFC07EDC063B1167A668F1D1EB678AA98E355A4A8F71D4EFA0D7368A23DE4F58FE594DE
Malicious:	false
Preview:	/! For license information please see Portal.js.LICENSE.txt /.!function(){var __webpack_modules__={1571:function(module,__unused_webpack_exports,__webpack_require__){"use strict";var aa=__webpack_require__(733),m=__webpack_require__(3943),q=__webpack_require__(710);function t(a){for(var b=a.message,c="https://reactjs.org/docs/error-decoder.html?invariant="+b,d=1;d<arguments.length;d++)c+="&args[]="+encodeURIComponent(arguments[d]);return a.message="Minified React error #"+b+"; visit "+c+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings. ",a}if(!aa)throw t(Error(227));var ba=null,ca={};function da(){if(ba)for(var a in ca){var b=ca[a],c=ba.indexOf(a);if(!(-1<c))throw t(Error(96),a);if(!ea[c]){if(!b.extractEvents)throw t(Error(97),a);for(var d in ea[c]=b,c=b.eventTypes){var e=void 0,f=c[d],h=b,g=d;if(fa.hasOwnProperty(g))throw t(Error(99),g);fa[g]=f;var k=f.phasedRegistrationNames;if(k){for(e in k)k.hasOwnProperty(e)&&ha(k[e],

Chrome Cache Entry: 160

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	10390
Entropy (8bit):	4.270353269861934
Encrypted:	false
SSDEEP:	192:pkfU4rWAFuSBufCeth4ZBMTdPd5d8KtnCPUaCOxgQkFZmB0pXxuLaZ4IW:pk5W6IOixkPWOgiiA7
MD5:	CB2D5BF14FF164557C79219C7FC63DAC
SHA1:	E45AA09AF9FEFD7109590EFC09013D554C59A96D
SHA-256:	C0432A3854BB3F722549EAF05E27D98E997E2FBEEA30EAECD4E13B5C5795354A
SHA-512:	EAA27566B3BF7746C3263B3D73C2ADF695DBE844A5AD4ED08757701169781A5325456113E15CADD5B56B82D0A32C193E12297A13058C3A2F3D6C30082D602B1A
Malicious:	false
URL:	https://api-5092fa72.duosecurity.com/frame/static/js/lib/jquery.tipsy.js?v=c0432
Preview:	// tipsy, facebook style tooltips for jquery.// version 1.0.0a.// (c) 2008-2010 jason frame [jason@onehackoranother.com].// released under the MIT license..(function($) {. . function maybeCall(thing, ctx) {. return (typeof thing == 'function') ? (thing.call(ctx)) : thing;. };. . function isElementInDOM(ele) {. while (ele = ele.parentNode) {. if (ele == document) return true;. }. return false;. };. . function Tipsy(element, options) {. this.$element = $(element);. this.options = options;. this.enabled = true;. this.fixTitle();. };. . Tipsy.prototype = {. show: function() {. var title = this.getTitle();. if (title && this.enabled) {. var $tip = this.tip();. . $tip.find('.tipsy-inner')[this.options.html ? 'html' : 'text'](title);. $tip[0].className = 'tipsy'; // reset classname in case of dynamic gravity.

Chrome Cache Entry: 161

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, CFF, length 23428, version 1.0
Category:	downloaded
Size (bytes):	23428
Entropy (8bit):	7.982937310764553
Encrypted:	false
SSDEEP:	384:RsPqnR+ScOw/POPun0KJwFzlrDKd4/sMGNXjsc3iqITFVv0dednGMkAtF7a/duCV:RGqn1w/h0Kws4xGNzscSljik5lFW/gCV
MD5:	C0AAEF5FDB4A9E8D34545D6E504FD64E
SHA1:	407460986F6381EE49D2F4F218FB83350FE52B21
SHA-256:	1A43923D91C4527E4473479476DAAF7C3137CF8B8D1696D8285690D6AE5B88D0
SHA-512:	2A208DEDC45891BE788FCFC8465EB31D4430831BFBBBE9E47BE86539AEF4ACD63E386E8E3D4D78CC9A167230E7B16A7E8255C96B5784228DC182DCD00DC1ED1F
Malicious:	false
URL:	https://api-5092fa72.duosecurity.com/frame/static/fonts/duo-admin/duo-admin.woff
Preview:	wOFFOTTO..[.................................CFF ......V...zo....FFTM..W.........ua..GDEF..W........ ....OS/2..X....J...`/.N.cmap..XT...J....`...head..Y....0...6.B.'hhea..Y........$.5..hmtx..Y.............maxp..Z...........P.name..Z.........g..$post..[t....... ....x....`T.8.Ir...k.R.'3Z..VP...-X.P...B.5$!.d..e2.].sg.L2IHH..V. .Z..K..U........y......!.........9.;..}...w.%'??.b...6T.)..tT.Xrs,9?...fG.W..-xz...o+...._...'.L..9........:'.+W....~u.g_.QY7\..9W.\..;r~..<gC.......O...5gw....9.s^..Y..s...M.os...y..r..k).\|.b...ey.Rfi..[..l.[F-oX.\|f.......so..N..{r..]..&.[..+..sw..V......M.....%.......9...x^.7o$og.y/..I........._......w..(...u...u.....R~O.....?..b....../....Q~......9.7.....7..>w.w?W.98'..y.0..m..q.s.r.()..`.9NGU9.o.[?............s..e....U...2.......R..Y.PU:.......PQqi..ZVZ........Y.....m\_].,-/+v.w:.6....5.T.W..;...T.;aT........Q6.dc.....z}YEqM}u.t.fX].v..x....e...eUe.M...0X#...QVQ:..Y]Wg~.p../..XY...jNUYS.,.....Qc.mN....n.....6..Y\..

Chrome Cache Entry: 162

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65166)
Category:	dropped
Size (bytes):	294407
Entropy (8bit):	5.490324624503922
Encrypted:	false
SSDEEP:	6144:+SHAXXVVocu6cY6UrESkXEUlSMOPcqL5A34aW:qVg6cY6UrESkXdgzkqLPaW
MD5:	4CB2665F7F2185CBEAE74F17282A632F
SHA1:	C231EBA21DE9DB08C3B2BDF14E4C34DEB9FDF983
SHA-256:	1E04980103DB09FD0D9203ABE140620671EF2D1697735A42190611CE140BF2A6
SHA-512:	6DEE68C3B699CBB7BF527450E2723D9552DE7BC62873CE25B0AD78969DBEBC7272B9C997E6315F78B557A1016325007C34314537FA1DA8F07144EEAD0C4FE4A4
Malicious:	false
Preview:	/! For license information please see prompt.js.LICENSE.txt /.!function(){var __webpack_modules__={2607:function(__unused_webpack_module,exports,__webpack_require__){"use strict";__webpack_require__(6887),__webpack_require__(584),__webpack_require__(3638),__webpack_require__(4),__webpack_require__(4975),exports.__esModule=!0,exports.b64RawEnc=function(buf){return base64js.fromByteArray(buf).replace(/\+/g,"-").replace(/\//g,"_")},exports.b64enc=function(buf){return base64js.fromByteArray(buf).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")},exports.hexEncode=function(buf){return Array.from(buf).map((function(x){return("0"+x.toString(16)).substr(-2)})).join("")},__webpack_require__(4768),__webpack_require__(5001),__webpack_require__(3713),__webpack_require__(2586),__webpack_require__(6348),__webpack_require__(881),__webpack_require__(8249),__webpack_require__(6350),__webpack_require__(9463);var base64js=function(e,r){if(!r&&e&&e.__esModule)return e;if(null===e\|\|"object"!=typeof

Chrome Cache Entry: 163

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	131
Entropy (8bit):	4.613522337964659
Encrypted:	false
SSDEEP:	3:RFnA1UVzKVWHKY4MKLFKx+0rVVLAG63/RFEaGAKDlcrIg+cBYNw:jnA1UV1HKMKe+YB63/LKDAIgrYNw
MD5:	B645B417E22264EA26A9E838DF8577B9
SHA1:	81E82700614B3A51C0DE9BE510D0DA75BE40E740
SHA-256:	C4AC5DCD7D12E242F9880AEAA777DAC52F6F48CECF4210A09E85D88656F1B1C0
SHA-512:	876C54AD2CACCF7B950544DF033D50DD74B1862554E3764ACB031435C86154BD9ECFA21F10D0FC7EDC2214FA2AB915457ABBBA5F936905BA80C78E5597A0E571
Malicious:	false
Preview:	// See jquery-prologue.js for information on why this is necessary..(function() { if (window.module) module = window.module; })();.

Chrome Cache Entry: 164

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	7943
Entropy (8bit):	4.74794918276543
Encrypted:	false
SSDEEP:	96:njoNE0EEm2BXMGXQfBXMGum2HnhslaX0n86voRY3aadAEBscW3+3uvBASHbSjr2:jwC3+DIK+laDRYOFvWZr2
MD5:	8C239BB94336BAEF5C4D5F5A3F4E5C28
SHA1:	28766A8E1651FCE20DE9606C4BAE4F31E8F821E9
SHA-256:	50A8A089303DEEDE7E5CBEAD59E932C0E5ABE9A85FFF72D17D273FBB7359EDDE
SHA-512:	696C675BCCFD64BF30013E8B8DD2C26781EE285FF4DB343DE550477CB39B64D1E8ABF34A4A1497166BF401EBFE552FD82C3F4CF7B49BF7B61022D12547D6052F
Malicious:	false
URL:	https://api-5092fa72.duosecurity.com/frame/static/css/fonts/duo-admin.css?v=50a8a
Preview:	@font-face {. font-family: "Duo Admin Icons";. src: url("../../fonts/duo-admin/duo-admin.eot");. /* IE /. / stylelint-disable-next-line value-list-comma-space-after /. src: url("../../fonts/duo-admin/duo-admin.eot?#iefix") format("embedded-opentype"), url("../../fonts/duo-admin/duo-admin.woff") format("woff");. font-weight: 400;. font-style: normal;.}.[data-icon]:before {. font-family: "Duo Admin Icons" !important;. content: attr(data-icon);. font-style: normal !important;. font-weight: 400 !important;. font-variant: normal !important;. text-transform: none !important;. speak: none;. line-height: 1;. -webkit-font-smoothing: antialiased;. -moz-osx-font-smoothing: grayscale;.}..[class^=icon-]:before,.[class=" icon-"]:before {. font-family: "Duo Admin Icons" !important;. font-style: normal !important;. font-weight: 400 !important;. font-variant: normal !important;. text-transform: none !important;. speak: none;. line-height: 1;. -webkit-font-smoothing: antiali

Chrome Cache Entry: 165

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19413)
Category:	downloaded
Size (bytes):	19414
Entropy (8bit):	5.066655217952398
Encrypted:	false
SSDEEP:	384:dttVLP2seb444J3q0TophLZL+D9VVkxmGuhtQ9d7zavoDvWyvct:dtr/jametQt
MD5:	752B6162850F33D9F6BB715D39E5BC3B
SHA1:	12E3591409B341727CCBA4E1CF515B8EC84E79D4
SHA-256:	E0FF6C99C8C33330448F0E977F2FE67636ED3EA77481833CEACF2303819F0C7B
SHA-512:	065D4044A9D09A54020F8A4AE9C1E9A4407D8832BC27A8BDB6B264EC8F9383BE8A13B50B437E576E3C8CB855AB1DEFCC299CBDB81493701B71D5DECAF0146C12
Malicious:	false
URL:	https://api-5092fa72.duosecurity.com/frame/static/shared/lib/backbone/backbone-min.js?v=e0ff6
Preview:	(function(){var t=this;var e=t.Backbone;var i=[];var r=i.push;var s=i.slice;var n=i.splice;var a;if(typeof exports!=="undefined"){a=exports}else{a=t.Backbone={}}a.VERSION="1.0.0";var h=t._;if(!h&&typeof require!=="undefined")h=require("underscore");a.$=t.jQuery\|\|t.Zepto\|\|t.ender\|\|t.$;a.noConflict=function(){t.Backbone=e;return this};a.emulateHTTP=false;a.emulateJSON=false;var o=a.Events={on:function(t,e,i){if(!l(this,"on",t,[e,i])\|\|!e)return this;this._events\|\|(this._events={});var r=this._events[t]\|\|(this._events[t]=[]);r.push({callback:e,context:i,ctx:i\|\|this});return this},once:function(t,e,i){if(!l(this,"once",t,[e,i])\|\|!e)return this;var r=this;var s=h.once(function(){r.off(t,s);e.apply(this,arguments)});s._callback=e;return this.on(t,s,i)},off:function(t,e,i){var r,s,n,a,o,u,c,f;if(!this._events\|\|!l(this,"off",t,[e,i]))return this;if(!t&&!e&&!i){this._events={};return this}a=t?[t]:h.keys(this._events);for(o=0,u=a.length;o<u;o++){t=a[o];if(n=this._events[t]){this._events[t]=r=[];i

Chrome Cache Entry: 166

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65168)
Category:	dropped
Size (bytes):	216396
Entropy (8bit):	5.518320330465852
Encrypted:	false
SSDEEP:	3072:3Ppp2ufjK4QVWbsS1Zmw6YxljjTk5kwStN7APcfmUZAB:3Ppp2uiWdXEUljjYDPLQAB
MD5:	57E0A78F821C9205A4ED26DF257ACD26
SHA1:	F49851D775AA5A9D4BF70E844BA3C28AA8D9F0F7
SHA-256:	FFF81D93F8FDD59B163A633E71F272623A17C03133E1A64A82E0BF8BE6CA73BF
SHA-512:	3A81847995A25B61ABDE5BA493EA0BC3E9CA0FD3356C8EC23264933B63F6911AB456729420FEE00C391E4137B27BB9363D71B7C61106146B0F2E1F7276618307
Malicious:	false
Preview:	/! For license information please see base.js.LICENSE.txt /.!function(){var __webpack_modules__={6997:function(module,exports,__webpack_require__){var __WEBPACK_AMD_DEFINE_ARRAY__,__WEBPACK_AMD_DEFINE_RESULT__;__webpack_require__(5001),__webpack_require__(4),__webpack_require__(3463),__webpack_require__(8327),__webpack_require__(4768),__webpack_require__(238),__webpack_require__(5428),__webpack_require__(8249),__webpack_require__(5451),__webpack_require__(4979),__webpack_require__(8272),__webpack_require__(6350),__webpack_require__(9463),__webpack_require__(6478),__webpack_require__(3713),__webpack_require__(6976),__webpack_require__(4206),function(factory){"use strict";__WEBPACK_AMD_DEFINE_ARRAY__=[__webpack_require__(5311)],__WEBPACK_AMD_DEFINE_RESULT__=function(jQuery){return function(jQuery,window){function compareVersions(v1,v2){var i,rVersionParts=/^(\d+)\.(\d+)\.(\d+)/,v1p=rVersionParts.exec(v1)\|\|[],v2p=rVersionParts.exec(v2)\|\|[];for(i=1;i<=3;i++){if(+v1p[i]>+v2p[i])return 1;i

Chrome Cache Entry: 167

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	5143
Entropy (8bit):	4.1163496031092865
Encrypted:	false
SSDEEP:	96:BFi5bU0Rz0Lif1P8vPY0Uys8mVgV7QkgAVKDERR7o4V6yEc:gbU7a1P8vPYryTmeqLSKM7F6yEc
MD5:	AE7C16125FAF5F5B2935EA239D85644E
SHA1:	F2A9430C371C37ECB980820FC795A025833CFEAA
SHA-256:	D10D28962E823CD3E0A502F61CB398C9BBD7AEFA81A88EC3F336B467FE61A598
SHA-512:	D6129CD3B1F1550EF672A6446E2A001D914D1F5EB483142D2F8C9F9D8079E30E1680674D003F34DD8F49FC970C550AF496DA1DD7739DFBC0BA0E19C53588544A
Malicious:	false
URL:	https://api-5092fa72.duosecurity.com/frame/static/shared/js/errors.js?v=d10d2
Preview:	/* eslint-disable */..(function() {. . // Some browsers don't include the error object when throwing, so it will be. // difficult to track if an error has already notified. This is an abuse. // of closure and could result in race conditions, I suppose, but it. // should work in most cases.. var hasNotified = null;.. function serialize(data) {. return Object.keys(data). .filter(function(key) {. return data[key];. }). .map(function(key) {. return key + '=' + data[key];. }). .join('&');. }.. function notify(data) {. // Some servs require an XSRF for POST (adminserv), some do. // not (iframe in frameserv). var xsrf = document.querySelector('[name="_xsrf"]');. if (xsrf) {. data._xsrf = xsrf.value;. }... // Servs control the path to which the BrowserExceptionHandler is. // mounted, so we use a data- attribute on th

Chrome Cache Entry: 168

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4146)
Category:	dropped
Size (bytes):	73409
Entropy (8bit):	5.340886681183381
Encrypted:	false
SSDEEP:	1536:NHulPegosdjJkXIGHGMqCMag88Nv2Zg3NBt7:NHAVWqzaYNv2ZyV7
MD5:	E5BAD3FE56A829990B20500EDC4C5937
SHA1:	7038EF07FBDA578550FABFF814CEB3173742CC80
SHA-256:	6585FD7035C6B061BCB275B9F9C59B9B81CEE3C96C75F5DF79BB394A6815751C
SHA-512:	DD1E6A2405B50F1D1E429FB7DC40A42ADCC5F31CF0E7F63460BEBF50354C149C8E655C7127AAF69034D8B41B4840D7BDDE6AC7AB901B4E4A3ACD4AD21BD8A5CA
Malicious:	false
Preview:	/*. @license. * Lodash <https://lodash.com/>. * Copyright OpenJS Foundation and other contributors <https://openjsf.org/>. * Released under MIT license <https://lodash.com/license>. * Based on Underscore.js 1.8.3 <http://underscorejs.org/LICENSE>. * Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors. */. (function(){function n(n,t,r){switch(r.length){case 0:return n.call(t);case 1:return n.call(t,r[0]);case 2:return n.call(t,r[0],r[1]);case 3:return n.call(t,r[0],r[1],r[2])}return n.apply(t,r)}function t(n,t,r,e){for(var u=-1,i=null==n?0:n.length;++u<i;){var o=n[u];t(e,o,r(o),n)}return e}function r(n,t){for(var r=-1,e=null==n?0:n.length;++r<e&&t(n[r],r,n)!==!1;);return n}function e(n,t){for(var r=null==n?0:n.length;r--&&t(n[r],r,n)!==!1;);return n}function u(n,t){for(var r=-1,e=null==n?0:n.length;++r<e;)if(!t(n[r],r,n))return!1;. return!0}function i(n,t){for(var r=-1,e=null==n?0:n.length,u=0,i=[];++r<e;){var o=n[r];t(o,r,n)&&(i[u++]=o)}return i}function

Chrome Cache Entry: 169

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1240), with no line terminators
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	5.2438478598558405
Encrypted:	false
SSDEEP:	24:cHiQTBIndgeLHzBTgezPW1LBiBTffIDu2uJTs5ay1puLENJkgwECEEfnfhE5ZoL:ha+xHzhAYR9s5dIkJGoe
MD5:	823220E12E06E7CE00DBB4885DAA5D7B
SHA1:	AD2719FDD3B9CC23868DEA91761BB69D75797E89
SHA-256:	AAF8CDCA78B616A30BD4FB8BA1531AFAD13695E2E09FFAF4E889162AA29C29EF
SHA-512:	A96DAAFE60E93CB271989976CA136E7CC82639338A24422C8DC4C67F67795AA8E59F53228511A3496C7C798452E58F2A05CDD57FE9CA8301A9ED88CC6AC6360F
Malicious:	false
Preview:	!function(){"use strict";var e,_jquery,DuoFrame,__webpack_modules__={5311:function(module){module.exports=jQuery}},__webpack_module_cache__={};function __webpack_require__(moduleId){var cachedModule=__webpack_module_cache__[moduleId];if(void 0!==cachedModule)return cachedModule.exports;var module=__webpack_module_cache__[moduleId]={exports:{}};return __webpack_modules__[moduleId](module,module.exports,__webpack_require__),module.exports}_jquery=(e=__webpack_require__(5311))&&e.__esModule?e:{default:e},DuoFrame={supportsSVG:function(){return!!document.createElementNS&&!!document.createElementNS("http://www.w3.org/2000/svg","svg").createSVGRect}},(0,_jquery.default)((function(){window.initErrorHandlers&&window.initErrorHandlers(),(0,_jquery.default)(".ie.quirks .base-wrapper").height((0,_jquery.default)(document).innerHeight()-2),(0,_jquery.default)("button[data-form]").on("click",(function(e){e.preventDefault(),(0,_jquery.default)("#"+(0,_jquery.default)(this).data("form")).submit()}))}

Chrome Cache Entry: 170

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65168)
Category:	downloaded
Size (bytes):	216396
Entropy (8bit):	5.518320330465852
Encrypted:	false
SSDEEP:	3072:3Ppp2ufjK4QVWbsS1Zmw6YxljjTk5kwStN7APcfmUZAB:3Ppp2uiWdXEUljjYDPLQAB
MD5:	57E0A78F821C9205A4ED26DF257ACD26
SHA1:	F49851D775AA5A9D4BF70E844BA3C28AA8D9F0F7
SHA-256:	FFF81D93F8FDD59B163A633E71F272623A17C03133E1A64A82E0BF8BE6CA73BF
SHA-512:	3A81847995A25B61ABDE5BA493EA0BC3E9CA0FD3356C8EC23264933B63F6911AB456729420FEE00C391E4137B27BB9363D71B7C61106146B0F2E1F7276618307
Malicious:	false
URL:	https://api-5092fa72.duosecurity.com/frame/static/js/page/v3/base.js?v=fff81
Preview:	/! For license information please see base.js.LICENSE.txt /.!function(){var __webpack_modules__={6997:function(module,exports,__webpack_require__){var __WEBPACK_AMD_DEFINE_ARRAY__,__WEBPACK_AMD_DEFINE_RESULT__;__webpack_require__(5001),__webpack_require__(4),__webpack_require__(3463),__webpack_require__(8327),__webpack_require__(4768),__webpack_require__(238),__webpack_require__(5428),__webpack_require__(8249),__webpack_require__(5451),__webpack_require__(4979),__webpack_require__(8272),__webpack_require__(6350),__webpack_require__(9463),__webpack_require__(6478),__webpack_require__(3713),__webpack_require__(6976),__webpack_require__(4206),function(factory){"use strict";__WEBPACK_AMD_DEFINE_ARRAY__=[__webpack_require__(5311)],__WEBPACK_AMD_DEFINE_RESULT__=function(jQuery){return function(jQuery,window){function compareVersions(v1,v2){var i,rVersionParts=/^(\d+)\.(\d+)\.(\d+)/,v1p=rVersionParts.exec(v1)\|\|[],v2p=rVersionParts.exec(v2)\|\|[];for(i=1;i<=3;i++){if(+v1p[i]>+v2p[i])return 1;i

Chrome Cache Entry: 171

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65139)
Category:	downloaded
Size (bytes):	187220
Entropy (8bit):	5.593958706711485
Encrypted:	false
SSDEEP:	3072:tSwK4QVWbWS1Zhw6YRTrk5kqStvjCkqI53:tSBW3XZGTwSCkqIx
MD5:	12F0E7492BC5DD3CBE98E51D43142981
SHA1:	F8E8856B54C7D20E58E3531E2E7C15559660C741
SHA-256:	E90E7B98989DE529A5B21747B350D8FBA5877C79BA4806A636271AF074489F20
SHA-512:	9234DC3BA182ECBB7F7776D01588A41835579D5A2C0B10640E777937EA8E3AB52E439F54EB3A0F00FBE790D99783FBE9B5172F327660DF03DEE82A0BEC8CE8B2
Malicious:	false
URL:	https://api-5092fa72.duosecurity.com/frame/static/js/page/v3/trigger-endpointhealth-verification.js?v=e90e7
Preview:	/! For license information please see trigger-endpointhealth-verification.js.LICENSE.txt /.!function(){var __webpack_modules__={1181:function(__unused_webpack_module,exports){"use strict";var _DISPLAY_KEYS,_DISPLAY_SSO_KEYS;exports.__esModule=!0,exports.WINDOWS_HELLO_PLATFORMS=exports.WINDOWS_HELLO_MIN_PLATFORM_VERSIONS=exports.WEBAUTHN_TOUCH_MIN_PLATFORM_VERSIONS=exports.WEBAUTHN_TOUCH_ID_PLATFORMS=exports.TRADITIONAL_PROMPT_EOL_DISMISSAL_KEY=exports.RBFS_BANNER_SEEN=exports.RBFS_BANNER_DISMISSAL_KEY=exports.POLICY_USE_COMPACT_VIEW=exports.POLICY_TABLE_VIEW_SET=exports.PLATFORM_WINDOWS_10=exports.PLATFORM_OSX=exports.PLATFORM_IOS=exports.KEY_NAME_ESCAPE=exports.KEY_NAME_ENTER=exports.KEYCODE_ENTER=exports.FILTER_SSO_KEYS=exports.FILTER_KEY_UNAME=exports.FILTER_KEY_UKEY=exports.FILTER_KEY_INAME=exports.FILTER_KEY_GROUPNAME=exports.FILTER_KEYS=exports.FILTER_CLIENT=exports.DTM_MONITORING_BANNER_SEEN=exports.DTM_DEVICE_REGISTRATION_NUDGE_SEEN=exports.DTM_DEVICE_REGISTRATION_BANNER_SEEN

Chrome Cache Entry: 172

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1240), with no line terminators
Category:	downloaded
Size (bytes):	1240
Entropy (8bit):	5.2438478598558405
Encrypted:	false
SSDEEP:	24:cHiQTBIndgeLHzBTgezPW1LBiBTffIDu2uJTs5ay1puLENJkgwECEEfnfhE5ZoL:ha+xHzhAYR9s5dIkJGoe
MD5:	823220E12E06E7CE00DBB4885DAA5D7B
SHA1:	AD2719FDD3B9CC23868DEA91761BB69D75797E89
SHA-256:	AAF8CDCA78B616A30BD4FB8BA1531AFAD13695E2E09FFAF4E889162AA29C29EF
SHA-512:	A96DAAFE60E93CB271989976CA136E7CC82639338A24422C8DC4C67F67795AA8E59F53228511A3496C7C798452E58F2A05CDD57FE9CA8301A9ED88CC6AC6360F
Malicious:	false
URL:	https://api-5092fa72.duosecurity.com/frame/static/js/page/v3/frame.js?v=aaf8c
Preview:	!function(){"use strict";var e,_jquery,DuoFrame,__webpack_modules__={5311:function(module){module.exports=jQuery}},__webpack_module_cache__={};function __webpack_require__(moduleId){var cachedModule=__webpack_module_cache__[moduleId];if(void 0!==cachedModule)return cachedModule.exports;var module=__webpack_module_cache__[moduleId]={exports:{}};return __webpack_modules__[moduleId](module,module.exports,__webpack_require__),module.exports}_jquery=(e=__webpack_require__(5311))&&e.__esModule?e:{default:e},DuoFrame={supportsSVG:function(){return!!document.createElementNS&&!!document.createElementNS("http://www.w3.org/2000/svg","svg").createSVGRect}},(0,_jquery.default)((function(){window.initErrorHandlers&&window.initErrorHandlers(),(0,_jquery.default)(".ie.quirks .base-wrapper").height((0,_jquery.default)(document).innerHeight()-2),(0,_jquery.default)("button[data-form]").on("click",(function(e){e.preventDefault(),(0,_jquery.default)("#"+(0,_jquery.default)(this).data("form")).submit()}))}

Chrome Cache Entry: 173

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10390
Entropy (8bit):	4.270353269861934
Encrypted:	false
SSDEEP:	192:pkfU4rWAFuSBufCeth4ZBMTdPd5d8KtnCPUaCOxgQkFZmB0pXxuLaZ4IW:pk5W6IOixkPWOgiiA7
MD5:	CB2D5BF14FF164557C79219C7FC63DAC
SHA1:	E45AA09AF9FEFD7109590EFC09013D554C59A96D
SHA-256:	C0432A3854BB3F722549EAF05E27D98E997E2FBEEA30EAECD4E13B5C5795354A
SHA-512:	EAA27566B3BF7746C3263B3D73C2ADF695DBE844A5AD4ED08757701169781A5325456113E15CADD5B56B82D0A32C193E12297A13058C3A2F3D6C30082D602B1A
Malicious:	false
Preview:	// tipsy, facebook style tooltips for jquery.// version 1.0.0a.// (c) 2008-2010 jason frame [jason@onehackoranother.com].// released under the MIT license..(function($) {. . function maybeCall(thing, ctx) {. return (typeof thing == 'function') ? (thing.call(ctx)) : thing;. };. . function isElementInDOM(ele) {. while (ele = ele.parentNode) {. if (ele == document) return true;. }. return false;. };. . function Tipsy(element, options) {. this.$element = $(element);. this.options = options;. this.enabled = true;. this.fixTitle();. };. . Tipsy.prototype = {. show: function() {. var title = this.getTitle();. if (title && this.enabled) {. var $tip = this.tip();. . $tip.find('.tipsy-inner')[this.options.html ? 'html' : 'text'](title);. $tip[0].className = 'tipsy'; // reset classname in case of dynamic gravity.

Chrome Cache Entry: 174

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (47965)
Category:	dropped
Size (bytes):	61367
Entropy (8bit):	5.586496468345389
Encrypted:	false
SSDEEP:	1536:QUgH1OEEPhhpcG0gsMALeQHJxZYJR6iVHb8BYArG:2OdFFAae2R6iVHYrG
MD5:	80D038A84BA79EA215979A4DFF3D6394
SHA1:	7277B3D7C924C11F0B92ADC71B1F1ED5B2497160
SHA-256:	AAA3394BB66B5F915B3D2E4F3B085E833FEEE8E2543C9660C442415BD256FDB6
SHA-512:	7F9073307B649097ED0AF6B68C0B5075DA22448249DE7310B41E3E4C881E3FCE76B125928E10FAF99DD7503DCCF52795ADD361A2E66FBFA3AE2EE557DC8F1225
Malicious:	false
Preview:	(function(root){var freeExports=typeof exports=="object"&&exports;var freeModule=typeof module=="object"&&module&&module.exports==freeExports&&module;var freeGlobal=typeof global=="object"&&global;if(freeGlobal.global===freeGlobal\|\|freeGlobal.window===freeGlobal){root=freeGlobal}var regexAstralSymbols=/[\uD800-\uDBFF][\uDC00-\uDFFF]/g;var regexAsciiWhitelist=/[\x01-\x7F]/g;var regexBmpWhitelist=/[\x01-\t\x0B\f\x0E-\x1F\x7F\x81\x8D\x8F\x90\x9D\xA0-\uFFFF]/g;var regexEncodeNonAscii=/<\u20D2\|=\u20E5\|>\u20D2\|\u205F\u200A\|\u219D\u0338\|\u2202\u0338\|\u2220\u20D2\|\u2229\uFE00\|\u222A\uFE00\|\u223C\u20D2\|\u223D\u0331\|\u223E\u0333\|\u2242\u0338\|\u224B\u0338\|\u224D\u20D2\|\u224E\u0338\|\u224F\u0338\|\u2250\u0338\|\u2261\u20E5\|\u2264\u20D2\|\u2265\u20D2\|\u2266\u0338\|\u2267\u0338\|\u2268\uFE00\|\u2269\uFE00\|\u226A\u0338\|\u226A\u20D2\|\u226B\u0338\|\u226B\u20D2\|\u227F\u0338\|\u2282\u20D2\|\u2283\u20D2\|\u228A\uFE00\|\u228B\uFE00\|\u228F\u0338\|\u2290\u0338\|\u2293\uFE00\|\u2294\uFE00\|\u22B4\u20D2\|\u22B5\u20D2\|\u22D8\u0

Chrome Cache Entry: 175

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (47965)
Category:	downloaded
Size (bytes):	61367
Entropy (8bit):	5.586496468345389
Encrypted:	false
SSDEEP:	1536:QUgH1OEEPhhpcG0gsMALeQHJxZYJR6iVHb8BYArG:2OdFFAae2R6iVHYrG
MD5:	80D038A84BA79EA215979A4DFF3D6394
SHA1:	7277B3D7C924C11F0B92ADC71B1F1ED5B2497160
SHA-256:	AAA3394BB66B5F915B3D2E4F3B085E833FEEE8E2543C9660C442415BD256FDB6
SHA-512:	7F9073307B649097ED0AF6B68C0B5075DA22448249DE7310B41E3E4C881E3FCE76B125928E10FAF99DD7503DCCF52795ADD361A2E66FBFA3AE2EE557DC8F1225
Malicious:	false
URL:	https://api-5092fa72.duosecurity.com/frame/static/shared/lib/he/he.min.js?v=aaa33
Preview:	(function(root){var freeExports=typeof exports=="object"&&exports;var freeModule=typeof module=="object"&&module&&module.exports==freeExports&&module;var freeGlobal=typeof global=="object"&&global;if(freeGlobal.global===freeGlobal\|\|freeGlobal.window===freeGlobal){root=freeGlobal}var regexAstralSymbols=/[\uD800-\uDBFF][\uDC00-\uDFFF]/g;var regexAsciiWhitelist=/[\x01-\x7F]/g;var regexBmpWhitelist=/[\x01-\t\x0B\f\x0E-\x1F\x7F\x81\x8D\x8F\x90\x9D\xA0-\uFFFF]/g;var regexEncodeNonAscii=/<\u20D2\|=\u20E5\|>\u20D2\|\u205F\u200A\|\u219D\u0338\|\u2202\u0338\|\u2220\u20D2\|\u2229\uFE00\|\u222A\uFE00\|\u223C\u20D2\|\u223D\u0331\|\u223E\u0333\|\u2242\u0338\|\u224B\u0338\|\u224D\u20D2\|\u224E\u0338\|\u224F\u0338\|\u2250\u0338\|\u2261\u20E5\|\u2264\u20D2\|\u2265\u20D2\|\u2266\u0338\|\u2267\u0338\|\u2268\uFE00\|\u2269\uFE00\|\u226A\u0338\|\u226A\u20D2\|\u226B\u0338\|\u226B\u20D2\|\u227F\u0338\|\u2282\u20D2\|\u2283\u20D2\|\u228A\uFE00\|\u228B\uFE00\|\u228F\u0338\|\u2290\u0338\|\u2293\uFE00\|\u2294\uFE00\|\u22B4\u20D2\|\u22B5\u20D2\|\u22D8\u0

Chrome Cache Entry: 176

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65166)
Category:	downloaded
Size (bytes):	306947
Entropy (8bit):	5.490123514272706
Encrypted:	false
SSDEEP:	6144:+SHAXXVVocu6cY6UrESkXEUlSMOPcqL5A34a+0:qVg6cY6UrESkXdgzkqLPah
MD5:	9259E58F2CDCD60788C4AE1ED40C0399
SHA1:	4B7407C795CF0C6734262D0597969A71914B288F
SHA-256:	69ACC6140968410D3AFE9C60D3B605C6486F006838CF6591E3BB26DDD4E6B27F
SHA-512:	F3D964135879A50E5A1B4A2CD41E6E0ED7635219FF940A07B37955E6A9868C2E1BA3CD0376C944B916846A14F3EC8DFDFDED731F7DE0D9D30A77C638104A8BCF
Malicious:	false
URL:	https://api-5092fa72.duosecurity.com/frame/static/js/page/v3/prompt.js?v=69acc
Preview:	/! For license information please see prompt.js.LICENSE.txt /.!function(){var __webpack_modules__={2607:function(__unused_webpack_module,exports,__webpack_require__){"use strict";__webpack_require__(6887),__webpack_require__(584),__webpack_require__(3638),__webpack_require__(4),__webpack_require__(4975),exports.__esModule=!0,exports.b64RawEnc=function(buf){return base64js.fromByteArray(buf).replace(/\+/g,"-").replace(/\//g,"_")},exports.b64enc=function(buf){return base64js.fromByteArray(buf).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")},exports.hexEncode=function(buf){return Array.from(buf).map((function(x){return("0"+x.toString(16)).substr(-2)})).join("")},__webpack_require__(4768),__webpack_require__(5001),__webpack_require__(3713),__webpack_require__(2586),__webpack_require__(6348),__webpack_require__(881),__webpack_require__(8249),__webpack_require__(6350),__webpack_require__(9463);var base64js=function(e,r){if(!r&&e&&e.__esModule)return e;if(null===e\|\|"object"!=typeof

Chrome Cache Entry: 177

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5143
Entropy (8bit):	4.1163496031092865
Encrypted:	false
SSDEEP:	96:BFi5bU0Rz0Lif1P8vPY0Uys8mVgV7QkgAVKDERR7o4V6yEc:gbU7a1P8vPYryTmeqLSKM7F6yEc
MD5:	AE7C16125FAF5F5B2935EA239D85644E
SHA1:	F2A9430C371C37ECB980820FC795A025833CFEAA
SHA-256:	D10D28962E823CD3E0A502F61CB398C9BBD7AEFA81A88EC3F336B467FE61A598
SHA-512:	D6129CD3B1F1550EF672A6446E2A001D914D1F5EB483142D2F8C9F9D8079E30E1680674D003F34DD8F49FC970C550AF496DA1DD7739DFBC0BA0E19C53588544A
Malicious:	false
Preview:	/* eslint-disable */..(function() {. . // Some browsers don't include the error object when throwing, so it will be. // difficult to track if an error has already notified. This is an abuse. // of closure and could result in race conditions, I suppose, but it. // should work in most cases.. var hasNotified = null;.. function serialize(data) {. return Object.keys(data). .filter(function(key) {. return data[key];. }). .map(function(key) {. return key + '=' + data[key];. }). .join('&');. }.. function notify(data) {. // Some servs require an XSRF for POST (adminserv), some do. // not (iframe in frameserv). var xsrf = document.querySelector('[name="_xsrf"]');. if (xsrf) {. data._xsrf = xsrf.value;. }... // Servs control the path to which the BrowserExceptionHandler is. // mounted, so we use a data- attribute on th

Chrome Cache Entry: 178

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4146)
Category:	downloaded
Size (bytes):	73409
Entropy (8bit):	5.340886681183381
Encrypted:	false
SSDEEP:	1536:NHulPegosdjJkXIGHGMqCMag88Nv2Zg3NBt7:NHAVWqzaYNv2ZyV7
MD5:	E5BAD3FE56A829990B20500EDC4C5937
SHA1:	7038EF07FBDA578550FABFF814CEB3173742CC80
SHA-256:	6585FD7035C6B061BCB275B9F9C59B9B81CEE3C96C75F5DF79BB394A6815751C
SHA-512:	DD1E6A2405B50F1D1E429FB7DC40A42ADCC5F31CF0E7F63460BEBF50354C149C8E655C7127AAF69034D8B41B4840D7BDDE6AC7AB901B4E4A3ACD4AD21BD8A5CA
Malicious:	false
URL:	https://api-5092fa72.duosecurity.com/frame/static/shared/lib/lodash/lodash.min.js?v=6585f
Preview:	/*. @license. * Lodash <https://lodash.com/>. * Copyright OpenJS Foundation and other contributors <https://openjsf.org/>. * Released under MIT license <https://lodash.com/license>. * Based on Underscore.js 1.8.3 <http://underscorejs.org/LICENSE>. * Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors. */. (function(){function n(n,t,r){switch(r.length){case 0:return n.call(t);case 1:return n.call(t,r[0]);case 2:return n.call(t,r[0],r[1]);case 3:return n.call(t,r[0],r[1],r[2])}return n.apply(t,r)}function t(n,t,r,e){for(var u=-1,i=null==n?0:n.length;++u<i;){var o=n[u];t(e,o,r(o),n)}return e}function r(n,t){for(var r=-1,e=null==n?0:n.length;++r<e&&t(n[r],r,n)!==!1;);return n}function e(n,t){for(var r=null==n?0:n.length;r--&&t(n[r],r,n)!==!1;);return n}function u(n,t){for(var r=-1,e=null==n?0:n.length;++r<e;)if(!t(n[r],r,n))return!1;. return!0}function i(n,t){for(var r=-1,e=null==n?0:n.length,u=0,i=[];++r<e;){var o=n[r];t(o,r,n)&&(i[u++]=o)}return i}function

Chrome Cache Entry: 179

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	7539
Entropy (8bit):	4.747782331544661
Encrypted:	false
SSDEEP:	96:5gPe0tyAZP/YIrxTMIhWhGpEUyG4bDCK7zn6Xo58u4a5ZL0K1:54ei79ldIAK+E/GGzn4oeu4a5Om
MD5:	51888718702BA6C4B8274326273AD4EF
SHA1:	24E11F6B49AC0C872A63CE22C2B4FBF5210A6E8B
SHA-256:	A674E5875BAA1E5E816246F1151DD96CB24CBDE094E0F3DBD5921E0D445A13C2
SHA-512:	05B936473EF43F95B51DF677B1B43CD50CE25F35B8528E16A7A87712CCD81AB50347C629961D113BE7FAC38CC2F905E5143BF5D38F130678E9CEC6CFAB8C6E21
Malicious:	false
URL:	https://api-5092fa72.duosecurity.com/frame/static/css/normalize.css?v=a674e
Preview:	/! normalize.css v2.1.2 \| MIT License \| git.io/normalize /../* ==========================================================================. HTML5 display definitions. ========================================================================== /../. Correct `block` display not defined in IE 8/9.. /..article,.aside,.details,.figcaption,.figure,.footer,.header,.hgroup,.main,.nav,.section,.summary {. display: block;.}../. Correct `inline-block` display not defined in IE 8/9.. /..audio,.canvas,.video {. display: inline-block;.}../. Prevent modern browsers from displaying `audio` without controls.. * Remove excess height in iOS 5 devices.. /..audio:not([controls]) {. display: none;. height: 0;.}../. Address `[hidden]` styling not present in IE 8/9.. * Hide the `template` element in IE, Safari, and Firefox < 22.. /..[hidden],.template {. display: none;.}../ ==========================================================================. Base. ==========

Chrome Cache Entry: 180

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 328 x 192, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5117
Entropy (8bit):	7.891921641985123
Encrypted:	false
SSDEEP:	96:wCNGrzlBvfsa/jCZCydFvnHQsmcGrWSZ0Bw4Q1shSRMX2gE0X5MC9erF:pUzv7/mfdF/HQJcGTiBwtuGgEMFwF
MD5:	C6362573BA9E7366A2154BF1E734CEE4
SHA1:	EB17B24CF064695E3CBE7663CF5EA738B9AC160E
SHA-256:	437F116C73CB705E80F0DAB7E0568D469740C5574EA08AD4186BE83F4615B837
SHA-512:	3B57D8AAB3D66C408F96C35993CCB9D5BAC9D6540C6931C75D0B0F158563A2203ADE5473BF80AB451960B18F976C595032980C6CEE3317E51383151B27926FB0
Malicious:	false
Preview:	.PNG........IHDR...H.........f..2....IDATx....o.g~...3.......n.2..).e...rR.qd..}k....6...Y>4X.^X..ny..Xv....Tzk.QN.-.....p........,...\|.\|..Y2Ik....\|..3#...............................Ir.^P....m.G...n.%../.O..^..XS..'.......;.{.<Y?..f.....v?.`kK.d?c..g.wK.W...<.L>..\..y..A.+z...-.N........D..:...`.J.'......U....t...ci(..6d30t...f.B.#..~...Ix.......j..j.].qG..,#..U...>Y....S...-....t;............AfS....y.T.B`]....+..y:h.a..d.m%..o.<......kE...#..>p...Z.l......1.}R.......$.F./ ....I.._..U....5......D>#$..=.H..!.mlN...M\.;..e.u\n......I.1mk1.$....!.A.]............u..&$..%\..i.d....`.cwZ')v.{^..%..J...'#l.i_8.t.kP...U....P:..vY.44......O.Ow).6.2f...h..u......UM..d.O.....Q.I.m..v.R......>~.d}.q......<....SI.....i..t....~..v3..+[..a.."Lr...U.Q...q.%=.=..J..w...i.b..?...$.....$..K l.v..k:.q.v.....m.`..p...>......N.a.....$._......R8.;3%.y..<...-...g]F2.}...)..5dp...d<.hc.. .(=M.Pq.oK`.q...R...n.K../...,w..'..M).M..{N..Cm+....F.U....-..{.R.r..7I

Chrome Cache Entry: 181

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	411
Entropy (8bit):	4.65462688732577
Encrypted:	false
SSDEEP:	12:je4JLnd1NH+upqv1LJ/VJEG6UiIdhiWOMHz:dLdHeup459TdiImWT
MD5:	12B7CD47FCCC0F8A8F64922B112873DC
SHA1:	D5ABB7270F9D25D8C02ED04D4DF59F80799AC90E
SHA-256:	400DC180F751CEDA5A22B40BD7396A8085780523FE8802EF2BB910EF4F20B171
SHA-512:	0556A8CFB6AFCEDD19E9C17A9A0F53E72C34A7183E11C38B26E32292C5B3CC537019BBD08D5B58E121C8EBCAC2995F6F24E14495D5D98436EA3523520788272F
Malicious:	false
URL:	https://api-5092fa72.duosecurity.com/frame/static/shared/lib/jquery/jquery-prologue.js?v=400dc
Preview:	// Certain runtime environments, like Electron, will define `module`.// on the global scope, which makes jQuery think it is being loaded.// in a CommonJS environment so it doesn't place itself on `window`..// The following will move `module` if it's defined so jQuery loads.// properly..(function () { try { if (typeof module === 'undefined') { window.module = module; module = undefined; } } catch (e) {}})();.

Chrome Cache Entry: 182

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (9408)
Category:	downloaded
Size (bytes):	12209
Entropy (8bit):	4.944477380279587
Encrypted:	false
SSDEEP:	192:k3o6i4IzEtvTtBhMvPkQJCPWxU45fGfJRfDfIe++9fEx9oCn2wfWfDvT5/CYfDsq:k3ostTXhaPkQJCPWxU45fGfJRfDfIeHr
MD5:	56373187E70479FDDD7DCEDB29AC0574
SHA1:	DE94669D326278F2223E3BDF2EDB9E28C46F57B8
SHA-256:	A8885806E666593EA024208A7BA66A0195D7C6252070B501BC00695BBEDAC513
SHA-512:	2CAC53462F389477425A846BB58E049DF6AFB58CD5EE33D6AF0AF2766E7DA144C07C7D25E152DA4256C7F1262C9D32EC1E8D52E634A35CE39CED335287226566
Malicious:	false
URL:	https://api-5092fa72.duosecurity.com/frame/static/fonts/ss-standard/ss-standard.css?v=a8885
Preview:	@charset "UTF-8";../. Symbolset.* www.symbolset.com.* Copyright . 2012 Oak Studios LLC.. Upload this file to your web server.* and place this within your <head> tags..* <link href="webfonts/ss-standard.css" rel="stylesheet" />./..@font-face {. font-family: "SSStandard";. src: url('ss-standard.eot');. src: url('ss-standard.eot?#iefix') format('embedded-opentype'),. url('ss-standard.woff') format('woff'),. url('ss-standard.ttf') format('truetype'),. url('ss-standard.svg#SSStandard') format('svg');. font-weight: normal;. font-style: normal;.}../ This triggers a redraw in IE to Fix IE8's :before content rendering. /.html:hover [class^="ss-"]{-ms-zoom: 1;}...ss-icon, .ss-icon.ss-standard,.[class^="ss-"]:before, [class=" ss-"]:before,.[class^="ss-"].ss-standard:before, [class=" ss-"].ss-standard:before,.[class^="ss-"].right:after, [class=" ss-"].right:after,.[class^="ss-"].ss-standard.right:after, [class*=" ss-"].ss-standard.right:after {. font-family: "SS

Chrome Cache Entry: 183

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	131
Entropy (8bit):	4.613522337964659
Encrypted:	false
SSDEEP:	3:RFnA1UVzKVWHKY4MKLFKx+0rVVLAG63/RFEaGAKDlcrIg+cBYNw:jnA1UV1HKMKe+YB63/LKDAIgrYNw
MD5:	B645B417E22264EA26A9E838DF8577B9
SHA1:	81E82700614B3A51C0DE9BE510D0DA75BE40E740
SHA-256:	C4AC5DCD7D12E242F9880AEAA777DAC52F6F48CECF4210A09E85D88656F1B1C0
SHA-512:	876C54AD2CACCF7B950544DF033D50DD74B1862554E3764ACB031435C86154BD9ECFA21F10D0FC7EDC2214FA2AB915457ABBBA5F936905BA80C78E5597A0E571
Malicious:	false
URL:	https://api-5092fa72.duosecurity.com/frame/static/shared/lib/jquery/jquery-epilogue.js?v=c4ac5
Preview:	// See jquery-prologue.js for information on why this is necessary..(function() { if (window.module) module = window.module; })();.

Chrome Cache Entry: 184

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	411
Entropy (8bit):	4.65462688732577
Encrypted:	false
SSDEEP:	12:je4JLnd1NH+upqv1LJ/VJEG6UiIdhiWOMHz:dLdHeup459TdiImWT
MD5:	12B7CD47FCCC0F8A8F64922B112873DC
SHA1:	D5ABB7270F9D25D8C02ED04D4DF59F80799AC90E
SHA-256:	400DC180F751CEDA5A22B40BD7396A8085780523FE8802EF2BB910EF4F20B171
SHA-512:	0556A8CFB6AFCEDD19E9C17A9A0F53E72C34A7183E11C38B26E32292C5B3CC537019BBD08D5B58E121C8EBCAC2995F6F24E14495D5D98436EA3523520788272F
Malicious:	false
Preview:	// Certain runtime environments, like Electron, will define `module`.// on the global scope, which makes jQuery think it is being loaded.// in a CommonJS environment so it doesn't place itself on `window`..// The following will move `module` if it's defined so jQuery loads.// properly..(function () { try { if (typeof module === 'undefined') { window.module = module; module = undefined; } } catch (e) {}})();.

Chrome Cache Entry: 185

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65139)
Category:	dropped
Size (bytes):	187220
Entropy (8bit):	5.593958706711485
Encrypted:	false
SSDEEP:	3072:tSwK4QVWbWS1Zhw6YRTrk5kqStvjCkqI53:tSBW3XZGTwSCkqIx
MD5:	12F0E7492BC5DD3CBE98E51D43142981
SHA1:	F8E8856B54C7D20E58E3531E2E7C15559660C741
SHA-256:	E90E7B98989DE529A5B21747B350D8FBA5877C79BA4806A636271AF074489F20
SHA-512:	9234DC3BA182ECBB7F7776D01588A41835579D5A2C0B10640E777937EA8E3AB52E439F54EB3A0F00FBE790D99783FBE9B5172F327660DF03DEE82A0BEC8CE8B2
Malicious:	false
Preview:	/! For license information please see trigger-endpointhealth-verification.js.LICENSE.txt /.!function(){var __webpack_modules__={1181:function(__unused_webpack_module,exports){"use strict";var _DISPLAY_KEYS,_DISPLAY_SSO_KEYS;exports.__esModule=!0,exports.WINDOWS_HELLO_PLATFORMS=exports.WINDOWS_HELLO_MIN_PLATFORM_VERSIONS=exports.WEBAUTHN_TOUCH_MIN_PLATFORM_VERSIONS=exports.WEBAUTHN_TOUCH_ID_PLATFORMS=exports.TRADITIONAL_PROMPT_EOL_DISMISSAL_KEY=exports.RBFS_BANNER_SEEN=exports.RBFS_BANNER_DISMISSAL_KEY=exports.POLICY_USE_COMPACT_VIEW=exports.POLICY_TABLE_VIEW_SET=exports.PLATFORM_WINDOWS_10=exports.PLATFORM_OSX=exports.PLATFORM_IOS=exports.KEY_NAME_ESCAPE=exports.KEY_NAME_ENTER=exports.KEYCODE_ENTER=exports.FILTER_SSO_KEYS=exports.FILTER_KEY_UNAME=exports.FILTER_KEY_UKEY=exports.FILTER_KEY_INAME=exports.FILTER_KEY_GROUPNAME=exports.FILTER_KEYS=exports.FILTER_CLIENT=exports.DTM_MONITORING_BANNER_SEEN=exports.DTM_DEVICE_REGISTRATION_NUDGE_SEEN=exports.DTM_DEVICE_REGISTRATION_BANNER_SEEN

Chrome Cache Entry: 186

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (908)
Category:	downloaded
Size (bytes):	212230
Entropy (8bit):	5.089616610892761
Encrypted:	false
SSDEEP:	6144:CseC5IkeCB+UDkqNcE2ahbMJQ6L6rR/Q9X/:CseC+keCcUDkqNcE2ahbMJQ6L6rR/Q9P
MD5:	58F4FA7B8361511D02532F7E6BFFA878
SHA1:	585E7469F499DAC7B829FE8A27AB88E45A682AEB
SHA-256:	9A14C1358B7854538C4E373681C3E8EB7E22B19FC599C470FF50FE832811AC9E
SHA-512:	38916D7E357C5DC2B7B8523509C0DF16DCEEC736BE0E7E1176B5D9F93A2929A5DCE6AD1BF5D678651F5BD74189D85E34BEFD006461F6E05D28705A9F7B3585C3
Malicious:	false
URL:	https://api-5092fa72.duosecurity.com/frame/static/css/v3/base.css?v=9a14c
Preview:	@charset "UTF-8";./! normalize.css v3.0.2 \| MIT License \| git.io/normalize /./*. 1. Set default font family to sans-serif.. * 2. Prevent iOS text size adjust after orientation change, without disabling. * user zoom.. /.html {. font-family: sans-serif;. / 1 /. -ms-text-size-adjust: 100%;. / 2 /. -webkit-text-size-adjust: 100%;. / 2 /.}../. Remove default margin.. /.body {. margin: 0;.}../ HTML5 display definitions. ========================================================================== /./. Correct `block` display not defined for any HTML5 element in IE 8/9.. * Correct `block` display not defined for `details` or `summary` in IE 10/11. * and Firefox.. * Correct `block` display not defined for `main` in IE 11.. /.article,.aside,.details,.figcaption,.figure,.footer,.header,.hgroup,.main,.menu,.nav,.section,.summary {. display: block;.}../. 1. Correct `inline-block` display not defined in IE 8/9.. * 2. Normalize vertical alignment of `progress` i

Chrome Cache Entry: 187

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 328 x 192, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5117
Entropy (8bit):	7.891921641985123
Encrypted:	false
SSDEEP:	96:wCNGrzlBvfsa/jCZCydFvnHQsmcGrWSZ0Bw4Q1shSRMX2gE0X5MC9erF:pUzv7/mfdF/HQJcGTiBwtuGgEMFwF
MD5:	C6362573BA9E7366A2154BF1E734CEE4
SHA1:	EB17B24CF064695E3CBE7663CF5EA738B9AC160E
SHA-256:	437F116C73CB705E80F0DAB7E0568D469740C5574EA08AD4186BE83F4615B837
SHA-512:	3B57D8AAB3D66C408F96C35993CCB9D5BAC9D6540C6931C75D0B0F158563A2203ADE5473BF80AB451960B18F976C595032980C6CEE3317E51383151B27926FB0
Malicious:	false
URL:	https://api-5092fa72.duosecurity.com/frame/static/img/duo-cisco-logo-green.png?v=437f1
Preview:	.PNG........IHDR...H.........f..2....IDATx....o.g~...3.......n.2..).e...rR.qd..}k....6...Y>4X.^X..ny..Xv....Tzk.QN.-.....p........,...\|.\|..Y2Ik....\|..3#...............................Ir.^P....m.G...n.%../.O..^..XS..'.......;.{.<Y?..f.....v?.`kK.d?c..g.wK.W...<.L>..\..y..A.+z...-.N........D..:...`.J.'......U....t...ci(..6d30t...f.B.#..~...Ix.......j..j.].qG..,#..U...>Y....S...-....t;............AfS....y.T.B`]....+..y:h.a..d.m%..o.<......kE...#..>p...Z.l......1.}R.......$.F./ ....I.._..U....5......D>#$..=.H..!.mlN...M\.;..e.u\n......I.1mk1.$....!.A.]............u..&$..%\..i.d....`.cwZ')v.{^..%..J...'#l.i_8.t.kP...U....P:..vY.44......O.Ow).6.2f...h..u......UM..d.O.....Q.I.m..v.R......>~.d}.q......<....SI.....i..t....~..v3..+[..a.."Lr...U.Q...q.%=.=..J..w...i.b..?...$.....$..K l.v..k:.q.v.....m.`..p...>......N.a.....$._......R8.;3%.y..<...-...g]F2.}...)..5dp...d<.hc.. .(=M.Pq.oK`.q...R...n.K../...,w..'..M).M..{N..Cm+....F.U....-..{.R.r..7I

Chrome Cache Entry: 188

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
URL:	https://api-5092fa72.duosecurity.com/frame/static/shared/lib/jquery/jquery.min.js?v=ff152
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 189

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (783)
Category:	dropped
Size (bytes):	1022
Entropy (8bit):	5.430604463503323
Encrypted:	false
SSDEEP:	24:+hB+qX/ozBGvCdcEaNUh0K3kNwwX0fLiFKvKE1tc49n:+hB+fsvC6u3kNwbWFKvKEEI
MD5:	15C30F572A0037D4FCA9A3370BC113AA
SHA1:	659DA683E0E46218ED1E9B89E53F0A304D57C9D0
SHA-256:	98C73AFA645104DA58E115405D99DFCE14731266F2F3F6DAA2DFAE8C59652A44
SHA-512:	7D2D0DA087227D8E4194285E419B78E91A5FDBB995FD58EC2DA6C9DE3B131D42E71377FA1D93E78F1E26A6D4E3E9E32DF8910358532C4835EAAF094DC561C64E
Malicious:	false
Preview:	/. jQuery postMessage - v0.5 - 9/11/2009. * http://benalman.com/projects/jquery-postmessage-plugin/. * . * Copyright (c) 2009 "Cowboy" Ben Alman. * Dual licensed under the MIT and GPL licenses.. * http://benalman.com/about/license/. /.(function($){var g,d,j=1,a,b=this,f=!1,h="postMessage",e="addEventListener",c,i=b[h];$[h]=function(k,l,m){if(!l){return}k=typeof k==="string"?k:$.param(k);m=m\|\|parent;if(i){m[h](k,l.replace(/([^:]+:\/\/[^\/]+)./,"$1"))}else{if(l){m.location=l.replace(/#.*$/,"")+"#"+(+new Date)+(j++)+"&"+k}}};$.receiveMessage=c=function(l,m,k){if(i){if(l){a&&c();a=function(n){if((typeof m==="string"&&n.origin!==m)\|\|($.isFunction(m)&&m(n.origin)===f)){return f}l(n)}}if(b[e]){b[l?e:"removeEventListener"]("message",a,f)}else{b[l?"attachEvent":"detachEvent"]("onmessage",a)}}else{g&&clearInterval(g);g=null;if(l){k=typeof m==="number"?m:typeof k==="number"?k:100;g=setInterval(function(){var o=document.location.hash,n=/^#?\d+&/;if(o!==d&&n.test(o)){d=o;l({data:o.replace(n,""

Chrome Cache Entry: 190

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5613), with no line terminators
Category:	dropped
Size (bytes):	5613
Entropy (8bit):	5.274360237354372
Encrypted:	false
SSDEEP:	96:fSTavNfV9inn87RcKssf1N7iPcztAtIVn67tDZXxSba/clU1rUcTI:fS2fDin87RcKsAN7iPe+6Vn67lMa/cld
MD5:	74345F6D79317E3A560C19367735259F
SHA1:	D2D20ADADC74001A24F26109E984AA168F4CA580
SHA-256:	9A0686D53A8640702855DB51E9B58A32F7EA2E076AD91373D1A67DD30C62DC80
SHA-512:	A3C9225A4AADD53752762AC07B6D95CBC4B20CD6A55C60B1F0959B1396549F8EBF5EF8FCBA91C4DCB25E02745593B371472C89F364C97C634E8112C808366B13
Malicious:	false
Preview:	/! validatorjs - v1.3.2 - https://github.com/skaterdav85/validatorjs - 2015-02-11 /!function(){function a(){for(var b,c,d,e,f,g=arguments[0]\|\|{},h=1,i=arguments.length;i>h;h++)if(null!=(e=arguments[h]))for(d in e)b=g[d],c=e[d],g!==c&&(c&&"object"==typeof c?(f=b&&"object"==typeof b?b:{},g[d]=a(f,c)):void 0!==c&&(g[d]=c));return g}var b={accepted:"The :attribute must be accepted.",alpha:"The :attribute field must contain only alphabetic characters.",alpha_dash:"The :attribute field may only contain alpha-numeric characters, as well as dashes and underscores.",alpha_num:"The :attribute field must be alphanumeric.",confirmed:"The :attribute confirmation does not match.",email:"The :attribute format is invalid.",def:"The :attribute attribute has errors.",digits:"The :attribute must be :digits digits.",different:"The :attribute and :different must be different.","in":"The selected :attribute is invalid.",integer:"The :attribute must be an integer.",min:{numeric:"The :attribute must be at l

Chrome Cache Entry: 191

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	550
Entropy (8bit):	4.717801247297169
Encrypted:	false
SSDEEP:	12:TjeRHVIdtklI5hfMINGlTF5TF5TF5TF5TF5TFK:neRH68ufSTPTPTPTPTPTc
MD5:	3EF7E82A6E1F10684A65E0E489EADCE7
SHA1:	C9F9C367C4D21F094922C91268234CB9FDC6D208
SHA-256:	734E1ADF3646F534F12047B8AB622FECA28C6B8474EC7D1566163D92F09B48E5
SHA-512:	8909B38DD973EEFA2B0C3443CF19651FD97C5FE074A1E3FB3452D834D259DC878AB41539FEE58E1F1B9A438142C6449A1A1F63F047D6CAA7E419C822C570BBCF
Malicious:	false
URL:	https://api-5092fa72.duosecurity.com/frame/static/v4/Portal.css
Preview:	<html>..<head><title>404 Not Found</title></head>..<body>..<center><h1>404 Not Found</h1></center>..<hr><center>Duo/1.0</center>..</body>..</html>.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->..

Static File Info

General

File type:	RFC 822 mail, ASCII text, with very long lines (320), with CRLF line terminators
Entropy (8bit):	5.464751079929368
TrID:	E-Mail message (Var. 5) (54515/1) 100.00%
File name:	Duo Security Enrollment.eml
File size:	23'907 bytes
MD5:	a823771b83c9451ab6b1c3b57e15edeb
SHA1:	5957ec904005784156339142e6f1305f0d56792a
SHA256:	5edce20c3c33e8f7b2f4f0f1c0b9c08ec6cf464c1bfe88851574b43a2871d200
SHA512:	8e940732e5a6731ab5fb0a6d994004769de659c54cc0cae52d7a9b12ad3318f0532cc547aca3f4c80e0d6394230b3a235556a44d7eec5faedd4a84a606c40d6b
SSDEEP:	192:KhB7HjAJXj0q+lpBDkJZUSXeQ/QNi26bCKHYDN5zSY8H2o1DVdU4/G02NRGtWZTR:KhB7DAJXja+JS0QAz61To/dUKxWZT7t
TLSH:	EAB27F47F7C00960CEAB49A468037B3E7F3959DA8F624C70699B7B7E0B0CDD38681249
File Content Preview:	Received: from DM4PR10MB6159.namprd10.prod.outlook.com (2603:10b6:8:ba::16) by.. MN2PR10MB3965.namprd10.prod.outlook.com with HTTPS; Mon, 30 Sep 2024 16:10:15.. +0000..Received: from CH0PR04CA0100.namprd04.prod.outlook.com (2603:10b6:610:75::15).. by DM4P

Static Mail

General

Subject:	Duo Security Enrollment
From:	Duo Security <no-reply@duosecurity.com>
To:	sbaker@msp-partner.com
Cc:
BCC:
Date:	Mon, 30 Sep 2024 16:10:09 +0000
Communications:	You don't often get email from no-reply@duosecurity.com. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification> This is an automated email from Duo Security. Your organization invites you to set up a user account for Duo. You will find instructions from your Duo administrator below. If you have questions, please reach out to your organization's IT or help desk team. Hello, Your organization is now rolling out Duo Security, a friendly and secure way for you to log into your applications. Your administrator has invited you to set up your account for Duo so you can start logging in. To begin, click this link to enroll a phone, tablet, or other device: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV Duo Security is a two-factor authentication service that strives to be easy to use and secure. To learn more about Duo authentication, visit the guide here: https://guide.duo.com/enrollment Privacy Statement <https://www.cisco.com/c/en/us/about/legal/privacy.html>
Attachments:

Headers

Key	Value
Received	from a31-130.smtp-out.amazonses.com (54.240.31.130) by CH2PEPF0000013E.mail.protection.outlook.com (10.167.244.70) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8026.11 via Frontend Transport; Mon, 30 Sep 2024 16:10:09 +0000
Authentication-Results	spf=pass (sender IP is 54.240.31.130) smtp.mailfrom=email-us-east-1.duosecurity.com; dkim=pass (signature was verified) header.d=duosecurity.com;dmarc=pass action=none header.from=duosecurity.com;compauth=pass reason=100
Received-SPF	Pass (protection.outlook.com: domain of email-us-east-1.duosecurity.com designates 54.240.31.130 as permitted sender) receiver=protection.outlook.com; client-ip=54.240.31.130; helo=a31-130.smtp-out.amazonses.com; pr=E
DKIM-Signature	v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=ug7nbtf4gccmlpwj322ax3p6ow6yfsug; d=amazonses.com; t=1727712609; h=Content-Type:MIME-Version:Subject:From:To:Date:Message-ID:Feedback-ID; bh=zjEigb7Msw85xa21zPqFh/yKYwFAPHSCzyL+JcAQQwc=; b=pAJBpuwzvRi0fr1V6j+HYqmx1UhTG0Wvg6X5OuA9FZNMgjwzJW2AMSDdllxvmAET EaisWwb/0VdYl4T4bdyKu8+obu4PfGAP5rmfbha0Y+75pxx3FXRt3h8WX/pSa/j61yJ HIOU4mgzuHaAspILbiLbTaDAtvqj6yTE3lCJlm6c=
Content-Type	multipart/alternative; boundary="===============6774703411307521116=="
Subject	Duo Security Enrollment
From	Duo Security <no-reply@duosecurity.com>
To	sbaker@msp-partner.com
Date	Mon, 30 Sep 2024 16:10:09 +0000
Message-ID	<0100019243b2435f-a039e070-c17a-458b-ab6b-e65f8d820768-000000@email.amazonses.com>
Feedback-ID	::1.us-east-1.csm6filJNqgLgthq9wA/9hQgH+TLGFmHFwGKWntRAXU=:AmazonSES
X-SES-Outgoing	2024.09.30-54.240.31.130
Return-Path	0100019243b2435f-a039e070-c17a-458b-ab6b-e65f8d820768-000000@email-us-east-1.duosecurity.com
X-MS-Exchange-Organization-ExpirationStartTime	30 Sep 2024 16:10:10.4780 (UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason	OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval	1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason	OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id	00e9f564-87cc-4dc0-8fc9-08dce16a5bec
X-EOPAttributedMessage	0
X-EOPTenantAttributedMessage	87ed6401-a239-4608-8d7a-1fcadd9f945c:0
X-MS-Exchange-Organization-MessageDirectionality	Incoming
X-MS-PublicTrafficType	Email
X-MS-TrafficTypeDiagnostic	CH2PEPF0000013E:EE_\|DM4PR10MB6159:EE_\|MN2PR10MB3965:EE_
X-MS-Exchange-Organization-AuthSource	CH2PEPF0000013E.namprd02.prod.outlook.com
X-MS-Exchange-Organization-AuthAs	Anonymous
X-MS-Office365-Filtering-Correlation-Id	00e9f564-87cc-4dc0-8fc9-08dce16a5bec
X-MS-Exchange-AtpMessageProperties	SA\|SL
X-MS-Exchange-Organization-SCL	1
X-Microsoft-Antispam	BCL:3;ARA:13230040\|13102899012\|5062899012\|13012899012\|3092899012\|2092899012\|3072899012\|4092899012\|12012899012\|32142699015\|5082899009\|43540500003;
X-Forefront-Antispam-Report	CIP:54.240.31.130;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:a31-130.smtp-out.amazonses.com;PTR:a31-130.smtp-out.amazonses.com;CAT:NONE;SFTY:9.25;SFS:(13230040)(13102899012)(5062899012)(13012899012)(3092899012)(2092899012)(3072899012)(4092899012)(12012899012)(32142699015)(5082899009)(43540500003);DIR:INB;SFTY:9.25;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	30 Sep 2024 16:10:09.8218 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id	00e9f564-87cc-4dc0-8fc9-08dce16a5bec
X-MS-Exchange-CrossTenant-Id	87ed6401-a239-4608-8d7a-1fcadd9f945c
X-MS-Exchange-CrossTenant-AuthSource	CH2PEPF0000013E.namprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs	Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader	Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped	DM4PR10MB6159
X-MS-Exchange-Transport-EndToEndLatency	00:00:05.9380482
X-MS-Exchange-Processed-By-BccFoldering	15.20.8026.009
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
X-Microsoft-Antispam-Message-Info	+JdVPF4xMrKeLx+v6FtTrZvMkbrICa/rJcZ0LF/6Qk8JKmOi0jhzE6WxBC47D3UQBzsLiNW+290wUhtxbfBWu9/EDW4KbMge0rAyNLeG0LwO4jPmxu71mAwoWlB+KmaRQwL8Ibq/IdZ8uvhcx8zJ1r8tOehd9GgV6TFO0SCNkw1LlANXztFk8/aZolbY2yCkohMT5+h3IzC6kIZAMDsn0YV1EGYeQneY45zv7cwr1MOucu8cITFHE0OJtjY5Glqh0clpwQjL0/zg/ZfNskN/N1zUezL9JM1i0JEvDE6gRnZ+ZqI/UPV0JasMcmskQVfvJEXrpI4AaenxUJD8RByKMRTRB7kPPc4V5EWPYDaemyHY/quWRnZLg7Pa8ZT0ldJ/MV9r10Bf1SjKKBJ1H2CUj0HRW6HG3LLWms8gBP7CqysWoXElmohv8YC6NuZLHf5GdZoKta0L9tEDk65NuQMlkbZsUu5qOuneyBCHexVKRdM2EtEGTNYrVTOqhn7rpzeFDImJBhTFWYTTFfKzscA8DEc905PCZmVdOaN0tKbq1SFWiSween4qsdRg/NeycHWKwg8LU8SGKJpnGf/6a5x7GIlSEPcI1BAxINBKqgJFvqCyV1pR9E84sOF8ATxqSckkt48Y8kSAH+3hRwVttJEp8QLxwe4++pBLpn4Lp1FelqTjGpRZ6shute0OGZ4291Np2H9XCfBWhL60cSlHPT7YHFsG6/JdYUJayPhjcoqwKxE++DErVRS8xEia+GFfR6jcd/e0x/+n6hkDQsFvX20RkEcXKS/jpZ8YpvFizmm/dnb4BF6rsHQRyFZD62nZp/p31xG3MMgKoKVdF/G8CglWF9OnZO6teL16KgoQGD4KvbI6oDaNyFU02Ff0nNoL8A1jr1QJgrFY9bIgLtH0H+F6WzpjKp0Ejw/4pJBHRMNZyGNwgudleTNoSIAJ8iF6AsCveVhdS580/bzUC0bkTNKDP0Kww/KdY4tJ5sXZhpAIYk9GoKTq2lgpAw6gvLlyM6/C7fSWMK3cHRwUu1X9nAkpR0G3Tlj/iMDYVCDjpx/WsX/f4P/6EpxvBUSPiGTLHLBuX4X319+F88NHnCI2hLeqqaIOLJYtzkO6GOKvoxcgfTus1w8AMCrGk7CFBPtyWmpjgnWdY62cWytzdzSD9EuMmXX00xwl+FSJbTLCczwzn2oJd0eSnxNB36wlDWpYQQn2eVrx0YRY+kTmS0JMaiY3ww0REBd52ihs39C88O9SVhazsMURnnbWz1EKwDkjv7fWeefMfm/6YRRqC6lNp2wyIyDjdd2ifYaZ0cxY5fdGuR5ptdQaVuZyLWzWCtl085wbW1y3bBt1bclsNyv+bL96PRPK+zBibeFQgn73nWHPorltSQXjqU/plp36YUX+v6KpP3kW8VfyPLz1Gg+A0xofum/tyElTgocxOKYP5rPZza920svpKFMsjr4e6oFOY3amTJbmjMD7menRDatIl1ZlJ66qBOrtYXJb+pQen9lYWqqtRPggJ8xQ1YgOemX9CJ9+athX644TqAf2A1TMUc4nGMnusUWuzEq3ag/B8XzIoJMQGdN1Y7Zw9UULn/OtkcB8iJuIfGeVpPTa1RBJnnLb+8pQGkelrvFao4ASDljWaz9d5xh5vDbbapdSoQnYa+pk1MgchSA4S+H7NYLh0G7e7cSWCscEHIoQ9AI1MPz5RMBhgh1kl45zSF+2mSNWXqkvoxOljnTfEFL9zbOiUK+OGtFk4UkLNTBi6reaYxyTmF++2gIsbJ3cMZn3KQK1THj18FW2kyCQhMkv9clWlElf/k2LWQub5eF0qDZwNyHyoRKo6JgBCT05eh/+mynuRcqOmrPGXk5V9SLGOJxYUnzoSrDRFbZ9w7gbM4bc7xGlW0sc2o5/YnWk3O7yt2AS8c3O1UV66KARjT5fHX4XONFqx/FEb6vY/uafFlbfu3rpFrXwKDGZpbtC+pK2mok+6fLCdy9ME/w/CeKXpDP36S65+P/4Lr9EfEsYx3OcXursq41tHOHMy75I5Ukqdekl/KFGDd7MQp8gXZ5MudjPuGMTlpIxza0zMl5ngmJwMQkWyoyarOv+z6QiMHI/2syaHBtjqYoNJ0WgCgHXXv/Lz5rUKIW1lnvU1ZeEiw7uNy6UNsBGn+5OiGVG7R8d+QXavqK4
MIME-Version	1.0

File Icon


Icon Hash:	46070c0a8e0c67d6

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 19:03:48.215250969 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 1, 2024 19:03:48.517788887 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 1, 2024 19:03:49.124778986 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 1, 2024 19:03:50.331792116 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 1, 2024 19:03:51.229047060 CEST	49689	80	192.168.2.16	192.229.211.108
Oct 1, 2024 19:03:52.040014029 CEST	49705	443	192.168.2.16	20.114.59.183
Oct 1, 2024 19:03:52.040076017 CEST	443	49705	20.114.59.183	192.168.2.16
Oct 1, 2024 19:03:52.040173054 CEST	49705	443	192.168.2.16	20.114.59.183
Oct 1, 2024 19:03:52.045914888 CEST	49705	443	192.168.2.16	20.114.59.183
Oct 1, 2024 19:03:52.045949936 CEST	443	49705	20.114.59.183	192.168.2.16
Oct 1, 2024 19:03:52.739412069 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 1, 2024 19:03:52.849982977 CEST	443	49705	20.114.59.183	192.168.2.16
Oct 1, 2024 19:03:52.850064993 CEST	49705	443	192.168.2.16	20.114.59.183
Oct 1, 2024 19:03:52.852580070 CEST	49705	443	192.168.2.16	20.114.59.183
Oct 1, 2024 19:03:52.852598906 CEST	443	49705	20.114.59.183	192.168.2.16
Oct 1, 2024 19:03:52.852818966 CEST	443	49705	20.114.59.183	192.168.2.16
Oct 1, 2024 19:03:52.897787094 CEST	49705	443	192.168.2.16	20.114.59.183
Oct 1, 2024 19:03:52.905323982 CEST	49705	443	192.168.2.16	20.114.59.183
Oct 1, 2024 19:03:52.951405048 CEST	443	49705	20.114.59.183	192.168.2.16
Oct 1, 2024 19:03:53.192778111 CEST	443	49705	20.114.59.183	192.168.2.16
Oct 1, 2024 19:03:53.192804098 CEST	443	49705	20.114.59.183	192.168.2.16
Oct 1, 2024 19:03:53.192811012 CEST	443	49705	20.114.59.183	192.168.2.16
Oct 1, 2024 19:03:53.192817926 CEST	443	49705	20.114.59.183	192.168.2.16
Oct 1, 2024 19:03:53.192846060 CEST	443	49705	20.114.59.183	192.168.2.16
Oct 1, 2024 19:03:53.192897081 CEST	49705	443	192.168.2.16	20.114.59.183
Oct 1, 2024 19:03:53.192897081 CEST	49705	443	192.168.2.16	20.114.59.183
Oct 1, 2024 19:03:53.192936897 CEST	443	49705	20.114.59.183	192.168.2.16
Oct 1, 2024 19:03:53.192995071 CEST	49705	443	192.168.2.16	20.114.59.183
Oct 1, 2024 19:03:53.193125010 CEST	443	49705	20.114.59.183	192.168.2.16
Oct 1, 2024 19:03:53.193186045 CEST	49705	443	192.168.2.16	20.114.59.183
Oct 1, 2024 19:03:53.193202019 CEST	443	49705	20.114.59.183	192.168.2.16
Oct 1, 2024 19:03:53.193314075 CEST	443	49705	20.114.59.183	192.168.2.16
Oct 1, 2024 19:03:53.193370104 CEST	49705	443	192.168.2.16	20.114.59.183
Oct 1, 2024 19:03:53.203543901 CEST	49705	443	192.168.2.16	20.114.59.183
Oct 1, 2024 19:03:53.203560114 CEST	443	49705	20.114.59.183	192.168.2.16
Oct 1, 2024 19:03:53.203572989 CEST	49705	443	192.168.2.16	20.114.59.183
Oct 1, 2024 19:03:53.203578949 CEST	443	49705	20.114.59.183	192.168.2.16
Oct 1, 2024 19:03:54.441174984 CEST	49708	443	192.168.2.16	184.28.90.27
Oct 1, 2024 19:03:54.441250086 CEST	443	49708	184.28.90.27	192.168.2.16
Oct 1, 2024 19:03:54.445230007 CEST	49708	443	192.168.2.16	184.28.90.27
Oct 1, 2024 19:03:54.449383020 CEST	49708	443	192.168.2.16	184.28.90.27
Oct 1, 2024 19:03:54.449413061 CEST	443	49708	184.28.90.27	192.168.2.16
Oct 1, 2024 19:03:55.124562025 CEST	443	49708	184.28.90.27	192.168.2.16
Oct 1, 2024 19:03:55.124649048 CEST	49708	443	192.168.2.16	184.28.90.27
Oct 1, 2024 19:03:55.126693010 CEST	49708	443	192.168.2.16	184.28.90.27
Oct 1, 2024 19:03:55.126723051 CEST	443	49708	184.28.90.27	192.168.2.16
Oct 1, 2024 19:03:55.127259970 CEST	443	49708	184.28.90.27	192.168.2.16
Oct 1, 2024 19:03:55.183959007 CEST	49708	443	192.168.2.16	184.28.90.27
Oct 1, 2024 19:03:55.207310915 CEST	49708	443	192.168.2.16	184.28.90.27
Oct 1, 2024 19:03:55.247442961 CEST	443	49708	184.28.90.27	192.168.2.16
Oct 1, 2024 19:03:55.406589985 CEST	443	49708	184.28.90.27	192.168.2.16
Oct 1, 2024 19:03:55.406744957 CEST	443	49708	184.28.90.27	192.168.2.16
Oct 1, 2024 19:03:55.406810045 CEST	49708	443	192.168.2.16	184.28.90.27
Oct 1, 2024 19:03:55.406810045 CEST	49708	443	192.168.2.16	184.28.90.27
Oct 1, 2024 19:03:55.406874895 CEST	443	49708	184.28.90.27	192.168.2.16
Oct 1, 2024 19:03:55.406929970 CEST	49708	443	192.168.2.16	184.28.90.27
Oct 1, 2024 19:03:55.406946898 CEST	443	49708	184.28.90.27	192.168.2.16
Oct 1, 2024 19:03:55.439181089 CEST	49709	443	192.168.2.16	184.28.90.27
Oct 1, 2024 19:03:55.439218044 CEST	443	49709	184.28.90.27	192.168.2.16
Oct 1, 2024 19:03:55.439285994 CEST	49709	443	192.168.2.16	184.28.90.27
Oct 1, 2024 19:03:55.439666033 CEST	49709	443	192.168.2.16	184.28.90.27
Oct 1, 2024 19:03:55.439681053 CEST	443	49709	184.28.90.27	192.168.2.16
Oct 1, 2024 19:03:56.122095108 CEST	443	49709	184.28.90.27	192.168.2.16
Oct 1, 2024 19:03:56.122267008 CEST	49709	443	192.168.2.16	184.28.90.27
Oct 1, 2024 19:03:56.123255014 CEST	49709	443	192.168.2.16	184.28.90.27
Oct 1, 2024 19:03:56.123265982 CEST	443	49709	184.28.90.27	192.168.2.16
Oct 1, 2024 19:03:56.124231100 CEST	443	49709	184.28.90.27	192.168.2.16
Oct 1, 2024 19:03:56.125228882 CEST	49709	443	192.168.2.16	184.28.90.27
Oct 1, 2024 19:03:56.167395115 CEST	443	49709	184.28.90.27	192.168.2.16
Oct 1, 2024 19:03:56.390002966 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 1, 2024 19:03:56.402694941 CEST	443	49709	184.28.90.27	192.168.2.16
Oct 1, 2024 19:03:56.402836084 CEST	443	49709	184.28.90.27	192.168.2.16
Oct 1, 2024 19:03:56.403481960 CEST	49709	443	192.168.2.16	184.28.90.27
Oct 1, 2024 19:03:56.403502941 CEST	49709	443	192.168.2.16	184.28.90.27
Oct 1, 2024 19:03:56.403502941 CEST	49709	443	192.168.2.16	184.28.90.27
Oct 1, 2024 19:03:56.403521061 CEST	443	49709	184.28.90.27	192.168.2.16
Oct 1, 2024 19:03:56.403527975 CEST	443	49709	184.28.90.27	192.168.2.16
Oct 1, 2024 19:03:56.642126083 CEST	49710	443	192.168.2.16	40.126.32.68
Oct 1, 2024 19:03:56.642158985 CEST	443	49710	40.126.32.68	192.168.2.16
Oct 1, 2024 19:03:56.642440081 CEST	49710	443	192.168.2.16	40.126.32.68
Oct 1, 2024 19:03:56.642580986 CEST	49710	443	192.168.2.16	40.126.32.68
Oct 1, 2024 19:03:56.642591953 CEST	443	49710	40.126.32.68	192.168.2.16
Oct 1, 2024 19:03:56.692794085 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 1, 2024 19:03:57.297828913 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 1, 2024 19:03:57.474143028 CEST	443	49710	40.126.32.68	192.168.2.16
Oct 1, 2024 19:03:57.474236012 CEST	49710	443	192.168.2.16	40.126.32.68
Oct 1, 2024 19:03:57.488207102 CEST	49710	443	192.168.2.16	40.126.32.68
Oct 1, 2024 19:03:57.488219976 CEST	443	49710	40.126.32.68	192.168.2.16
Oct 1, 2024 19:03:57.489178896 CEST	443	49710	40.126.32.68	192.168.2.16
Oct 1, 2024 19:03:57.489634037 CEST	49710	443	192.168.2.16	40.126.32.68
Oct 1, 2024 19:03:57.489665985 CEST	49710	443	192.168.2.16	40.126.32.68
Oct 1, 2024 19:03:57.489722967 CEST	443	49710	40.126.32.68	192.168.2.16
Oct 1, 2024 19:03:57.552778006 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 1, 2024 19:03:57.868837118 CEST	443	49710	40.126.32.68	192.168.2.16
Oct 1, 2024 19:03:57.868905067 CEST	443	49710	40.126.32.68	192.168.2.16
Oct 1, 2024 19:03:57.868940115 CEST	443	49710	40.126.32.68	192.168.2.16
Oct 1, 2024 19:03:57.868969917 CEST	49710	443	192.168.2.16	40.126.32.68
Oct 1, 2024 19:03:57.868985891 CEST	443	49710	40.126.32.68	192.168.2.16
Oct 1, 2024 19:03:57.868998051 CEST	49710	443	192.168.2.16	40.126.32.68
Oct 1, 2024 19:03:57.869177103 CEST	49710	443	192.168.2.16	40.126.32.68
Oct 1, 2024 19:03:57.869185925 CEST	443	49710	40.126.32.68	192.168.2.16
Oct 1, 2024 19:03:57.869198084 CEST	49710	443	192.168.2.16	40.126.32.68
Oct 1, 2024 19:03:57.869235992 CEST	443	49710	40.126.32.68	192.168.2.16
Oct 1, 2024 19:03:57.869288921 CEST	49710	443	192.168.2.16	40.126.32.68
Oct 1, 2024 19:03:57.869302034 CEST	443	49710	40.126.32.68	192.168.2.16
Oct 1, 2024 19:03:58.510802031 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 1, 2024 19:03:58.695888996 CEST	49714	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:03:58.695919037 CEST	443	49714	52.32.63.141	192.168.2.16
Oct 1, 2024 19:03:58.695988894 CEST	49714	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:03:58.696397066 CEST	49714	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:03:58.696410894 CEST	443	49714	52.32.63.141	192.168.2.16
Oct 1, 2024 19:03:59.334763050 CEST	443	49714	52.32.63.141	192.168.2.16
Oct 1, 2024 19:03:59.338208914 CEST	49714	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:03:59.338233948 CEST	443	49714	52.32.63.141	192.168.2.16
Oct 1, 2024 19:03:59.340368032 CEST	443	49714	52.32.63.141	192.168.2.16
Oct 1, 2024 19:03:59.340439081 CEST	49714	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:03:59.349829912 CEST	49714	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:03:59.349893093 CEST	443	49714	52.32.63.141	192.168.2.16
Oct 1, 2024 19:03:59.350028992 CEST	49714	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:03:59.350037098 CEST	443	49714	52.32.63.141	192.168.2.16
Oct 1, 2024 19:03:59.403784990 CEST	49714	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:03:59.590080023 CEST	443	49714	52.32.63.141	192.168.2.16
Oct 1, 2024 19:03:59.590122938 CEST	443	49714	52.32.63.141	192.168.2.16
Oct 1, 2024 19:03:59.590344906 CEST	49714	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:03:59.591083050 CEST	49714	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:03:59.591094971 CEST	443	49714	52.32.63.141	192.168.2.16
Oct 1, 2024 19:03:59.604743004 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:03:59.604847908 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:03:59.604927063 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:03:59.605201960 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:03:59.605249882 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:03:59.605986118 CEST	49716	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:03:59.606029987 CEST	443	49716	52.32.63.141	192.168.2.16
Oct 1, 2024 19:03:59.606195927 CEST	49716	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:03:59.606287956 CEST	49717	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:03:59.606311083 CEST	443	49717	52.32.63.141	192.168.2.16
Oct 1, 2024 19:03:59.606411934 CEST	49717	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:03:59.606563091 CEST	49716	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:03:59.606578112 CEST	443	49716	52.32.63.141	192.168.2.16
Oct 1, 2024 19:03:59.606801987 CEST	49717	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:03:59.606818914 CEST	443	49717	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.220247030 CEST	443	49717	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.220515966 CEST	49717	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.220525980 CEST	443	49717	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.221410036 CEST	443	49717	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.221482038 CEST	49717	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.221777916 CEST	49717	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.221828938 CEST	443	49717	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.221949100 CEST	49717	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.221955061 CEST	443	49717	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.253581047 CEST	443	49716	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.253873110 CEST	49716	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.253890038 CEST	443	49716	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.254250050 CEST	443	49716	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.254618883 CEST	49716	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.254687071 CEST	443	49716	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.254770041 CEST	49716	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.263742924 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.264161110 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.264187098 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.264483929 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.264827967 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.264883041 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.264970064 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.276776075 CEST	49717	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.295396090 CEST	443	49716	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.311393023 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.400088072 CEST	443	49717	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.400135040 CEST	443	49717	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.400300026 CEST	49717	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.400914907 CEST	49717	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.400929928 CEST	443	49717	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.504192114 CEST	443	49716	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.504215002 CEST	443	49716	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.504270077 CEST	49716	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.504278898 CEST	443	49716	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.504328012 CEST	49716	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.505027056 CEST	49716	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.505048990 CEST	443	49716	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.528769016 CEST	49718	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:00.528795004 CEST	443	49718	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:00.529089928 CEST	49718	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:00.529273033 CEST	49718	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:00.529285908 CEST	443	49718	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:00.596504927 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.596525908 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.596540928 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.596602917 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.596630096 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.596776009 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.616018057 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.616039038 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.616087914 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.616099119 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.616151094 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.616151094 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.674176931 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.674191952 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.674298048 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.674319983 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.674519062 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.710145950 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.710160017 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.710230112 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.710242033 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.710309982 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.712403059 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.712419033 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.712721109 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.712728024 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.713162899 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.714174032 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.714186907 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.714325905 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.714337111 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.714570045 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.803039074 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.803056002 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.803201914 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.803219080 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.803266048 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.804084063 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.804100990 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.804508924 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.804516077 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.804574013 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.805069923 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.805085897 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.805155039 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.805161953 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.805223942 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.806711912 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.806727886 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.807037115 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.807045937 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.807188988 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.807854891 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.807878017 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.807952881 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.807952881 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.807960987 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.807996035 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.808799028 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.808814049 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.808934927 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.808943033 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.809072971 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.852216005 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 1, 2024 19:04:00.870923042 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.870984077 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.871009111 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.871212959 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.871413946 CEST	49715	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.871431112 CEST	443	49715	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.876039028 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:00.876070976 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:00.876208067 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:00.876324892 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:00.876333952 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:00.890995026 CEST	49720	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.891083956 CEST	443	49720	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.891366959 CEST	49721	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.891411066 CEST	443	49721	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.891447067 CEST	49720	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.891496897 CEST	49721	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.891871929 CEST	49721	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.891889095 CEST	443	49721	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.892183065 CEST	49720	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:00.892219067 CEST	443	49720	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:00.914885998 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 1, 2024 19:04:01.152870893 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 1, 2024 19:04:01.164652109 CEST	443	49718	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.164989948 CEST	49718	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.165014982 CEST	443	49718	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.169184923 CEST	443	49718	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.169490099 CEST	49718	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.169627905 CEST	49718	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.169775963 CEST	443	49718	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.169805050 CEST	49718	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.215398073 CEST	443	49718	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.215790033 CEST	49718	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.215799093 CEST	443	49718	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.262887955 CEST	49718	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.408473969 CEST	443	49718	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.408524990 CEST	443	49718	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.408545017 CEST	443	49718	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.408634901 CEST	49718	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.408657074 CEST	443	49718	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.408669949 CEST	49718	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.408803940 CEST	443	49718	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.408926964 CEST	49718	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.409652948 CEST	49718	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.409663916 CEST	443	49718	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.409693956 CEST	49718	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.409786940 CEST	49718	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.507791042 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.508116007 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.508138895 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.509567976 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.509736061 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.510176897 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.510255098 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.510315895 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.510322094 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.523143053 CEST	443	49721	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:01.523510933 CEST	49721	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:01.523531914 CEST	443	49721	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:01.523852110 CEST	443	49721	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:01.524300098 CEST	49721	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:01.524300098 CEST	49721	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:01.524317026 CEST	443	49721	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:01.524358988 CEST	443	49721	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:01.524899960 CEST	443	49720	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:01.527626038 CEST	49720	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:01.527663946 CEST	443	49720	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:01.528054953 CEST	443	49720	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:01.528348923 CEST	49720	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:01.528414965 CEST	443	49720	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:01.550785065 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.566840887 CEST	49721	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:01.582782030 CEST	49720	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:01.758842945 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 1, 2024 19:04:01.823951960 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.824018955 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.824039936 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.824080944 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.824091911 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.824115992 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.824125051 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.824152946 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.824172974 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.836854935 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.836898088 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.836935043 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.836944103 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.836978912 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.836997986 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.910635948 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.910682917 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.910712004 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.910722971 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.910774946 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.923551083 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.923621893 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.923625946 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.923651934 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.923683882 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.923703909 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.925256968 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.925302029 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.925339937 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.925344944 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.925367117 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.925389051 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.926909924 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.926949978 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.926978111 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.926983118 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.927009106 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.927027941 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.998661995 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.998739004 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:01.998773098 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:01.998833895 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:02.009888887 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:02.009958029 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:02.009960890 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:02.009984970 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:02.010009050 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:02.010025978 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:02.010852098 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:02.010894060 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:02.010919094 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:02.010925055 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:02.010970116 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:02.010982037 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:02.011748075 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:02.011821985 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:02.011822939 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:02.011845112 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:02.011884928 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:02.011908054 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:02.012729883 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:02.012768984 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:02.012799978 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:02.012806892 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:02.012825966 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:02.012860060 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:02.047960043 CEST	443	49721	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.047977924 CEST	443	49721	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.048017025 CEST	443	49721	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.048033953 CEST	443	49721	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.048037052 CEST	49721	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.048042059 CEST	443	49721	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.048089981 CEST	49721	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.048695087 CEST	49721	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.048726082 CEST	443	49721	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.060239077 CEST	49724	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.060265064 CEST	443	49724	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.060339928 CEST	49724	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.060580015 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.060609102 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.060796022 CEST	49726	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.060806036 CEST	443	49726	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.060813904 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.060848951 CEST	49726	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.061018944 CEST	49727	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.061026096 CEST	443	49727	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.061073065 CEST	49727	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.061259031 CEST	49728	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.061326027 CEST	443	49728	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.061367989 CEST	49720	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.061449051 CEST	49728	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.061554909 CEST	49724	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.061568975 CEST	443	49724	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.061798096 CEST	49726	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.061809063 CEST	443	49726	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.061923027 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.061932087 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.062062025 CEST	49727	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.062072992 CEST	443	49727	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.062196970 CEST	49728	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.062227011 CEST	443	49728	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.071686029 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:02.071743965 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:02.071779966 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:02.071785927 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:02.071816921 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:02.071831942 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:02.084292889 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:02.084366083 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:02.084372044 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:02.084462881 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:02.084517956 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:02.084532022 CEST	49719	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:02.084542036 CEST	443	49719	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:02.107405901 CEST	443	49720	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.234951973 CEST	443	49720	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.234977961 CEST	443	49720	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.234983921 CEST	443	49720	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.235021114 CEST	443	49720	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.235035896 CEST	443	49720	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.235060930 CEST	49720	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.235109091 CEST	49720	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.236095905 CEST	49720	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.236125946 CEST	443	49720	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.236479044 CEST	49729	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.236535072 CEST	443	49729	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.236625910 CEST	49729	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.237015963 CEST	49729	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.237042904 CEST	443	49729	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.689783096 CEST	443	49727	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.690037966 CEST	49727	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.690062046 CEST	443	49727	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.690804005 CEST	443	49728	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.691004038 CEST	49728	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.691063881 CEST	443	49728	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.691091061 CEST	443	49727	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.691159964 CEST	49727	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.691430092 CEST	49727	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.691513062 CEST	443	49727	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.691987991 CEST	443	49728	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.692063093 CEST	49728	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.692281961 CEST	49727	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.692289114 CEST	443	49727	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.692523956 CEST	49728	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.692589998 CEST	443	49728	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.692643881 CEST	49728	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.694674969 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.694842100 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.694865942 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.695610046 CEST	443	49726	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.695768118 CEST	49726	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.695775986 CEST	443	49726	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.695791960 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.695851088 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.696099043 CEST	443	49726	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.696158886 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.696212053 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.696386099 CEST	49726	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.696443081 CEST	443	49726	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.696527958 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.696533918 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.696592093 CEST	49726	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.697181940 CEST	443	49724	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.697370052 CEST	49724	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.697382927 CEST	443	49724	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.697681904 CEST	443	49724	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.698007107 CEST	49724	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.698057890 CEST	443	49724	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.698087931 CEST	49724	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.738770962 CEST	49727	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.738797903 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.738799095 CEST	49724	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.738804102 CEST	443	49724	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.738810062 CEST	49728	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.738833904 CEST	443	49728	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.743396997 CEST	443	49726	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.786792994 CEST	49728	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.877818108 CEST	443	49729	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.878051043 CEST	49729	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.878067970 CEST	443	49729	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.879530907 CEST	443	49729	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.879590034 CEST	49729	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.879829884 CEST	49729	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.879904985 CEST	443	49729	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.879954100 CEST	49729	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.927393913 CEST	443	49729	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.929785013 CEST	49729	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.929792881 CEST	443	49729	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.938404083 CEST	443	49728	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.938433886 CEST	443	49728	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.938441038 CEST	443	49728	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.938486099 CEST	443	49728	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.938530922 CEST	443	49728	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.938543081 CEST	49728	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.938580036 CEST	49728	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.939265013 CEST	49728	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.939296007 CEST	443	49728	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.939579964 CEST	443	49727	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.939603090 CEST	443	49727	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.939610004 CEST	443	49727	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.939640045 CEST	443	49727	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.939654112 CEST	49727	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.939672947 CEST	443	49727	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.939702034 CEST	49727	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.939718962 CEST	49727	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.941324949 CEST	49730	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.941350937 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.941519976 CEST	49730	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.941864014 CEST	49730	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.941874981 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.942132950 CEST	49727	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.942146063 CEST	443	49727	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.943484068 CEST	443	49726	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.943502903 CEST	443	49726	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.943547010 CEST	443	49726	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.943547964 CEST	49726	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.943594933 CEST	49726	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.943631887 CEST	49731	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.943679094 CEST	443	49731	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.943820953 CEST	49731	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.944026947 CEST	49731	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.944061041 CEST	443	49731	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.944336891 CEST	49726	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.944353104 CEST	443	49726	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.945982933 CEST	49732	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.946001053 CEST	443	49732	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.946160078 CEST	49732	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.946305990 CEST	49732	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.946314096 CEST	443	49732	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.951878071 CEST	443	49724	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.951931953 CEST	443	49724	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.951983929 CEST	49724	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.952512026 CEST	49724	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.952518940 CEST	443	49724	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.954175949 CEST	49733	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.954201937 CEST	443	49733	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.954271078 CEST	49733	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.954454899 CEST	49733	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:02.954468012 CEST	443	49733	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:02.955311060 CEST	49734	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:02.955343008 CEST	443	49734	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:02.955401897 CEST	49734	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:02.955574036 CEST	49734	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:02.955589056 CEST	443	49734	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:02.961793900 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 1, 2024 19:04:02.977797031 CEST	49729	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.018691063 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.018754005 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.018774986 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.018811941 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.018824100 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.018840075 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.018867016 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.018887997 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.018893003 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.035279989 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.035343885 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.035367012 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.035376072 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.035418034 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.109179020 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.109278917 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.109285116 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.109303951 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.109328032 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.109350920 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.125484943 CEST	443	49729	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.125536919 CEST	443	49729	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.125555992 CEST	443	49729	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.125595093 CEST	49729	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.125608921 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.125643969 CEST	443	49729	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.125649929 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.125680923 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.125686884 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.125688076 CEST	49729	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.125694990 CEST	443	49729	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.125705004 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.125714064 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.125777006 CEST	49729	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.126624107 CEST	49729	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.126655102 CEST	443	49729	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.126972914 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.127013922 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.127042055 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.127046108 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.127089977 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.127964973 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.128006935 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.128034115 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.128038883 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.128081083 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.129137993 CEST	49735	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.129177094 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.129235029 CEST	49735	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.129837990 CEST	49735	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.129856110 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.130275965 CEST	49736	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:03.130341053 CEST	443	49736	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:03.130513906 CEST	49736	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:03.130717039 CEST	49736	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:03.130744934 CEST	443	49736	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:03.200217962 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.200277090 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.200308084 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.200320959 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.200364113 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.216190100 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.216231108 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.216269016 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.216275930 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.216316938 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.216737986 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.216774940 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.216801882 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.216806889 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.216855049 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.217745066 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.217789888 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.217813015 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.217817068 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.217844009 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.217858076 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.218812943 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.218856096 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.218883038 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.218888044 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.218931913 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.275562048 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.275608063 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.275650978 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.275660038 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.275701046 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.291218042 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.291260958 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.291290998 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.291299105 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.291353941 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.291357994 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.291551113 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.291605949 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.291611910 CEST	443	49725	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.291671991 CEST	49725	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.294457912 CEST	49737	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.294491053 CEST	443	49737	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.294576883 CEST	49737	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.294812918 CEST	49737	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.294826984 CEST	443	49737	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.519577026 CEST	49738	443	192.168.2.16	142.250.186.164
Oct 1, 2024 19:04:03.519609928 CEST	443	49738	142.250.186.164	192.168.2.16
Oct 1, 2024 19:04:03.519678116 CEST	49738	443	192.168.2.16	142.250.186.164
Oct 1, 2024 19:04:03.519943953 CEST	49738	443	192.168.2.16	142.250.186.164
Oct 1, 2024 19:04:03.519954920 CEST	443	49738	142.250.186.164	192.168.2.16
Oct 1, 2024 19:04:03.550659895 CEST	443	49731	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.550914049 CEST	49731	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.550975084 CEST	443	49731	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.551306963 CEST	443	49731	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.551666021 CEST	49731	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.551728010 CEST	443	49731	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.551825047 CEST	49731	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.553391933 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.553597927 CEST	49730	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.553637981 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.554857969 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.555200100 CEST	49730	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.555314064 CEST	49730	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.555326939 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.555376053 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.560401917 CEST	443	49734	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:03.560633898 CEST	49734	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:03.560647011 CEST	443	49734	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:03.560996056 CEST	443	49734	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:03.561366081 CEST	49734	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:03.561422110 CEST	443	49734	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:03.561501026 CEST	49734	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:03.567878962 CEST	443	49733	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.568062067 CEST	49733	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.568072081 CEST	443	49733	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.568973064 CEST	443	49733	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.569098949 CEST	49733	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.569349051 CEST	49733	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.569416046 CEST	443	49733	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.569549084 CEST	49733	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.572062969 CEST	443	49732	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.572249889 CEST	49732	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.572262049 CEST	443	49732	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.573101997 CEST	443	49732	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.573160887 CEST	49732	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.573435068 CEST	49732	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.573474884 CEST	443	49732	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.573596001 CEST	49732	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.573600054 CEST	443	49732	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.595423937 CEST	443	49731	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.600802898 CEST	49730	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.600817919 CEST	49731	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.607394934 CEST	443	49734	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:03.615391016 CEST	443	49733	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.616775990 CEST	49732	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.616863966 CEST	49733	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.616873980 CEST	443	49733	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.664793968 CEST	49733	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.734302998 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.734575987 CEST	49735	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.734587908 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.738015890 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.738089085 CEST	49735	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.738374949 CEST	49735	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.738457918 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.738501072 CEST	49735	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.742245913 CEST	443	49736	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:03.742439985 CEST	49736	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:03.742469072 CEST	443	49736	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:03.742778063 CEST	443	49736	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:03.743057966 CEST	49736	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:03.743123055 CEST	443	49736	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:03.743135929 CEST	49736	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:03.779452085 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.783449888 CEST	443	49736	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:03.792799950 CEST	49735	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.792803049 CEST	49736	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:03.792809963 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.804454088 CEST	443	49734	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:03.804526091 CEST	443	49734	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:03.804590940 CEST	49734	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:03.805213928 CEST	49734	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:03.805234909 CEST	443	49734	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:03.829848051 CEST	443	49732	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.829905987 CEST	443	49732	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.830008030 CEST	49732	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.830682993 CEST	49732	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.830697060 CEST	443	49732	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.831257105 CEST	49739	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.831365108 CEST	443	49739	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.831453085 CEST	49739	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.831774950 CEST	49739	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.831810951 CEST	443	49739	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.834743977 CEST	49740	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:03.834785938 CEST	443	49740	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:03.834867954 CEST	49740	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:03.835114002 CEST	49740	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:03.835124969 CEST	443	49740	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:03.840800047 CEST	49735	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.870912075 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.870951891 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.870975018 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.871014118 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.871031046 CEST	49730	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.871057034 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.871074915 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.871102095 CEST	49730	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.871103048 CEST	49730	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.871155024 CEST	49730	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.874131918 CEST	443	49731	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.874151945 CEST	443	49731	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.874157906 CEST	443	49731	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.874185085 CEST	443	49731	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.874207973 CEST	443	49731	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.874217987 CEST	49731	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.874255896 CEST	443	49731	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.874286890 CEST	49731	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.874286890 CEST	49731	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.874319077 CEST	49731	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.882529020 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.882570982 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.882602930 CEST	49730	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.882616997 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.882638931 CEST	49730	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.882684946 CEST	49730	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.883976936 CEST	443	49731	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.884026051 CEST	443	49731	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.884068012 CEST	49731	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.884094954 CEST	49731	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.884346962 CEST	49731	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.884375095 CEST	443	49731	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.887191057 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.887219906 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.887278080 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.887495995 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.887506008 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.897043943 CEST	443	49733	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.897068977 CEST	443	49733	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.897078037 CEST	443	49733	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.897103071 CEST	443	49733	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.897116899 CEST	443	49733	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.897129059 CEST	443	49733	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.897129059 CEST	49733	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.897142887 CEST	443	49733	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.897164106 CEST	49733	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.897202969 CEST	49733	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.911890030 CEST	443	49733	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.911900043 CEST	443	49733	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.911926985 CEST	443	49733	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.911977053 CEST	49733	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.911984921 CEST	443	49733	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.912003040 CEST	49733	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.912045002 CEST	49733	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.913947105 CEST	443	49737	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.914144993 CEST	49737	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.914167881 CEST	443	49737	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.917985916 CEST	443	49737	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.918047905 CEST	49737	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.918384075 CEST	49737	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.918468952 CEST	443	49737	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.918524981 CEST	49737	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.955857038 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.955904007 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.955948114 CEST	49730	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.956001043 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.956021070 CEST	49730	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.956136942 CEST	49730	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.963398933 CEST	443	49737	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.967817068 CEST	49737	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.967824936 CEST	443	49737	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.970724106 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.970768929 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.970808029 CEST	49730	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.970823050 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.970856905 CEST	49730	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.970877886 CEST	49730	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.971961975 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.972004890 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.972033024 CEST	49730	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.972045898 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.972079992 CEST	49730	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.972100973 CEST	49730	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.972806931 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.972887039 CEST	49730	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.972898960 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.972984076 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.973048925 CEST	49730	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.973402023 CEST	49730	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.973433018 CEST	443	49730	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.976413965 CEST	49742	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.976434946 CEST	443	49742	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.976537943 CEST	49742	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.976851940 CEST	49743	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:03.976886034 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:03.976950884 CEST	49743	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:03.977118969 CEST	49742	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:03.977130890 CEST	443	49742	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:03.977381945 CEST	49743	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:03.977395058 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.008125067 CEST	443	49733	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.008142948 CEST	443	49733	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.008234024 CEST	49733	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.008260965 CEST	443	49733	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.008388042 CEST	49733	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.015790939 CEST	49737	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.016298056 CEST	443	49736	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.016314983 CEST	443	49736	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.016355991 CEST	443	49736	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.016382933 CEST	49736	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.016417027 CEST	49736	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.026171923 CEST	49736	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.026215076 CEST	443	49736	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.036123991 CEST	443	49733	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.036189079 CEST	443	49733	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.036211967 CEST	49733	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.036267996 CEST	49733	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.036894083 CEST	49733	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.036916018 CEST	443	49733	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.041171074 CEST	49744	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.041198969 CEST	443	49744	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.041286945 CEST	49744	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.041695118 CEST	49745	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.041718960 CEST	443	49745	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.041783094 CEST	49745	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.042093992 CEST	49744	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.042108059 CEST	443	49744	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.042288065 CEST	49745	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.042300940 CEST	443	49745	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.076122999 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.076180935 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.076200962 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.076220989 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.076245070 CEST	49735	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.076261044 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.076277971 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.076278925 CEST	49735	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.076297998 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.076314926 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.076318026 CEST	49735	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.076343060 CEST	49735	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.076344013 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.076364994 CEST	49735	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.080476999 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.080527067 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.080562115 CEST	49735	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.080563068 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.080575943 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.080606937 CEST	49735	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.124804020 CEST	49735	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.162514925 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.162538052 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.162575960 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.162595987 CEST	49735	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.162604094 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.162641048 CEST	49735	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.162646055 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.162817001 CEST	49735	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.167671919 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.167718887 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.167742968 CEST	49735	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.167749882 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.167805910 CEST	49735	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.168858051 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.168926001 CEST	49735	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.168931961 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.169203997 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.169254065 CEST	49735	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.170454025 CEST	49735	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.170460939 CEST	443	49735	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.178811073 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.178824902 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.179100037 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.179403067 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.179413080 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.180418015 CEST	49747	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.180459023 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.180561066 CEST	49747	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.180706978 CEST	49747	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.180732965 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.183043003 CEST	443	49738	142.250.186.164	192.168.2.16
Oct 1, 2024 19:04:04.183342934 CEST	49738	443	192.168.2.16	142.250.186.164
Oct 1, 2024 19:04:04.183360100 CEST	443	49738	142.250.186.164	192.168.2.16
Oct 1, 2024 19:04:04.184530973 CEST	443	49738	142.250.186.164	192.168.2.16
Oct 1, 2024 19:04:04.184623957 CEST	49738	443	192.168.2.16	142.250.186.164
Oct 1, 2024 19:04:04.185697079 CEST	49738	443	192.168.2.16	142.250.186.164
Oct 1, 2024 19:04:04.185761929 CEST	443	49738	142.250.186.164	192.168.2.16
Oct 1, 2024 19:04:04.236812115 CEST	49738	443	192.168.2.16	142.250.186.164
Oct 1, 2024 19:04:04.236821890 CEST	443	49738	142.250.186.164	192.168.2.16
Oct 1, 2024 19:04:04.266052961 CEST	443	49737	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.266105890 CEST	443	49737	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.266124964 CEST	443	49737	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.266144037 CEST	443	49737	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.266170025 CEST	49737	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.266181946 CEST	443	49737	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.266200066 CEST	443	49737	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.266201973 CEST	49737	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.266225100 CEST	49737	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.266230106 CEST	443	49737	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.266246080 CEST	49737	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.266278982 CEST	49737	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.276190042 CEST	443	49737	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.276252985 CEST	49737	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.276261091 CEST	443	49737	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.276304960 CEST	49737	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.276381969 CEST	443	49737	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.276388884 CEST	49737	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.276397943 CEST	49737	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.276406050 CEST	443	49737	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.276432991 CEST	49737	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.276447058 CEST	49737	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.278026104 CEST	49748	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.278091908 CEST	443	49748	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.278295994 CEST	49748	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.278493881 CEST	49748	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.278522968 CEST	443	49748	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.278933048 CEST	49749	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.278948069 CEST	443	49749	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.279051065 CEST	49749	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.279222012 CEST	49749	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.279233932 CEST	443	49749	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.284810066 CEST	49738	443	192.168.2.16	142.250.186.164
Oct 1, 2024 19:04:04.493402958 CEST	443	49740	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.493660927 CEST	49740	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.493680000 CEST	443	49740	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.494016886 CEST	443	49740	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.494281054 CEST	49740	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.494349003 CEST	443	49740	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.494381905 CEST	49740	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.494911909 CEST	443	49739	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.495115995 CEST	49739	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.495176077 CEST	443	49739	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.495512009 CEST	443	49739	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.495817900 CEST	49739	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.495903015 CEST	443	49739	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.495939016 CEST	49739	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.539443970 CEST	443	49740	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.539809942 CEST	49739	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.539813995 CEST	49740	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.539871931 CEST	443	49739	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.546005011 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.546221972 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.546236992 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.546519041 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.546818972 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.546870947 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.546936989 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.585695982 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.585891962 CEST	49743	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.585903883 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.586190939 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.586432934 CEST	49743	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.586494923 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.586524010 CEST	49743	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.591404915 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.602787018 CEST	443	49742	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.603063107 CEST	49742	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.603072882 CEST	443	49742	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.604279995 CEST	443	49742	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.604538918 CEST	49742	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.604650974 CEST	49742	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.604655981 CEST	443	49742	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.604724884 CEST	443	49742	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.631401062 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.634844065 CEST	49743	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.650808096 CEST	49742	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.664202929 CEST	443	49744	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.664458990 CEST	49744	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.664479017 CEST	443	49744	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.664994001 CEST	443	49744	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.665318966 CEST	49744	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.665394068 CEST	443	49744	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.665445089 CEST	49744	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.667382002 CEST	443	49745	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.667603016 CEST	49745	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.667615891 CEST	443	49745	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.668482065 CEST	443	49745	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.668534994 CEST	49745	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.668812990 CEST	49745	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.668853045 CEST	443	49745	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.668927908 CEST	49745	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.711399078 CEST	443	49744	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.714793921 CEST	49744	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.714796066 CEST	49745	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.714819908 CEST	443	49745	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.732016087 CEST	443	49740	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.732098103 CEST	443	49740	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.732172966 CEST	49740	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.732642889 CEST	49740	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.732657909 CEST	443	49740	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.741581917 CEST	443	49739	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.741660118 CEST	443	49739	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.741780996 CEST	49739	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.742216110 CEST	49739	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.742257118 CEST	443	49739	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.744179964 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.744272947 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.744353056 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.744709015 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.744744062 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.744996071 CEST	49751	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.745044947 CEST	443	49751	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.745112896 CEST	49751	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.745287895 CEST	49751	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.745317936 CEST	443	49751	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.762792110 CEST	49745	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.831577063 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.831789970 CEST	49747	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.831829071 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.833002090 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.833065033 CEST	49747	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.833327055 CEST	49747	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.833395004 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.833426952 CEST	49747	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.834817886 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.834997892 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.835016012 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.838934898 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.838994026 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.839294910 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.839373112 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.839423895 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.869421959 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.869440079 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.869452953 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.869510889 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.869528055 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.869549036 CEST	443	49742	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.869580984 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.869605064 CEST	443	49742	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.869658947 CEST	49742	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.869678020 CEST	443	49742	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.869801998 CEST	443	49742	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.870477915 CEST	49742	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.870488882 CEST	443	49742	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.870498896 CEST	49742	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.872636080 CEST	49752	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.872662067 CEST	443	49752	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.872740030 CEST	49752	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.873620033 CEST	49752	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.873634100 CEST	443	49752	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.879399061 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.879895926 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.879911900 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.879964113 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.879971027 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.880016088 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.880040884 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.887398958 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.887788057 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.887794971 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.889055967 CEST	49747	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.889086008 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.900377035 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.900393963 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.900399923 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.900460005 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.900474072 CEST	49743	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.900512934 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.900522947 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.900532007 CEST	49743	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.900564909 CEST	49743	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.902343988 CEST	443	49744	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.902395010 CEST	443	49744	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.903291941 CEST	49744	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.903459072 CEST	49744	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.903470993 CEST	443	49744	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.914874077 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.914891958 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.914963007 CEST	49743	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.914972067 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.915288925 CEST	49743	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.921278000 CEST	443	49748	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.921482086 CEST	49748	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.921498060 CEST	443	49748	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.925944090 CEST	443	49748	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.926029921 CEST	49748	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.926306009 CEST	49748	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.926422119 CEST	49748	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.926426888 CEST	443	49748	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.926471949 CEST	443	49748	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.930494070 CEST	443	49749	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.930659056 CEST	49749	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.930680037 CEST	443	49749	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.931546926 CEST	443	49749	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.931612015 CEST	49749	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.931840897 CEST	49749	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.931891918 CEST	443	49749	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.932005882 CEST	49749	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.935802937 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.935803890 CEST	49747	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.954143047 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.954159975 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.954224110 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.954230070 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.954811096 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.965514898 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.965529919 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.965594053 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.965599060 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.966048002 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.967284918 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.967299938 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.967358112 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.967363119 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.967443943 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.967792034 CEST	49748	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.967798948 CEST	443	49748	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.968328953 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.968344927 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.968399048 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.968404055 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:04.968859911 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:04.979409933 CEST	443	49749	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.983781099 CEST	49749	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.983788967 CEST	443	49749	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.986881018 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.986896038 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.986970901 CEST	49743	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.986980915 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.987430096 CEST	49743	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.989645958 CEST	443	49745	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.989664078 CEST	443	49745	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.989670038 CEST	443	49745	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.989695072 CEST	443	49745	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.989703894 CEST	443	49745	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.989715099 CEST	443	49745	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.989737988 CEST	49745	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.989762068 CEST	443	49745	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:04.989790916 CEST	49745	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:04.989806890 CEST	49745	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.001632929 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.001652956 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.001730919 CEST	49743	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.001739025 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.001774073 CEST	49743	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.003271103 CEST	443	49745	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.003278971 CEST	443	49745	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.003310919 CEST	443	49745	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.003336906 CEST	49745	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.003345966 CEST	443	49745	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.003356934 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.003371000 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.003371954 CEST	49745	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.003401041 CEST	49745	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.003432035 CEST	49743	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.003438950 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.003495932 CEST	49743	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.004259109 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.004306078 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.004323006 CEST	49743	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.004359007 CEST	49743	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.004533052 CEST	49743	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.004539013 CEST	443	49743	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.004795074 CEST	49753	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.004812956 CEST	443	49753	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.005043030 CEST	49753	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.005227089 CEST	49753	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.005235910 CEST	443	49753	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.014786959 CEST	49748	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.030790091 CEST	49749	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.040947914 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.040963888 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.042313099 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.042313099 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.042320013 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.042373896 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.052603006 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.052618027 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.052670956 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.052675962 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.052721024 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.052990913 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.053004980 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.053047895 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.053055048 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.053518057 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.053734064 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.053747892 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.053787947 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.053793907 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.053806067 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.053829908 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.054744959 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.054759979 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.054804087 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.054809093 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.054821968 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.054841042 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.076972961 CEST	443	49745	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.076987982 CEST	443	49745	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.077049971 CEST	49745	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.077055931 CEST	443	49745	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.077475071 CEST	49745	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.089397907 CEST	443	49745	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.089440107 CEST	443	49745	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.089452028 CEST	443	49745	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.089462996 CEST	49745	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.089484930 CEST	49745	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.089659929 CEST	49745	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.089672089 CEST	443	49745	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.117033958 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.117048979 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.117106915 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.117113113 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.117180109 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.138511896 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.138526917 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.138581991 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.138586998 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.138669968 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.138720036 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.138724089 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.139096022 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.139283895 CEST	49741	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.139288902 CEST	443	49741	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.142750025 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.142771959 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.142827988 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.143152952 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.143165112 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.153414965 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.153430939 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.153436899 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.153497934 CEST	49747	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.153512955 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.153525114 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.153553963 CEST	49747	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.153553009 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.153565884 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.153583050 CEST	49747	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.153592110 CEST	49747	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.153610945 CEST	49747	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.159176111 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.159231901 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.159251928 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.159269094 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.159296989 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.159308910 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.159326077 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.159327030 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.159356117 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.159359932 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.159375906 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.159410000 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.165987015 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.165994883 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.166043997 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.166069031 CEST	49747	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.166079044 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.166090012 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.166100025 CEST	49747	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.166126966 CEST	49747	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.168631077 CEST	443	49748	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.168678999 CEST	443	49748	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.168700933 CEST	443	49748	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.168719053 CEST	443	49748	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.168739080 CEST	49748	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.168751955 CEST	443	49748	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.168786049 CEST	49748	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.168791056 CEST	443	49748	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.168807983 CEST	49748	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.168908119 CEST	443	49748	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.169226885 CEST	49748	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.169236898 CEST	443	49748	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.169245005 CEST	49748	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.169275045 CEST	49748	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.169332027 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.169365883 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.169394016 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.169420958 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.169471979 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.169533014 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.240166903 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.240181923 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.240264893 CEST	49747	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.240283012 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.240328074 CEST	49747	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.245613098 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.245656013 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.245687962 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.245697975 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.245716095 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.245735884 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.250282049 CEST	443	49749	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.250298023 CEST	443	49749	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.250304937 CEST	443	49749	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.250361919 CEST	443	49749	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.250366926 CEST	49749	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.250410080 CEST	443	49749	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.250437975 CEST	443	49749	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.250461102 CEST	443	49749	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.250473976 CEST	49749	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.250473976 CEST	49749	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.250484943 CEST	49749	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.250504971 CEST	49749	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.251677990 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.251693010 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.251780987 CEST	49747	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.251791954 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.251832962 CEST	49747	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.252576113 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.252625942 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.252645969 CEST	49747	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.252670050 CEST	49747	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.252844095 CEST	49747	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.252862930 CEST	443	49747	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.253139019 CEST	49755	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.253158092 CEST	443	49755	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.254056931 CEST	49755	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.254256964 CEST	49755	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.254270077 CEST	443	49755	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.256387949 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.256432056 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.256469011 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.256475925 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.256508112 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.256525040 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.258109093 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.258150101 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.258177996 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.258183956 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.258212090 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.258230925 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.259185076 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.259226084 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.259259939 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.259265900 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.259293079 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.259306908 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.266191959 CEST	443	49749	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.266237020 CEST	443	49749	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.266263008 CEST	49749	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.266300917 CEST	49749	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.266472101 CEST	49749	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.266480923 CEST	443	49749	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.332436085 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.332482100 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.332525015 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.332535982 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.332567930 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.332578897 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.342951059 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.342994928 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.343033075 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.343039989 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.343071938 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.343080044 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.344084978 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.344140053 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.344176054 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.344182014 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.344196081 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.344868898 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.344919920 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.344944000 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.344950914 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.344986916 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.345936060 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.345979929 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.346014023 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.346020937 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.346031904 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.346071959 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.357078075 CEST	443	49751	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.357306004 CEST	49751	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.357364893 CEST	443	49751	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.357724905 CEST	443	49751	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.358015060 CEST	49751	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.358086109 CEST	443	49751	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.358123064 CEST	49751	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.360889912 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.361082077 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.361129045 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.361428976 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.361686945 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.361747980 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.361771107 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.366796970 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 1, 2024 19:04:05.398935080 CEST	49751	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.398996115 CEST	443	49751	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.399775028 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.399848938 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.399869919 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.399961948 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.400016069 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.400038004 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.400038004 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.400048018 CEST	443	49746	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.400091887 CEST	49746	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.402079105 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.402108908 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.402177095 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.402379990 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.402389050 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.403424978 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.414800882 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.483864069 CEST	443	49752	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.484141111 CEST	49752	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.484168053 CEST	443	49752	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.485335112 CEST	443	49752	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.485646963 CEST	49752	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.485757113 CEST	49752	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.485761881 CEST	443	49752	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.485821962 CEST	443	49752	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.526791096 CEST	49752	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.602355957 CEST	443	49751	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.602436066 CEST	443	49751	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.603570938 CEST	49751	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.603655100 CEST	49751	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.603694916 CEST	443	49751	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.619518995 CEST	443	49753	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.619740963 CEST	49753	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.619765997 CEST	443	49753	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.620063066 CEST	443	49753	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.620347023 CEST	49753	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.620407104 CEST	443	49753	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.620467901 CEST	49753	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.667397022 CEST	443	49753	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.687252045 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.687271118 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.687279940 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.687309027 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.687323093 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.687339067 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.687355995 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.687443972 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.687493086 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.687520981 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.699707985 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.699723959 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.699809074 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.699829102 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.699892044 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.718801975 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 1, 2024 19:04:05.724225998 CEST	443	49752	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.724292040 CEST	443	49752	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.724356890 CEST	49752	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.724370956 CEST	443	49752	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.724469900 CEST	443	49752	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.724852085 CEST	49752	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.724862099 CEST	443	49752	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.724879980 CEST	49752	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.764353991 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.764370918 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.764451981 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.764478922 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.764544010 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.779551983 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.779771090 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.779783964 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.780070066 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.780347109 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.780404091 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.780452967 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.787437916 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.787452936 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.787528992 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.787544966 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.787600994 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.790334940 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.790350914 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.790414095 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.790426970 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.790486097 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.790508986 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.790522099 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.790575981 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.790589094 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.790641069 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.827399015 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.869462013 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.869482040 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.869565964 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.869626999 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.869698048 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.870457888 CEST	443	49753	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.870512962 CEST	443	49753	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.871359110 CEST	49753	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.871526003 CEST	49753	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.871541023 CEST	443	49753	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.875824928 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.875838995 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.875905037 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.875942945 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.875952959 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.875966072 CEST	443	49755	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.876029015 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.876167059 CEST	49755	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.876182079 CEST	443	49755	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.876844883 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.876857996 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.876924992 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.876960039 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.877023935 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.877787113 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.877801895 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.877865076 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.877871037 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.877923965 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.878803968 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.878817081 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.878870964 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.878876925 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.878926992 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.879730940 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.879744053 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.879765987 CEST	443	49755	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.879807949 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.879812956 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.879847050 CEST	49755	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.879864931 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.880167961 CEST	49755	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.880249023 CEST	443	49755	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.880357981 CEST	49755	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.922282934 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.922296047 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.922370911 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.922389984 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:05.922451973 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:05.926808119 CEST	49755	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:05.926815033 CEST	443	49755	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:05.974795103 CEST	49755	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.171035051 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.171042919 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.171113968 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.171133041 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:06.171201944 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.171237946 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:06.171260118 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:06.171416044 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.171431065 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.171539068 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:06.171555042 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.171714067 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:06.171761990 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.171776056 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.171830893 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:06.171844006 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.171914101 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:06.172239065 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.172252893 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.172312021 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:06.172324896 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.172374964 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:06.172717094 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.172733068 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.172802925 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:06.172816038 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.172858000 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:06.172955036 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.172982931 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.173005104 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:06.173012972 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.173032045 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:06.173055887 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:06.173346043 CEST	49750	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:06.173377037 CEST	443	49750	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.173981905 CEST	443	49755	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.174051046 CEST	443	49755	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.174072981 CEST	443	49755	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.174091101 CEST	443	49755	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.174102068 CEST	49755	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.174117088 CEST	443	49755	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.174130917 CEST	49755	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.174143076 CEST	443	49755	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.174316883 CEST	443	49755	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.174364090 CEST	49755	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.175791979 CEST	49755	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.175802946 CEST	443	49755	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.176311970 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.176394939 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.176480055 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.176805973 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.176851988 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.178359032 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.178385973 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.178441048 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.178455114 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.178488016 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.178505898 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.178530931 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.178936005 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.179323912 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.179341078 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.180396080 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.180412054 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.180459976 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.180469990 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.180499077 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.180526972 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.180526972 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.181447029 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.181632996 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.181759119 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.189136982 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.189155102 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.189218998 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.189229965 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.189672947 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.220629930 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.220644951 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.220706940 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.220717907 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.220760107 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.220778942 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.220813036 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.220820904 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.220834017 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.220863104 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.221708059 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.221720934 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.221796989 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.221806049 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.223444939 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.227395058 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.251960039 CEST	49773	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:06.251981020 CEST	443	49773	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.252089024 CEST	49773	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:06.252321005 CEST	49773	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:06.252335072 CEST	443	49773	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.312614918 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.312637091 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.312700987 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.312712908 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.312889099 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.312906981 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.312951088 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.312959909 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.312973976 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.313010931 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.313304901 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.313327074 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.313380957 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.313390970 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.313750982 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.313769102 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.313827038 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.313838005 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.315434933 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.317687035 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.317704916 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.317769051 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.317779064 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.317981958 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.318000078 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.318037033 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.318043947 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.318068981 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.318093061 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.360673904 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.360691071 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.360769987 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.360796928 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.360810041 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.360846043 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.361037970 CEST	49754	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.361057043 CEST	443	49754	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.495409012 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.495465994 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.495510101 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.495538950 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.495577097 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.495603085 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.495632887 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.508493900 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.508539915 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.508574009 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.508588076 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.508616924 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.508636951 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.582113981 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.582159996 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.582200050 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.582236052 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.582284927 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.582284927 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.594191074 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.594233990 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.594259024 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.594271898 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.594297886 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.594316959 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.595937014 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.595979929 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.596015930 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.596028090 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.596052885 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.596070051 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.635423899 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.635464907 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.635520935 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.635540009 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.635586023 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.635586023 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.668973923 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.669034004 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.669080973 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.669121981 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.669152975 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.669172049 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.681094885 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.681152105 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.681189060 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.681204081 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.681231976 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.681266069 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.682372093 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.682410955 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.682457924 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.682470083 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.682493925 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.682518005 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.683341980 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.683382988 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.683435917 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.683446884 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.683470011 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.683489084 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.685229063 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.685270071 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.685305119 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.685317039 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.685339928 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.685362101 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.685379982 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.685445070 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.685456038 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.685542107 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.685591936 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.685631990 CEST	49757	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.685659885 CEST	443	49757	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.749732018 CEST	49788	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:06.749803066 CEST	443	49788	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.749891043 CEST	49788	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:06.750078917 CEST	49788	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:06.750112057 CEST	443	49788	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.808387041 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.808679104 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.808732986 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.809242964 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.809542894 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.809613943 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.809669018 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:06.855398893 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:06.885529995 CEST	443	49773	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.885792017 CEST	49773	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:06.885813951 CEST	443	49773	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.886105061 CEST	443	49773	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.886389017 CEST	49773	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:06.886440992 CEST	443	49773	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:06.886523962 CEST	49773	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:06.886548042 CEST	49773	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:06.886554956 CEST	443	49773	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:07.118691921 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.118773937 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.118815899 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.118854046 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.118884087 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.118905067 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.118937016 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.134740114 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.134783983 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.134812117 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.134819984 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.134843111 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.134862900 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.163794994 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 1, 2024 19:04:07.191629887 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.191694021 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.191734076 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.191745043 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.191777945 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.191797972 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.220273972 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.220333099 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.220386982 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.220396996 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.220424891 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.220448017 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.221668959 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.221710920 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.221744061 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.221750021 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.221796036 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.223428965 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.223469973 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.223504066 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.223509073 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.223526001 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.223556042 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.292115927 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.292177916 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.292197943 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.292222977 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.292242050 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.292257071 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.305411100 CEST	443	49773	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:07.305490017 CEST	443	49773	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:07.305547953 CEST	49773	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:07.307141066 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.307183027 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.307220936 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.307231903 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.307255983 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.307276964 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.307594061 CEST	49773	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:07.307615042 CEST	443	49773	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:07.307626963 CEST	49773	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:07.307657003 CEST	49773	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:07.307858944 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.307900906 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.307925940 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.307943106 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.307971954 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.307987928 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.308340073 CEST	49789	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:07.308372974 CEST	443	49789	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:07.308427095 CEST	49789	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:07.308537960 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.308578014 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.308607101 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.308613062 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.308625937 CEST	49789	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:07.308636904 CEST	443	49789	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:07.308648109 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.308654070 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.309539080 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.309578896 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.309608936 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.309614897 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.309638977 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.309665918 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.334462881 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.334503889 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.334547997 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.334558964 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.334578991 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.334595919 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.365362883 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.365406990 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.365477085 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.365484953 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.365513086 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.365530968 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.393537998 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.393580914 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.393624067 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.393652916 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.393670082 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.393699884 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.394171000 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.394210100 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.394242048 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.394248009 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.394267082 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.394300938 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.394627094 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.394669056 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.394701004 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.394706011 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.394747972 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.394774914 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.395596981 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.395637035 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.395662069 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.395667076 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.395694971 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.395710945 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.395806074 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.395849943 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.395867109 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.395873070 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.395915985 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.395937920 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.396320105 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.396433115 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.396471977 CEST	443	49758	3.145.240.82	192.168.2.16
Oct 1, 2024 19:04:07.396518946 CEST	49758	443	192.168.2.16	3.145.240.82
Oct 1, 2024 19:04:07.400099039 CEST	443	49788	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:07.400388002 CEST	49788	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:07.400458097 CEST	443	49788	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:07.401639938 CEST	443	49788	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:07.401987076 CEST	49788	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:07.402118921 CEST	49788	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:07.402132034 CEST	443	49788	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:07.402168036 CEST	443	49788	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:07.450813055 CEST	49788	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:07.726957083 CEST	443	49788	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:07.727011919 CEST	443	49788	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:07.727080107 CEST	443	49788	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:07.727102041 CEST	49788	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:07.727174044 CEST	443	49788	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:07.727240086 CEST	49788	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:07.727246046 CEST	443	49788	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:07.727310896 CEST	49788	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:07.727608919 CEST	49788	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:07.727643967 CEST	443	49788	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:07.781723022 CEST	49790	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:07.781776905 CEST	443	49790	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:07.781862020 CEST	49790	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:07.782294035 CEST	49790	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:07.782310009 CEST	443	49790	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:07.934978962 CEST	443	49789	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:07.935275078 CEST	49789	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:07.935295105 CEST	443	49789	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:07.935604095 CEST	443	49789	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:07.935935020 CEST	49789	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:07.935992956 CEST	443	49789	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:07.936081886 CEST	49789	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:07.983403921 CEST	443	49789	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:08.183172941 CEST	443	49789	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:08.183232069 CEST	443	49789	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:08.183280945 CEST	49789	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:08.183600903 CEST	49789	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:08.183618069 CEST	443	49789	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:08.410715103 CEST	443	49790	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:08.411003113 CEST	49790	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:08.411027908 CEST	443	49790	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:08.412208080 CEST	443	49790	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:08.412511110 CEST	49790	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:08.412683964 CEST	443	49790	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:08.454802036 CEST	49790	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:10.173841953 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 1, 2024 19:04:14.099101067 CEST	443	49738	142.250.186.164	192.168.2.16
Oct 1, 2024 19:04:14.099184036 CEST	443	49738	142.250.186.164	192.168.2.16
Oct 1, 2024 19:04:14.099375963 CEST	49738	443	192.168.2.16	142.250.186.164
Oct 1, 2024 19:04:14.955332041 CEST	49738	443	192.168.2.16	142.250.186.164
Oct 1, 2024 19:04:14.955377102 CEST	443	49738	142.250.186.164	192.168.2.16
Oct 1, 2024 19:04:15.321852922 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 1, 2024 19:04:18.479007959 CEST	49790	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:18.479182005 CEST	443	49790	52.32.63.141	192.168.2.16
Oct 1, 2024 19:04:18.479279041 CEST	49790	443	192.168.2.16	52.32.63.141
Oct 1, 2024 19:04:19.783799887 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 1, 2024 19:04:29.868973970 CEST	49696	80	192.168.2.16	93.184.221.240
Oct 1, 2024 19:04:29.869076014 CEST	49697	80	192.168.2.16	93.184.221.240
Oct 1, 2024 19:04:29.874195099 CEST	80	49696	93.184.221.240	192.168.2.16
Oct 1, 2024 19:04:29.874294996 CEST	49696	80	192.168.2.16	93.184.221.240
Oct 1, 2024 19:04:29.874567032 CEST	80	49697	93.184.221.240	192.168.2.16
Oct 1, 2024 19:04:29.874627113 CEST	49697	80	192.168.2.16	93.184.221.240

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 19:03:58.658876896 CEST	53	58410	1.1.1.1	192.168.2.16
Oct 1, 2024 19:03:58.675654888 CEST	62543	53	192.168.2.16	1.1.1.1
Oct 1, 2024 19:03:58.675908089 CEST	55309	53	192.168.2.16	1.1.1.1
Oct 1, 2024 19:03:58.683258057 CEST	53	56472	1.1.1.1	192.168.2.16
Oct 1, 2024 19:03:58.694055080 CEST	53	62543	1.1.1.1	192.168.2.16
Oct 1, 2024 19:03:58.695529938 CEST	53	55309	1.1.1.1	192.168.2.16
Oct 1, 2024 19:03:59.911562920 CEST	53	55608	1.1.1.1	192.168.2.16
Oct 1, 2024 19:04:00.508944035 CEST	51452	53	192.168.2.16	1.1.1.1
Oct 1, 2024 19:04:00.509083986 CEST	64129	53	192.168.2.16	1.1.1.1
Oct 1, 2024 19:04:00.526911974 CEST	53	64129	1.1.1.1	192.168.2.16
Oct 1, 2024 19:04:00.528240919 CEST	53	51452	1.1.1.1	192.168.2.16
Oct 1, 2024 19:04:03.511908054 CEST	64528	53	192.168.2.16	1.1.1.1
Oct 1, 2024 19:04:03.512018919 CEST	65515	53	192.168.2.16	1.1.1.1
Oct 1, 2024 19:04:03.518682003 CEST	53	65515	1.1.1.1	192.168.2.16
Oct 1, 2024 19:04:03.518743038 CEST	53	64528	1.1.1.1	192.168.2.16
Oct 1, 2024 19:04:16.877621889 CEST	53	50808	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 1, 2024 19:03:58.675654888 CEST	192.168.2.16	1.1.1.1	0x25e8	Standard query (0)	api-5092fa72.duosecurity.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 19:03:58.675908089 CEST	192.168.2.16	1.1.1.1	0xa78f	Standard query (0)	api-5092fa72.duosecurity.com	65	IN (0x0001)	false
Oct 1, 2024 19:04:00.508944035 CEST	192.168.2.16	1.1.1.1	0xbf4b	Standard query (0)	api-5092fa72.duosecurity.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 19:04:00.509083986 CEST	192.168.2.16	1.1.1.1	0xb754	Standard query (0)	api-5092fa72.duosecurity.com	65	IN (0x0001)	false
Oct 1, 2024 19:04:03.511908054 CEST	192.168.2.16	1.1.1.1	0x4ed7	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 19:04:03.512018919 CEST	192.168.2.16	1.1.1.1	0x2b3b	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 1, 2024 19:03:58.694055080 CEST	1.1.1.1	192.168.2.16	0x25e8	No error (0)	api-5092fa72.duosecurity.com	52.32.63.141	A (IP address)	IN (0x0001)	false
Oct 1, 2024 19:03:58.694055080 CEST	1.1.1.1	192.168.2.16	0x25e8	No error (0)	api-5092fa72.duosecurity.com	52.32.63.151	A (IP address)	IN (0x0001)	false
Oct 1, 2024 19:04:00.528240919 CEST	1.1.1.1	192.168.2.16	0xbf4b	No error (0)	api-5092fa72.duosecurity.com	3.145.240.82	A (IP address)	IN (0x0001)	false
Oct 1, 2024 19:04:00.528240919 CEST	1.1.1.1	192.168.2.16	0xbf4b	No error (0)	api-5092fa72.duosecurity.com	3.145.240.104	A (IP address)	IN (0x0001)	false
Oct 1, 2024 19:04:03.518682003 CEST	1.1.1.1	192.168.2.16	0x2b3b	No error (0)	www.google.com		65	IN (0x0001)	false
Oct 1, 2024 19:04:03.518743038 CEST	1.1.1.1	192.168.2.16	0x4ed7	No error (0)	www.google.com	142.250.186.164	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

slscr.update.microsoft.com

fs.microsoft.com

api-5092fa72.duosecurity.com

https:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49705	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:03:52 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=KzKDlhYekoLUXpa&MD=gPr39eHA HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-01 17:03:53 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 11b3abed-1492-4dc2-ab32-4184861e9c78 MS-RequestId: 6e294998-c8c5-4b6e-9c3d-ab1f4738248a MS-CV: D0FFYzqaxESFVran.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 01 Oct 2024 17:03:52 GMT Connection: close Content-Length: 24490
2024-10-01 17:03:53 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-01 17:03:53 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49708	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:03:55 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-01 17:03:55 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=171715 Date: Tue, 01 Oct 2024 17:03:55 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49709	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:03:56 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-01 17:03:56 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=171658 Date: Tue, 01 Oct 2024 17:03:56 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-01 17:03:56 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.16	49710	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:03:57 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4762 Host: login.live.com
2024-10-01 17:03:57 UTC	4762	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-01 17:03:57 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 01 Oct 2024 17:02:57 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_SN1 x-ms-request-id: d316bfcd-2c60-4c82-abc3-d50d4198ead3 PPServer: PPV: 30 H: SN1PEPF0002F949 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 01 Oct 2024 17:03:57 GMT Connection: close Content-Length: 10197
2024-10-01 17:03:57 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49714	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:03:59 UTC	741	OUT	GET /frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 17:03:59 UTC	1169	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:03:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1388 Connection: close Cache-Control: no-store Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Origin-Trial: AhDE/Lkj7FwOtGMAMOH+LFvCJDt7seggZcsOJ+7Xkiji+/RG3zSsocNA4l+7sDJTlbc/jN4ctAgiZwCPsdTZ2Q0AAABteyJvcmlnaW4iOiJodHRwczovL2R1b3NlY3VyaXR5LmNvbTo0NDMiLCJmZWF0dXJlIjoiVTJGU2VjdXJpdHlLZXlBUEkiLCJleHBpcnkiOjE2NjM3MTgzOTksImlzU3ViZG9tYWluIjp0cnVlfQ== Etag: "6a63f8c2f07eb734798d1769a38da8e4326af764" Set-Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; expires=Tue, 01 Oct 2024 17:18:59 GMT; HttpOnly; Path=/; SameSite=None; Secure Set-Cookie: _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"; HttpOnly; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff
2024-10-01 17:03:59 UTC	1388	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 26 23 78 32 66 3b 66 72 61 6d 65 26 23 78 32 66 3b 73 74 61 74 69 63 26 23 78 32 66 3b 76 34 26 23 78 32 66 3b 50 6f 72 74 61 6c 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 21 2d 2d 20 53 65 74 20 6c 61 74 65 73 74 20 63 6f 6d 70 61 74 69 62 69 6c 69 74 79 20 66 6f 72 20 49 45 20 2d 2d 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e Data Ascii: <html lang="en"><head><link href="/frame/static/v4/Portal.css" rel="stylesheet" />... Set latest compatibility for IE --><meta http-equiv="X-UA-Compatible" content="IE=Edge" /><meta name="viewport" content="width=device-width, in

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49717	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:00 UTC	869	OUT	GET /frame/static/v4/Portal.css HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:00 UTC	145	IN	HTTP/1.1 404 Not Found Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:00 GMT Content-Type: text/html Content-Length: 550 Connection: close
2024-10-01 17:04:00 UTC	550	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 44 75 6f 2f 31 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>Duo/1.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrom

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49716	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:00 UTC	869	OUT	GET /frame/static/shared/js/errors.js?v=d10d2 HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:00 UTC	502	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:00 GMT Content-Type: application/javascript Content-Length: 5143 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-1417" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:00 UTC	5143	IN	Data Raw: 2f 2a 20 65 73 6c 69 6e 74 2d 64 69 73 61 62 6c 65 20 2a 2f 0a 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 0a 20 20 20 20 2f 2f 20 53 6f 6d 65 20 62 72 6f 77 73 65 72 73 20 64 6f 6e 27 74 20 69 6e 63 6c 75 64 65 20 74 68 65 20 65 72 72 6f 72 20 6f 62 6a 65 63 74 20 77 68 65 6e 20 74 68 72 6f 77 69 6e 67 2c 20 73 6f 20 69 74 20 77 69 6c 6c 20 62 65 0a 20 20 20 20 2f 2f 20 64 69 66 66 69 63 75 6c 74 20 74 6f 20 74 72 61 63 6b 20 69 66 20 61 6e 20 65 72 72 6f 72 20 68 61 73 20 61 6c 72 65 61 64 79 20 6e 6f 74 69 66 69 65 64 2e 20 20 54 68 69 73 20 69 73 20 61 6e 20 61 62 75 73 65 0a 20 20 20 20 2f 2f 20 6f 66 20 63 6c 6f 73 75 72 65 20 61 6e 64 20 63 6f 75 6c 64 20 72 65 73 75 6c 74 20 69 6e 20 72 61 63 65 20 63 6f 6e 64 69 74 69 6f 6e 73 2c 20 Data Ascii: /* eslint-disable */(function() { // Some browsers don't include the error object when throwing, so it will be // difficult to track if an error has already notified. This is an abuse // of closure and could result in race conditions,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49715	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:00 UTC	862	OUT	GET /frame/static/v4/Portal.js?v=cfaf2 HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:00 UTC	505	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:00 GMT Content-Type: application/javascript Content-Length: 205504 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-322c0" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:00 UTC	15879	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 50 6f 72 74 61 6c 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 5f 77 65 62 70 61 63 6b 5f 6d 6f 64 75 6c 65 73 5f 5f 3d 7b 31 35 37 31 3a 66 75 6e 63 74 69 6f 6e 28 6d 6f 64 75 6c 65 2c 5f 5f 75 6e 75 73 65 64 5f 77 65 62 70 61 63 6b 5f 65 78 70 6f 72 74 73 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 61 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 37 33 33 29 2c 6d 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 33 39 34 33 29 2c 71 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 Data Ascii: /! For license information please see Portal.js.LICENSE.txt /!function(){var __webpack_modules__={1571:function(module,__unused_webpack_exports,__webpack_require__){"use strict";var aa=__webpack_require__(733),m=__webpack_require__(3943),q=__webpack_re
2024-10-01 17:04:00 UTC	16384	IN	Data Raw: 61 73 65 28 29 7d 66 75 6e 63 74 69 6f 6e 20 7a 63 28 61 2c 62 2c 63 2c 64 29 7b 76 61 72 20 65 3d 46 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 62 29 3f 46 5b 62 5d 3a 6e 75 6c 6c 3b 28 6e 75 6c 6c 21 3d 3d 65 3f 30 3d 3d 3d 65 2e 74 79 70 65 3a 21 64 26 26 28 32 3c 62 2e 6c 65 6e 67 74 68 26 26 28 22 6f 22 3d 3d 3d 62 5b 30 5d 7c 7c 22 4f 22 3d 3d 3d 62 5b 30 5d 29 26 26 28 22 6e 22 3d 3d 3d 62 5b 31 5d 7c 7c 22 4e 22 3d 3d 3d 62 5b 31 5d 29 29 29 7c 7c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 69 66 28 6e 75 6c 6c 3d 3d 62 7c 7c 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 69 66 28 6e 75 6c 6c 21 3d 3d 63 26 26 30 3d 3d 3d 63 2e 74 79 70 65 29 72 65 74 75 72 6e 21 31 3b 73 77 69 74 63 68 28 74 79 70 65 6f 66 20 62 29 7b 63 Data Ascii: ase()}function zc(a,b,c,d){var e=F.hasOwnProperty(b)?F[b]:null;(null!==e?0===e.type:!d&&(2<b.length&&("o"===b[0]\|\|"O"===b[0])&&("n"===b[1]\|\|"N"===b[1])))\|\|(function(a,b,c,d){if(null==b\|\|function(a,b,c,d){if(null!==c&&0===c.type)return!1;switch(typeof b){c
2024-10-01 17:04:00 UTC	16384	IN	Data Raw: 3d 3d 3d 62 26 26 28 62 3d 6e 65 77 20 53 65 74 2c 56 64 2e 73 65 74 28 61 2c 62 29 29 2c 62 7d 66 75 6e 63 74 69 6f 6e 20 58 64 28 61 29 7b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 28 61 3d 61 7c 7c 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 64 6f 63 75 6d 65 6e 74 3f 64 6f 63 75 6d 65 6e 74 3a 76 6f 69 64 20 30 29 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 74 72 79 7b 72 65 74 75 72 6e 20 61 2e 61 63 74 69 76 65 45 6c 65 6d 65 6e 74 7c 7c 61 2e 62 6f 64 79 7d 63 61 74 63 68 28 62 29 7b 72 65 74 75 72 6e 20 61 2e 62 6f 64 79 7d 7d 66 75 6e 63 74 69 6f 6e 20 59 64 28 61 29 7b 66 6f 72 28 3b 61 26 26 61 2e 66 69 72 73 74 43 68 69 6c 64 3b 29 61 3d 61 2e 66 69 72 73 74 43 68 69 6c 64 3b 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 5a Data Ascii: ===b&&(b=new Set,Vd.set(a,b)),b}function Xd(a){if(void 0===(a=a\|\|("undefined"!=typeof document?document:void 0)))return null;try{return a.activeElement\|\|a.body}catch(b){return a.body}}function Yd(a){for(;a&&a.firstChild;)a=a.firstChild;return a}function Z
2024-10-01 17:04:00 UTC	16384	IN	Data Raw: 6e 74 57 69 6c 6c 4d 6f 75 6e 74 26 26 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 65 2e 63 6f 6d 70 6f 6e 65 6e 74 57 69 6c 6c 4d 6f 75 6e 74 7c 7c 28 62 3d 65 2e 73 74 61 74 65 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 2e 63 6f 6d 70 6f 6e 65 6e 74 57 69 6c 6c 4d 6f 75 6e 74 26 26 65 2e 63 6f 6d 70 6f 6e 65 6e 74 57 69 6c 6c 4d 6f 75 6e 74 28 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 2e 55 4e 53 41 46 45 5f 63 6f 6d 70 6f 6e 65 6e 74 57 69 6c 6c 4d 6f 75 6e 74 26 26 65 2e 55 4e 53 41 46 45 5f 63 6f 6d 70 6f 6e 65 6e 74 57 69 6c 6c 4d 6f 75 6e 74 28 29 2c 62 21 3d 3d 65 2e 73 74 61 74 65 26 26 66 67 2e 65 6e 71 75 65 75 65 52 65 70 6c 61 63 65 53 74 61 74 65 28 65 2c 65 2e 73 74 61 74 65 2c 6e 75 Data Ascii: ntWillMount&&"function"!=typeof e.componentWillMount\|\|(b=e.state,"function"==typeof e.componentWillMount&&e.componentWillMount(),"function"==typeof e.UNSAFE_componentWillMount&&e.UNSAFE_componentWillMount(),b!==e.state&&fg.enqueueReplaceState(e,e.state,nu
2024-10-01 17:04:00 UTC	16384	IN	Data Raw: 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 68 2e 63 6f 6d 70 6f 6e 65 6e 74 57 69 6c 6c 55 70 64 61 74 65 26 26 68 2e 63 6f 6d 70 6f 6e 65 6e 74 57 69 6c 6c 55 70 64 61 74 65 28 64 2c 78 2c 6c 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 68 2e 55 4e 53 41 46 45 5f 63 6f 6d 70 6f 6e 65 6e 74 57 69 6c 6c 55 70 64 61 74 65 26 26 68 2e 55 4e 53 41 46 45 5f 63 6f 6d 70 6f 6e 65 6e 74 57 69 6c 6c 55 70 64 61 74 65 28 64 2c 78 2c 6c 29 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 68 2e 63 6f 6d 70 6f 6e 65 6e 74 44 69 64 55 70 64 61 74 65 26 26 28 62 2e 65 66 66 65 63 74 54 61 67 7c 3d 34 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 68 2e 67 65 74 53 6e 61 70 73 68 6f 74 42 65 66 6f 72 65 55 70 64 61 Data Ascii: unction"==typeof h.componentWillUpdate&&h.componentWillUpdate(d,x,l),"function"==typeof h.UNSAFE_componentWillUpdate&&h.UNSAFE_componentWillUpdate(d,x,l)),"function"==typeof h.componentDidUpdate&&(b.effectTag\|=4),"function"==typeof h.getSnapshotBeforeUpda
2024-10-01 17:04:00 UTC	16384	IN	Data Raw: 3d 66 2e 72 65 74 75 72 6e 29 74 68 72 6f 77 20 68 6a 28 61 2c 62 29 2c 55 3d 64 2c 72 62 3b 61 3a 7b 76 61 72 20 68 3d 61 2c 67 3d 66 2e 72 65 74 75 72 6e 2c 6b 3d 66 2c 6c 3d 72 62 2c 6e 3d 57 3b 69 66 28 6b 2e 65 66 66 65 63 74 54 61 67 7c 3d 31 30 32 34 2c 6b 2e 66 69 72 73 74 45 66 66 65 63 74 3d 6b 2e 6c 61 73 74 45 66 66 65 63 74 3d 6e 75 6c 6c 2c 6e 75 6c 6c 21 3d 3d 6c 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6c 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6c 2e 74 68 65 6e 29 7b 76 61 72 20 7a 3d 6c 2c 78 3d 30 21 3d 28 50 2e 63 75 72 72 65 6e 74 26 46 67 29 3b 6c 3d 67 3b 64 6f 7b 76 61 72 20 76 3b 69 66 28 28 76 3d 31 33 3d 3d 3d 6c 2e 74 61 67 29 26 26 28 6e 75 6c 6c 21 3d 3d 6c 2e 6d 65 6d 6f 69 7a 65 64 53 Data Ascii: =f.return)throw hj(a,b),U=d,rb;a:{var h=a,g=f.return,k=f,l=rb,n=W;if(k.effectTag\|=1024,k.firstEffect=k.lastEffect=null,null!==l&&"object"==typeof l&&"function"==typeof l.then){var z=l,x=0!=(P.current&Fg);l=g;do{var v;if((v=13===l.tag)&&(null!==l.memoizedS
2024-10-01 17:04:00 UTC	16384	IN	Data Raw: 65 29 26 26 64 3e 3d 63 3f 50 68 28 61 2c 62 2c 63 29 3a 28 4a 28 50 2c 50 2e 63 75 72 72 65 6e 74 26 45 67 29 2c 6e 75 6c 6c 21 3d 3d 28 62 3d 46 68 28 61 2c 62 2c 63 29 29 3f 62 2e 73 69 62 6c 69 6e 67 3a 6e 75 6c 6c 29 3b 4a 28 50 2c 50 2e 63 75 72 72 65 6e 74 26 45 67 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 39 3a 69 66 28 64 3d 62 2e 63 68 69 6c 64 45 78 70 69 72 61 74 69 6f 6e 54 69 6d 65 3e 3d 63 2c 30 21 3d 28 36 34 26 61 2e 65 66 66 65 63 74 54 61 67 29 29 7b 69 66 28 64 29 72 65 74 75 72 6e 20 52 68 28 61 2c 62 2c 63 29 3b 62 2e 65 66 66 65 63 74 54 61 67 7c 3d 36 34 7d 69 66 28 6e 75 6c 6c 21 3d 3d 28 65 3d 62 2e 6d 65 6d 6f 69 7a 65 64 53 74 61 74 65 29 26 26 28 65 2e 72 65 6e 64 65 72 69 6e 67 3d 6e 75 6c 6c 2c 65 2e 74 61 69 6c 3d 6e 75 6c Data Ascii: e)&&d>=c?Ph(a,b,c):(J(P,P.current&Eg),null!==(b=Fh(a,b,c))?b.sibling:null);J(P,P.current&Eg);break;case 19:if(d=b.childExpirationTime>=c,0!=(64&a.effectTag)){if(d)return Rh(a,b,c);b.effectTag\|=64}if(null!==(e=b.memoizedState)&&(e.rendering=null,e.tail=nul
2024-10-01 17:04:00 UTC	16384	IN	Data Raw: 6c 75 65 3d 4f 5b 69 6e 64 65 78 2b 2b 5d 29 21 3d 76 61 6c 75 65 29 72 65 74 75 72 6e 21 30 7d 65 6c 73 65 20 66 6f 72 28 3b 6c 65 6e 67 74 68 3e 69 6e 64 65 78 3b 69 6e 64 65 78 2b 2b 29 69 66 28 28 49 53 5f 49 4e 43 4c 55 44 45 53 7c 7c 69 6e 64 65 78 20 69 6e 20 4f 29 26 26 4f 5b 69 6e 64 65 78 5d 3d 3d 3d 65 6c 29 72 65 74 75 72 6e 20 49 53 5f 49 4e 43 4c 55 44 45 53 7c 7c 69 6e 64 65 78 7c 7c 30 3b 72 65 74 75 72 6e 21 49 53 5f 49 4e 43 4c 55 44 45 53 26 26 2d 31 7d 7d 3b 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 7b 69 6e 63 6c 75 64 65 73 3a 63 72 65 61 74 65 4d 65 74 68 6f 64 28 21 30 29 2c 69 6e 64 65 78 4f 66 3a 63 72 65 61 74 65 4d 65 74 68 6f 64 28 21 31 29 7d 7d 2c 37 32 38 39 3a 66 75 6e 63 74 69 6f 6e 28 6d 6f 64 75 6c 65 2c 5f 5f 75 6e Data Ascii: lue=O[index++])!=value)return!0}else for(;length>index;index++)if((IS_INCLUDES\|\|index in O)&&O[index]===el)return IS_INCLUDES\|\|index\|\|0;return!IS_INCLUDES&&-1}};module.exports={includes:createMethod(!0),indexOf:createMethod(!1)}},7289:function(module,__un
2024-10-01 17:04:00 UTC	16384	IN	Data Raw: 65 63 74 53 6f 75 72 63 65 7d 2c 38 36 32 31 3a 66 75 6e 63 74 69 6f 6e 28 6d 6f 64 75 6c 65 2c 5f 5f 75 6e 75 73 65 64 5f 77 65 62 70 61 63 6b 5f 65 78 70 6f 72 74 73 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 7b 76 61 72 20 73 65 74 2c 67 65 74 2c 68 61 73 2c 4e 41 54 49 56 45 5f 57 45 41 4b 5f 4d 41 50 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 31 31 30 36 29 2c 67 6c 6f 62 61 6c 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 32 31 30 38 29 2c 69 73 4f 62 6a 65 63 74 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 33 38 39 32 29 2c 63 72 65 61 74 65 4e 6f 6e 45 6e 75 6d 65 72 61 62 6c 65 50 72 6f 70 65 72 74 79 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 31 30 32 Data Ascii: ectSource},8621:function(module,__unused_webpack_exports,__webpack_require__){var set,get,has,NATIVE_WEAK_MAP=__webpack_require__(1106),global=__webpack_require__(2108),isObject=__webpack_require__(3892),createNonEnumerableProperty=__webpack_require__(102
2024-10-01 17:04:00 UTC	16384	IN	Data Raw: 74 28 22 53 74 72 69 6e 67 22 29 3b 28 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 4f 2c 6b 65 79 2c 76 61 6c 75 65 2c 6f 70 74 69 6f 6e 73 29 7b 76 61 72 20 73 74 61 74 65 2c 75 6e 73 61 66 65 3d 21 21 6f 70 74 69 6f 6e 73 26 26 21 21 6f 70 74 69 6f 6e 73 2e 75 6e 73 61 66 65 2c 73 69 6d 70 6c 65 3d 21 21 6f 70 74 69 6f 6e 73 26 26 21 21 6f 70 74 69 6f 6e 73 2e 65 6e 75 6d 65 72 61 62 6c 65 2c 6e 6f 54 61 72 67 65 74 47 65 74 3d 21 21 6f 70 74 69 6f 6e 73 26 26 21 21 6f 70 74 69 6f 6e 73 2e 6e 6f 54 61 72 67 65 74 47 65 74 3b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 76 61 6c 75 65 26 26 28 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 6b 65 79 7c 7c 68 61 73 28 76 61 6c 75 65 2c 22 6e 61 6d 65 22 29 7c 7c Data Ascii: t("String");(module.exports=function(O,key,value,options){var state,unsafe=!!options&&!!options.unsafe,simple=!!options&&!!options.enumerable,noTargetGet=!!options&&!!options.noTargetGet;"function"==typeof value&&("string"!=typeof key\|\|has(value,"name")\|\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49718	3.145.240.82	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:01 UTC	610	OUT	GET /frame/static/shared/js/errors.js?v=d10d2 HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:01 UTC	502	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:01 GMT Content-Type: application/javascript Content-Length: 5143 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-1417" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:01 UTC	5143	IN	Data Raw: 2f 2a 20 65 73 6c 69 6e 74 2d 64 69 73 61 62 6c 65 20 2a 2f 0a 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 0a 20 20 20 20 2f 2f 20 53 6f 6d 65 20 62 72 6f 77 73 65 72 73 20 64 6f 6e 27 74 20 69 6e 63 6c 75 64 65 20 74 68 65 20 65 72 72 6f 72 20 6f 62 6a 65 63 74 20 77 68 65 6e 20 74 68 72 6f 77 69 6e 67 2c 20 73 6f 20 69 74 20 77 69 6c 6c 20 62 65 0a 20 20 20 20 2f 2f 20 64 69 66 66 69 63 75 6c 74 20 74 6f 20 74 72 61 63 6b 20 69 66 20 61 6e 20 65 72 72 6f 72 20 68 61 73 20 61 6c 72 65 61 64 79 20 6e 6f 74 69 66 69 65 64 2e 20 20 54 68 69 73 20 69 73 20 61 6e 20 61 62 75 73 65 0a 20 20 20 20 2f 2f 20 6f 66 20 63 6c 6f 73 75 72 65 20 61 6e 64 20 63 6f 75 6c 64 20 72 65 73 75 6c 74 20 69 6e 20 72 61 63 65 20 63 6f 6e 64 69 74 69 6f 6e 73 2c 20 Data Ascii: /* eslint-disable */(function() { // Some browsers don't include the error object when throwing, so it will be // difficult to track if an error has already notified. This is an abuse // of closure and could result in race conditions,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49719	3.145.240.82	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:01 UTC	603	OUT	GET /frame/static/v4/Portal.js?v=cfaf2 HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:01 UTC	505	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:01 GMT Content-Type: application/javascript Content-Length: 205504 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-322c0" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:01 UTC	15879	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 50 6f 72 74 61 6c 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 5f 77 65 62 70 61 63 6b 5f 6d 6f 64 75 6c 65 73 5f 5f 3d 7b 31 35 37 31 3a 66 75 6e 63 74 69 6f 6e 28 6d 6f 64 75 6c 65 2c 5f 5f 75 6e 75 73 65 64 5f 77 65 62 70 61 63 6b 5f 65 78 70 6f 72 74 73 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 61 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 37 33 33 29 2c 6d 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 33 39 34 33 29 2c 71 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 Data Ascii: /! For license information please see Portal.js.LICENSE.txt /!function(){var __webpack_modules__={1571:function(module,__unused_webpack_exports,__webpack_require__){"use strict";var aa=__webpack_require__(733),m=__webpack_require__(3943),q=__webpack_re
2024-10-01 17:04:01 UTC	16384	IN	Data Raw: 61 73 65 28 29 7d 66 75 6e 63 74 69 6f 6e 20 7a 63 28 61 2c 62 2c 63 2c 64 29 7b 76 61 72 20 65 3d 46 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 62 29 3f 46 5b 62 5d 3a 6e 75 6c 6c 3b 28 6e 75 6c 6c 21 3d 3d 65 3f 30 3d 3d 3d 65 2e 74 79 70 65 3a 21 64 26 26 28 32 3c 62 2e 6c 65 6e 67 74 68 26 26 28 22 6f 22 3d 3d 3d 62 5b 30 5d 7c 7c 22 4f 22 3d 3d 3d 62 5b 30 5d 29 26 26 28 22 6e 22 3d 3d 3d 62 5b 31 5d 7c 7c 22 4e 22 3d 3d 3d 62 5b 31 5d 29 29 29 7c 7c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 69 66 28 6e 75 6c 6c 3d 3d 62 7c 7c 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 69 66 28 6e 75 6c 6c 21 3d 3d 63 26 26 30 3d 3d 3d 63 2e 74 79 70 65 29 72 65 74 75 72 6e 21 31 3b 73 77 69 74 63 68 28 74 79 70 65 6f 66 20 62 29 7b 63 Data Ascii: ase()}function zc(a,b,c,d){var e=F.hasOwnProperty(b)?F[b]:null;(null!==e?0===e.type:!d&&(2<b.length&&("o"===b[0]\|\|"O"===b[0])&&("n"===b[1]\|\|"N"===b[1])))\|\|(function(a,b,c,d){if(null==b\|\|function(a,b,c,d){if(null!==c&&0===c.type)return!1;switch(typeof b){c
2024-10-01 17:04:01 UTC	16384	IN	Data Raw: 3d 3d 3d 62 26 26 28 62 3d 6e 65 77 20 53 65 74 2c 56 64 2e 73 65 74 28 61 2c 62 29 29 2c 62 7d 66 75 6e 63 74 69 6f 6e 20 58 64 28 61 29 7b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 28 61 3d 61 7c 7c 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 64 6f 63 75 6d 65 6e 74 3f 64 6f 63 75 6d 65 6e 74 3a 76 6f 69 64 20 30 29 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 74 72 79 7b 72 65 74 75 72 6e 20 61 2e 61 63 74 69 76 65 45 6c 65 6d 65 6e 74 7c 7c 61 2e 62 6f 64 79 7d 63 61 74 63 68 28 62 29 7b 72 65 74 75 72 6e 20 61 2e 62 6f 64 79 7d 7d 66 75 6e 63 74 69 6f 6e 20 59 64 28 61 29 7b 66 6f 72 28 3b 61 26 26 61 2e 66 69 72 73 74 43 68 69 6c 64 3b 29 61 3d 61 2e 66 69 72 73 74 43 68 69 6c 64 3b 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 5a Data Ascii: ===b&&(b=new Set,Vd.set(a,b)),b}function Xd(a){if(void 0===(a=a\|\|("undefined"!=typeof document?document:void 0)))return null;try{return a.activeElement\|\|a.body}catch(b){return a.body}}function Yd(a){for(;a&&a.firstChild;)a=a.firstChild;return a}function Z
2024-10-01 17:04:01 UTC	16384	IN	Data Raw: 6e 74 57 69 6c 6c 4d 6f 75 6e 74 26 26 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 65 2e 63 6f 6d 70 6f 6e 65 6e 74 57 69 6c 6c 4d 6f 75 6e 74 7c 7c 28 62 3d 65 2e 73 74 61 74 65 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 2e 63 6f 6d 70 6f 6e 65 6e 74 57 69 6c 6c 4d 6f 75 6e 74 26 26 65 2e 63 6f 6d 70 6f 6e 65 6e 74 57 69 6c 6c 4d 6f 75 6e 74 28 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 2e 55 4e 53 41 46 45 5f 63 6f 6d 70 6f 6e 65 6e 74 57 69 6c 6c 4d 6f 75 6e 74 26 26 65 2e 55 4e 53 41 46 45 5f 63 6f 6d 70 6f 6e 65 6e 74 57 69 6c 6c 4d 6f 75 6e 74 28 29 2c 62 21 3d 3d 65 2e 73 74 61 74 65 26 26 66 67 2e 65 6e 71 75 65 75 65 52 65 70 6c 61 63 65 53 74 61 74 65 28 65 2c 65 2e 73 74 61 74 65 2c 6e 75 Data Ascii: ntWillMount&&"function"!=typeof e.componentWillMount\|\|(b=e.state,"function"==typeof e.componentWillMount&&e.componentWillMount(),"function"==typeof e.UNSAFE_componentWillMount&&e.UNSAFE_componentWillMount(),b!==e.state&&fg.enqueueReplaceState(e,e.state,nu
2024-10-01 17:04:01 UTC	16384	IN	Data Raw: 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 68 2e 63 6f 6d 70 6f 6e 65 6e 74 57 69 6c 6c 55 70 64 61 74 65 26 26 68 2e 63 6f 6d 70 6f 6e 65 6e 74 57 69 6c 6c 55 70 64 61 74 65 28 64 2c 78 2c 6c 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 68 2e 55 4e 53 41 46 45 5f 63 6f 6d 70 6f 6e 65 6e 74 57 69 6c 6c 55 70 64 61 74 65 26 26 68 2e 55 4e 53 41 46 45 5f 63 6f 6d 70 6f 6e 65 6e 74 57 69 6c 6c 55 70 64 61 74 65 28 64 2c 78 2c 6c 29 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 68 2e 63 6f 6d 70 6f 6e 65 6e 74 44 69 64 55 70 64 61 74 65 26 26 28 62 2e 65 66 66 65 63 74 54 61 67 7c 3d 34 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 68 2e 67 65 74 53 6e 61 70 73 68 6f 74 42 65 66 6f 72 65 55 70 64 61 Data Ascii: unction"==typeof h.componentWillUpdate&&h.componentWillUpdate(d,x,l),"function"==typeof h.UNSAFE_componentWillUpdate&&h.UNSAFE_componentWillUpdate(d,x,l)),"function"==typeof h.componentDidUpdate&&(b.effectTag\|=4),"function"==typeof h.getSnapshotBeforeUpda
2024-10-01 17:04:01 UTC	16384	IN	Data Raw: 3d 66 2e 72 65 74 75 72 6e 29 74 68 72 6f 77 20 68 6a 28 61 2c 62 29 2c 55 3d 64 2c 72 62 3b 61 3a 7b 76 61 72 20 68 3d 61 2c 67 3d 66 2e 72 65 74 75 72 6e 2c 6b 3d 66 2c 6c 3d 72 62 2c 6e 3d 57 3b 69 66 28 6b 2e 65 66 66 65 63 74 54 61 67 7c 3d 31 30 32 34 2c 6b 2e 66 69 72 73 74 45 66 66 65 63 74 3d 6b 2e 6c 61 73 74 45 66 66 65 63 74 3d 6e 75 6c 6c 2c 6e 75 6c 6c 21 3d 3d 6c 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6c 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6c 2e 74 68 65 6e 29 7b 76 61 72 20 7a 3d 6c 2c 78 3d 30 21 3d 28 50 2e 63 75 72 72 65 6e 74 26 46 67 29 3b 6c 3d 67 3b 64 6f 7b 76 61 72 20 76 3b 69 66 28 28 76 3d 31 33 3d 3d 3d 6c 2e 74 61 67 29 26 26 28 6e 75 6c 6c 21 3d 3d 6c 2e 6d 65 6d 6f 69 7a 65 64 53 Data Ascii: =f.return)throw hj(a,b),U=d,rb;a:{var h=a,g=f.return,k=f,l=rb,n=W;if(k.effectTag\|=1024,k.firstEffect=k.lastEffect=null,null!==l&&"object"==typeof l&&"function"==typeof l.then){var z=l,x=0!=(P.current&Fg);l=g;do{var v;if((v=13===l.tag)&&(null!==l.memoizedS
2024-10-01 17:04:01 UTC	16384	IN	Data Raw: 65 29 26 26 64 3e 3d 63 3f 50 68 28 61 2c 62 2c 63 29 3a 28 4a 28 50 2c 50 2e 63 75 72 72 65 6e 74 26 45 67 29 2c 6e 75 6c 6c 21 3d 3d 28 62 3d 46 68 28 61 2c 62 2c 63 29 29 3f 62 2e 73 69 62 6c 69 6e 67 3a 6e 75 6c 6c 29 3b 4a 28 50 2c 50 2e 63 75 72 72 65 6e 74 26 45 67 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 39 3a 69 66 28 64 3d 62 2e 63 68 69 6c 64 45 78 70 69 72 61 74 69 6f 6e 54 69 6d 65 3e 3d 63 2c 30 21 3d 28 36 34 26 61 2e 65 66 66 65 63 74 54 61 67 29 29 7b 69 66 28 64 29 72 65 74 75 72 6e 20 52 68 28 61 2c 62 2c 63 29 3b 62 2e 65 66 66 65 63 74 54 61 67 7c 3d 36 34 7d 69 66 28 6e 75 6c 6c 21 3d 3d 28 65 3d 62 2e 6d 65 6d 6f 69 7a 65 64 53 74 61 74 65 29 26 26 28 65 2e 72 65 6e 64 65 72 69 6e 67 3d 6e 75 6c 6c 2c 65 2e 74 61 69 6c 3d 6e 75 6c Data Ascii: e)&&d>=c?Ph(a,b,c):(J(P,P.current&Eg),null!==(b=Fh(a,b,c))?b.sibling:null);J(P,P.current&Eg);break;case 19:if(d=b.childExpirationTime>=c,0!=(64&a.effectTag)){if(d)return Rh(a,b,c);b.effectTag\|=64}if(null!==(e=b.memoizedState)&&(e.rendering=null,e.tail=nul
2024-10-01 17:04:02 UTC	16384	IN	Data Raw: 6c 75 65 3d 4f 5b 69 6e 64 65 78 2b 2b 5d 29 21 3d 76 61 6c 75 65 29 72 65 74 75 72 6e 21 30 7d 65 6c 73 65 20 66 6f 72 28 3b 6c 65 6e 67 74 68 3e 69 6e 64 65 78 3b 69 6e 64 65 78 2b 2b 29 69 66 28 28 49 53 5f 49 4e 43 4c 55 44 45 53 7c 7c 69 6e 64 65 78 20 69 6e 20 4f 29 26 26 4f 5b 69 6e 64 65 78 5d 3d 3d 3d 65 6c 29 72 65 74 75 72 6e 20 49 53 5f 49 4e 43 4c 55 44 45 53 7c 7c 69 6e 64 65 78 7c 7c 30 3b 72 65 74 75 72 6e 21 49 53 5f 49 4e 43 4c 55 44 45 53 26 26 2d 31 7d 7d 3b 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 7b 69 6e 63 6c 75 64 65 73 3a 63 72 65 61 74 65 4d 65 74 68 6f 64 28 21 30 29 2c 69 6e 64 65 78 4f 66 3a 63 72 65 61 74 65 4d 65 74 68 6f 64 28 21 31 29 7d 7d 2c 37 32 38 39 3a 66 75 6e 63 74 69 6f 6e 28 6d 6f 64 75 6c 65 2c 5f 5f 75 6e Data Ascii: lue=O[index++])!=value)return!0}else for(;length>index;index++)if((IS_INCLUDES\|\|index in O)&&O[index]===el)return IS_INCLUDES\|\|index\|\|0;return!IS_INCLUDES&&-1}};module.exports={includes:createMethod(!0),indexOf:createMethod(!1)}},7289:function(module,__un
2024-10-01 17:04:02 UTC	16384	IN	Data Raw: 65 63 74 53 6f 75 72 63 65 7d 2c 38 36 32 31 3a 66 75 6e 63 74 69 6f 6e 28 6d 6f 64 75 6c 65 2c 5f 5f 75 6e 75 73 65 64 5f 77 65 62 70 61 63 6b 5f 65 78 70 6f 72 74 73 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 7b 76 61 72 20 73 65 74 2c 67 65 74 2c 68 61 73 2c 4e 41 54 49 56 45 5f 57 45 41 4b 5f 4d 41 50 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 31 31 30 36 29 2c 67 6c 6f 62 61 6c 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 32 31 30 38 29 2c 69 73 4f 62 6a 65 63 74 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 33 38 39 32 29 2c 63 72 65 61 74 65 4e 6f 6e 45 6e 75 6d 65 72 61 62 6c 65 50 72 6f 70 65 72 74 79 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 31 30 32 Data Ascii: ectSource},8621:function(module,__unused_webpack_exports,__webpack_require__){var set,get,has,NATIVE_WEAK_MAP=__webpack_require__(1106),global=__webpack_require__(2108),isObject=__webpack_require__(3892),createNonEnumerableProperty=__webpack_require__(102
2024-10-01 17:04:02 UTC	16384	IN	Data Raw: 74 28 22 53 74 72 69 6e 67 22 29 3b 28 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 4f 2c 6b 65 79 2c 76 61 6c 75 65 2c 6f 70 74 69 6f 6e 73 29 7b 76 61 72 20 73 74 61 74 65 2c 75 6e 73 61 66 65 3d 21 21 6f 70 74 69 6f 6e 73 26 26 21 21 6f 70 74 69 6f 6e 73 2e 75 6e 73 61 66 65 2c 73 69 6d 70 6c 65 3d 21 21 6f 70 74 69 6f 6e 73 26 26 21 21 6f 70 74 69 6f 6e 73 2e 65 6e 75 6d 65 72 61 62 6c 65 2c 6e 6f 54 61 72 67 65 74 47 65 74 3d 21 21 6f 70 74 69 6f 6e 73 26 26 21 21 6f 70 74 69 6f 6e 73 2e 6e 6f 54 61 72 67 65 74 47 65 74 3b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 76 61 6c 75 65 26 26 28 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 6b 65 79 7c 7c 68 61 73 28 76 61 6c 75 65 2c 22 6e 61 6d 65 22 29 7c 7c Data Ascii: t("String");(module.exports=function(O,key,value,options){var state,unsafe=!!options&&!!options.unsafe,simple=!!options&&!!options.enumerable,noTargetGet=!!options&&!!options.noTargetGet;"function"==typeof value&&("string"!=typeof key\|\|has(value,"name")\|\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49721	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:01 UTC	1207	OUT	POST /frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive Content-Length: 134 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://api-5092fa72.duosecurity.com Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:01 UTC	134	OUT	Data Raw: 5f 78 73 72 66 3d 64 36 64 63 63 62 32 31 30 61 35 36 34 61 30 38 62 33 31 66 65 65 32 36 39 37 32 35 38 63 61 34 26 61 6b 65 79 3d 44 41 38 4c 38 49 53 45 4b 53 55 35 34 52 51 48 32 4b 59 56 26 63 6f 64 65 3d 33 31 38 33 61 35 30 30 62 33 32 62 37 38 38 33 26 72 65 61 63 74 5f 73 75 70 70 6f 72 74 3d 74 72 75 65 26 72 65 61 63 74 5f 73 75 70 70 6f 72 74 5f 65 72 72 6f 72 5f 6d 65 73 73 61 67 65 3d Data Ascii: _xsrf=d6dccb210a564a08b31fee2697258ca4&akey=DA8L8ISEKSU54RQH2KYV&code=3183a500b32b7883&react_support=true&react_support_error_message=
2024-10-01 17:04:02 UTC	1317	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 8311 Connection: close Cache-Control: no-store Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Origin-Trial: AhDE/Lkj7FwOtGMAMOH+LFvCJDt7seggZcsOJ+7Xkiji+/RG3zSsocNA4l+7sDJTlbc/jN4ctAgiZwCPsdTZ2Q0AAABteyJvcmlnaW4iOiJodHRwczovL2R1b3NlY3VyaXR5LmNvbTo0NDMiLCJmZWF0dXJlIjoiVTJGU2VjdXJpdHlLZXlBUEkiLCJleHBpcnkiOjE2NjM3MTgzOTksImlzU3ViZG9tYWluIjp0cnVlfQ== Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' com-duosecurity-devicehealth://*; img-src 'self' ; connect-src 'self' https://127.0.0.1:53100 https://127.0.0.1:53101 https://127.0.0.1:53102 https://127.0.0.1:53103 https://127.0.0.1:53104 https://127.0.0.1:53105 https://127.0.0.1:63100 https://127.0.0.1:63101 http://127.0.0.1:53106 http://127.0.0.1:53107 http://127.0.0.1:53108 http://127.0.0.1:53109 http://127.0.0.1:53110 http://127.0.0.1:53111 https://localhost:53100 https://localhost:53101 https://localhost:53102 https://localhost:53103 https://localhost:53104 https://localhost:53105 https://localhost:63100 https://localhost:63101 X-Content-Type-Options: nosniff
2024-10-01 17:04:02 UTC	8311	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 5d 3e 20 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 39 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 0a 3c 21 2d 2d 20 53 65 74 20 6c 61 74 65 73 74 20 63 6f 6d 70 61 74 69 62 69 6c 69 74 79 20 66 Data Ascii: <!DOCTYPE html>...[if IE 8]> <html lang="en" class="ie ie8"> <![endif]-->...[if IE 9]> <html lang="en" class="ie ie9"> <![endif]-->...[if gt IE 9]>...> <html lang="en"> ...<![endif]--><head><meta charset="utf-8">... Set latest compatibility f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49720	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:02 UTC	881	OUT	GET /frame/static/css/normalize.css?v=a674e HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:02 UTC	488	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:02 GMT Content-Type: text/css Content-Length: 7539 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-1d73" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:02 UTC	7539	IN	Data Raw: 2f 2a 21 20 6e 6f 72 6d 61 6c 69 7a 65 2e 63 73 73 20 76 32 2e 31 2e 32 20 7c 20 4d 49 54 20 4c 69 63 65 6e 73 65 20 7c 20 67 69 74 2e 69 6f 2f 6e 6f 72 6d 61 6c 69 7a 65 20 2a 2f 0a 0a 2f 2a 20 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 0a 20 20 20 48 54 4d 4c 35 20 64 69 73 70 6c 61 79 20 64 65 66 69 6e 69 74 69 6f 6e 73 0a 20 20 20 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 20 2a 2f 0a 0a 2f 2a 2a 0a Data Ascii: /! normalize.css v2.1.2 \| MIT License \| git.io/normalize //* ========================================================================== HTML5 display definitions ========================================================================== //*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49727	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:02 UTC	897	OUT	GET /frame/static/fonts/ss-standard/ss-standard.css?v=a8885 HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:02 UTC	489	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:02 GMT Content-Type: text/css Content-Length: 12209 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-2fb1" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:02 UTC	12209	IN	Data Raw: 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 0a 0a 2f 2a 0a 2a 20 53 79 6d 62 6f 6c 73 65 74 0a 2a 20 77 77 77 2e 73 79 6d 62 6f 6c 73 65 74 2e 63 6f 6d 0a 2a 20 43 6f 70 79 72 69 67 68 74 20 c2 a9 20 32 30 31 32 20 4f 61 6b 20 53 74 75 64 69 6f 73 20 4c 4c 43 0a 2a 0a 2a 20 55 70 6c 6f 61 64 20 74 68 69 73 20 66 69 6c 65 20 74 6f 20 79 6f 75 72 20 77 65 62 20 73 65 72 76 65 72 0a 2a 20 61 6e 64 20 70 6c 61 63 65 20 74 68 69 73 20 77 69 74 68 69 6e 20 79 6f 75 72 20 3c 68 65 61 64 3e 20 74 61 67 73 2e 0a 2a 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 77 65 62 66 6f 6e 74 73 2f 73 73 2d 73 74 61 6e 64 61 72 64 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 2a 2f 0a 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 Data Ascii: @charset "UTF-8";/** Symbolset* www.symbolset.com* Copyright 2012 Oak Studios LLC** Upload this file to your web server* and place this within your <head> tags.* <link href="webfonts/ss-standard.css" rel="stylesheet" />*/@font-face { font

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49728	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:02 UTC	887	OUT	GET /frame/static/css/fonts/duo-admin.css?v=50a8a HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:02 UTC	488	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:02 GMT Content-Type: text/css Content-Length: 7943 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-1f07" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:02 UTC	7943	IN	Data Raw: 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 44 75 6f 20 41 64 6d 69 6e 20 49 63 6f 6e 73 22 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 22 2e 2e 2f 2e 2e 2f 66 6f 6e 74 73 2f 64 75 6f 2d 61 64 6d 69 6e 2f 64 75 6f 2d 61 64 6d 69 6e 2e 65 6f 74 22 29 3b 0a 20 20 2f 2a 20 49 45 20 2a 2f 0a 20 20 2f 2a 20 73 74 79 6c 65 6c 69 6e 74 2d 64 69 73 61 62 6c 65 2d 6e 65 78 74 2d 6c 69 6e 65 20 76 61 6c 75 65 2d 6c 69 73 74 2d 63 6f 6d 6d 61 2d 73 70 61 63 65 2d 61 66 74 65 72 20 2a 2f 0a 20 20 73 72 63 3a 20 75 72 6c 28 22 2e 2e 2f 2e 2e 2f 66 6f 6e 74 73 2f 64 75 6f 2d 61 64 6d 69 6e 2f 64 75 6f 2d 61 64 6d 69 6e 2e 65 6f 74 3f 23 69 65 66 69 78 22 29 20 66 6f 72 6d 61 74 28 22 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 Data Ascii: @font-face { font-family: "Duo Admin Icons"; src: url("../../fonts/duo-admin/duo-admin.eot"); /* IE / / stylelint-disable-next-line value-list-comma-space-after */ src: url("../../fonts/duo-admin/duo-admin.eot?#iefix") format("embedded-opentyp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49725	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:02 UTC	879	OUT	GET /frame/static/css/v3/base.css?v=9a14c HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:03 UTC	491	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:02 GMT Content-Type: text/css Content-Length: 212230 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-33d06" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:03 UTC	15893	IN	Data Raw: 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 0a 2f 2a 21 20 6e 6f 72 6d 61 6c 69 7a 65 2e 63 73 73 20 76 33 2e 30 2e 32 20 7c 20 4d 49 54 20 4c 69 63 65 6e 73 65 20 7c 20 67 69 74 2e 69 6f 2f 6e 6f 72 6d 61 6c 69 7a 65 20 2a 2f 0a 2f 2a 2a 0a 20 2a 20 31 2e 20 53 65 74 20 64 65 66 61 75 6c 74 20 66 6f 6e 74 20 66 61 6d 69 6c 79 20 74 6f 20 73 61 6e 73 2d 73 65 72 69 66 2e 0a 20 2a 20 32 2e 20 50 72 65 76 65 6e 74 20 69 4f 53 20 74 65 78 74 20 73 69 7a 65 20 61 64 6a 75 73 74 20 61 66 74 65 72 20 6f 72 69 65 6e 74 61 74 69 6f 6e 20 63 68 61 6e 67 65 2c 20 77 69 74 68 6f 75 74 20 64 69 73 61 62 6c 69 6e 67 0a 20 2a 20 20 20 20 75 73 65 72 20 7a 6f 6f 6d 2e 0a 20 2a 2f 0a 68 74 6d 6c 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d Data Ascii: @charset "UTF-8";/! normalize.css v3.0.2 \| MIT License \| git.io/normalize //** * 1. Set default font family to sans-serif. * 2. Prevent iOS text size adjust after orientation change, without disabling * user zoom. */html { font-family: sans-
2024-10-01 17:04:03 UTC	16384	IN	Data Raw: 69 6e 65 2e 69 6e 64 65 6e 74 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 30 3b 0a 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 72 65 6d 3b 0a 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 31 72 65 6d 3b 0a 7d 0a 2e 6c 69 6e 65 3a 6c 61 73 74 2d 63 68 69 6c 64 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 30 3b 0a 7d 0a 2e 66 6c 65 78 62 6f 78 20 2e 6c 69 6e 65 3a 6e 6f 74 28 2e 76 65 72 74 69 63 61 6c 29 20 7b 0a 20 20 64 69 73 70 6c 61 79 3a 20 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 0a 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 2d 6d 73 2d 66 6c 65 78 2d 61 6c 69 67 6e 3a 20 62 61 73 65 6c 69 6e 65 3b 0a 20 20 20 20 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 62 61 73 65 6c 69 6e 65 3b 0a 7d 0a 2e 66 6c 65 Data Ascii: ine.indent { margin-left: 0; padding-left: 1rem; padding-right: 1rem;}.line:last-child { margin-bottom: 0;}.flexbox .line:not(.vertical) { display: -ms-flexbox; display: flex; -ms-flex-align: baseline; align-items: baseline;}.fle
2024-10-01 17:04:03 UTC	16384	IN	Data Raw: 6f 6e 2e 64 69 73 61 62 6c 65 64 2c 20 2e 62 75 74 74 6f 6e 3a 64 69 73 61 62 6c 65 64 2c 20 2e 62 75 74 74 6f 6e 2e 64 69 73 61 62 6c 65 64 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 73 75 62 6d 69 74 5d 3a 6e 6f 74 28 2e 6c 69 6e 6b 29 3a 64 69 73 61 62 6c 65 64 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 73 75 62 6d 69 74 5d 3a 6e 6f 74 28 2e 6c 69 6e 6b 29 2e 64 69 73 61 62 6c 65 64 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 72 65 73 65 74 5d 3a 64 69 73 61 62 6c 65 64 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 72 65 73 65 74 5d 2e 64 69 73 61 62 6c 65 64 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 62 75 74 74 6f 6e 5d 3a 64 69 73 61 62 6c 65 64 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 62 75 74 74 6f 6e 5d 2e 64 69 73 61 62 6c 65 64 20 7b 0a 20 20 63 75 72 73 6f 72 3a 20 6e Data Ascii: on.disabled, .button:disabled, .button.disabled, input[type=submit]:not(.link):disabled, input[type=submit]:not(.link).disabled, input[type=reset]:disabled, input[type=reset].disabled, input[type=button]:disabled, input[type=button].disabled { cursor: n
2024-10-01 17:04:03 UTC	16384	IN	Data Raw: 69 76 65 2e 66 75 6c 6c 2d 77 69 64 74 68 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 73 75 62 6d 69 74 5d 3a 6e 6f 74 28 2e 6c 69 6e 6b 29 2e 70 6f 73 69 74 69 76 65 2e 66 75 6c 6c 2d 77 69 64 74 68 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 72 65 73 65 74 5d 2e 70 6f 73 69 74 69 76 65 2e 66 75 6c 6c 2d 77 69 64 74 68 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 62 75 74 74 6f 6e 5d 2e 70 6f 73 69 74 69 76 65 2e 66 75 6c 6c 2d 77 69 64 74 68 20 7b 0a 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 7d 0a 62 75 74 74 6f 6e 2e 64 61 6e 67 65 72 2c 20 2e 62 75 74 74 6f 6e 2e 64 61 6e 67 65 72 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 73 75 62 6d 69 74 5d 3a 6e 6f 74 28 2e 6c 69 6e 6b 29 2e 64 61 6e 67 65 72 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 72 65 73 65 74 5d 2e 64 61 6e 67 Data Ascii: ive.full-width, input[type=submit]:not(.link).positive.full-width, input[type=reset].positive.full-width, input[type=button].positive.full-width { width: 100%;}button.danger, .button.danger, input[type=submit]:not(.link).danger, input[type=reset].dang
2024-10-01 17:04:03 UTC	16384	IN	Data Raw: 20 20 66 6c 6f 61 74 3a 20 6c 65 66 74 3b 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 31 72 65 6d 3b 0a 20 20 77 69 64 74 68 3a 20 63 61 6c 63 28 28 31 30 30 25 20 2a 20 30 2e 37 35 29 20 2d 20 28 31 72 65 6d 20 2a 20 28 31 20 2d 20 30 2e 37 35 29 29 29 3b 0a 7d 0a 2e 63 6f 6c 2d 33 2d 34 3a 6e 74 68 2d 6f 66 2d 74 79 70 65 28 34 6e 29 2c 20 2e 63 6f 6c 2d 33 2d 34 3a 6c 61 73 74 2d 6f 66 2d 74 79 70 65 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 30 3b 0a 7d 0a 0a 2e 63 6f 6c 2d 34 2d 34 20 7b 0a 20 20 66 6c 6f 61 74 3a 20 6c 65 66 74 3b 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 31 72 65 6d 3b 0a 20 20 77 69 64 74 68 3a 20 63 61 6c 63 28 28 31 30 30 25 20 2a 20 31 29 20 2d 20 28 31 72 65 6d 20 2a 20 28 31 20 2d 20 31 29 29 29 Data Ascii: float: left; margin-right: 1rem; width: calc((100% * 0.75) - (1rem * (1 - 0.75)));}.col-3-4:nth-of-type(4n), .col-3-4:last-of-type { margin-right: 0;}.col-4-4 { float: left; margin-right: 1rem; width: calc((100% * 1) - (1rem * (1 - 1)))
2024-10-01 17:04:03 UTC	16384	IN	Data Raw: 20 46 69 72 65 66 6f 78 20 34 2b 2c 20 53 61 66 61 72 69 2c 20 61 6e 64 20 43 68 72 6f 6d 65 2e 0a 20 2a 2f 0a 68 31 20 7b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 65 6d 3b 0a 20 20 6d 61 72 67 69 6e 3a 20 30 2e 36 37 65 6d 20 30 3b 0a 7d 0a 0a 2f 2a 2a 0a 20 2a 20 41 64 64 72 65 73 73 20 73 74 79 6c 69 6e 67 20 6e 6f 74 20 70 72 65 73 65 6e 74 20 69 6e 20 49 45 20 38 2f 39 2e 0a 20 2a 2f 0a 6d 61 72 6b 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 30 3b 0a 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 7d 0a 0a 2f 2a 2a 0a 20 2a 20 41 64 64 72 65 73 73 20 69 6e 63 6f 6e 73 69 73 74 65 6e 74 20 61 6e 64 20 76 61 72 69 61 62 6c 65 20 66 6f 6e 74 20 73 69 7a 65 20 69 6e 20 61 6c 6c 20 62 72 6f 77 73 65 72 73 2e 0a 20 2a 2f 0a 73 6d 61 6c 6c Data Ascii: Firefox 4+, Safari, and Chrome. /h1 { font-size: 2em; margin: 0.67em 0;}/* * Address styling not present in IE 8/9. /mark { background: #ff0; color: #000;}/* * Address inconsistent and variable font size in all browsers. */small
2024-10-01 17:04:03 UTC	16384	IN	Data Raw: 70 75 74 5b 74 79 70 65 3d 6e 75 6d 62 65 72 5d 3a 3a 2d 77 65 62 6b 69 74 2d 69 6e 6e 65 72 2d 73 70 69 6e 2d 62 75 74 74 6f 6e 20 7b 0a 20 20 61 70 70 65 61 72 61 6e 63 65 3a 20 6e 6f 6e 65 3b 0a 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 7d 0a 0a 69 6e 70 75 74 5b 74 79 70 65 3d 6e 75 6d 62 65 72 5d 20 7b 0a 20 20 61 70 70 65 61 72 61 6e 63 65 3a 20 74 65 78 74 66 69 65 6c 64 3b 0a 7d 0a 0a 69 6e 70 75 74 5b 74 79 70 65 3d 74 65 6c 5d 3a 66 6f 63 75 73 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 20 20 62 6f 72 64 65 72 3a 20 32 70 78 20 73 6f 6c 69 64 20 23 36 33 42 32 34 36 3b 0a 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 30 20 35 70 78 20 30 20 72 67 62 61 28 39 39 2c 20 31 37 38 2c 20 37 30 2c 20 30 2e 35 29 3b 0a 7d 0a 0a 73 65 6c 65 63 Data Ascii: put[type=number]::-webkit-inner-spin-button { appearance: none; margin: 0;}input[type=number] { appearance: textfield;}input[type=tel]:focus { color: #333; border: 2px solid #63B246; box-shadow: 0 0 5px 0 rgba(99, 178, 70, 0.5);}selec
2024-10-01 17:04:03 UTC	16384	IN	Data Raw: 79 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 62 75 74 74 6f 6e 5d 2e 70 72 69 6d 61 72 79 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 33 37 39 65 64 34 3b 0a 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 33 37 39 65 64 34 3b 0a 20 20 63 6f 6c 6f 72 3a 20 77 68 69 74 65 3b 0a 20 20 6f 75 74 6c 69 6e 65 3a 20 30 3b 0a 7d 0a 62 75 74 74 6f 6e 2e 70 72 69 6d 61 72 79 20 73 70 61 6e 2c 20 2e 62 75 74 74 6f 6e 2e 70 72 69 6d 61 72 79 20 73 70 61 6e 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 73 75 62 6d 69 74 5d 3a 6e 6f 74 28 2e 6c 69 6e 6b 29 2e 70 72 69 6d 61 72 79 20 73 70 61 6e 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 72 65 73 65 74 5d 2e 70 72 69 6d 61 72 79 20 73 70 61 6e 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 62 75 74 74 6f 6e 5d Data Ascii: y, input[type=button].primary { background-color: #379ed4; border-color: #379ed4; color: white; outline: 0;}button.primary span, .button.primary span, input[type=submit]:not(.link).primary span, input[type=reset].primary span, input[type=button]
2024-10-01 17:04:03 UTC	16384	IN	Data Raw: 20 69 6e 70 75 74 5b 74 79 70 65 3d 72 65 73 65 74 5d 2e 64 61 6e 67 65 72 2e 67 68 6f 73 74 3a 68 6f 76 65 72 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 62 75 74 74 6f 6e 5d 2e 64 61 6e 67 65 72 2e 67 68 6f 73 74 3a 68 6f 76 65 72 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 0a 20 20 63 6f 6c 6f 72 3a 20 23 35 35 31 63 31 65 3b 0a 7d 0a 62 75 74 74 6f 6e 2e 64 61 6e 67 65 72 2e 67 68 6f 73 74 3a 61 63 74 69 76 65 2c 20 2e 62 75 74 74 6f 6e 2e 64 61 6e 67 65 72 2e 67 68 6f 73 74 3a 61 63 74 69 76 65 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 73 75 62 6d 69 74 5d 3a 6e 6f 74 28 2e 6c 69 6e 6b 29 2e 64 61 6e 67 65 72 2e 67 68 6f 73 74 3a 61 63 74 69 76 65 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 72 65 73 65 Data Ascii: input[type=reset].danger.ghost:hover, input[type=button].danger.ghost:hover { background-color: transparent; color: #551c1e;}button.danger.ghost:active, .button.danger.ghost:active, input[type=submit]:not(.link).danger.ghost:active, input[type=rese
2024-10-01 17:04:03 UTC	16384	IN	Data Raw: 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 30 3b 0a 7d 0a 0a 2e 63 6f 6c 2d 34 2d 37 20 7b 0a 20 20 66 6c 6f 61 74 3a 20 6c 65 66 74 3b 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 31 72 65 6d 3b 0a 20 20 77 69 64 74 68 3a 20 63 61 6c 63 28 28 31 30 30 25 20 2a 20 30 2e 35 37 31 34 32 38 35 37 31 34 29 20 2d 20 28 31 72 65 6d 20 2a 20 28 31 20 2d 20 30 2e 35 37 31 34 32 38 35 37 31 34 29 29 29 3b 0a 7d 0a 2e 63 6f 6c 2d 34 2d 37 3a 6e 74 68 2d 6f 66 2d 74 79 70 65 28 37 6e 29 2c 20 2e 63 6f 6c 2d 34 2d 37 3a 6c 61 73 74 2d 6f 66 2d 74 79 70 65 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 30 3b 0a 7d 0a 0a 2e 63 6f 6c 2d 35 2d 37 20 7b 0a 20 20 66 6c 6f 61 74 3a 20 6c 65 66 74 3b 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 31 Data Ascii: margin-right: 0;}.col-4-7 { float: left; margin-right: 1rem; width: calc((100% * 0.5714285714) - (1rem * (1 - 0.5714285714)));}.col-4-7:nth-of-type(7n), .col-4-7:last-of-type { margin-right: 0;}.col-5-7 { float: left; margin-right: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49726	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:02 UTC	877	OUT	GET /frame/static/css/tipsy.css?v=4217a HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:02 UTC	487	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:02 GMT Content-Type: text/css Content-Length: 2285 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-8ed" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:02 UTC	2285	IN	Data Raw: 2e 74 69 70 73 79 20 7b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 20 70 61 64 64 69 6e 67 3a 20 35 70 78 3b 20 7a 2d 69 6e 64 65 78 3a 20 31 30 30 30 30 30 3b 20 7d 0a 20 20 2e 74 69 70 73 79 2d 69 6e 6e 65 72 20 7b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 63 6f 6c 6f 72 3a 20 23 46 46 46 3b 20 6d 61 78 2d 77 69 64 74 68 3a 20 32 30 30 70 78 3b 20 70 61 64 64 69 6e 67 3a 20 35 70 78 20 38 70 78 20 34 70 78 20 38 70 78 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 7d 0a 0a 20 20 2f 2a 20 52 6f 75 6e 64 65 64 20 63 6f 72 6e 65 72 73 20 2a 2f 0a 20 20 2e 74 69 70 73 79 2d 69 6e 6e 65 72 20 7b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a Data Ascii: .tipsy { font-size: 10px; position: absolute; padding: 5px; z-index: 100000; } .tipsy-inner { background-color: #000; color: #FFF; max-width: 200px; padding: 5px 8px 4px 8px; text-align: center; } /* Rounded corners */ .tipsy-inner { border-radius:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49724	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:02 UTC	886	OUT	GET /frame/static/shared/lib/jquery/jquery-prologue.js?v=400dc HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:02 UTC	500	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:02 GMT Content-Type: application/javascript Content-Length: 411 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-19b" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:02 UTC	411	IN	Data Raw: 2f 2f 20 43 65 72 74 61 69 6e 20 72 75 6e 74 69 6d 65 20 65 6e 76 69 72 6f 6e 6d 65 6e 74 73 2c 20 6c 69 6b 65 20 45 6c 65 63 74 72 6f 6e 2c 20 77 69 6c 6c 20 64 65 66 69 6e 65 20 60 6d 6f 64 75 6c 65 60 0a 2f 2f 20 6f 6e 20 74 68 65 20 67 6c 6f 62 61 6c 20 73 63 6f 70 65 2c 20 77 68 69 63 68 20 6d 61 6b 65 73 20 6a 51 75 65 72 79 20 74 68 69 6e 6b 20 69 74 20 69 73 20 62 65 69 6e 67 20 6c 6f 61 64 65 64 0a 2f 2f 20 69 6e 20 61 20 43 6f 6d 6d 6f 6e 4a 53 20 65 6e 76 69 72 6f 6e 6d 65 6e 74 20 73 6f 20 69 74 20 64 6f 65 73 6e 27 74 20 70 6c 61 63 65 20 69 74 73 65 6c 66 20 6f 6e 20 60 77 69 6e 64 6f 77 60 2e 0a 2f 2f 20 54 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 77 69 6c 6c 20 6d 6f 76 65 20 60 6d 6f 64 75 6c 65 60 20 69 66 20 69 74 27 73 20 64 65 66 69 6e Data Ascii: // Certain runtime environments, like Electron, will define `module`// on the global scope, which makes jQuery think it is being loaded// in a CommonJS environment so it doesn't place itself on `window`.// The following will move `module` if it's defin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49729	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:02 UTC	938	OUT	GET /frame/static/img/duo-cisco-logo-green.png?v=437f1 HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:03 UTC	489	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:03 GMT Content-Type: image/png Content-Length: 5117 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-13fd" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:03 UTC	5117	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 48 00 00 00 c0 08 06 00 00 00 66 80 fa 32 00 00 13 c4 49 44 41 54 78 01 ed dd cf 6f 1b 67 7e c7 f1 ef 33 a2 b3 ed 02 c9 0a bd 6e 81 32 b7 cd 29 ca 65 bb a7 86 72 52 a0 71 64 8b ee 7d 6b e5 da ed c2 36 f2 03 be 59 3e 34 58 c4 5e 58 86 f7 6e 79 ff 80 58 76 ac a4 07 07 54 7a 6b 2e 51 4e c9 2d 0c d0 9c d7 eb fc 70 1c 91 f3 ec f7 cb 19 da 94 2c 0e 87 d4 90 7c 86 7c bf 00 59 32 49 6b a4 a1 9f cf 7c 9f 1f 33 23 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 49 72 83 5e 50 af d7 17 db 6d a9 47 91 bc dc 6e fb 25 e7 a4 aa 0f 2f a6 4f df f7 5e 9a fa 58 53 bf d5 27 0b 0b b2 b3 b5 b5 b5 3b e8 7b 9e 3c 59 3f a7 ff 66 f1 e0 e3 fa bd 76 3f f8 60 6b 4b 86 64 3f 63 1c c7 Data Ascii: PNGIHDRHf2IDATxog~3n2)erRqd}k6Y>4X^XnyXvTzk.QN-p,\|\|Y2Ik\|3#Ir^PmGn%/O^XS';{<Y?fv?`kKd?c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49731	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:03 UTC	887	OUT	GET /frame/static/fonts/duo-admin/duo-admin.woff HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://api-5092fa72.duosecurity.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://api-5092fa72.duosecurity.com/frame/static/css/fonts/duo-admin.css?v=50a8a Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:03 UTC	428	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:03 GMT Content-Type: application/font-woff Content-Length: 23428 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-5b84" Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:03 UTC	15956	IN	Data Raw: 77 4f 46 46 4f 54 54 4f 00 00 5b 84 00 0b 00 00 00 00 81 bc 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 46 46 20 00 00 01 08 00 00 56 c4 00 00 7a 6f bf 08 05 eb 46 46 54 4d 00 00 57 cc 00 00 00 1a 00 00 00 1c 75 61 18 f8 47 44 45 46 00 00 57 e8 00 00 00 1d 00 00 00 20 00 b9 00 04 4f 53 2f 32 00 00 58 08 00 00 00 4a 00 00 00 60 2f be 4e 14 63 6d 61 70 00 00 58 54 00 00 01 4a 00 00 02 ba 60 85 81 d3 68 65 61 64 00 00 59 a0 00 00 00 30 00 00 00 36 0a 42 b7 27 68 68 65 61 00 00 59 d0 00 00 00 1e 00 00 00 24 04 35 02 00 68 6d 74 78 00 00 59 f0 00 00 00 a3 00 00 01 1c 0d 87 0a 87 6d 61 78 70 00 00 5a 94 00 00 00 06 00 00 00 06 00 8c 50 00 6e 61 6d 65 00 00 5a 9c 00 00 00 d8 00 00 01 95 67 80 a1 24 70 6f 73 74 00 00 5b 74 00 00 00 Data Ascii: wOFFOTTO[CFF VzoFFTMWuaGDEFW OS/2XJ`/NcmapXTJ`headY06B'hheaY$5hmtxYmaxpZPnameZg$post[t
2024-10-01 17:04:03 UTC	7472	IN	Data Raw: 9e 78 0e 5a df 30 1e 11 1e d6 dd 09 8c 5f f2 fe 51 7e a7 fb e7 5d 11 58 8b b4 8e 5e eb bd 25 0c a2 ac 31 6b 17 24 2b 4b 37 36 58 0e ab e6 65 17 d8 60 60 8d ab 68 48 14 d8 6f bb 6c dc 58 67 41 71 e3 b1 21 20 e8 d0 3f d3 42 41 01 c3 17 0c 5a b6 b1 4d d3 56 e6 e1 43 b1 b3 0c 56 99 c5 dc d8 13 10 58 07 1a 0a c1 6e 80 f6 ec 6d dc 3a 65 7f 6c 44 9a 25 88 a1 80 e6 57 7d aa 5f 01 6b 8a a5 70 fb fd 38 a8 c8 20 fd 64 3f d3 99 aa 47 f5 20 cd 83 fd a0 75 02 b2 4f 06 84 2a 3e 05 b0 60 dc 30 86 17 58 fb 29 2d 8e c3 48 8d 2b 61 99 05 3a 65 d1 e7 ed 68 f5 d6 4a f5 52 9b ee 4d 18 29 30 4c f2 c1 3f 64 2c d2 48 7f 64 72 18 be c9 d1 0e c5 eb 13 71 4c 89 42 73 78 89 61 24 46 24 5d 0e 45 d8 cd 05 9d 1d 92 2a e0 c6 b1 33 2d 45 f5 c6 5a bb 5a 53 9e 38 98 37 2c 41 dc 38 a5 02 47 Data Ascii: xZ0_Q~]X^%1k$+K76Xe``hHolXgAq! ?BAZMVCVXnm:elD%W}_kp8 d?G uO>`0X)-H+a:ehJRM)0L?d,HdrqLBsxa$F$]E3-EZZS87,A8G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49730	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:03 UTC	881	OUT	GET /frame/static/shared/lib/jquery/jquery.min.js?v=ff152 HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:03 UTC	504	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:03 GMT Content-Type: application/javascript Content-Length: 89501 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-15d9d" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:03 UTC	15880	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-10-01 17:04:03 UTC	16384	IN	Data Raw: 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 2c 61 2c 73 2c 75 2c 6c 3d 79 21 3d 3d 6d 3f 22 6e 65 78 74 53 69 62 6c 69 6e 67 22 3a 22 70 72 65 76 69 6f 75 73 53 69 62 6c 69 6e 67 22 2c 63 3d 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2c 66 3d 78 26 26 65 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 70 3d 21 6e 26 26 21 78 2c 64 3d 21 31 3b 69 66 28 63 29 7b 69 66 28 79 29 7b 77 68 69 6c 65 28 6c 29 7b 61 3d 65 3b 77 68 69 6c 65 28 61 3d 61 5b 6c 5d 29 69 66 28 78 3f 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 66 3a 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 72 65 74 75 72 6e 21 31 3b 75 3d 6c 3d 22 6f 6e 6c 79 22 3d 3d 3d 68 26 26 21 75 26 26 22 6e 65 78 74 53 69 62 6c 69 Data Ascii: nction(e,t,n){var r,i,o,a,s,u,l=y!==m?"nextSibling":"previousSibling",c=e.parentNode,f=x&&e.nodeName.toLowerCase(),p=!n&&!x,d=!1;if(c){if(y){while(l){a=e;while(a=a[l])if(x?a.nodeName.toLowerCase()===f:1===a.nodeType)return!1;u=l="only"===h&&!u&&"nextSibli
2024-10-01 17:04:03 UTC	16384	IN	Data Raw: 65 6f 75 74 28 53 2e 72 65 61 64 79 29 3a 28 45 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 42 29 2c 43 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 42 29 29 3b 76 61 72 20 24 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 2c 69 2c 6f 2c 61 29 7b 76 61 72 20 73 3d 30 2c 75 3d 65 2e 6c 65 6e 67 74 68 2c 6c 3d 6e 75 6c 6c 3d 3d 6e 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 3d 77 28 6e 29 29 66 6f 72 28 73 20 69 6e 20 69 3d 21 30 2c 6e 29 24 28 65 2c 74 2c 73 2c 6e 5b 73 5d 2c 21 30 2c 6f 2c 61 29 3b 65 6c 73 65 20 69 66 28 76 6f 69 64 20 30 21 3d 3d 72 26 26 28 69 3d 21 30 2c 6d 28 72 29 7c 7c 28 61 3d 21 30 29 2c 6c 26 26 28 61 3f 28 74 2e 63 61 6c 6c 28 65 Data Ascii: eout(S.ready):(E.addEventListener("DOMContentLoaded",B),C.addEventListener("load",B));var $=function(e,t,n,r,i,o,a){var s=0,u=e.length,l=null==n;if("object"===w(n))for(s in i=!0,n)$(e,t,s,n[s],!0,o,a);else if(void 0!==r&&(i=!0,m(r)\|\|(a=!0),l&&(a?(t.call(e
2024-10-01 17:04:03 UTC	16384	IN	Data Raw: 72 2c 22 73 63 72 69 70 74 22 29 29 2c 72 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 72 29 29 3b 72 65 74 75 72 6e 20 65 7d 53 2e 65 78 74 65 6e 64 28 7b 68 74 6d 6c 50 72 65 66 69 6c 74 65 72 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 2c 63 6c 6f 6e 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 2c 61 2c 73 2c 75 2c 6c 2c 63 3d 65 2e 63 6c 6f 6e 65 4e 6f 64 65 28 21 30 29 2c 66 3d 69 65 28 65 29 3b 69 66 28 21 28 79 2e 6e 6f 43 6c 6f 6e 65 43 68 65 63 6b 65 64 7c 7c 31 21 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 26 26 31 31 21 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 53 2e 69 73 58 4d 4c 44 6f 63 28 65 29 29 29 66 6f 72 28 61 3d 76 65 28 63 29 2c 72 3d 30 2c 69 3d 28 6f 3d Data Ascii: r,"script")),r.parentNode.removeChild(r));return e}S.extend({htmlPrefilter:function(e){return e},clone:function(e,t,n){var r,i,o,a,s,u,l,c=e.cloneNode(!0),f=ie(e);if(!(y.noCloneChecked\|\|1!==e.nodeType&&11!==e.nodeType\|\|S.isXMLDoc(e)))for(a=ve(c),r=0,i=(o=
2024-10-01 17:04:03 UTC	16384	IN	Data Raw: 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 43 2e 73 65 74 54 69 6d 65 6f 75 74 28 65 2c 72 29 3b 74 2e 73 74 6f 70 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 43 2e 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 6e 29 7d 7d 29 7d 2c 74 74 3d 45 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6e 70 75 74 22 29 2c 6e 74 3d 45 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 65 6c 65 63 74 22 29 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 45 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 6f 70 74 69 6f 6e 22 29 29 2c 74 74 2e 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 2c 79 2e 63 68 65 63 6b 4f 6e 3d 22 22 21 3d 3d 74 74 2e 76 61 6c 75 65 2c 79 2e 6f 70 74 53 65 6c 65 63 74 65 64 3d 6e 74 2e 73 65 6c 65 63 74 65 64 2c 28 74 74 3d 45 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e Data Ascii: on(e,t){var n=C.setTimeout(e,r);t.stop=function(){C.clearTimeout(n)}})},tt=E.createElement("input"),nt=E.createElement("select").appendChild(E.createElement("option")),tt.type="checkbox",y.checkOn=""!==tt.value,y.optSelected=nt.selected,(tt=E.createElemen
2024-10-01 17:04:03 UTC	8085	IN	Data Raw: 72 65 6e 74 28 65 29 2e 6e 6f 74 28 22 62 6f 64 79 22 29 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 53 28 74 68 69 73 29 2e 72 65 70 6c 61 63 65 57 69 74 68 28 74 68 69 73 2e 63 68 69 6c 64 4e 6f 64 65 73 29 7d 29 2c 74 68 69 73 7d 7d 29 2c 53 2e 65 78 70 72 2e 70 73 65 75 64 6f 73 2e 68 69 64 64 65 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 21 53 2e 65 78 70 72 2e 70 73 65 75 64 6f 73 2e 76 69 73 69 62 6c 65 28 65 29 7d 2c 53 2e 65 78 70 72 2e 70 73 65 75 64 6f 73 2e 76 69 73 69 62 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 21 21 28 65 2e 6f 66 66 73 65 74 57 69 64 74 68 7c 7c 65 2e 6f 66 66 73 65 74 48 65 69 67 68 74 7c 7c 65 2e 67 65 74 43 6c 69 65 6e 74 52 65 63 74 73 28 29 2e 6c 65 6e 67 74 68 29 7d 2c 53 Data Ascii: rent(e).not("body").each(function(){S(this).replaceWith(this.childNodes)}),this}}),S.expr.pseudos.hidden=function(e){return!S.expr.pseudos.visible(e)},S.expr.pseudos.visible=function(e){return!!(e.offsetWidth\|\|e.offsetHeight\|\|e.getClientRects().length)},S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49734	3.145.240.82	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:03 UTC	627	OUT	GET /frame/static/shared/lib/jquery/jquery-prologue.js?v=400dc HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:03 UTC	500	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:03 GMT Content-Type: application/javascript Content-Length: 411 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-19b" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:03 UTC	411	IN	Data Raw: 2f 2f 20 43 65 72 74 61 69 6e 20 72 75 6e 74 69 6d 65 20 65 6e 76 69 72 6f 6e 6d 65 6e 74 73 2c 20 6c 69 6b 65 20 45 6c 65 63 74 72 6f 6e 2c 20 77 69 6c 6c 20 64 65 66 69 6e 65 20 60 6d 6f 64 75 6c 65 60 0a 2f 2f 20 6f 6e 20 74 68 65 20 67 6c 6f 62 61 6c 20 73 63 6f 70 65 2c 20 77 68 69 63 68 20 6d 61 6b 65 73 20 6a 51 75 65 72 79 20 74 68 69 6e 6b 20 69 74 20 69 73 20 62 65 69 6e 67 20 6c 6f 61 64 65 64 0a 2f 2f 20 69 6e 20 61 20 43 6f 6d 6d 6f 6e 4a 53 20 65 6e 76 69 72 6f 6e 6d 65 6e 74 20 73 6f 20 69 74 20 64 6f 65 73 6e 27 74 20 70 6c 61 63 65 20 69 74 73 65 6c 66 20 6f 6e 20 60 77 69 6e 64 6f 77 60 2e 0a 2f 2f 20 54 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 77 69 6c 6c 20 6d 6f 76 65 20 60 6d 6f 64 75 6c 65 60 20 69 66 20 69 74 27 73 20 64 65 66 69 6e Data Ascii: // Certain runtime environments, like Electron, will define `module`// on the global scope, which makes jQuery think it is being loaded// in a CommonJS environment so it doesn't place itself on `window`.// The following will move `module` if it's defin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49733	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:03 UTC	873	OUT	GET /frame/static/shared/lib/he/he.min.js?v=aaa33 HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:03 UTC	503	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:03 GMT Content-Type: application/javascript Content-Length: 61367 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-efb7" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:03 UTC	15881	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 72 6f 6f 74 29 7b 76 61 72 20 66 72 65 65 45 78 70 6f 72 74 73 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3d 3d 22 6f 62 6a 65 63 74 22 26 26 65 78 70 6f 72 74 73 3b 76 61 72 20 66 72 65 65 4d 6f 64 75 6c 65 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3d 3d 22 6f 62 6a 65 63 74 22 26 26 6d 6f 64 75 6c 65 26 26 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 3d 66 72 65 65 45 78 70 6f 72 74 73 26 26 6d 6f 64 75 6c 65 3b 76 61 72 20 66 72 65 65 47 6c 6f 62 61 6c 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 3d 3d 22 6f 62 6a 65 63 74 22 26 26 67 6c 6f 62 61 6c 3b 69 66 28 66 72 65 65 47 6c 6f 62 61 6c 2e 67 6c 6f 62 61 6c 3d 3d 3d 66 72 65 65 47 6c 6f 62 61 6c 7c 7c 66 72 65 65 47 6c 6f 62 61 6c 2e 77 69 6e 64 6f 77 3d 3d 3d 66 72 65 Data Ascii: (function(root){var freeExports=typeof exports=="object"&&exports;var freeModule=typeof module=="object"&&module&&module.exports==freeExports&&module;var freeGlobal=typeof global=="object"&&global;if(freeGlobal.global===freeGlobal\|\|freeGlobal.window===fre
2024-10-01 17:04:03 UTC	16384	IN	Data Raw: 22 3a 22 6e 67 65 22 2c 22 e2 a9 be cc b8 22 3a 22 6e 67 65 73 22 2c 22 e2 8b 99 cc b8 22 3a 22 6e 47 67 22 2c 22 e2 89 b5 22 3a 22 6e 67 73 69 6d 22 2c 22 e2 89 ab e2 83 92 22 3a 22 6e 47 74 22 2c 22 e2 89 af 22 3a 22 6e 67 74 22 2c 22 e2 89 ab cc b8 22 3a 22 6e 47 74 76 22 2c 22 e2 86 ae 22 3a 22 6e 68 61 72 72 22 2c 22 e2 87 8e 22 3a 22 6e 68 41 72 72 22 2c 22 e2 ab b2 22 3a 22 6e 68 70 61 72 22 2c 22 e2 88 8b 22 3a 22 6e 69 22 2c 22 e2 8b bc 22 3a 22 6e 69 73 22 2c 22 e2 8b ba 22 3a 22 6e 69 73 64 22 2c 22 d0 8a 22 3a 22 4e 4a 63 79 22 2c 22 d1 9a 22 3a 22 6e 6a 63 79 22 2c 22 e2 86 9a 22 3a 22 6e 6c 61 72 72 22 2c 22 e2 87 8d 22 3a 22 6e 6c 41 72 72 22 2c 22 e2 80 a5 22 3a 22 6e 6c 64 72 22 2c 22 e2 89 a6 cc b8 22 3a 22 6e 6c 45 22 2c 22 e2 89 b0 22 Data Ascii: ":"nge","":"nges","":"nGg","":"ngsim","":"nGt","":"ngt","":"nGtv","":"nharr","":"nhArr","":"nhpar","":"ni","":"nis","":"nisd","":"NJcy","":"njcy","":"nlarr","":"nlArr","":"nldr","":"nlE",""
2024-10-01 17:04:04 UTC	16384	IN	Data Raw: c4 9a 22 2c 65 63 61 72 6f 6e 3a 22 c4 9b 22 2c 45 63 69 72 63 3a 22 c3 8a 22 2c 65 63 69 72 63 3a 22 c3 aa 22 2c 65 63 69 72 3a 22 e2 89 96 22 2c 65 63 6f 6c 6f 6e 3a 22 e2 89 95 22 2c 45 63 79 3a 22 d0 ad 22 2c 65 63 79 3a 22 d1 8d 22 2c 65 44 44 6f 74 3a 22 e2 a9 b7 22 2c 45 64 6f 74 3a 22 c4 96 22 2c 65 64 6f 74 3a 22 c4 97 22 2c 65 44 6f 74 3a 22 e2 89 91 22 2c 65 65 3a 22 e2 85 87 22 2c 65 66 44 6f 74 3a 22 e2 89 92 22 2c 45 66 72 3a 22 f0 9d 94 88 22 2c 65 66 72 3a 22 f0 9d 94 a2 22 2c 65 67 3a 22 e2 aa 9a 22 2c 45 67 72 61 76 65 3a 22 c3 88 22 2c 65 67 72 61 76 65 3a 22 c3 a8 22 2c 65 67 73 3a 22 e2 aa 96 22 2c 65 67 73 64 6f 74 3a 22 e2 aa 98 22 2c 65 6c 3a 22 e2 aa 99 22 2c 45 6c 65 6d 65 6e 74 3a 22 e2 88 88 22 2c 65 6c 69 6e 74 65 72 73 3a 22 Data Ascii: ",ecaron:"",Ecirc:"",ecirc:"",ecir:"",ecolon:"",Ecy:"",ecy:"",eDDot:"",Edot:"",edot:"",eDot:"",ee:"",efDot:"",Efr:"",efr:"",eg:"",Egrave:"",egrave:"",egs:"",egsdot:"",el:"",Element:"",elinters:"
2024-10-01 17:04:04 UTC	12718	IN	Data Raw: 2c 73 68 61 72 70 3a 22 e2 99 af 22 2c 53 48 43 48 63 79 3a 22 d0 a9 22 2c 73 68 63 68 63 79 3a 22 d1 89 22 2c 53 48 63 79 3a 22 d0 a8 22 2c 73 68 63 79 3a 22 d1 88 22 2c 53 68 6f 72 74 44 6f 77 6e 41 72 72 6f 77 3a 22 e2 86 93 22 2c 53 68 6f 72 74 4c 65 66 74 41 72 72 6f 77 3a 22 e2 86 90 22 2c 73 68 6f 72 74 6d 69 64 3a 22 e2 88 a3 22 2c 73 68 6f 72 74 70 61 72 61 6c 6c 65 6c 3a 22 e2 88 a5 22 2c 53 68 6f 72 74 52 69 67 68 74 41 72 72 6f 77 3a 22 e2 86 92 22 2c 53 68 6f 72 74 55 70 41 72 72 6f 77 3a 22 e2 86 91 22 2c 73 68 79 3a 22 c2 ad 22 2c 53 69 67 6d 61 3a 22 ce a3 22 2c 73 69 67 6d 61 3a 22 cf 83 22 2c 73 69 67 6d 61 66 3a 22 cf 82 22 2c 73 69 67 6d 61 76 3a 22 cf 82 22 2c 73 69 6d 3a 22 e2 88 bc 22 2c 73 69 6d 64 6f 74 3a 22 e2 a9 aa 22 2c 73 69 Data Ascii: ,sharp:"",SHCHcy:"",shchcy:"",SHcy:"",shcy:"",ShortDownArrow:"",ShortLeftArrow:"",shortmid:"",shortparallel:"",ShortRightArrow:"",ShortUpArrow:"",shy:"",Sigma:"",sigma:"",sigmaf:"",sigmav:"",sim:"",simdot:"",si

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	49732	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:03 UTC	882	OUT	GET /frame/static/js/lib/jquery-postmessage.min.js?v=98c73 HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:03 UTC	501	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:03 GMT Content-Type: application/javascript Content-Length: 1022 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-3fe" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:03 UTC	1022	IN	Data Raw: 2f 2a 0a 20 2a 20 6a 51 75 65 72 79 20 70 6f 73 74 4d 65 73 73 61 67 65 20 2d 20 76 30 2e 35 20 2d 20 39 2f 31 31 2f 32 30 30 39 0a 20 2a 20 68 74 74 70 3a 2f 2f 62 65 6e 61 6c 6d 61 6e 2e 63 6f 6d 2f 70 72 6f 6a 65 63 74 73 2f 6a 71 75 65 72 79 2d 70 6f 73 74 6d 65 73 73 61 67 65 2d 70 6c 75 67 69 6e 2f 0a 20 2a 20 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 30 39 20 22 43 6f 77 62 6f 79 22 20 42 65 6e 20 41 6c 6d 61 6e 0a 20 2a 20 44 75 61 6c 20 6c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 61 6e 64 20 47 50 4c 20 6c 69 63 65 6e 73 65 73 2e 0a 20 2a 20 68 74 74 70 3a 2f 2f 62 65 6e 61 6c 6d 61 6e 2e 63 6f 6d 2f 61 62 6f 75 74 2f 6c 69 63 65 6e 73 65 2f 0a 20 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 24 29 7b 76 61 72 Data Ascii: /* * jQuery postMessage - v0.5 - 9/11/2009 * http://benalman.com/projects/jquery-postmessage-plugin/ * * Copyright (c) 2009 "Cowboy" Ben Alman * Dual licensed under the MIT and GPL licenses. * http://benalman.com/about/license/ */(function($){var

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	49735	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:03 UTC	881	OUT	GET /frame/static/shared/lib/lodash/lodash.min.js?v=6585f HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:04 UTC	504	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:03 GMT Content-Type: application/javascript Content-Length: 73409 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-11ec1" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:04 UTC	15880	IN	Data Raw: 2f 2a 2a 0a 20 2a 20 40 6c 69 63 65 6e 73 65 0a 20 2a 20 4c 6f 64 61 73 68 20 3c 68 74 74 70 73 3a 2f 2f 6c 6f 64 61 73 68 2e 63 6f 6d 2f 3e 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 3c 68 74 74 70 73 3a 2f 2f 6f 70 65 6e 6a 73 66 2e 6f 72 67 2f 3e 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 6c 69 63 65 6e 73 65 20 3c 68 74 74 70 73 3a 2f 2f 6c 6f 64 61 73 68 2e 63 6f 6d 2f 6c 69 63 65 6e 73 65 3e 0a 20 2a 20 42 61 73 65 64 20 6f 6e 20 55 6e 64 65 72 73 63 6f 72 65 2e 6a 73 20 31 2e 38 2e 33 20 3c 68 74 74 70 3a 2f 2f 75 6e 64 65 72 73 63 6f 72 65 6a 73 2e 6f 72 67 2f 4c 49 43 45 4e 53 45 3e 0a 20 2a 20 43 6f Data Ascii: /** * @license * Lodash <https://lodash.com/> * Copyright OpenJS Foundation and other contributors <https://openjsf.org/> * Released under MIT license <https://lodash.com/license> * Based on Underscore.js 1.8.3 <http://underscorejs.org/LICENSE> * Co
2024-10-01 17:04:04 UTC	16384	IN	Data Raw: 6f 74 6f 5f 5f 22 3d 3d 74 26 26 54 6c 3f 54 6c 28 6e 2c 74 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 72 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 6e 5b 74 5d 3d 72 7d 66 75 6e 63 74 69 6f 6e 20 54 72 28 6e 2c 74 29 7b 66 6f 72 28 76 61 72 20 72 3d 2d 31 2c 65 3d 74 2e 6c 65 6e 67 74 68 2c 75 3d 69 6c 28 65 29 2c 69 3d 6e 75 6c 6c 3d 3d 6e 3b 2b 2b 72 3c 65 3b 29 75 5b 72 5d 3d 69 3f 58 3a 4d 63 28 6e 2c 74 5b 72 5d 29 3b 72 65 74 75 72 6e 20 75 7d 66 75 6e 63 74 69 6f 6e 20 4d 72 28 6e 2c 74 2c 72 29 7b 72 65 74 75 72 6e 20 6e 3d 3d 3d 6e 26 26 28 72 21 3d 3d 58 26 26 28 6e 3d 6e 3c 3d 72 3f 6e 3a 72 29 2c 0a 20 20 20 74 21 3d 3d 58 26 26 28 6e 3d 6e 3e 3d 74 3f 6e 3a 74 29 29 2c Data Ascii: oto__"==t&&Tl?Tl(n,t,{configurable:!0,enumerable:!0,value:r,writable:!0}):n[t]=r}function Tr(n,t){for(var r=-1,e=t.length,u=il(e),i=null==n;++r<e;)u[r]=i?X:Mc(n,t[r]);return u}function Mr(n,t,r){return n===n&&(r!==X&&(n=n<=r?n:r), t!==X&&(n=n>=t?n:t)),
2024-10-01 17:04:04 UTC	16384	IN	Data Raw: 5f 3d 72 26 70 6e 3f 6e 65 77 20 79 72 3a 58 3b 66 6f 72 28 69 2e 73 65 74 28 6e 2c 74 29 2c 69 2e 73 65 74 28 74 2c 6e 29 3b 2b 2b 73 3c 66 3b 29 7b 76 61 72 20 76 3d 6e 5b 73 5d 2c 67 3d 74 5b 73 5d 3b 69 66 28 65 29 76 61 72 20 79 3d 6f 3f 65 28 67 2c 76 2c 73 2c 74 2c 6e 2c 69 29 3a 65 28 76 2c 67 2c 73 2c 6e 2c 74 2c 69 29 3b 69 66 28 79 21 3d 3d 58 29 7b 69 66 28 79 29 63 6f 6e 74 69 6e 75 65 3b 70 3d 21 31 3b 62 72 65 61 6b 7d 69 66 28 5f 29 7b 69 66 28 21 68 28 74 2c 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 69 66 28 21 53 28 5f 2c 74 29 26 26 28 76 3d 3d 3d 6e 7c 7c 75 28 76 2c 6e 2c 72 2c 65 2c 69 29 29 29 72 65 74 75 72 6e 20 5f 2e 70 75 73 68 28 74 29 7d 29 29 7b 70 3d 21 31 3b 62 72 65 61 6b 7d 7d 65 6c 73 65 20 69 66 28 76 21 3d 3d 67 26 26 Data Ascii: _=r&pn?new yr:X;for(i.set(n,t),i.set(t,n);++s<f;){var v=n[s],g=t[s];if(e)var y=o?e(g,v,s,t,n,i):e(v,g,s,n,t,i);if(y!==X){if(y)continue;p=!1;break}if(_){if(!h(t,function(n,t){if(!S(_,t)&&(v===n\|\|u(v,n,r,e,i)))return _.push(t)})){p=!1;break}}else if(v!==g&&
2024-10-01 17:04:04 UTC	16384	IN	Data Raw: 29 7c 7c 77 65 28 6e 29 21 3d 59 6e 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 74 3d 45 6c 28 6e 29 3b 69 66 28 6e 75 6c 6c 3d 3d 3d 74 29 72 65 74 75 72 6e 21 30 3b 76 61 72 20 72 3d 62 6c 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 26 26 72 20 69 6e 73 74 61 6e 63 65 6f 66 20 72 26 26 64 6c 2e 63 61 6c 6c 28 72 29 3d 3d 6a 6c 7d 66 75 6e 63 74 69 6f 6e 20 79 63 28 6e 29 7b 0a 20 20 20 72 65 74 75 72 6e 20 69 63 28 6e 29 26 26 6e 3e 3d 2d 57 6e 26 26 6e 3c 3d 57 6e 7d 66 75 6e 63 74 69 6f 6e 20 64 63 28 6e 29 7b 72 65 74 75 72 6e 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 6e 7c 7c 21 62 68 28 6e 29 26 Data Ascii: )\|\|we(n)!=Yn)return!1;var t=El(n);if(null===t)return!0;var r=bl.call(t,"constructor")&&t.constructor;return"function"==typeof r&&r instanceof r&&dl.call(r)==jl}function yc(n){ return ic(n)&&n>=-Wn&&n<=Wn}function dc(n){return"string"==typeof n\|\|!bh(n)&
2024-10-01 17:04:04 UTC	8377	IN	Data Raw: 72 65 74 75 72 6e 20 6e 2b 28 72 3f 22 2d 22 3a 22 22 29 2b 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7d 29 2c 56 68 3d 56 75 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 29 7b 72 65 74 75 72 6e 20 6e 2b 28 72 3f 22 20 22 3a 22 22 29 2b 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7d 29 2c 47 68 3d 4b 75 28 22 74 6f 4c 6f 77 65 72 43 61 73 65 22 29 2c 48 68 3d 56 75 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 29 7b 0a 20 20 20 72 65 74 75 72 6e 20 6e 2b 28 72 3f 22 5f 22 3a 22 22 29 2b 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7d 29 2c 4a 68 3d 56 75 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 29 7b 72 65 74 75 72 6e 20 6e 2b 28 72 3f 22 20 22 3a 22 22 29 2b 51 68 28 74 29 7d 29 2c 59 68 3d 56 75 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 29 7b Data Ascii: return n+(r?"-":"")+t.toLowerCase()}),Vh=Vu(function(n,t,r){return n+(r?" ":"")+t.toLowerCase()}),Gh=Ku("toLowerCase"),Hh=Vu(function(n,t,r){ return n+(r?"_":"")+t.toLowerCase()}),Jh=Vu(function(n,t,r){return n+(r?" ":"")+Qh(t)}),Yh=Vu(function(n,t,r){

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.16	49736	3.145.240.82	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:03 UTC	619	OUT	GET /frame/static/img/duo-cisco-logo-green.png?v=437f1 HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:04 UTC	489	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:03 GMT Content-Type: image/png Content-Length: 5117 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-13fd" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:04 UTC	5117	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 48 00 00 00 c0 08 06 00 00 00 66 80 fa 32 00 00 13 c4 49 44 41 54 78 01 ed dd cf 6f 1b 67 7e c7 f1 ef 33 a2 b3 ed 02 c9 0a bd 6e 81 32 b7 cd 29 ca 65 bb a7 86 72 52 a0 71 64 8b ee 7d 6b e5 da ed c2 36 f2 03 be 59 3e 34 58 c4 5e 58 86 f7 6e 79 ff 80 58 76 ac a4 07 07 54 7a 6b 2e 51 4e c9 2d 0c d0 9c d7 eb fc 70 1c 91 f3 ec f7 cb 19 da 94 2c 0e 87 d4 90 7c 86 7c bf 00 59 32 49 6b a4 a1 9f cf 7c 9f 1f 33 23 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 49 72 83 5e 50 af d7 17 db 6d a9 47 91 bc dc 6e fb 25 e7 a4 aa 0f 2f a6 4f df f7 5e 9a fa 58 53 bf d5 27 0b 0b b2 b3 b5 b5 b5 3b e8 7b 9e 3c 59 3f a7 ff 66 f1 e0 e3 fa bd 76 3f f8 60 6b 4b 86 64 3f 63 1c c7 Data Ascii: PNGIHDRHf2IDATxog~3n2)erRqd}k6Y>4X^XnyXvTzk.QN-p,\|\|Y2Ik\|3#Ir^PmGn%/O^XS';{<Y?fv?`kKd?c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.16	49737	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:03 UTC	885	OUT	GET /frame/static/shared/lib/backbone/backbone-min.js?v=e0ff6 HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:04 UTC	503	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:04 GMT Content-Type: application/javascript Content-Length: 19414 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-4bd6" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:04 UTC	15881	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 76 61 72 20 65 3d 74 2e 42 61 63 6b 62 6f 6e 65 3b 76 61 72 20 69 3d 5b 5d 3b 76 61 72 20 72 3d 69 2e 70 75 73 68 3b 76 61 72 20 73 3d 69 2e 73 6c 69 63 65 3b 76 61 72 20 6e 3d 69 2e 73 70 6c 69 63 65 3b 76 61 72 20 61 3b 69 66 28 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 7b 61 3d 65 78 70 6f 72 74 73 7d 65 6c 73 65 7b 61 3d 74 2e 42 61 63 6b 62 6f 6e 65 3d 7b 7d 7d 61 2e 56 45 52 53 49 4f 4e 3d 22 31 2e 30 2e 30 22 3b 76 61 72 20 68 3d 74 2e 5f 3b 69 66 28 21 68 26 26 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 68 3d 72 65 71 75 69 72 65 28 22 75 6e 64 65 72 73 63 6f 72 65 22 29 3b 61 2e 24 3d 74 2e Data Ascii: (function(){var t=this;var e=t.Backbone;var i=[];var r=i.push;var s=i.slice;var n=i.splice;var a;if(typeof exports!=="undefined"){a=exports}else{a=t.Backbone={}}a.VERSION="1.0.0";var h=t._;if(!h&&typeof require!=="undefined")h=require("underscore");a.$=t.
2024-10-01 17:04:04 UTC	3533	IN	Data Raw: 7d 2c 67 65 74 46 72 61 67 6d 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 74 3d 3d 6e 75 6c 6c 29 7b 69 66 28 74 68 69 73 2e 5f 68 61 73 50 75 73 68 53 74 61 74 65 7c 7c 21 74 68 69 73 2e 5f 77 61 6e 74 73 48 61 73 68 43 68 61 6e 67 65 7c 7c 65 29 7b 74 3d 74 68 69 73 2e 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 3b 76 61 72 20 69 3d 74 68 69 73 2e 72 6f 6f 74 2e 72 65 70 6c 61 63 65 28 43 2c 22 22 29 3b 69 66 28 21 74 2e 69 6e 64 65 78 4f 66 28 69 29 29 74 3d 74 2e 73 75 62 73 74 72 28 69 2e 6c 65 6e 67 74 68 29 7d 65 6c 73 65 7b 74 3d 74 68 69 73 2e 67 65 74 48 61 73 68 28 29 7d 7d 72 65 74 75 72 6e 20 74 2e 72 65 70 6c 61 63 65 28 4e 2c 22 22 29 7d 2c 73 74 61 72 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 49 2e 73 74 Data Ascii: },getFragment:function(t,e){if(t==null){if(this._hasPushState\|\|!this._wantsHashChange\|\|e){t=this.location.pathname;var i=this.root.replace(C,"");if(!t.indexOf(i))t=t.substr(i.length)}else{t=this.getHash()}}return t.replace(N,"")},start:function(t){if(I.st

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.16	49740	3.145.240.82	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:04 UTC	623	OUT	GET /frame/static/js/lib/jquery-postmessage.min.js?v=98c73 HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:04 UTC	501	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:04 GMT Content-Type: application/javascript Content-Length: 1022 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-3fe" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:04 UTC	1022	IN	Data Raw: 2f 2a 0a 20 2a 20 6a 51 75 65 72 79 20 70 6f 73 74 4d 65 73 73 61 67 65 20 2d 20 76 30 2e 35 20 2d 20 39 2f 31 31 2f 32 30 30 39 0a 20 2a 20 68 74 74 70 3a 2f 2f 62 65 6e 61 6c 6d 61 6e 2e 63 6f 6d 2f 70 72 6f 6a 65 63 74 73 2f 6a 71 75 65 72 79 2d 70 6f 73 74 6d 65 73 73 61 67 65 2d 70 6c 75 67 69 6e 2f 0a 20 2a 20 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 30 39 20 22 43 6f 77 62 6f 79 22 20 42 65 6e 20 41 6c 6d 61 6e 0a 20 2a 20 44 75 61 6c 20 6c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 61 6e 64 20 47 50 4c 20 6c 69 63 65 6e 73 65 73 2e 0a 20 2a 20 68 74 74 70 3a 2f 2f 62 65 6e 61 6c 6d 61 6e 2e 63 6f 6d 2f 61 62 6f 75 74 2f 6c 69 63 65 6e 73 65 2f 0a 20 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 24 29 7b 76 61 72 Data Ascii: /* * jQuery postMessage - v0.5 - 9/11/2009 * http://benalman.com/projects/jquery-postmessage-plugin/ * * Copyright (c) 2009 "Cowboy" Ben Alman * Dual licensed under the MIT and GPL licenses. * http://benalman.com/about/license/ */(function($){var

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.16	49739	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:04 UTC	869	OUT	GET /frame/static/js/page/v3/frame.js?v=aaf8c HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:04 UTC	501	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:04 GMT Content-Type: application/javascript Content-Length: 1240 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-4d8" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:04 UTC	1240	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 2c 5f 6a 71 75 65 72 79 2c 44 75 6f 46 72 61 6d 65 2c 5f 5f 77 65 62 70 61 63 6b 5f 6d 6f 64 75 6c 65 73 5f 5f 3d 7b 35 33 31 31 3a 66 75 6e 63 74 69 6f 6e 28 6d 6f 64 75 6c 65 29 7b 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 6a 51 75 65 72 79 7d 7d 2c 5f 5f 77 65 62 70 61 63 6b 5f 6d 6f 64 75 6c 65 5f 63 61 63 68 65 5f 5f 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 6d 6f 64 75 6c 65 49 64 29 7b 76 61 72 20 63 61 63 68 65 64 4d 6f 64 75 6c 65 3d 5f 5f 77 65 62 70 61 63 6b 5f 6d 6f 64 75 6c 65 5f 63 61 63 68 65 5f 5f 5b 6d 6f 64 75 6c 65 49 64 5d 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 63 61 63 68 65 64 4d 6f 64 Data Ascii: !function(){"use strict";var e,_jquery,DuoFrame,__webpack_modules__={5311:function(module){module.exports=jQuery}},__webpack_module_cache__={};function __webpack_require__(moduleId){var cachedModule=__webpack_module_cache__[moduleId];if(void 0!==cachedMod

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.16	49741	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:04 UTC	868	OUT	GET /frame/static/js/page/v3/base.js?v=fff81 HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:04 UTC	505	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:04 GMT Content-Type: application/javascript Content-Length: 216396 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-34d4c" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:04 UTC	15879	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 62 61 73 65 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 5f 77 65 62 70 61 63 6b 5f 6d 6f 64 75 6c 65 73 5f 5f 3d 7b 36 39 39 37 3a 66 75 6e 63 74 69 6f 6e 28 6d 6f 64 75 6c 65 2c 65 78 70 6f 72 74 73 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 7b 76 61 72 20 5f 5f 57 45 42 50 41 43 4b 5f 41 4d 44 5f 44 45 46 49 4e 45 5f 41 52 52 41 59 5f 5f 2c 5f 5f 57 45 42 50 41 43 4b 5f 41 4d 44 5f 44 45 46 49 4e 45 5f 52 45 53 55 4c 54 5f 5f 3b 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 35 30 30 31 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 Data Ascii: /! For license information please see base.js.LICENSE.txt /!function(){var __webpack_modules__={6997:function(module,exports,__webpack_require__){var __WEBPACK_AMD_DEFINE_ARRAY__,__WEBPACK_AMD_DEFINE_RESULT__;__webpack_require__(5001),__webpack_require
2024-10-01 17:04:04 UTC	16384	IN	Data Raw: 5f 65 73 4d 6f 64 75 6c 65 3d 21 30 2c 65 78 70 6f 72 74 73 2e 57 49 4e 44 4f 57 53 5f 48 45 4c 4c 4f 5f 50 4c 41 54 46 4f 52 4d 53 3d 65 78 70 6f 72 74 73 2e 57 49 4e 44 4f 57 53 5f 48 45 4c 4c 4f 5f 4d 49 4e 5f 50 4c 41 54 46 4f 52 4d 5f 56 45 52 53 49 4f 4e 53 3d 65 78 70 6f 72 74 73 2e 57 45 42 41 55 54 48 4e 5f 54 4f 55 43 48 5f 4d 49 4e 5f 50 4c 41 54 46 4f 52 4d 5f 56 45 52 53 49 4f 4e 53 3d 65 78 70 6f 72 74 73 2e 57 45 42 41 55 54 48 4e 5f 54 4f 55 43 48 5f 49 44 5f 50 4c 41 54 46 4f 52 4d 53 3d 65 78 70 6f 72 74 73 2e 54 52 41 44 49 54 49 4f 4e 41 4c 5f 50 52 4f 4d 50 54 5f 45 4f 4c 5f 44 49 53 4d 49 53 53 41 4c 5f 4b 45 59 3d 65 78 70 6f 72 74 73 2e 52 42 46 53 5f 42 41 4e 4e 45 52 5f 53 45 45 4e 3d 65 78 70 6f 72 74 73 2e 52 42 46 53 5f 42 41 Data Ascii: _esModule=!0,exports.WINDOWS_HELLO_PLATFORMS=exports.WINDOWS_HELLO_MIN_PLATFORM_VERSIONS=exports.WEBAUTHN_TOUCH_MIN_PLATFORM_VERSIONS=exports.WEBAUTHN_TOUCH_ID_PLATFORMS=exports.TRADITIONAL_PROMPT_EOL_DISMISSAL_KEY=exports.RBFS_BANNER_SEEN=exports.RBFS_BA
2024-10-01 17:04:04 UTC	16384	IN	Data Raw: 64 41 75 74 68 54 69 6d 65 73 65 72 69 65 73 44 61 74 61 46 6f 72 6d 61 74 74 65 72 3d 65 78 70 6f 72 74 73 2e 64 65 62 6f 75 6e 63 65 3d 65 78 70 6f 72 74 73 2e 63 72 65 61 74 65 54 69 6d 65 4c 69 73 74 3d 65 78 70 6f 72 74 73 2e 63 72 65 61 74 65 4d 69 6e 75 74 65 73 4c 69 73 74 3d 65 78 70 6f 72 74 73 2e 63 6c 65 61 6e 46 69 6c 74 65 72 53 74 61 74 65 3d 76 6f 69 64 20 30 2c 65 78 70 6f 72 74 73 2e 67 65 74 42 72 6f 77 73 65 72 41 6e 64 56 65 72 73 69 6f 6e 3d 67 65 74 42 72 6f 77 73 65 72 41 6e 64 56 65 72 73 69 6f 6e 2c 65 78 70 6f 72 74 73 2e 67 65 74 44 65 6e 69 65 64 43 6f 75 6e 74 3d 76 6f 69 64 20 30 2c 65 78 70 6f 72 74 73 2e 67 65 74 4f 73 50 6c 61 74 66 6f 72 6d 3d 67 65 74 4f 73 50 6c 61 74 66 6f 72 6d 2c 65 78 70 6f 72 74 73 2e 69 73 4c 6f Data Ascii: dAuthTimeseriesDataFormatter=exports.debounce=exports.createTimeList=exports.createMinutesList=exports.cleanFilterState=void 0,exports.getBrowserAndVersion=getBrowserAndVersion,exports.getDeniedCount=void 0,exports.getOsPlatform=getOsPlatform,exports.isLo
2024-10-01 17:04:04 UTC	16384	IN	Data Raw: 20 67 65 74 42 72 6f 77 73 65 72 41 6e 64 56 65 72 73 69 6f 6e 28 29 7b 76 61 72 20 62 72 6f 77 73 65 72 56 65 72 73 69 6f 6e 2c 75 61 3d 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2c 62 72 6f 77 73 65 72 3d 22 22 3b 69 66 28 2d 31 21 3d 3d 75 61 2e 69 6e 64 65 78 4f 66 28 22 43 68 72 6f 6d 65 22 29 26 26 2d 31 3d 3d 3d 75 61 2e 69 6e 64 65 78 4f 66 28 22 43 68 72 6f 6d 69 75 6d 22 29 26 26 2d 31 3d 3d 3d 75 61 2e 69 6e 64 65 78 4f 66 28 22 45 64 67 22 29 29 62 72 6f 77 73 65 72 3d 22 43 68 72 6f 6d 65 22 3b 65 6c 73 65 20 69 66 28 2d 31 21 3d 3d 75 61 2e 69 6e 64 65 78 4f 66 28 22 46 69 72 65 66 6f 78 22 29 29 62 72 6f 77 73 65 72 3d 22 46 69 72 65 66 6f 78 22 3b 65 6c 73 65 20 69 66 28 2d 31 21 3d 3d 75 61 2e 69 6e 64 65 78 4f 66 28 22 45 Data Ascii: getBrowserAndVersion(){var browserVersion,ua=navigator.userAgent,browser="";if(-1!==ua.indexOf("Chrome")&&-1===ua.indexOf("Chromium")&&-1===ua.indexOf("Edg"))browser="Chrome";else if(-1!==ua.indexOf("Firefox"))browser="Firefox";else if(-1!==ua.indexOf("E
2024-10-01 17:04:04 UTC	16384	IN	Data Raw: 65 28 4e 61 74 69 76 65 50 72 6f 74 6f 74 79 70 65 2c 4b 45 59 2c 22 61 64 64 22 3d 3d 4b 45 59 3f 66 75 6e 63 74 69 6f 6e 28 76 61 6c 75 65 29 7b 72 65 74 75 72 6e 20 6e 61 74 69 76 65 4d 65 74 68 6f 64 2e 63 61 6c 6c 28 74 68 69 73 2c 30 3d 3d 3d 76 61 6c 75 65 3f 30 3a 76 61 6c 75 65 29 2c 74 68 69 73 7d 3a 22 64 65 6c 65 74 65 22 3d 3d 4b 45 59 3f 66 75 6e 63 74 69 6f 6e 28 6b 65 79 29 7b 72 65 74 75 72 6e 21 28 49 53 5f 57 45 41 4b 26 26 21 69 73 4f 62 6a 65 63 74 28 6b 65 79 29 29 26 26 6e 61 74 69 76 65 4d 65 74 68 6f 64 2e 63 61 6c 6c 28 74 68 69 73 2c 30 3d 3d 3d 6b 65 79 3f 30 3a 6b 65 79 29 7d 3a 22 67 65 74 22 3d 3d 4b 45 59 3f 66 75 6e 63 74 69 6f 6e 28 6b 65 79 29 7b 72 65 74 75 72 6e 20 49 53 5f 57 45 41 4b 26 26 21 69 73 4f 62 6a 65 63 74 Data Ascii: e(NativePrototype,KEY,"add"==KEY?function(value){return nativeMethod.call(this,0===value?0:value),this}:"delete"==KEY?function(key){return!(IS_WEAK&&!isObject(key))&&nativeMethod.call(this,0===key?0:key)}:"get"==KEY?function(key){return IS_WEAK&&!isObject
2024-10-01 17:04:04 UTC	16384	IN	Data Raw: 74 73 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 7b 76 61 72 20 74 6f 4f 62 6a 65 63 74 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 36 30 31 32 29 2c 66 6c 6f 6f 72 3d 4d 61 74 68 2e 66 6c 6f 6f 72 2c 72 65 70 6c 61 63 65 3d 22 22 2e 72 65 70 6c 61 63 65 2c 53 55 42 53 54 49 54 55 54 49 4f 4e 5f 53 59 4d 42 4f 4c 53 3d 2f 5c 24 28 5b 24 26 27 60 5d 7c 5c 64 7b 31 2c 32 7d 7c 3c 5b 5e 3e 5d 2a 3e 29 2f 67 2c 53 55 42 53 54 49 54 55 54 49 4f 4e 5f 53 59 4d 42 4f 4c 53 5f 4e 4f 5f 4e 41 4d 45 44 3d 2f 5c 24 28 5b 24 26 27 60 5d 7c 5c 64 7b 31 2c 32 7d 29 2f 67 3b 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 6d 61 74 63 68 65 64 2c 73 74 72 2c 70 6f 73 69 74 69 6f 6e 2c 63 61 70 74 75 72 65 73 Data Ascii: ts,__webpack_require__){var toObject=__webpack_require__(6012),floor=Math.floor,replace="".replace,SUBSTITUTION_SYMBOLS=/\$([$&'`]\|\d{1,2}\|<[^>]*>)/g,SUBSTITUTION_SYMBOLS_NO_NAMED=/\$([$&'`]\|\d{1,2})/g;module.exports=function(matched,str,position,captures
2024-10-01 17:04:05 UTC	16384	IN	Data Raw: 72 6f 70 65 72 74 69 65 73 29 7b 61 6e 4f 62 6a 65 63 74 28 4f 29 3b 66 6f 72 28 76 61 72 20 6b 65 79 2c 6b 65 79 73 3d 6f 62 6a 65 63 74 4b 65 79 73 28 50 72 6f 70 65 72 74 69 65 73 29 2c 6c 65 6e 67 74 68 3d 6b 65 79 73 2e 6c 65 6e 67 74 68 2c 69 6e 64 65 78 3d 30 3b 6c 65 6e 67 74 68 3e 69 6e 64 65 78 3b 29 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 4d 6f 64 75 6c 65 2e 66 28 4f 2c 6b 65 79 3d 6b 65 79 73 5b 69 6e 64 65 78 2b 2b 5d 2c 50 72 6f 70 65 72 74 69 65 73 5b 6b 65 79 5d 29 3b 72 65 74 75 72 6e 20 4f 7d 7d 2c 34 31 35 37 3a 66 75 6e 63 74 69 6f 6e 28 5f 5f 75 6e 75 73 65 64 5f 77 65 62 70 61 63 6b 5f 6d 6f 64 75 6c 65 2c 65 78 70 6f 72 74 73 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 7b 76 61 72 20 44 45 53 43 52 49 50 54 4f Data Ascii: roperties){anObject(O);for(var key,keys=objectKeys(Properties),length=keys.length,index=0;length>index;)definePropertyModule.f(O,key=keys[index++],Properties[key]);return O}},4157:function(__unused_webpack_module,exports,__webpack_require__){var DESCRIPTO
2024-10-01 17:04:05 UTC	16384	IN	Data Raw: 7b 69 66 28 22 6e 75 6d 62 65 72 22 21 3d 74 79 70 65 6f 66 20 76 61 6c 75 65 26 26 22 4e 75 6d 62 65 72 22 21 3d 63 6c 61 73 73 6f 66 28 76 61 6c 75 65 29 29 74 68 72 6f 77 20 54 79 70 65 45 72 72 6f 72 28 22 49 6e 63 6f 72 72 65 63 74 20 69 6e 76 6f 63 61 74 69 6f 6e 22 29 3b 72 65 74 75 72 6e 2b 76 61 6c 75 65 7d 7d 2c 37 39 35 30 3a 66 75 6e 63 74 69 6f 6e 28 6d 6f 64 75 6c 65 2c 5f 5f 75 6e 75 73 65 64 5f 77 65 62 70 61 63 6b 5f 65 78 70 6f 72 74 73 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 7b 76 61 72 20 74 6f 49 6e 74 65 67 65 72 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 39 36 30 34 29 2c 6d 61 78 3d 4d 61 74 68 2e 6d 61 78 2c 6d 69 6e 3d 4d 61 74 68 2e 6d 69 6e 3b 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 Data Ascii: {if("number"!=typeof value&&"Number"!=classof(value))throw TypeError("Incorrect invocation");return+value}},7950:function(module,__unused_webpack_exports,__webpack_require__){var toInteger=__webpack_require__(9604),max=Math.max,min=Math.min;module.exports
2024-10-01 17:04:05 UTC	16384	IN	Data Raw: 28 78 2c 6e 2c 61 63 63 29 7b 72 65 74 75 72 6e 20 30 3d 3d 3d 6e 3f 61 63 63 3a 6e 25 32 3d 3d 31 3f 70 6f 77 28 78 2c 6e 2d 31 2c 61 63 63 2a 78 29 3a 70 6f 77 28 78 2a 78 2c 6e 2f 32 2c 61 63 63 29 7d 2c 6d 75 6c 74 69 70 6c 79 3d 66 75 6e 63 74 69 6f 6e 28 64 61 74 61 2c 6e 2c 63 29 7b 66 6f 72 28 76 61 72 20 69 6e 64 65 78 3d 2d 31 2c 63 32 3d 63 3b 2b 2b 69 6e 64 65 78 3c 36 3b 29 63 32 2b 3d 6e 2a 64 61 74 61 5b 69 6e 64 65 78 5d 2c 64 61 74 61 5b 69 6e 64 65 78 5d 3d 63 32 25 31 65 37 2c 63 32 3d 66 6c 6f 6f 72 28 63 32 2f 31 65 37 29 7d 2c 64 69 76 69 64 65 3d 66 75 6e 63 74 69 6f 6e 28 64 61 74 61 2c 6e 29 7b 66 6f 72 28 76 61 72 20 69 6e 64 65 78 3d 36 2c 63 3d 30 3b 2d 2d 69 6e 64 65 78 3e 3d 30 3b 29 63 2b 3d 64 61 74 61 5b 69 6e 64 65 78 5d Data Ascii: (x,n,acc){return 0===n?acc:n%2==1?pow(x,n-1,accx):pow(xx,n/2,acc)},multiply=function(data,n,c){for(var index=-1,c2=c;++index<6;)c2+=n*data[index],data[index]=c2%1e7,c2=floor(c2/1e7)},divide=function(data,n){for(var index=6,c=0;--index>=0;)c+=data[index]
2024-10-01 17:04:05 UTC	16384	IN	Data Raw: 6f 64 75 6c 65 2c 5f 5f 75 6e 75 73 65 64 5f 77 65 62 70 61 63 6b 5f 65 78 70 6f 72 74 73 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 65 64 65 66 69 6e 65 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 31 39 30 31 29 2c 61 6e 4f 62 6a 65 63 74 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 31 37 36 30 29 2c 66 61 69 6c 73 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 31 33 38 37 29 2c 66 6c 61 67 73 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 36 33 35 37 29 2c 52 65 67 45 78 70 50 72 6f 74 6f 74 79 70 65 3d 52 65 67 45 78 70 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 61 74 69 76 65 54 6f 53 74 72 69 6e 67 3d 52 65 67 45 Data Ascii: odule,__unused_webpack_exports,__webpack_require__){"use strict";var redefine=__webpack_require__(1901),anObject=__webpack_require__(1760),fails=__webpack_require__(1387),flags=__webpack_require__(6357),RegExpPrototype=RegExp.prototype,nativeToString=RegE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.16	49743	3.145.240.82	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:04 UTC	622	OUT	GET /frame/static/shared/lib/jquery/jquery.min.js?v=ff152 HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:04 UTC	504	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:04 GMT Content-Type: application/javascript Content-Length: 89501 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-15d9d" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:04 UTC	15880	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-10-01 17:04:04 UTC	16384	IN	Data Raw: 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 2c 61 2c 73 2c 75 2c 6c 3d 79 21 3d 3d 6d 3f 22 6e 65 78 74 53 69 62 6c 69 6e 67 22 3a 22 70 72 65 76 69 6f 75 73 53 69 62 6c 69 6e 67 22 2c 63 3d 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2c 66 3d 78 26 26 65 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 70 3d 21 6e 26 26 21 78 2c 64 3d 21 31 3b 69 66 28 63 29 7b 69 66 28 79 29 7b 77 68 69 6c 65 28 6c 29 7b 61 3d 65 3b 77 68 69 6c 65 28 61 3d 61 5b 6c 5d 29 69 66 28 78 3f 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 66 3a 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 72 65 74 75 72 6e 21 31 3b 75 3d 6c 3d 22 6f 6e 6c 79 22 3d 3d 3d 68 26 26 21 75 26 26 22 6e 65 78 74 53 69 62 6c 69 Data Ascii: nction(e,t,n){var r,i,o,a,s,u,l=y!==m?"nextSibling":"previousSibling",c=e.parentNode,f=x&&e.nodeName.toLowerCase(),p=!n&&!x,d=!1;if(c){if(y){while(l){a=e;while(a=a[l])if(x?a.nodeName.toLowerCase()===f:1===a.nodeType)return!1;u=l="only"===h&&!u&&"nextSibli
2024-10-01 17:04:04 UTC	16384	IN	Data Raw: 65 6f 75 74 28 53 2e 72 65 61 64 79 29 3a 28 45 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 42 29 2c 43 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 42 29 29 3b 76 61 72 20 24 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 2c 69 2c 6f 2c 61 29 7b 76 61 72 20 73 3d 30 2c 75 3d 65 2e 6c 65 6e 67 74 68 2c 6c 3d 6e 75 6c 6c 3d 3d 6e 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 3d 77 28 6e 29 29 66 6f 72 28 73 20 69 6e 20 69 3d 21 30 2c 6e 29 24 28 65 2c 74 2c 73 2c 6e 5b 73 5d 2c 21 30 2c 6f 2c 61 29 3b 65 6c 73 65 20 69 66 28 76 6f 69 64 20 30 21 3d 3d 72 26 26 28 69 3d 21 30 2c 6d 28 72 29 7c 7c 28 61 3d 21 30 29 2c 6c 26 26 28 61 3f 28 74 2e 63 61 6c 6c 28 65 Data Ascii: eout(S.ready):(E.addEventListener("DOMContentLoaded",B),C.addEventListener("load",B));var $=function(e,t,n,r,i,o,a){var s=0,u=e.length,l=null==n;if("object"===w(n))for(s in i=!0,n)$(e,t,s,n[s],!0,o,a);else if(void 0!==r&&(i=!0,m(r)\|\|(a=!0),l&&(a?(t.call(e
2024-10-01 17:04:04 UTC	16384	IN	Data Raw: 72 2c 22 73 63 72 69 70 74 22 29 29 2c 72 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 72 29 29 3b 72 65 74 75 72 6e 20 65 7d 53 2e 65 78 74 65 6e 64 28 7b 68 74 6d 6c 50 72 65 66 69 6c 74 65 72 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 2c 63 6c 6f 6e 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 2c 61 2c 73 2c 75 2c 6c 2c 63 3d 65 2e 63 6c 6f 6e 65 4e 6f 64 65 28 21 30 29 2c 66 3d 69 65 28 65 29 3b 69 66 28 21 28 79 2e 6e 6f 43 6c 6f 6e 65 43 68 65 63 6b 65 64 7c 7c 31 21 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 26 26 31 31 21 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 53 2e 69 73 58 4d 4c 44 6f 63 28 65 29 29 29 66 6f 72 28 61 3d 76 65 28 63 29 2c 72 3d 30 2c 69 3d 28 6f 3d Data Ascii: r,"script")),r.parentNode.removeChild(r));return e}S.extend({htmlPrefilter:function(e){return e},clone:function(e,t,n){var r,i,o,a,s,u,l,c=e.cloneNode(!0),f=ie(e);if(!(y.noCloneChecked\|\|1!==e.nodeType&&11!==e.nodeType\|\|S.isXMLDoc(e)))for(a=ve(c),r=0,i=(o=
2024-10-01 17:04:04 UTC	16384	IN	Data Raw: 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 43 2e 73 65 74 54 69 6d 65 6f 75 74 28 65 2c 72 29 3b 74 2e 73 74 6f 70 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 43 2e 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 6e 29 7d 7d 29 7d 2c 74 74 3d 45 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6e 70 75 74 22 29 2c 6e 74 3d 45 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 65 6c 65 63 74 22 29 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 45 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 6f 70 74 69 6f 6e 22 29 29 2c 74 74 2e 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 2c 79 2e 63 68 65 63 6b 4f 6e 3d 22 22 21 3d 3d 74 74 2e 76 61 6c 75 65 2c 79 2e 6f 70 74 53 65 6c 65 63 74 65 64 3d 6e 74 2e 73 65 6c 65 63 74 65 64 2c 28 74 74 3d 45 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e Data Ascii: on(e,t){var n=C.setTimeout(e,r);t.stop=function(){C.clearTimeout(n)}})},tt=E.createElement("input"),nt=E.createElement("select").appendChild(E.createElement("option")),tt.type="checkbox",y.checkOn=""!==tt.value,y.optSelected=nt.selected,(tt=E.createElemen
2024-10-01 17:04:05 UTC	8085	IN	Data Raw: 72 65 6e 74 28 65 29 2e 6e 6f 74 28 22 62 6f 64 79 22 29 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 53 28 74 68 69 73 29 2e 72 65 70 6c 61 63 65 57 69 74 68 28 74 68 69 73 2e 63 68 69 6c 64 4e 6f 64 65 73 29 7d 29 2c 74 68 69 73 7d 7d 29 2c 53 2e 65 78 70 72 2e 70 73 65 75 64 6f 73 2e 68 69 64 64 65 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 21 53 2e 65 78 70 72 2e 70 73 65 75 64 6f 73 2e 76 69 73 69 62 6c 65 28 65 29 7d 2c 53 2e 65 78 70 72 2e 70 73 65 75 64 6f 73 2e 76 69 73 69 62 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 21 21 28 65 2e 6f 66 66 73 65 74 57 69 64 74 68 7c 7c 65 2e 6f 66 66 73 65 74 48 65 69 67 68 74 7c 7c 65 2e 67 65 74 43 6c 69 65 6e 74 52 65 63 74 73 28 29 2e 6c 65 6e 67 74 68 29 7d 2c 53 Data Ascii: rent(e).not("body").each(function(){S(this).replaceWith(this.childNodes)}),this}}),S.expr.pseudos.hidden=function(e){return!S.expr.pseudos.visible(e)},S.expr.pseudos.visible=function(e){return!!(e.offsetWidth\|\|e.offsetHeight\|\|e.getClientRects().length)},S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.16	49742	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:04 UTC	887	OUT	GET /frame/static/shared/lib/validator/validator.min.js?v=9a068 HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:04 UTC	502	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:04 GMT Content-Type: application/javascript Content-Length: 5613 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-15ed" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:04 UTC	5613	IN	Data Raw: 2f 2a 21 20 76 61 6c 69 64 61 74 6f 72 6a 73 20 2d 20 76 31 2e 33 2e 32 20 2d 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 73 6b 61 74 65 72 64 61 76 38 35 2f 76 61 6c 69 64 61 74 6f 72 6a 73 20 2d 20 32 30 31 35 2d 30 32 2d 31 31 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 66 6f 72 28 76 61 72 20 62 2c 63 2c 64 2c 65 2c 66 2c 67 3d 61 72 67 75 6d 65 6e 74 73 5b 30 5d 7c 7c 7b 7d 2c 68 3d 31 2c 69 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 69 3e 68 3b 68 2b 2b 29 69 66 28 6e 75 6c 6c 21 3d 28 65 3d 61 72 67 75 6d 65 6e 74 73 5b 68 5d 29 29 66 6f 72 28 64 20 69 6e 20 65 29 62 3d 67 5b 64 5d 2c 63 3d 65 5b 64 5d 2c 67 21 3d 3d 63 26 26 28 63 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f Data Ascii: /! validatorjs - v1.3.2 - https://github.com/skaterdav85/validatorjs - 2015-02-11 /!function(){function a(){for(var b,c,d,e,f,g=arguments[0]\|\|{},h=1,i=arguments.length;i>h;h++)if(null!=(e=arguments[h]))for(d in e)b=g[d],c=e[d],g!==c&&(c&&"object"==typeo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.16	49744	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:04 UTC	886	OUT	GET /frame/static/shared/lib/jquery/jquery-epilogue.js?v=c4ac5 HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:04 UTC	499	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:04 GMT Content-Type: application/javascript Content-Length: 131 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-83" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:04 UTC	131	IN	Data Raw: 2f 2f 20 53 65 65 20 6a 71 75 65 72 79 2d 70 72 6f 6c 6f 67 75 65 2e 6a 73 20 66 6f 72 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 6f 6e 20 77 68 79 20 74 68 69 73 20 69 73 20 6e 65 63 65 73 73 61 72 79 2e 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 69 66 20 28 77 69 6e 64 6f 77 2e 6d 6f 64 75 6c 65 29 20 6d 6f 64 75 6c 65 20 3d 20 77 69 6e 64 6f 77 2e 6d 6f 64 75 6c 65 3b 20 7d 29 28 29 3b 0a Data Ascii: // See jquery-prologue.js for information on why this is necessary.(function() { if (window.module) module = window.module; })();

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.16	49745	3.145.240.82	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:04 UTC	614	OUT	GET /frame/static/shared/lib/he/he.min.js?v=aaa33 HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:04 UTC	503	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:04 GMT Content-Type: application/javascript Content-Length: 61367 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-efb7" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:04 UTC	15881	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 72 6f 6f 74 29 7b 76 61 72 20 66 72 65 65 45 78 70 6f 72 74 73 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3d 3d 22 6f 62 6a 65 63 74 22 26 26 65 78 70 6f 72 74 73 3b 76 61 72 20 66 72 65 65 4d 6f 64 75 6c 65 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3d 3d 22 6f 62 6a 65 63 74 22 26 26 6d 6f 64 75 6c 65 26 26 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 3d 66 72 65 65 45 78 70 6f 72 74 73 26 26 6d 6f 64 75 6c 65 3b 76 61 72 20 66 72 65 65 47 6c 6f 62 61 6c 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 3d 3d 22 6f 62 6a 65 63 74 22 26 26 67 6c 6f 62 61 6c 3b 69 66 28 66 72 65 65 47 6c 6f 62 61 6c 2e 67 6c 6f 62 61 6c 3d 3d 3d 66 72 65 65 47 6c 6f 62 61 6c 7c 7c 66 72 65 65 47 6c 6f 62 61 6c 2e 77 69 6e 64 6f 77 3d 3d 3d 66 72 65 Data Ascii: (function(root){var freeExports=typeof exports=="object"&&exports;var freeModule=typeof module=="object"&&module&&module.exports==freeExports&&module;var freeGlobal=typeof global=="object"&&global;if(freeGlobal.global===freeGlobal\|\|freeGlobal.window===fre
2024-10-01 17:04:04 UTC	16384	IN	Data Raw: 22 3a 22 6e 67 65 22 2c 22 e2 a9 be cc b8 22 3a 22 6e 67 65 73 22 2c 22 e2 8b 99 cc b8 22 3a 22 6e 47 67 22 2c 22 e2 89 b5 22 3a 22 6e 67 73 69 6d 22 2c 22 e2 89 ab e2 83 92 22 3a 22 6e 47 74 22 2c 22 e2 89 af 22 3a 22 6e 67 74 22 2c 22 e2 89 ab cc b8 22 3a 22 6e 47 74 76 22 2c 22 e2 86 ae 22 3a 22 6e 68 61 72 72 22 2c 22 e2 87 8e 22 3a 22 6e 68 41 72 72 22 2c 22 e2 ab b2 22 3a 22 6e 68 70 61 72 22 2c 22 e2 88 8b 22 3a 22 6e 69 22 2c 22 e2 8b bc 22 3a 22 6e 69 73 22 2c 22 e2 8b ba 22 3a 22 6e 69 73 64 22 2c 22 d0 8a 22 3a 22 4e 4a 63 79 22 2c 22 d1 9a 22 3a 22 6e 6a 63 79 22 2c 22 e2 86 9a 22 3a 22 6e 6c 61 72 72 22 2c 22 e2 87 8d 22 3a 22 6e 6c 41 72 72 22 2c 22 e2 80 a5 22 3a 22 6e 6c 64 72 22 2c 22 e2 89 a6 cc b8 22 3a 22 6e 6c 45 22 2c 22 e2 89 b0 22 Data Ascii: ":"nge","":"nges","":"nGg","":"ngsim","":"nGt","":"ngt","":"nGtv","":"nharr","":"nhArr","":"nhpar","":"ni","":"nis","":"nisd","":"NJcy","":"njcy","":"nlarr","":"nlArr","":"nldr","":"nlE",""
2024-10-01 17:04:05 UTC	16384	IN	Data Raw: c4 9a 22 2c 65 63 61 72 6f 6e 3a 22 c4 9b 22 2c 45 63 69 72 63 3a 22 c3 8a 22 2c 65 63 69 72 63 3a 22 c3 aa 22 2c 65 63 69 72 3a 22 e2 89 96 22 2c 65 63 6f 6c 6f 6e 3a 22 e2 89 95 22 2c 45 63 79 3a 22 d0 ad 22 2c 65 63 79 3a 22 d1 8d 22 2c 65 44 44 6f 74 3a 22 e2 a9 b7 22 2c 45 64 6f 74 3a 22 c4 96 22 2c 65 64 6f 74 3a 22 c4 97 22 2c 65 44 6f 74 3a 22 e2 89 91 22 2c 65 65 3a 22 e2 85 87 22 2c 65 66 44 6f 74 3a 22 e2 89 92 22 2c 45 66 72 3a 22 f0 9d 94 88 22 2c 65 66 72 3a 22 f0 9d 94 a2 22 2c 65 67 3a 22 e2 aa 9a 22 2c 45 67 72 61 76 65 3a 22 c3 88 22 2c 65 67 72 61 76 65 3a 22 c3 a8 22 2c 65 67 73 3a 22 e2 aa 96 22 2c 65 67 73 64 6f 74 3a 22 e2 aa 98 22 2c 65 6c 3a 22 e2 aa 99 22 2c 45 6c 65 6d 65 6e 74 3a 22 e2 88 88 22 2c 65 6c 69 6e 74 65 72 73 3a 22 Data Ascii: ",ecaron:"",Ecirc:"",ecirc:"",ecir:"",ecolon:"",Ecy:"",ecy:"",eDDot:"",Edot:"",edot:"",eDot:"",ee:"",efDot:"",Efr:"",efr:"",eg:"",Egrave:"",egrave:"",egs:"",egsdot:"",el:"",Element:"",elinters:"
2024-10-01 17:04:05 UTC	12718	IN	Data Raw: 2c 73 68 61 72 70 3a 22 e2 99 af 22 2c 53 48 43 48 63 79 3a 22 d0 a9 22 2c 73 68 63 68 63 79 3a 22 d1 89 22 2c 53 48 63 79 3a 22 d0 a8 22 2c 73 68 63 79 3a 22 d1 88 22 2c 53 68 6f 72 74 44 6f 77 6e 41 72 72 6f 77 3a 22 e2 86 93 22 2c 53 68 6f 72 74 4c 65 66 74 41 72 72 6f 77 3a 22 e2 86 90 22 2c 73 68 6f 72 74 6d 69 64 3a 22 e2 88 a3 22 2c 73 68 6f 72 74 70 61 72 61 6c 6c 65 6c 3a 22 e2 88 a5 22 2c 53 68 6f 72 74 52 69 67 68 74 41 72 72 6f 77 3a 22 e2 86 92 22 2c 53 68 6f 72 74 55 70 41 72 72 6f 77 3a 22 e2 86 91 22 2c 73 68 79 3a 22 c2 ad 22 2c 53 69 67 6d 61 3a 22 ce a3 22 2c 73 69 67 6d 61 3a 22 cf 83 22 2c 73 69 67 6d 61 66 3a 22 cf 82 22 2c 73 69 67 6d 61 76 3a 22 cf 82 22 2c 73 69 6d 3a 22 e2 88 bc 22 2c 73 69 6d 64 6f 74 3a 22 e2 a9 aa 22 2c 73 69 Data Ascii: ,sharp:"",SHCHcy:"",shchcy:"",SHcy:"",shcy:"",ShortDownArrow:"",ShortLeftArrow:"",shortmid:"",shortparallel:"",ShortRightArrow:"",ShortUpArrow:"",shy:"",Sigma:"",sigma:"",sigmaf:"",sigmav:"",sim:"",simdot:"",si

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.16	49747	3.145.240.82	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:04 UTC	622	OUT	GET /frame/static/shared/lib/lodash/lodash.min.js?v=6585f HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:05 UTC	504	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:04 GMT Content-Type: application/javascript Content-Length: 73409 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-11ec1" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:05 UTC	15880	IN	Data Raw: 2f 2a 2a 0a 20 2a 20 40 6c 69 63 65 6e 73 65 0a 20 2a 20 4c 6f 64 61 73 68 20 3c 68 74 74 70 73 3a 2f 2f 6c 6f 64 61 73 68 2e 63 6f 6d 2f 3e 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 3c 68 74 74 70 73 3a 2f 2f 6f 70 65 6e 6a 73 66 2e 6f 72 67 2f 3e 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 6c 69 63 65 6e 73 65 20 3c 68 74 74 70 73 3a 2f 2f 6c 6f 64 61 73 68 2e 63 6f 6d 2f 6c 69 63 65 6e 73 65 3e 0a 20 2a 20 42 61 73 65 64 20 6f 6e 20 55 6e 64 65 72 73 63 6f 72 65 2e 6a 73 20 31 2e 38 2e 33 20 3c 68 74 74 70 3a 2f 2f 75 6e 64 65 72 73 63 6f 72 65 6a 73 2e 6f 72 67 2f 4c 49 43 45 4e 53 45 3e 0a 20 2a 20 43 6f Data Ascii: /** * @license * Lodash <https://lodash.com/> * Copyright OpenJS Foundation and other contributors <https://openjsf.org/> * Released under MIT license <https://lodash.com/license> * Based on Underscore.js 1.8.3 <http://underscorejs.org/LICENSE> * Co
2024-10-01 17:04:05 UTC	16384	IN	Data Raw: 6f 74 6f 5f 5f 22 3d 3d 74 26 26 54 6c 3f 54 6c 28 6e 2c 74 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 72 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 6e 5b 74 5d 3d 72 7d 66 75 6e 63 74 69 6f 6e 20 54 72 28 6e 2c 74 29 7b 66 6f 72 28 76 61 72 20 72 3d 2d 31 2c 65 3d 74 2e 6c 65 6e 67 74 68 2c 75 3d 69 6c 28 65 29 2c 69 3d 6e 75 6c 6c 3d 3d 6e 3b 2b 2b 72 3c 65 3b 29 75 5b 72 5d 3d 69 3f 58 3a 4d 63 28 6e 2c 74 5b 72 5d 29 3b 72 65 74 75 72 6e 20 75 7d 66 75 6e 63 74 69 6f 6e 20 4d 72 28 6e 2c 74 2c 72 29 7b 72 65 74 75 72 6e 20 6e 3d 3d 3d 6e 26 26 28 72 21 3d 3d 58 26 26 28 6e 3d 6e 3c 3d 72 3f 6e 3a 72 29 2c 0a 20 20 20 74 21 3d 3d 58 26 26 28 6e 3d 6e 3e 3d 74 3f 6e 3a 74 29 29 2c Data Ascii: oto__"==t&&Tl?Tl(n,t,{configurable:!0,enumerable:!0,value:r,writable:!0}):n[t]=r}function Tr(n,t){for(var r=-1,e=t.length,u=il(e),i=null==n;++r<e;)u[r]=i?X:Mc(n,t[r]);return u}function Mr(n,t,r){return n===n&&(r!==X&&(n=n<=r?n:r), t!==X&&(n=n>=t?n:t)),
2024-10-01 17:04:05 UTC	16384	IN	Data Raw: 5f 3d 72 26 70 6e 3f 6e 65 77 20 79 72 3a 58 3b 66 6f 72 28 69 2e 73 65 74 28 6e 2c 74 29 2c 69 2e 73 65 74 28 74 2c 6e 29 3b 2b 2b 73 3c 66 3b 29 7b 76 61 72 20 76 3d 6e 5b 73 5d 2c 67 3d 74 5b 73 5d 3b 69 66 28 65 29 76 61 72 20 79 3d 6f 3f 65 28 67 2c 76 2c 73 2c 74 2c 6e 2c 69 29 3a 65 28 76 2c 67 2c 73 2c 6e 2c 74 2c 69 29 3b 69 66 28 79 21 3d 3d 58 29 7b 69 66 28 79 29 63 6f 6e 74 69 6e 75 65 3b 70 3d 21 31 3b 62 72 65 61 6b 7d 69 66 28 5f 29 7b 69 66 28 21 68 28 74 2c 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 69 66 28 21 53 28 5f 2c 74 29 26 26 28 76 3d 3d 3d 6e 7c 7c 75 28 76 2c 6e 2c 72 2c 65 2c 69 29 29 29 72 65 74 75 72 6e 20 5f 2e 70 75 73 68 28 74 29 7d 29 29 7b 70 3d 21 31 3b 62 72 65 61 6b 7d 7d 65 6c 73 65 20 69 66 28 76 21 3d 3d 67 26 26 Data Ascii: _=r&pn?new yr:X;for(i.set(n,t),i.set(t,n);++s<f;){var v=n[s],g=t[s];if(e)var y=o?e(g,v,s,t,n,i):e(v,g,s,n,t,i);if(y!==X){if(y)continue;p=!1;break}if(_){if(!h(t,function(n,t){if(!S(_,t)&&(v===n\|\|u(v,n,r,e,i)))return _.push(t)})){p=!1;break}}else if(v!==g&&
2024-10-01 17:04:05 UTC	16384	IN	Data Raw: 29 7c 7c 77 65 28 6e 29 21 3d 59 6e 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 74 3d 45 6c 28 6e 29 3b 69 66 28 6e 75 6c 6c 3d 3d 3d 74 29 72 65 74 75 72 6e 21 30 3b 76 61 72 20 72 3d 62 6c 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 26 26 72 20 69 6e 73 74 61 6e 63 65 6f 66 20 72 26 26 64 6c 2e 63 61 6c 6c 28 72 29 3d 3d 6a 6c 7d 66 75 6e 63 74 69 6f 6e 20 79 63 28 6e 29 7b 0a 20 20 20 72 65 74 75 72 6e 20 69 63 28 6e 29 26 26 6e 3e 3d 2d 57 6e 26 26 6e 3c 3d 57 6e 7d 66 75 6e 63 74 69 6f 6e 20 64 63 28 6e 29 7b 72 65 74 75 72 6e 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 6e 7c 7c 21 62 68 28 6e 29 26 Data Ascii: )\|\|we(n)!=Yn)return!1;var t=El(n);if(null===t)return!0;var r=bl.call(t,"constructor")&&t.constructor;return"function"==typeof r&&r instanceof r&&dl.call(r)==jl}function yc(n){ return ic(n)&&n>=-Wn&&n<=Wn}function dc(n){return"string"==typeof n\|\|!bh(n)&
2024-10-01 17:04:05 UTC	8377	IN	Data Raw: 72 65 74 75 72 6e 20 6e 2b 28 72 3f 22 2d 22 3a 22 22 29 2b 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7d 29 2c 56 68 3d 56 75 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 29 7b 72 65 74 75 72 6e 20 6e 2b 28 72 3f 22 20 22 3a 22 22 29 2b 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7d 29 2c 47 68 3d 4b 75 28 22 74 6f 4c 6f 77 65 72 43 61 73 65 22 29 2c 48 68 3d 56 75 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 29 7b 0a 20 20 20 72 65 74 75 72 6e 20 6e 2b 28 72 3f 22 5f 22 3a 22 22 29 2b 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7d 29 2c 4a 68 3d 56 75 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 29 7b 72 65 74 75 72 6e 20 6e 2b 28 72 3f 22 20 22 3a 22 22 29 2b 51 68 28 74 29 7d 29 2c 59 68 3d 56 75 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 29 7b Data Ascii: return n+(r?"-":"")+t.toLowerCase()}),Vh=Vu(function(n,t,r){return n+(r?" ":"")+t.toLowerCase()}),Gh=Ku("toLowerCase"),Hh=Vu(function(n,t,r){ return n+(r?"_":"")+t.toLowerCase()}),Jh=Vu(function(n,t,r){return n+(r?" ":"")+Qh(t)}),Yh=Vu(function(n,t,r){

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.16	49746	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:04 UTC	899	OUT	GET /frame/static/js/page/v3/trigger-endpointhealth-verification.js?v=e90e7 HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:05 UTC	505	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:05 GMT Content-Type: application/javascript Content-Length: 187220 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-2db54" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:05 UTC	15879	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 74 72 69 67 67 65 72 2d 65 6e 64 70 6f 69 6e 74 68 65 61 6c 74 68 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 5f 77 65 62 70 61 63 6b 5f 6d 6f 64 75 6c 65 73 5f 5f 3d 7b 31 31 38 31 3a 66 75 6e 63 74 69 6f 6e 28 5f 5f 75 6e 75 73 65 64 5f 77 65 62 70 61 63 6b 5f 6d 6f 64 75 6c 65 2c 65 78 70 6f 72 74 73 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 5f 44 49 53 50 4c 41 59 5f 4b 45 59 53 2c 5f 44 49 53 50 4c 41 59 5f 53 53 4f 5f 4b 45 59 53 3b 65 78 70 6f 72 74 73 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3d 21 30 2c 65 78 70 6f 72 74 73 Data Ascii: /! For license information please see trigger-endpointhealth-verification.js.LICENSE.txt /!function(){var __webpack_modules__={1181:function(__unused_webpack_module,exports){"use strict";var _DISPLAY_KEYS,_DISPLAY_SSO_KEYS;exports.__esModule=!0,exports
2024-10-01 17:04:05 UTC	16384	IN	Data Raw: 72 69 74 61 62 6c 65 3a 21 30 7d 29 2c 74 5b 65 5d 7d 74 72 79 7b 64 65 66 69 6e 65 28 7b 7d 2c 22 22 29 7d 63 61 74 63 68 28 74 29 7b 64 65 66 69 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 72 65 74 75 72 6e 20 74 5b 65 5d 3d 72 7d 7d 66 75 6e 63 74 69 6f 6e 20 77 72 61 70 28 74 2c 65 2c 72 2c 6e 29 7b 76 61 72 20 69 3d 65 26 26 65 2e 70 72 6f 74 6f 74 79 70 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 47 65 6e 65 72 61 74 6f 72 3f 65 3a 47 65 6e 65 72 61 74 6f 72 2c 61 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 69 2e 70 72 6f 74 6f 74 79 70 65 29 2c 63 3d 6e 65 77 20 43 6f 6e 74 65 78 74 28 6e 7c 7c 5b 5d 29 3b 72 65 74 75 72 6e 20 6f 28 61 2c 22 5f 69 6e 76 6f 6b 65 22 2c 7b 76 61 6c 75 65 3a 6d 61 6b 65 49 6e 76 6f 6b 65 4d 65 74 68 6f 64 28 Data Ascii: ritable:!0}),t[e]}try{define({},"")}catch(t){define=function(t,e,r){return t[e]=r}}function wrap(t,e,r,n){var i=e&&e.prototype instanceof Generator?e:Generator,a=Object.create(i.prototype),c=new Context(n\|\|[]);return o(a,"_invoke",{value:makeInvokeMethod(
2024-10-01 17:04:05 UTC	16384	IN	Data Raw: 6f 64 3d 66 75 6e 63 74 69 6f 6e 28 49 53 5f 49 4e 43 4c 55 44 45 53 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 24 74 68 69 73 2c 65 6c 2c 66 72 6f 6d 49 6e 64 65 78 29 7b 76 61 72 20 76 61 6c 75 65 2c 4f 3d 74 6f 49 6e 64 65 78 65 64 4f 62 6a 65 63 74 28 24 74 68 69 73 29 2c 6c 65 6e 67 74 68 3d 74 6f 4c 65 6e 67 74 68 28 4f 2e 6c 65 6e 67 74 68 29 2c 69 6e 64 65 78 3d 74 6f 41 62 73 6f 6c 75 74 65 49 6e 64 65 78 28 66 72 6f 6d 49 6e 64 65 78 2c 6c 65 6e 67 74 68 29 3b 69 66 28 49 53 5f 49 4e 43 4c 55 44 45 53 26 26 65 6c 21 3d 65 6c 29 7b 66 6f 72 28 3b 6c 65 6e 67 74 68 3e 69 6e 64 65 78 3b 29 69 66 28 28 76 61 6c 75 65 3d 4f 5b 69 6e 64 65 78 2b 2b 5d 29 21 3d 76 61 6c 75 65 29 72 65 74 75 72 6e 21 30 7d 65 6c 73 65 20 66 6f 72 28 3b 6c 65 Data Ascii: od=function(IS_INCLUDES){return function($this,el,fromIndex){var value,O=toIndexedObject($this),length=toLength(O.length),index=toAbsoluteIndex(fromIndex,length);if(IS_INCLUDES&&el!=el){for(;length>index;)if((value=O[index++])!=value)return!0}else for(;le
2024-10-01 17:04:05 UTC	16384	IN	Data Raw: 65 72 74 79 4d 6f 64 75 6c 65 2e 66 28 6f 62 6a 65 63 74 2c 6b 65 79 2c 63 72 65 61 74 65 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 31 2c 76 61 6c 75 65 29 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 6f 62 6a 65 63 74 2c 6b 65 79 2c 76 61 6c 75 65 29 7b 72 65 74 75 72 6e 20 6f 62 6a 65 63 74 5b 6b 65 79 5d 3d 76 61 6c 75 65 2c 6f 62 6a 65 63 74 7d 7d 2c 37 32 30 37 3a 66 75 6e 63 74 69 6f 6e 28 6d 6f 64 75 6c 65 29 7b 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 62 69 74 6d 61 70 2c 76 61 6c 75 65 29 7b 72 65 74 75 72 6e 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 28 31 26 62 69 74 6d 61 70 29 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 28 32 26 62 69 74 6d 61 70 29 2c 77 72 69 74 61 62 6c 65 3a 21 28 34 26 62 69 74 6d 61 70 Data Ascii: ertyModule.f(object,key,createPropertyDescriptor(1,value))}:function(object,key,value){return object[key]=value,object}},7207:function(module){module.exports=function(bitmap,value){return{enumerable:!(1&bitmap),configurable:!(2&bitmap),writable:!(4&bitmap
2024-10-01 17:04:05 UTC	16384	IN	Data Raw: 5f 5f 75 6e 75 73 65 64 5f 77 65 62 70 61 63 6b 5f 65 78 70 6f 72 74 73 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 7b 76 61 72 20 73 65 74 2c 67 65 74 2c 68 61 73 2c 4e 41 54 49 56 45 5f 57 45 41 4b 5f 4d 41 50 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 32 31 33 31 29 2c 67 6c 6f 62 61 6c 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 36 35 33 37 29 2c 69 73 4f 62 6a 65 63 74 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 39 36 39 29 2c 63 72 65 61 74 65 4e 6f 6e 45 6e 75 6d 65 72 61 62 6c 65 50 72 6f 70 65 72 74 79 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 33 35 32 29 2c 6f 62 6a 65 63 74 48 61 73 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 36 Data Ascii: __unused_webpack_exports,__webpack_require__){var set,get,has,NATIVE_WEAK_MAP=__webpack_require__(2131),global=__webpack_require__(6537),isObject=__webpack_require__(969),createNonEnumerableProperty=__webpack_require__(352),objectHas=__webpack_require__(6
2024-10-01 17:04:05 UTC	16384	IN	Data Raw: 63 74 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 39 36 39 29 2c 6e 65 77 50 72 6f 6d 69 73 65 43 61 70 61 62 69 6c 69 74 79 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 32 38 31 36 29 3b 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 43 2c 78 29 7b 69 66 28 61 6e 4f 62 6a 65 63 74 28 43 29 2c 69 73 4f 62 6a 65 63 74 28 78 29 26 26 78 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 43 29 72 65 74 75 72 6e 20 78 3b 76 61 72 20 70 72 6f 6d 69 73 65 43 61 70 61 62 69 6c 69 74 79 3d 6e 65 77 50 72 6f 6d 69 73 65 43 61 70 61 62 69 6c 69 74 79 2e 66 28 43 29 3b 72 65 74 75 72 6e 28 30 2c 70 72 6f 6d 69 73 65 43 61 70 61 62 69 6c 69 74 79 2e 72 65 73 6f 6c 76 65 29 28 78 29 2c 70 72 6f 6d 69 73 65 43 61 Data Ascii: ct=__webpack_require__(969),newPromiseCapability=__webpack_require__(2816);module.exports=function(C,x){if(anObject(C),isObject(x)&&x.constructor===C)return x;var promiseCapability=newPromiseCapability.f(C);return(0,promiseCapability.resolve)(x),promiseCa
2024-10-01 17:04:05 UTC	16384	IN	Data Raw: 6c 65 6d 65 6e 74 29 7b 72 65 74 75 72 6e 20 4e 45 47 41 54 49 56 45 5f 5a 45 52 4f 3f 6e 61 74 69 76 65 49 6e 64 65 78 4f 66 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7c 7c 30 3a 24 69 6e 64 65 78 4f 66 28 74 68 69 73 2c 73 65 61 72 63 68 45 6c 65 6d 65 6e 74 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 31 3f 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3a 76 6f 69 64 20 30 29 7d 7d 29 7d 2c 32 33 38 3a 66 75 6e 63 74 69 6f 6e 28 5f 5f 75 6e 75 73 65 64 5f 77 65 62 70 61 63 6b 5f 6d 6f 64 75 6c 65 2c 5f 5f 75 6e 75 73 65 64 5f 77 65 62 70 61 63 6b 5f 65 78 70 6f 72 74 73 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 7b 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 38 30 37 30 29 28 7b 74 61 72 67 65 Data Ascii: lement){return NEGATIVE_ZERO?nativeIndexOf.apply(this,arguments)\|\|0:$indexOf(this,searchElement,arguments.length>1?arguments[1]:void 0)}})},238:function(__unused_webpack_module,__unused_webpack_exports,__webpack_require__){__webpack_require__(8070)({targe
2024-10-01 17:04:05 UTC	16384	IN	Data Raw: 69 6e 3a 76 6f 69 64 20 30 2c 73 74 61 74 65 2e 70 61 72 65 6e 74 3d 21 30 2c 73 74 61 74 65 2e 72 65 61 63 74 69 6f 6e 73 2e 70 75 73 68 28 72 65 61 63 74 69 6f 6e 29 2c 30 21 3d 73 74 61 74 65 2e 73 74 61 74 65 26 26 6e 6f 74 69 66 79 28 73 74 61 74 65 2c 21 31 29 2c 72 65 61 63 74 69 6f 6e 2e 70 72 6f 6d 69 73 65 7d 2c 63 61 74 63 68 3a 66 75 6e 63 74 69 6f 6e 28 6f 6e 52 65 6a 65 63 74 65 64 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 74 68 65 6e 28 76 6f 69 64 20 30 2c 6f 6e 52 65 6a 65 63 74 65 64 29 7d 7d 29 2c 4f 77 6e 50 72 6f 6d 69 73 65 43 61 70 61 62 69 6c 69 74 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 70 72 6f 6d 69 73 65 3d 6e 65 77 20 49 6e 74 65 72 6e 61 6c 2c 73 74 61 74 65 3d 67 65 74 49 6e 74 65 72 6e 61 6c 53 74 61 74 65 28 70 Data Ascii: in:void 0,state.parent=!0,state.reactions.push(reaction),0!=state.state&&notify(state,!1),reaction.promise},catch:function(onRejected){return this.then(void 0,onRejected)}}),OwnPromiseCapability=function(){var promise=new Internal,state=getInternalState(p
2024-10-01 17:04:05 UTC	16384	IN	Data Raw: 69 6e 65 50 72 6f 70 65 72 74 79 3d 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 4d 6f 64 75 6c 65 2e 66 2c 6e 61 74 69 76 65 47 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 4e 61 6d 65 73 3d 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 4e 61 6d 65 73 45 78 74 65 72 6e 61 6c 2e 66 2c 6e 61 74 69 76 65 50 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 3d 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 4d 6f 64 75 6c 65 2e 66 2c 41 6c 6c 53 79 6d 62 6f 6c 73 3d 73 68 61 72 65 64 28 22 73 79 6d 62 6f 6c 73 22 29 2c 4f 62 6a 65 63 74 50 72 6f 74 6f 74 79 70 65 53 79 6d 62 6f 6c 73 3d 73 68 61 72 65 64 28 22 6f 70 2d 73 79 6d 62 6f 6c 73 22 29 2c 53 74 72 69 6e 67 54 6f 53 79 6d 62 6f 6c 52 65 67 69 73 74 72 79 3d 73 68 61 72 65 64 28 22 73 74 72 69 Data Ascii: ineProperty=definePropertyModule.f,nativeGetOwnPropertyNames=getOwnPropertyNamesExternal.f,nativePropertyIsEnumerable=propertyIsEnumerableModule.f,AllSymbols=shared("symbols"),ObjectPrototypeSymbols=shared("op-symbols"),StringToSymbolRegistry=shared("stri
2024-10-01 17:04:05 UTC	16384	IN	Data Raw: 28 29 29 7b 76 61 72 20 75 72 6c 4d 61 74 63 68 3d 2f 5e 28 5b 61 2d 7a 41 2d 5a 5d 2b 29 3a 5c 2f 5c 2f 2e 2a 3a 28 5c 64 2b 29 5c 2f 2f 2e 65 78 65 63 28 75 72 6c 29 3b 69 66 28 75 72 6c 4d 61 74 63 68 26 26 75 72 6c 4d 61 74 63 68 2e 6c 65 6e 67 74 68 3e 32 29 7b 76 61 72 20 73 63 68 65 6d 61 3d 75 72 6c 4d 61 74 63 68 5b 31 5d 2c 70 6f 72 74 3d 75 72 6c 4d 61 74 63 68 5b 32 5d 3b 77 69 6e 64 6f 77 2e 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 73 63 68 65 6d 61 2b 22 5f 70 72 65 76 69 6f 75 73 5f 61 70 70 5f 70 6f 72 74 22 2c 70 6f 72 74 29 7d 7d 76 61 72 20 61 64 61 70 74 65 64 41 70 70 55 72 6c 3d 75 72 6c 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 75 72 6c 2e 69 6e 64 65 78 4f 66 28 22 2f 61 6c 69 76 65 22 29 29 2b 61 70 70 55 72 6c Data Ascii: ()){var urlMatch=/^([a-zA-Z]+):\/\/.*:(\d+)\//.exec(url);if(urlMatch&&urlMatch.length>2){var schema=urlMatch[1],port=urlMatch[2];window.localStorage.setItem(schema+"_previous_app_port",port)}}var adaptedAppUrl=url.substring(0,url.indexOf("/alive"))+appUrl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.16	49748	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:04 UTC	872	OUT	GET /frame/static/js/lib/jquery.tipsy.js?v=c0432 HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:05 UTC	503	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:05 GMT Content-Type: application/javascript Content-Length: 10390 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-2896" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:05 UTC	10390	IN	Data Raw: 2f 2f 20 74 69 70 73 79 2c 20 66 61 63 65 62 6f 6f 6b 20 73 74 79 6c 65 20 74 6f 6f 6c 74 69 70 73 20 66 6f 72 20 6a 71 75 65 72 79 0a 2f 2f 20 76 65 72 73 69 6f 6e 20 31 2e 30 2e 30 61 0a 2f 2f 20 28 63 29 20 32 30 30 38 2d 32 30 31 30 20 6a 61 73 6f 6e 20 66 72 61 6d 65 20 5b 6a 61 73 6f 6e 40 6f 6e 65 68 61 63 6b 6f 72 61 6e 6f 74 68 65 72 2e 63 6f 6d 5d 0a 2f 2f 20 72 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6c 69 63 65 6e 73 65 0a 0a 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0a 20 20 20 20 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 6d 61 79 62 65 43 61 6c 6c 28 74 68 69 6e 67 2c 20 63 74 78 29 20 7b 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 28 74 79 70 65 6f 66 20 74 68 69 6e 67 20 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 Data Ascii: // tipsy, facebook style tooltips for jquery// version 1.0.0a// (c) 2008-2010 jason frame [jason@onehackoranother.com]// released under the MIT license(function($) { function maybeCall(thing, ctx) { return (typeof thing == 'function'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.16	49749	3.145.240.82	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:04 UTC	626	OUT	GET /frame/static/shared/lib/backbone/backbone-min.js?v=e0ff6 HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:05 UTC	503	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:05 GMT Content-Type: application/javascript Content-Length: 19414 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-4bd6" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:05 UTC	15881	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 76 61 72 20 65 3d 74 2e 42 61 63 6b 62 6f 6e 65 3b 76 61 72 20 69 3d 5b 5d 3b 76 61 72 20 72 3d 69 2e 70 75 73 68 3b 76 61 72 20 73 3d 69 2e 73 6c 69 63 65 3b 76 61 72 20 6e 3d 69 2e 73 70 6c 69 63 65 3b 76 61 72 20 61 3b 69 66 28 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 7b 61 3d 65 78 70 6f 72 74 73 7d 65 6c 73 65 7b 61 3d 74 2e 42 61 63 6b 62 6f 6e 65 3d 7b 7d 7d 61 2e 56 45 52 53 49 4f 4e 3d 22 31 2e 30 2e 30 22 3b 76 61 72 20 68 3d 74 2e 5f 3b 69 66 28 21 68 26 26 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 68 3d 72 65 71 75 69 72 65 28 22 75 6e 64 65 72 73 63 6f 72 65 22 29 3b 61 2e 24 3d 74 2e Data Ascii: (function(){var t=this;var e=t.Backbone;var i=[];var r=i.push;var s=i.slice;var n=i.splice;var a;if(typeof exports!=="undefined"){a=exports}else{a=t.Backbone={}}a.VERSION="1.0.0";var h=t._;if(!h&&typeof require!=="undefined")h=require("underscore");a.$=t.
2024-10-01 17:04:05 UTC	3533	IN	Data Raw: 7d 2c 67 65 74 46 72 61 67 6d 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 74 3d 3d 6e 75 6c 6c 29 7b 69 66 28 74 68 69 73 2e 5f 68 61 73 50 75 73 68 53 74 61 74 65 7c 7c 21 74 68 69 73 2e 5f 77 61 6e 74 73 48 61 73 68 43 68 61 6e 67 65 7c 7c 65 29 7b 74 3d 74 68 69 73 2e 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 3b 76 61 72 20 69 3d 74 68 69 73 2e 72 6f 6f 74 2e 72 65 70 6c 61 63 65 28 43 2c 22 22 29 3b 69 66 28 21 74 2e 69 6e 64 65 78 4f 66 28 69 29 29 74 3d 74 2e 73 75 62 73 74 72 28 69 2e 6c 65 6e 67 74 68 29 7d 65 6c 73 65 7b 74 3d 74 68 69 73 2e 67 65 74 48 61 73 68 28 29 7d 7d 72 65 74 75 72 6e 20 74 2e 72 65 70 6c 61 63 65 28 4e 2c 22 22 29 7d 2c 73 74 61 72 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 49 2e 73 74 Data Ascii: },getFragment:function(t,e){if(t==null){if(this._hasPushState\|\|!this._wantsHashChange\|\|e){t=this.location.pathname;var i=this.root.replace(C,"");if(!t.indexOf(i))t=t.substr(i.length)}else{t=this.getHash()}}return t.replace(N,"")},start:function(t){if(I.st

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.16	49751	3.145.240.82	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:05 UTC	610	OUT	GET /frame/static/js/page/v3/frame.js?v=aaf8c HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:05 UTC	501	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:05 GMT Content-Type: application/javascript Content-Length: 1240 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-4d8" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:05 UTC	1240	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 2c 5f 6a 71 75 65 72 79 2c 44 75 6f 46 72 61 6d 65 2c 5f 5f 77 65 62 70 61 63 6b 5f 6d 6f 64 75 6c 65 73 5f 5f 3d 7b 35 33 31 31 3a 66 75 6e 63 74 69 6f 6e 28 6d 6f 64 75 6c 65 29 7b 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 6a 51 75 65 72 79 7d 7d 2c 5f 5f 77 65 62 70 61 63 6b 5f 6d 6f 64 75 6c 65 5f 63 61 63 68 65 5f 5f 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 6d 6f 64 75 6c 65 49 64 29 7b 76 61 72 20 63 61 63 68 65 64 4d 6f 64 75 6c 65 3d 5f 5f 77 65 62 70 61 63 6b 5f 6d 6f 64 75 6c 65 5f 63 61 63 68 65 5f 5f 5b 6d 6f 64 75 6c 65 49 64 5d 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 63 61 63 68 65 64 4d 6f 64 Data Ascii: !function(){"use strict";var e,_jquery,DuoFrame,__webpack_modules__={5311:function(module){module.exports=jQuery}},__webpack_module_cache__={};function __webpack_require__(moduleId){var cachedModule=__webpack_module_cache__[moduleId];if(void 0!==cachedMod

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.16	49750	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:05 UTC	870	OUT	GET /frame/static/js/page/v3/prompt.js?v=69acc HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:05 UTC	505	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:05 GMT Content-Type: application/javascript Content-Length: 306947 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-4af03" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:05 UTC	15879	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 70 72 6f 6d 70 74 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 5f 77 65 62 70 61 63 6b 5f 6d 6f 64 75 6c 65 73 5f 5f 3d 7b 32 36 30 37 3a 66 75 6e 63 74 69 6f 6e 28 5f 5f 75 6e 75 73 65 64 5f 77 65 62 70 61 63 6b 5f 6d 6f 64 75 6c 65 2c 65 78 70 6f 72 74 73 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 36 38 38 37 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 35 38 34 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 33 36 33 Data Ascii: /! For license information please see prompt.js.LICENSE.txt /!function(){var __webpack_modules__={2607:function(__unused_webpack_module,exports,__webpack_require__){"use strict";__webpack_require__(6887),__webpack_require__(584),__webpack_require__(363
2024-10-01 17:04:05 UTC	16384	IN	Data Raw: 28 6e 65 77 20 48 54 54 50 45 72 72 6f 72 28 6d 65 74 68 6f 64 2c 75 72 6c 2c 22 55 6e 61 62 6c 65 20 74 6f 20 70 61 72 73 65 20 72 65 73 70 6f 6e 73 65 20 73 74 72 69 6e 67 20 61 73 20 4a 53 4f 4e 2e 22 2c 78 68 72 29 29 7d 76 61 72 20 72 65 73 70 6f 6e 73 65 3d 28 30 2c 5f 75 74 69 6c 2e 73 61 66 65 44 65 63 6f 64 65 4a 53 4f 4e 29 28 4a 53 4f 4e 2e 70 61 72 73 65 28 78 68 72 2e 72 65 73 70 6f 6e 73 65 54 65 78 74 29 29 3b 64 66 64 2e 72 65 6a 65 63 74 28 6e 65 77 20 48 54 54 50 45 72 72 6f 72 28 6d 65 74 68 6f 64 2c 75 72 6c 2c 65 72 72 6f 72 2c 78 68 72 2c 72 65 73 70 6f 6e 73 65 29 29 7d 65 6c 73 65 20 64 66 64 2e 72 65 6a 65 63 74 28 6e 65 77 20 48 54 54 50 45 72 72 6f 72 28 6d 65 74 68 6f 64 2c 75 72 6c 2c 65 72 72 6f 72 2c 78 68 72 29 29 7d 29 29 Data Ascii: (new HTTPError(method,url,"Unable to parse response string as JSON.",xhr))}var response=(0,_util.safeDecodeJSON)(JSON.parse(xhr.responseText));dfd.reject(new HTTPError(method,url,error,xhr,response))}else dfd.reject(new HTTPError(method,url,error,xhr))}))
2024-10-01 17:04:05 UTC	16384	IN	Data Raw: 2c 5f 6b 65 79 32 3d 31 3b 5f 6b 65 79 32 3c 5f 6c 65 6e 32 3b 5f 6b 65 79 32 2b 2b 29 70 61 74 68 5b 5f 6b 65 79 32 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 5f 6b 65 79 32 5d 3b 5f 6c 6f 64 61 73 68 2e 64 65 66 61 75 6c 74 2e 69 73 41 72 72 61 79 28 6f 62 6a 29 3f 63 6f 6d 6d 61 53 65 70 61 72 61 74 65 64 41 72 72 61 79 56 61 6c 75 65 73 26 26 6f 62 6a 2e 6c 65 6e 67 74 68 3e 30 3f 70 61 72 74 73 2e 70 75 73 68 28 73 65 72 69 61 6c 69 7a 65 4b 65 79 2e 61 70 70 6c 79 28 76 6f 69 64 20 30 2c 5b 6b 65 79 5d 2e 63 6f 6e 63 61 74 28 70 61 74 68 29 29 2b 22 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6f 62 6a 2e 6a 6f 69 6e 28 22 2c 22 29 29 29 3a 6f 62 6a 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 76 61 6c 75 65 29 7b 70 Data Ascii: ,_key2=1;_key2<_len2;_key2++)path[_key2-1]=arguments[_key2];_lodash.default.isArray(obj)?commaSeparatedArrayValues&&obj.length>0?parts.push(serializeKey.apply(void 0,[key].concat(path))+"="+encodeURIComponent(obj.join(","))):obj.forEach((function(value){p
2024-10-01 17:04:05 UTC	16384	IN	Data Raw: 31 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 36 33 35 30 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 39 34 36 33 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 33 37 33 31 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 36 38 35 34 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 38 38 31 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 33 36 33 38 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 39 33 33 31 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 36 38 38 37 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 34 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 34 39 Data Ascii: 1),__webpack_require__(6350),__webpack_require__(9463),__webpack_require__(3731),__webpack_require__(6854),__webpack_require__(881),__webpack_require__(3638),__webpack_require__(9331),__webpack_require__(6887),__webpack_require__(4),__webpack_require__(49
2024-10-01 17:04:05 UTC	16384	IN	Data Raw: 72 41 74 3b 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 53 2c 69 6e 64 65 78 2c 75 6e 69 63 6f 64 65 29 7b 72 65 74 75 72 6e 20 69 6e 64 65 78 2b 28 75 6e 69 63 6f 64 65 3f 63 68 61 72 41 74 28 53 2c 69 6e 64 65 78 29 2e 6c 65 6e 67 74 68 3a 31 29 7d 7d 2c 31 31 37 37 3a 66 75 6e 63 74 69 6f 6e 28 6d 6f 64 75 6c 65 29 7b 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 69 74 2c 43 6f 6e 73 74 72 75 63 74 6f 72 2c 6e 61 6d 65 29 7b 69 66 28 21 28 69 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 43 6f 6e 73 74 72 75 63 74 6f 72 29 29 74 68 72 6f 77 20 54 79 70 65 45 72 72 6f 72 28 22 49 6e 63 6f 72 72 65 63 74 20 22 2b 28 6e 61 6d 65 3f 6e 61 6d 65 2b 22 20 22 3a 22 22 29 2b 22 69 6e 76 6f 63 61 74 69 6f 6e 22 29 Data Ascii: rAt;module.exports=function(S,index,unicode){return index+(unicode?charAt(S,index).length:1)}},1177:function(module){module.exports=function(it,Constructor,name){if(!(it instanceof Constructor))throw TypeError("Incorrect "+(name?name+" ":"")+"invocation")
2024-10-01 17:04:05 UTC	16384	IN	Data Raw: 6f 4c 65 6e 67 74 68 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 32 30 30 29 2c 61 72 72 61 79 4d 65 74 68 6f 64 49 73 53 74 72 69 63 74 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 39 38 36 33 29 2c 6d 69 6e 3d 4d 61 74 68 2e 6d 69 6e 2c 24 6c 61 73 74 49 6e 64 65 78 4f 66 3d 5b 5d 2e 6c 61 73 74 49 6e 64 65 78 4f 66 2c 4e 45 47 41 54 49 56 45 5f 5a 45 52 4f 3d 21 21 24 6c 61 73 74 49 6e 64 65 78 4f 66 26 26 31 2f 5b 31 5d 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 31 2c 2d 30 29 3c 30 2c 53 54 52 49 43 54 5f 4d 45 54 48 4f 44 3d 61 72 72 61 79 4d 65 74 68 6f 64 49 73 53 74 72 69 63 74 28 22 6c 61 73 74 49 6e 64 65 78 4f 66 22 29 2c 46 4f 52 43 45 44 3d 4e 45 47 41 54 49 56 45 5f 5a 45 52 4f 7c 7c 21 53 54 52 49 43 54 5f Data Ascii: oLength=__webpack_require__(200),arrayMethodIsStrict=__webpack_require__(9863),min=Math.min,$lastIndexOf=[].lastIndexOf,NEGATIVE_ZERO=!!$lastIndexOf&&1/[1].lastIndexOf(1,-0)<0,STRICT_METHOD=arrayMethodIsStrict("lastIndexOf"),FORCED=NEGATIVE_ZERO\|\|!STRICT_
2024-10-01 17:04:05 UTC	16384	IN	Data Raw: 28 37 32 30 37 29 3b 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 6f 62 6a 65 63 74 2c 6b 65 79 2c 76 61 6c 75 65 29 7b 76 61 72 20 70 72 6f 70 65 72 74 79 4b 65 79 3d 74 6f 50 72 69 6d 69 74 69 76 65 28 6b 65 79 29 3b 70 72 6f 70 65 72 74 79 4b 65 79 20 69 6e 20 6f 62 6a 65 63 74 3f 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 4d 6f 64 75 6c 65 2e 66 28 6f 62 6a 65 63 74 2c 70 72 6f 70 65 72 74 79 4b 65 79 2c 63 72 65 61 74 65 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 30 2c 76 61 6c 75 65 29 29 3a 6f 62 6a 65 63 74 5b 70 72 6f 70 65 72 74 79 4b 65 79 5d 3d 76 61 6c 75 65 7d 7d 2c 35 36 33 38 3a 66 75 6e 63 74 69 6f 6e 28 6d 6f 64 75 6c 65 2c 5f 5f 75 6e 75 73 65 64 5f 77 65 62 70 61 63 6b 5f 65 78 70 6f 72 74 73 2c Data Ascii: (7207);module.exports=function(object,key,value){var propertyKey=toPrimitive(key);propertyKey in object?definePropertyModule.f(object,propertyKey,createPropertyDescriptor(0,value)):object[propertyKey]=value}},5638:function(module,__unused_webpack_exports,
2024-10-01 17:04:05 UTC	16384	IN	Data Raw: 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 7b 76 61 72 20 73 74 6f 72 65 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 39 39 35 34 29 2c 66 75 6e 63 74 69 6f 6e 54 6f 53 74 72 69 6e 67 3d 46 75 6e 63 74 69 6f 6e 2e 74 6f 53 74 72 69 6e 67 3b 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 73 74 6f 72 65 2e 69 6e 73 70 65 63 74 53 6f 75 72 63 65 26 26 28 73 74 6f 72 65 2e 69 6e 73 70 65 63 74 53 6f 75 72 63 65 3d 66 75 6e 63 74 69 6f 6e 28 69 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 54 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 69 74 29 7d 29 2c 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 73 74 6f 72 65 2e 69 6e 73 70 65 63 74 53 6f 75 72 63 65 7d 2c 34 31 37 33 3a 66 75 6e 63 74 69 6f 6e 28 6d 6f 64 75 6c Data Ascii: _webpack_require__){var store=__webpack_require__(9954),functionToString=Function.toString;"function"!=typeof store.inspectSource&&(store.inspectSource=function(it){return functionToString.call(it)}),module.exports=store.inspectSource},4173:function(modul
2024-10-01 17:04:05 UTC	16384	IN	Data Raw: 65 5f 5f 28 35 35 33 30 29 2e 69 6e 64 65 78 4f 66 2c 68 69 64 64 65 6e 4b 65 79 73 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 34 36 38 36 29 3b 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 6f 62 6a 65 63 74 2c 6e 61 6d 65 73 29 7b 76 61 72 20 6b 65 79 2c 4f 3d 74 6f 49 6e 64 65 78 65 64 4f 62 6a 65 63 74 28 6f 62 6a 65 63 74 29 2c 69 3d 30 2c 72 65 73 75 6c 74 3d 5b 5d 3b 66 6f 72 28 6b 65 79 20 69 6e 20 4f 29 21 68 61 73 28 68 69 64 64 65 6e 4b 65 79 73 2c 6b 65 79 29 26 26 68 61 73 28 4f 2c 6b 65 79 29 26 26 72 65 73 75 6c 74 2e 70 75 73 68 28 6b 65 79 29 3b 66 6f 72 28 3b 6e 61 6d 65 73 2e 6c 65 6e 67 74 68 3e 69 3b 29 68 61 73 28 4f 2c 6b 65 79 3d 6e 61 6d 65 73 5b 69 2b 2b 5d 29 26 26 28 7e 69 6e 64 65 Data Ascii: e__(5530).indexOf,hiddenKeys=__webpack_require__(4686);module.exports=function(object,names){var key,O=toIndexedObject(object),i=0,result=[];for(key in O)!has(hiddenKeys,key)&&has(O,key)&&result.push(key);for(;names.length>i;)has(O,key=names[i++])&&(~inde
2024-10-01 17:04:05 UTC	16384	IN	Data Raw: 65 71 75 69 72 65 5f 5f 28 36 33 31 39 29 2c 61 6e 49 6e 73 74 61 6e 63 65 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 31 31 37 37 29 2c 63 72 65 61 74 65 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 37 32 30 37 29 2c 63 72 65 61 74 65 4e 6f 6e 45 6e 75 6d 65 72 61 62 6c 65 50 72 6f 70 65 72 74 79 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 33 35 32 29 2c 74 6f 4c 65 6e 67 74 68 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 32 30 30 29 2c 74 6f 49 6e 64 65 78 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 37 31 39 38 29 2c 74 6f 4f 66 66 73 65 74 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 33 31 Data Ascii: equire__(6319),anInstance=__webpack_require__(1177),createPropertyDescriptor=__webpack_require__(7207),createNonEnumerableProperty=__webpack_require__(352),toLength=__webpack_require__(200),toIndex=__webpack_require__(7198),toOffset=__webpack_require__(31

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.16	49752	3.145.240.82	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:05 UTC	628	OUT	GET /frame/static/shared/lib/validator/validator.min.js?v=9a068 HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:05 UTC	502	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:05 GMT Content-Type: application/javascript Content-Length: 5613 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-15ed" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:05 UTC	5613	IN	Data Raw: 2f 2a 21 20 76 61 6c 69 64 61 74 6f 72 6a 73 20 2d 20 76 31 2e 33 2e 32 20 2d 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 73 6b 61 74 65 72 64 61 76 38 35 2f 76 61 6c 69 64 61 74 6f 72 6a 73 20 2d 20 32 30 31 35 2d 30 32 2d 31 31 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 66 6f 72 28 76 61 72 20 62 2c 63 2c 64 2c 65 2c 66 2c 67 3d 61 72 67 75 6d 65 6e 74 73 5b 30 5d 7c 7c 7b 7d 2c 68 3d 31 2c 69 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 69 3e 68 3b 68 2b 2b 29 69 66 28 6e 75 6c 6c 21 3d 28 65 3d 61 72 67 75 6d 65 6e 74 73 5b 68 5d 29 29 66 6f 72 28 64 20 69 6e 20 65 29 62 3d 67 5b 64 5d 2c 63 3d 65 5b 64 5d 2c 67 21 3d 3d 63 26 26 28 63 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f Data Ascii: /! validatorjs - v1.3.2 - https://github.com/skaterdav85/validatorjs - 2015-02-11 /!function(){function a(){for(var b,c,d,e,f,g=arguments[0]\|\|{},h=1,i=arguments.length;i>h;h++)if(null!=(e=arguments[h]))for(d in e)b=g[d],c=e[d],g!==c&&(c&&"object"==typeo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.16	49753	3.145.240.82	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:05 UTC	627	OUT	GET /frame/static/shared/lib/jquery/jquery-epilogue.js?v=c4ac5 HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:05 UTC	499	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:05 GMT Content-Type: application/javascript Content-Length: 131 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-83" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:05 UTC	131	IN	Data Raw: 2f 2f 20 53 65 65 20 6a 71 75 65 72 79 2d 70 72 6f 6c 6f 67 75 65 2e 6a 73 20 66 6f 72 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 6f 6e 20 77 68 79 20 74 68 69 73 20 69 73 20 6e 65 63 65 73 73 61 72 79 2e 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 69 66 20 28 77 69 6e 64 6f 77 2e 6d 6f 64 75 6c 65 29 20 6d 6f 64 75 6c 65 20 3d 20 77 69 6e 64 6f 77 2e 6d 6f 64 75 6c 65 3b 20 7d 29 28 29 3b 0a Data Ascii: // See jquery-prologue.js for information on why this is necessary.(function() { if (window.module) module = window.module; })();

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.16	49754	3.145.240.82	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:05 UTC	609	OUT	GET /frame/static/js/page/v3/base.js?v=fff81 HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:06 UTC	505	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:05 GMT Content-Type: application/javascript Content-Length: 216396 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-34d4c" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:06 UTC	15879	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 62 61 73 65 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 5f 77 65 62 70 61 63 6b 5f 6d 6f 64 75 6c 65 73 5f 5f 3d 7b 36 39 39 37 3a 66 75 6e 63 74 69 6f 6e 28 6d 6f 64 75 6c 65 2c 65 78 70 6f 72 74 73 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 7b 76 61 72 20 5f 5f 57 45 42 50 41 43 4b 5f 41 4d 44 5f 44 45 46 49 4e 45 5f 41 52 52 41 59 5f 5f 2c 5f 5f 57 45 42 50 41 43 4b 5f 41 4d 44 5f 44 45 46 49 4e 45 5f 52 45 53 55 4c 54 5f 5f 3b 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 35 30 30 31 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 Data Ascii: /! For license information please see base.js.LICENSE.txt /!function(){var __webpack_modules__={6997:function(module,exports,__webpack_require__){var __WEBPACK_AMD_DEFINE_ARRAY__,__WEBPACK_AMD_DEFINE_RESULT__;__webpack_require__(5001),__webpack_require
2024-10-01 17:04:06 UTC	16384	IN	Data Raw: 5f 65 73 4d 6f 64 75 6c 65 3d 21 30 2c 65 78 70 6f 72 74 73 2e 57 49 4e 44 4f 57 53 5f 48 45 4c 4c 4f 5f 50 4c 41 54 46 4f 52 4d 53 3d 65 78 70 6f 72 74 73 2e 57 49 4e 44 4f 57 53 5f 48 45 4c 4c 4f 5f 4d 49 4e 5f 50 4c 41 54 46 4f 52 4d 5f 56 45 52 53 49 4f 4e 53 3d 65 78 70 6f 72 74 73 2e 57 45 42 41 55 54 48 4e 5f 54 4f 55 43 48 5f 4d 49 4e 5f 50 4c 41 54 46 4f 52 4d 5f 56 45 52 53 49 4f 4e 53 3d 65 78 70 6f 72 74 73 2e 57 45 42 41 55 54 48 4e 5f 54 4f 55 43 48 5f 49 44 5f 50 4c 41 54 46 4f 52 4d 53 3d 65 78 70 6f 72 74 73 2e 54 52 41 44 49 54 49 4f 4e 41 4c 5f 50 52 4f 4d 50 54 5f 45 4f 4c 5f 44 49 53 4d 49 53 53 41 4c 5f 4b 45 59 3d 65 78 70 6f 72 74 73 2e 52 42 46 53 5f 42 41 4e 4e 45 52 5f 53 45 45 4e 3d 65 78 70 6f 72 74 73 2e 52 42 46 53 5f 42 41 Data Ascii: _esModule=!0,exports.WINDOWS_HELLO_PLATFORMS=exports.WINDOWS_HELLO_MIN_PLATFORM_VERSIONS=exports.WEBAUTHN_TOUCH_MIN_PLATFORM_VERSIONS=exports.WEBAUTHN_TOUCH_ID_PLATFORMS=exports.TRADITIONAL_PROMPT_EOL_DISMISSAL_KEY=exports.RBFS_BANNER_SEEN=exports.RBFS_BA
2024-10-01 17:04:06 UTC	16384	IN	Data Raw: 64 41 75 74 68 54 69 6d 65 73 65 72 69 65 73 44 61 74 61 46 6f 72 6d 61 74 74 65 72 3d 65 78 70 6f 72 74 73 2e 64 65 62 6f 75 6e 63 65 3d 65 78 70 6f 72 74 73 2e 63 72 65 61 74 65 54 69 6d 65 4c 69 73 74 3d 65 78 70 6f 72 74 73 2e 63 72 65 61 74 65 4d 69 6e 75 74 65 73 4c 69 73 74 3d 65 78 70 6f 72 74 73 2e 63 6c 65 61 6e 46 69 6c 74 65 72 53 74 61 74 65 3d 76 6f 69 64 20 30 2c 65 78 70 6f 72 74 73 2e 67 65 74 42 72 6f 77 73 65 72 41 6e 64 56 65 72 73 69 6f 6e 3d 67 65 74 42 72 6f 77 73 65 72 41 6e 64 56 65 72 73 69 6f 6e 2c 65 78 70 6f 72 74 73 2e 67 65 74 44 65 6e 69 65 64 43 6f 75 6e 74 3d 76 6f 69 64 20 30 2c 65 78 70 6f 72 74 73 2e 67 65 74 4f 73 50 6c 61 74 66 6f 72 6d 3d 67 65 74 4f 73 50 6c 61 74 66 6f 72 6d 2c 65 78 70 6f 72 74 73 2e 69 73 4c 6f Data Ascii: dAuthTimeseriesDataFormatter=exports.debounce=exports.createTimeList=exports.createMinutesList=exports.cleanFilterState=void 0,exports.getBrowserAndVersion=getBrowserAndVersion,exports.getDeniedCount=void 0,exports.getOsPlatform=getOsPlatform,exports.isLo
2024-10-01 17:04:06 UTC	16384	IN	Data Raw: 20 67 65 74 42 72 6f 77 73 65 72 41 6e 64 56 65 72 73 69 6f 6e 28 29 7b 76 61 72 20 62 72 6f 77 73 65 72 56 65 72 73 69 6f 6e 2c 75 61 3d 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2c 62 72 6f 77 73 65 72 3d 22 22 3b 69 66 28 2d 31 21 3d 3d 75 61 2e 69 6e 64 65 78 4f 66 28 22 43 68 72 6f 6d 65 22 29 26 26 2d 31 3d 3d 3d 75 61 2e 69 6e 64 65 78 4f 66 28 22 43 68 72 6f 6d 69 75 6d 22 29 26 26 2d 31 3d 3d 3d 75 61 2e 69 6e 64 65 78 4f 66 28 22 45 64 67 22 29 29 62 72 6f 77 73 65 72 3d 22 43 68 72 6f 6d 65 22 3b 65 6c 73 65 20 69 66 28 2d 31 21 3d 3d 75 61 2e 69 6e 64 65 78 4f 66 28 22 46 69 72 65 66 6f 78 22 29 29 62 72 6f 77 73 65 72 3d 22 46 69 72 65 66 6f 78 22 3b 65 6c 73 65 20 69 66 28 2d 31 21 3d 3d 75 61 2e 69 6e 64 65 78 4f 66 28 22 45 Data Ascii: getBrowserAndVersion(){var browserVersion,ua=navigator.userAgent,browser="";if(-1!==ua.indexOf("Chrome")&&-1===ua.indexOf("Chromium")&&-1===ua.indexOf("Edg"))browser="Chrome";else if(-1!==ua.indexOf("Firefox"))browser="Firefox";else if(-1!==ua.indexOf("E
2024-10-01 17:04:06 UTC	16384	IN	Data Raw: 65 28 4e 61 74 69 76 65 50 72 6f 74 6f 74 79 70 65 2c 4b 45 59 2c 22 61 64 64 22 3d 3d 4b 45 59 3f 66 75 6e 63 74 69 6f 6e 28 76 61 6c 75 65 29 7b 72 65 74 75 72 6e 20 6e 61 74 69 76 65 4d 65 74 68 6f 64 2e 63 61 6c 6c 28 74 68 69 73 2c 30 3d 3d 3d 76 61 6c 75 65 3f 30 3a 76 61 6c 75 65 29 2c 74 68 69 73 7d 3a 22 64 65 6c 65 74 65 22 3d 3d 4b 45 59 3f 66 75 6e 63 74 69 6f 6e 28 6b 65 79 29 7b 72 65 74 75 72 6e 21 28 49 53 5f 57 45 41 4b 26 26 21 69 73 4f 62 6a 65 63 74 28 6b 65 79 29 29 26 26 6e 61 74 69 76 65 4d 65 74 68 6f 64 2e 63 61 6c 6c 28 74 68 69 73 2c 30 3d 3d 3d 6b 65 79 3f 30 3a 6b 65 79 29 7d 3a 22 67 65 74 22 3d 3d 4b 45 59 3f 66 75 6e 63 74 69 6f 6e 28 6b 65 79 29 7b 72 65 74 75 72 6e 20 49 53 5f 57 45 41 4b 26 26 21 69 73 4f 62 6a 65 63 74 Data Ascii: e(NativePrototype,KEY,"add"==KEY?function(value){return nativeMethod.call(this,0===value?0:value),this}:"delete"==KEY?function(key){return!(IS_WEAK&&!isObject(key))&&nativeMethod.call(this,0===key?0:key)}:"get"==KEY?function(key){return IS_WEAK&&!isObject
2024-10-01 17:04:06 UTC	16384	IN	Data Raw: 74 73 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 7b 76 61 72 20 74 6f 4f 62 6a 65 63 74 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 36 30 31 32 29 2c 66 6c 6f 6f 72 3d 4d 61 74 68 2e 66 6c 6f 6f 72 2c 72 65 70 6c 61 63 65 3d 22 22 2e 72 65 70 6c 61 63 65 2c 53 55 42 53 54 49 54 55 54 49 4f 4e 5f 53 59 4d 42 4f 4c 53 3d 2f 5c 24 28 5b 24 26 27 60 5d 7c 5c 64 7b 31 2c 32 7d 7c 3c 5b 5e 3e 5d 2a 3e 29 2f 67 2c 53 55 42 53 54 49 54 55 54 49 4f 4e 5f 53 59 4d 42 4f 4c 53 5f 4e 4f 5f 4e 41 4d 45 44 3d 2f 5c 24 28 5b 24 26 27 60 5d 7c 5c 64 7b 31 2c 32 7d 29 2f 67 3b 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 6d 61 74 63 68 65 64 2c 73 74 72 2c 70 6f 73 69 74 69 6f 6e 2c 63 61 70 74 75 72 65 73 Data Ascii: ts,__webpack_require__){var toObject=__webpack_require__(6012),floor=Math.floor,replace="".replace,SUBSTITUTION_SYMBOLS=/\$([$&'`]\|\d{1,2}\|<[^>]*>)/g,SUBSTITUTION_SYMBOLS_NO_NAMED=/\$([$&'`]\|\d{1,2})/g;module.exports=function(matched,str,position,captures
2024-10-01 17:04:06 UTC	16384	IN	Data Raw: 72 6f 70 65 72 74 69 65 73 29 7b 61 6e 4f 62 6a 65 63 74 28 4f 29 3b 66 6f 72 28 76 61 72 20 6b 65 79 2c 6b 65 79 73 3d 6f 62 6a 65 63 74 4b 65 79 73 28 50 72 6f 70 65 72 74 69 65 73 29 2c 6c 65 6e 67 74 68 3d 6b 65 79 73 2e 6c 65 6e 67 74 68 2c 69 6e 64 65 78 3d 30 3b 6c 65 6e 67 74 68 3e 69 6e 64 65 78 3b 29 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 4d 6f 64 75 6c 65 2e 66 28 4f 2c 6b 65 79 3d 6b 65 79 73 5b 69 6e 64 65 78 2b 2b 5d 2c 50 72 6f 70 65 72 74 69 65 73 5b 6b 65 79 5d 29 3b 72 65 74 75 72 6e 20 4f 7d 7d 2c 34 31 35 37 3a 66 75 6e 63 74 69 6f 6e 28 5f 5f 75 6e 75 73 65 64 5f 77 65 62 70 61 63 6b 5f 6d 6f 64 75 6c 65 2c 65 78 70 6f 72 74 73 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 7b 76 61 72 20 44 45 53 43 52 49 50 54 4f Data Ascii: roperties){anObject(O);for(var key,keys=objectKeys(Properties),length=keys.length,index=0;length>index;)definePropertyModule.f(O,key=keys[index++],Properties[key]);return O}},4157:function(__unused_webpack_module,exports,__webpack_require__){var DESCRIPTO
2024-10-01 17:04:06 UTC	16384	IN	Data Raw: 7b 69 66 28 22 6e 75 6d 62 65 72 22 21 3d 74 79 70 65 6f 66 20 76 61 6c 75 65 26 26 22 4e 75 6d 62 65 72 22 21 3d 63 6c 61 73 73 6f 66 28 76 61 6c 75 65 29 29 74 68 72 6f 77 20 54 79 70 65 45 72 72 6f 72 28 22 49 6e 63 6f 72 72 65 63 74 20 69 6e 76 6f 63 61 74 69 6f 6e 22 29 3b 72 65 74 75 72 6e 2b 76 61 6c 75 65 7d 7d 2c 37 39 35 30 3a 66 75 6e 63 74 69 6f 6e 28 6d 6f 64 75 6c 65 2c 5f 5f 75 6e 75 73 65 64 5f 77 65 62 70 61 63 6b 5f 65 78 70 6f 72 74 73 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 7b 76 61 72 20 74 6f 49 6e 74 65 67 65 72 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 39 36 30 34 29 2c 6d 61 78 3d 4d 61 74 68 2e 6d 61 78 2c 6d 69 6e 3d 4d 61 74 68 2e 6d 69 6e 3b 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 Data Ascii: {if("number"!=typeof value&&"Number"!=classof(value))throw TypeError("Incorrect invocation");return+value}},7950:function(module,__unused_webpack_exports,__webpack_require__){var toInteger=__webpack_require__(9604),max=Math.max,min=Math.min;module.exports
2024-10-01 17:04:06 UTC	16384	IN	Data Raw: 28 78 2c 6e 2c 61 63 63 29 7b 72 65 74 75 72 6e 20 30 3d 3d 3d 6e 3f 61 63 63 3a 6e 25 32 3d 3d 31 3f 70 6f 77 28 78 2c 6e 2d 31 2c 61 63 63 2a 78 29 3a 70 6f 77 28 78 2a 78 2c 6e 2f 32 2c 61 63 63 29 7d 2c 6d 75 6c 74 69 70 6c 79 3d 66 75 6e 63 74 69 6f 6e 28 64 61 74 61 2c 6e 2c 63 29 7b 66 6f 72 28 76 61 72 20 69 6e 64 65 78 3d 2d 31 2c 63 32 3d 63 3b 2b 2b 69 6e 64 65 78 3c 36 3b 29 63 32 2b 3d 6e 2a 64 61 74 61 5b 69 6e 64 65 78 5d 2c 64 61 74 61 5b 69 6e 64 65 78 5d 3d 63 32 25 31 65 37 2c 63 32 3d 66 6c 6f 6f 72 28 63 32 2f 31 65 37 29 7d 2c 64 69 76 69 64 65 3d 66 75 6e 63 74 69 6f 6e 28 64 61 74 61 2c 6e 29 7b 66 6f 72 28 76 61 72 20 69 6e 64 65 78 3d 36 2c 63 3d 30 3b 2d 2d 69 6e 64 65 78 3e 3d 30 3b 29 63 2b 3d 64 61 74 61 5b 69 6e 64 65 78 5d Data Ascii: (x,n,acc){return 0===n?acc:n%2==1?pow(x,n-1,accx):pow(xx,n/2,acc)},multiply=function(data,n,c){for(var index=-1,c2=c;++index<6;)c2+=n*data[index],data[index]=c2%1e7,c2=floor(c2/1e7)},divide=function(data,n){for(var index=6,c=0;--index>=0;)c+=data[index]
2024-10-01 17:04:06 UTC	16384	IN	Data Raw: 6f 64 75 6c 65 2c 5f 5f 75 6e 75 73 65 64 5f 77 65 62 70 61 63 6b 5f 65 78 70 6f 72 74 73 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 65 64 65 66 69 6e 65 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 31 39 30 31 29 2c 61 6e 4f 62 6a 65 63 74 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 31 37 36 30 29 2c 66 61 69 6c 73 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 31 33 38 37 29 2c 66 6c 61 67 73 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 36 33 35 37 29 2c 52 65 67 45 78 70 50 72 6f 74 6f 74 79 70 65 3d 52 65 67 45 78 70 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 61 74 69 76 65 54 6f 53 74 72 69 6e 67 3d 52 65 67 45 Data Ascii: odule,__unused_webpack_exports,__webpack_require__){"use strict";var redefine=__webpack_require__(1901),anObject=__webpack_require__(1760),fails=__webpack_require__(1387),flags=__webpack_require__(6357),RegExpPrototype=RegExp.prototype,nativeToString=RegE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.16	49755	3.145.240.82	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:05 UTC	613	OUT	GET /frame/static/js/lib/jquery.tipsy.js?v=c0432 HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:06 UTC	503	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:06 GMT Content-Type: application/javascript Content-Length: 10390 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-2896" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:06 UTC	10390	IN	Data Raw: 2f 2f 20 74 69 70 73 79 2c 20 66 61 63 65 62 6f 6f 6b 20 73 74 79 6c 65 20 74 6f 6f 6c 74 69 70 73 20 66 6f 72 20 6a 71 75 65 72 79 0a 2f 2f 20 76 65 72 73 69 6f 6e 20 31 2e 30 2e 30 61 0a 2f 2f 20 28 63 29 20 32 30 30 38 2d 32 30 31 30 20 6a 61 73 6f 6e 20 66 72 61 6d 65 20 5b 6a 61 73 6f 6e 40 6f 6e 65 68 61 63 6b 6f 72 61 6e 6f 74 68 65 72 2e 63 6f 6d 5d 0a 2f 2f 20 72 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6c 69 63 65 6e 73 65 0a 0a 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0a 20 20 20 20 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 6d 61 79 62 65 43 61 6c 6c 28 74 68 69 6e 67 2c 20 63 74 78 29 20 7b 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 28 74 79 70 65 6f 66 20 74 68 69 6e 67 20 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 Data Ascii: // tipsy, facebook style tooltips for jquery// version 1.0.0a// (c) 2008-2010 jason frame [jason@onehackoranother.com]// released under the MIT license(function($) { function maybeCall(thing, ctx) { return (typeof thing == 'function'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.16	49757	3.145.240.82	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:06 UTC	640	OUT	GET /frame/static/js/page/v3/trigger-endpointhealth-verification.js?v=e90e7 HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:06 UTC	505	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:06 GMT Content-Type: application/javascript Content-Length: 187220 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-2db54" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:06 UTC	15879	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 74 72 69 67 67 65 72 2d 65 6e 64 70 6f 69 6e 74 68 65 61 6c 74 68 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 5f 77 65 62 70 61 63 6b 5f 6d 6f 64 75 6c 65 73 5f 5f 3d 7b 31 31 38 31 3a 66 75 6e 63 74 69 6f 6e 28 5f 5f 75 6e 75 73 65 64 5f 77 65 62 70 61 63 6b 5f 6d 6f 64 75 6c 65 2c 65 78 70 6f 72 74 73 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 5f 44 49 53 50 4c 41 59 5f 4b 45 59 53 2c 5f 44 49 53 50 4c 41 59 5f 53 53 4f 5f 4b 45 59 53 3b 65 78 70 6f 72 74 73 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3d 21 30 2c 65 78 70 6f 72 74 73 Data Ascii: /! For license information please see trigger-endpointhealth-verification.js.LICENSE.txt /!function(){var __webpack_modules__={1181:function(__unused_webpack_module,exports){"use strict";var _DISPLAY_KEYS,_DISPLAY_SSO_KEYS;exports.__esModule=!0,exports
2024-10-01 17:04:06 UTC	16384	IN	Data Raw: 72 69 74 61 62 6c 65 3a 21 30 7d 29 2c 74 5b 65 5d 7d 74 72 79 7b 64 65 66 69 6e 65 28 7b 7d 2c 22 22 29 7d 63 61 74 63 68 28 74 29 7b 64 65 66 69 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 72 65 74 75 72 6e 20 74 5b 65 5d 3d 72 7d 7d 66 75 6e 63 74 69 6f 6e 20 77 72 61 70 28 74 2c 65 2c 72 2c 6e 29 7b 76 61 72 20 69 3d 65 26 26 65 2e 70 72 6f 74 6f 74 79 70 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 47 65 6e 65 72 61 74 6f 72 3f 65 3a 47 65 6e 65 72 61 74 6f 72 2c 61 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 69 2e 70 72 6f 74 6f 74 79 70 65 29 2c 63 3d 6e 65 77 20 43 6f 6e 74 65 78 74 28 6e 7c 7c 5b 5d 29 3b 72 65 74 75 72 6e 20 6f 28 61 2c 22 5f 69 6e 76 6f 6b 65 22 2c 7b 76 61 6c 75 65 3a 6d 61 6b 65 49 6e 76 6f 6b 65 4d 65 74 68 6f 64 28 Data Ascii: ritable:!0}),t[e]}try{define({},"")}catch(t){define=function(t,e,r){return t[e]=r}}function wrap(t,e,r,n){var i=e&&e.prototype instanceof Generator?e:Generator,a=Object.create(i.prototype),c=new Context(n\|\|[]);return o(a,"_invoke",{value:makeInvokeMethod(
2024-10-01 17:04:06 UTC	16384	IN	Data Raw: 6f 64 3d 66 75 6e 63 74 69 6f 6e 28 49 53 5f 49 4e 43 4c 55 44 45 53 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 24 74 68 69 73 2c 65 6c 2c 66 72 6f 6d 49 6e 64 65 78 29 7b 76 61 72 20 76 61 6c 75 65 2c 4f 3d 74 6f 49 6e 64 65 78 65 64 4f 62 6a 65 63 74 28 24 74 68 69 73 29 2c 6c 65 6e 67 74 68 3d 74 6f 4c 65 6e 67 74 68 28 4f 2e 6c 65 6e 67 74 68 29 2c 69 6e 64 65 78 3d 74 6f 41 62 73 6f 6c 75 74 65 49 6e 64 65 78 28 66 72 6f 6d 49 6e 64 65 78 2c 6c 65 6e 67 74 68 29 3b 69 66 28 49 53 5f 49 4e 43 4c 55 44 45 53 26 26 65 6c 21 3d 65 6c 29 7b 66 6f 72 28 3b 6c 65 6e 67 74 68 3e 69 6e 64 65 78 3b 29 69 66 28 28 76 61 6c 75 65 3d 4f 5b 69 6e 64 65 78 2b 2b 5d 29 21 3d 76 61 6c 75 65 29 72 65 74 75 72 6e 21 30 7d 65 6c 73 65 20 66 6f 72 28 3b 6c 65 Data Ascii: od=function(IS_INCLUDES){return function($this,el,fromIndex){var value,O=toIndexedObject($this),length=toLength(O.length),index=toAbsoluteIndex(fromIndex,length);if(IS_INCLUDES&&el!=el){for(;length>index;)if((value=O[index++])!=value)return!0}else for(;le
2024-10-01 17:04:06 UTC	16384	IN	Data Raw: 65 72 74 79 4d 6f 64 75 6c 65 2e 66 28 6f 62 6a 65 63 74 2c 6b 65 79 2c 63 72 65 61 74 65 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 31 2c 76 61 6c 75 65 29 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 6f 62 6a 65 63 74 2c 6b 65 79 2c 76 61 6c 75 65 29 7b 72 65 74 75 72 6e 20 6f 62 6a 65 63 74 5b 6b 65 79 5d 3d 76 61 6c 75 65 2c 6f 62 6a 65 63 74 7d 7d 2c 37 32 30 37 3a 66 75 6e 63 74 69 6f 6e 28 6d 6f 64 75 6c 65 29 7b 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 62 69 74 6d 61 70 2c 76 61 6c 75 65 29 7b 72 65 74 75 72 6e 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 28 31 26 62 69 74 6d 61 70 29 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 28 32 26 62 69 74 6d 61 70 29 2c 77 72 69 74 61 62 6c 65 3a 21 28 34 26 62 69 74 6d 61 70 Data Ascii: ertyModule.f(object,key,createPropertyDescriptor(1,value))}:function(object,key,value){return object[key]=value,object}},7207:function(module){module.exports=function(bitmap,value){return{enumerable:!(1&bitmap),configurable:!(2&bitmap),writable:!(4&bitmap
2024-10-01 17:04:06 UTC	16384	IN	Data Raw: 5f 5f 75 6e 75 73 65 64 5f 77 65 62 70 61 63 6b 5f 65 78 70 6f 72 74 73 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 7b 76 61 72 20 73 65 74 2c 67 65 74 2c 68 61 73 2c 4e 41 54 49 56 45 5f 57 45 41 4b 5f 4d 41 50 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 32 31 33 31 29 2c 67 6c 6f 62 61 6c 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 36 35 33 37 29 2c 69 73 4f 62 6a 65 63 74 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 39 36 39 29 2c 63 72 65 61 74 65 4e 6f 6e 45 6e 75 6d 65 72 61 62 6c 65 50 72 6f 70 65 72 74 79 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 33 35 32 29 2c 6f 62 6a 65 63 74 48 61 73 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 36 Data Ascii: __unused_webpack_exports,__webpack_require__){var set,get,has,NATIVE_WEAK_MAP=__webpack_require__(2131),global=__webpack_require__(6537),isObject=__webpack_require__(969),createNonEnumerableProperty=__webpack_require__(352),objectHas=__webpack_require__(6
2024-10-01 17:04:06 UTC	16384	IN	Data Raw: 63 74 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 39 36 39 29 2c 6e 65 77 50 72 6f 6d 69 73 65 43 61 70 61 62 69 6c 69 74 79 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 32 38 31 36 29 3b 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 43 2c 78 29 7b 69 66 28 61 6e 4f 62 6a 65 63 74 28 43 29 2c 69 73 4f 62 6a 65 63 74 28 78 29 26 26 78 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 43 29 72 65 74 75 72 6e 20 78 3b 76 61 72 20 70 72 6f 6d 69 73 65 43 61 70 61 62 69 6c 69 74 79 3d 6e 65 77 50 72 6f 6d 69 73 65 43 61 70 61 62 69 6c 69 74 79 2e 66 28 43 29 3b 72 65 74 75 72 6e 28 30 2c 70 72 6f 6d 69 73 65 43 61 70 61 62 69 6c 69 74 79 2e 72 65 73 6f 6c 76 65 29 28 78 29 2c 70 72 6f 6d 69 73 65 43 61 Data Ascii: ct=__webpack_require__(969),newPromiseCapability=__webpack_require__(2816);module.exports=function(C,x){if(anObject(C),isObject(x)&&x.constructor===C)return x;var promiseCapability=newPromiseCapability.f(C);return(0,promiseCapability.resolve)(x),promiseCa
2024-10-01 17:04:06 UTC	16384	IN	Data Raw: 6c 65 6d 65 6e 74 29 7b 72 65 74 75 72 6e 20 4e 45 47 41 54 49 56 45 5f 5a 45 52 4f 3f 6e 61 74 69 76 65 49 6e 64 65 78 4f 66 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7c 7c 30 3a 24 69 6e 64 65 78 4f 66 28 74 68 69 73 2c 73 65 61 72 63 68 45 6c 65 6d 65 6e 74 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 31 3f 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3a 76 6f 69 64 20 30 29 7d 7d 29 7d 2c 32 33 38 3a 66 75 6e 63 74 69 6f 6e 28 5f 5f 75 6e 75 73 65 64 5f 77 65 62 70 61 63 6b 5f 6d 6f 64 75 6c 65 2c 5f 5f 75 6e 75 73 65 64 5f 77 65 62 70 61 63 6b 5f 65 78 70 6f 72 74 73 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 7b 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 38 30 37 30 29 28 7b 74 61 72 67 65 Data Ascii: lement){return NEGATIVE_ZERO?nativeIndexOf.apply(this,arguments)\|\|0:$indexOf(this,searchElement,arguments.length>1?arguments[1]:void 0)}})},238:function(__unused_webpack_module,__unused_webpack_exports,__webpack_require__){__webpack_require__(8070)({targe
2024-10-01 17:04:06 UTC	16384	IN	Data Raw: 69 6e 3a 76 6f 69 64 20 30 2c 73 74 61 74 65 2e 70 61 72 65 6e 74 3d 21 30 2c 73 74 61 74 65 2e 72 65 61 63 74 69 6f 6e 73 2e 70 75 73 68 28 72 65 61 63 74 69 6f 6e 29 2c 30 21 3d 73 74 61 74 65 2e 73 74 61 74 65 26 26 6e 6f 74 69 66 79 28 73 74 61 74 65 2c 21 31 29 2c 72 65 61 63 74 69 6f 6e 2e 70 72 6f 6d 69 73 65 7d 2c 63 61 74 63 68 3a 66 75 6e 63 74 69 6f 6e 28 6f 6e 52 65 6a 65 63 74 65 64 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 74 68 65 6e 28 76 6f 69 64 20 30 2c 6f 6e 52 65 6a 65 63 74 65 64 29 7d 7d 29 2c 4f 77 6e 50 72 6f 6d 69 73 65 43 61 70 61 62 69 6c 69 74 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 70 72 6f 6d 69 73 65 3d 6e 65 77 20 49 6e 74 65 72 6e 61 6c 2c 73 74 61 74 65 3d 67 65 74 49 6e 74 65 72 6e 61 6c 53 74 61 74 65 28 70 Data Ascii: in:void 0,state.parent=!0,state.reactions.push(reaction),0!=state.state&&notify(state,!1),reaction.promise},catch:function(onRejected){return this.then(void 0,onRejected)}}),OwnPromiseCapability=function(){var promise=new Internal,state=getInternalState(p
2024-10-01 17:04:06 UTC	16384	IN	Data Raw: 69 6e 65 50 72 6f 70 65 72 74 79 3d 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 4d 6f 64 75 6c 65 2e 66 2c 6e 61 74 69 76 65 47 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 4e 61 6d 65 73 3d 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 4e 61 6d 65 73 45 78 74 65 72 6e 61 6c 2e 66 2c 6e 61 74 69 76 65 50 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 3d 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 4d 6f 64 75 6c 65 2e 66 2c 41 6c 6c 53 79 6d 62 6f 6c 73 3d 73 68 61 72 65 64 28 22 73 79 6d 62 6f 6c 73 22 29 2c 4f 62 6a 65 63 74 50 72 6f 74 6f 74 79 70 65 53 79 6d 62 6f 6c 73 3d 73 68 61 72 65 64 28 22 6f 70 2d 73 79 6d 62 6f 6c 73 22 29 2c 53 74 72 69 6e 67 54 6f 53 79 6d 62 6f 6c 52 65 67 69 73 74 72 79 3d 73 68 61 72 65 64 28 22 73 74 72 69 Data Ascii: ineProperty=definePropertyModule.f,nativeGetOwnPropertyNames=getOwnPropertyNamesExternal.f,nativePropertyIsEnumerable=propertyIsEnumerableModule.f,AllSymbols=shared("symbols"),ObjectPrototypeSymbols=shared("op-symbols"),StringToSymbolRegistry=shared("stri
2024-10-01 17:04:06 UTC	16384	IN	Data Raw: 28 29 29 7b 76 61 72 20 75 72 6c 4d 61 74 63 68 3d 2f 5e 28 5b 61 2d 7a 41 2d 5a 5d 2b 29 3a 5c 2f 5c 2f 2e 2a 3a 28 5c 64 2b 29 5c 2f 2f 2e 65 78 65 63 28 75 72 6c 29 3b 69 66 28 75 72 6c 4d 61 74 63 68 26 26 75 72 6c 4d 61 74 63 68 2e 6c 65 6e 67 74 68 3e 32 29 7b 76 61 72 20 73 63 68 65 6d 61 3d 75 72 6c 4d 61 74 63 68 5b 31 5d 2c 70 6f 72 74 3d 75 72 6c 4d 61 74 63 68 5b 32 5d 3b 77 69 6e 64 6f 77 2e 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 73 63 68 65 6d 61 2b 22 5f 70 72 65 76 69 6f 75 73 5f 61 70 70 5f 70 6f 72 74 22 2c 70 6f 72 74 29 7d 7d 76 61 72 20 61 64 61 70 74 65 64 41 70 70 55 72 6c 3d 75 72 6c 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 75 72 6c 2e 69 6e 64 65 78 4f 66 28 22 2f 61 6c 69 76 65 22 29 29 2b 61 70 70 55 72 6c Data Ascii: ()){var urlMatch=/^([a-zA-Z]+):\/\/.*:(\d+)\//.exec(url);if(urlMatch&&urlMatch.length>2){var schema=urlMatch[1],port=urlMatch[2];window.localStorage.setItem(schema+"_previous_app_port",port)}}var adaptedAppUrl=url.substring(0,url.indexOf("/alive"))+appUrl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.16	49758	3.145.240.82	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:06 UTC	611	OUT	GET /frame/static/js/page/v3/prompt.js?v=69acc HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:07 UTC	505	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:06 GMT Content-Type: application/javascript Content-Length: 306947 Last-Modified: Fri, 27 Sep 2024 23:43:44 GMT Connection: close ETag: "66f74330-4af03" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-01 17:04:07 UTC	15879	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 70 72 6f 6d 70 74 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 5f 77 65 62 70 61 63 6b 5f 6d 6f 64 75 6c 65 73 5f 5f 3d 7b 32 36 30 37 3a 66 75 6e 63 74 69 6f 6e 28 5f 5f 75 6e 75 73 65 64 5f 77 65 62 70 61 63 6b 5f 6d 6f 64 75 6c 65 2c 65 78 70 6f 72 74 73 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 36 38 38 37 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 35 38 34 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 33 36 33 Data Ascii: /! For license information please see prompt.js.LICENSE.txt /!function(){var __webpack_modules__={2607:function(__unused_webpack_module,exports,__webpack_require__){"use strict";__webpack_require__(6887),__webpack_require__(584),__webpack_require__(363
2024-10-01 17:04:07 UTC	16384	IN	Data Raw: 28 6e 65 77 20 48 54 54 50 45 72 72 6f 72 28 6d 65 74 68 6f 64 2c 75 72 6c 2c 22 55 6e 61 62 6c 65 20 74 6f 20 70 61 72 73 65 20 72 65 73 70 6f 6e 73 65 20 73 74 72 69 6e 67 20 61 73 20 4a 53 4f 4e 2e 22 2c 78 68 72 29 29 7d 76 61 72 20 72 65 73 70 6f 6e 73 65 3d 28 30 2c 5f 75 74 69 6c 2e 73 61 66 65 44 65 63 6f 64 65 4a 53 4f 4e 29 28 4a 53 4f 4e 2e 70 61 72 73 65 28 78 68 72 2e 72 65 73 70 6f 6e 73 65 54 65 78 74 29 29 3b 64 66 64 2e 72 65 6a 65 63 74 28 6e 65 77 20 48 54 54 50 45 72 72 6f 72 28 6d 65 74 68 6f 64 2c 75 72 6c 2c 65 72 72 6f 72 2c 78 68 72 2c 72 65 73 70 6f 6e 73 65 29 29 7d 65 6c 73 65 20 64 66 64 2e 72 65 6a 65 63 74 28 6e 65 77 20 48 54 54 50 45 72 72 6f 72 28 6d 65 74 68 6f 64 2c 75 72 6c 2c 65 72 72 6f 72 2c 78 68 72 29 29 7d 29 29 Data Ascii: (new HTTPError(method,url,"Unable to parse response string as JSON.",xhr))}var response=(0,_util.safeDecodeJSON)(JSON.parse(xhr.responseText));dfd.reject(new HTTPError(method,url,error,xhr,response))}else dfd.reject(new HTTPError(method,url,error,xhr))}))
2024-10-01 17:04:07 UTC	16384	IN	Data Raw: 2c 5f 6b 65 79 32 3d 31 3b 5f 6b 65 79 32 3c 5f 6c 65 6e 32 3b 5f 6b 65 79 32 2b 2b 29 70 61 74 68 5b 5f 6b 65 79 32 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 5f 6b 65 79 32 5d 3b 5f 6c 6f 64 61 73 68 2e 64 65 66 61 75 6c 74 2e 69 73 41 72 72 61 79 28 6f 62 6a 29 3f 63 6f 6d 6d 61 53 65 70 61 72 61 74 65 64 41 72 72 61 79 56 61 6c 75 65 73 26 26 6f 62 6a 2e 6c 65 6e 67 74 68 3e 30 3f 70 61 72 74 73 2e 70 75 73 68 28 73 65 72 69 61 6c 69 7a 65 4b 65 79 2e 61 70 70 6c 79 28 76 6f 69 64 20 30 2c 5b 6b 65 79 5d 2e 63 6f 6e 63 61 74 28 70 61 74 68 29 29 2b 22 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6f 62 6a 2e 6a 6f 69 6e 28 22 2c 22 29 29 29 3a 6f 62 6a 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 76 61 6c 75 65 29 7b 70 Data Ascii: ,_key2=1;_key2<_len2;_key2++)path[_key2-1]=arguments[_key2];_lodash.default.isArray(obj)?commaSeparatedArrayValues&&obj.length>0?parts.push(serializeKey.apply(void 0,[key].concat(path))+"="+encodeURIComponent(obj.join(","))):obj.forEach((function(value){p
2024-10-01 17:04:07 UTC	16384	IN	Data Raw: 31 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 36 33 35 30 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 39 34 36 33 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 33 37 33 31 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 36 38 35 34 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 38 38 31 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 33 36 33 38 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 39 33 33 31 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 36 38 38 37 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 34 29 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 34 39 Data Ascii: 1),__webpack_require__(6350),__webpack_require__(9463),__webpack_require__(3731),__webpack_require__(6854),__webpack_require__(881),__webpack_require__(3638),__webpack_require__(9331),__webpack_require__(6887),__webpack_require__(4),__webpack_require__(49
2024-10-01 17:04:07 UTC	16384	IN	Data Raw: 72 41 74 3b 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 53 2c 69 6e 64 65 78 2c 75 6e 69 63 6f 64 65 29 7b 72 65 74 75 72 6e 20 69 6e 64 65 78 2b 28 75 6e 69 63 6f 64 65 3f 63 68 61 72 41 74 28 53 2c 69 6e 64 65 78 29 2e 6c 65 6e 67 74 68 3a 31 29 7d 7d 2c 31 31 37 37 3a 66 75 6e 63 74 69 6f 6e 28 6d 6f 64 75 6c 65 29 7b 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 69 74 2c 43 6f 6e 73 74 72 75 63 74 6f 72 2c 6e 61 6d 65 29 7b 69 66 28 21 28 69 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 43 6f 6e 73 74 72 75 63 74 6f 72 29 29 74 68 72 6f 77 20 54 79 70 65 45 72 72 6f 72 28 22 49 6e 63 6f 72 72 65 63 74 20 22 2b 28 6e 61 6d 65 3f 6e 61 6d 65 2b 22 20 22 3a 22 22 29 2b 22 69 6e 76 6f 63 61 74 69 6f 6e 22 29 Data Ascii: rAt;module.exports=function(S,index,unicode){return index+(unicode?charAt(S,index).length:1)}},1177:function(module){module.exports=function(it,Constructor,name){if(!(it instanceof Constructor))throw TypeError("Incorrect "+(name?name+" ":"")+"invocation")
2024-10-01 17:04:07 UTC	16384	IN	Data Raw: 6f 4c 65 6e 67 74 68 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 32 30 30 29 2c 61 72 72 61 79 4d 65 74 68 6f 64 49 73 53 74 72 69 63 74 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 39 38 36 33 29 2c 6d 69 6e 3d 4d 61 74 68 2e 6d 69 6e 2c 24 6c 61 73 74 49 6e 64 65 78 4f 66 3d 5b 5d 2e 6c 61 73 74 49 6e 64 65 78 4f 66 2c 4e 45 47 41 54 49 56 45 5f 5a 45 52 4f 3d 21 21 24 6c 61 73 74 49 6e 64 65 78 4f 66 26 26 31 2f 5b 31 5d 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 31 2c 2d 30 29 3c 30 2c 53 54 52 49 43 54 5f 4d 45 54 48 4f 44 3d 61 72 72 61 79 4d 65 74 68 6f 64 49 73 53 74 72 69 63 74 28 22 6c 61 73 74 49 6e 64 65 78 4f 66 22 29 2c 46 4f 52 43 45 44 3d 4e 45 47 41 54 49 56 45 5f 5a 45 52 4f 7c 7c 21 53 54 52 49 43 54 5f Data Ascii: oLength=__webpack_require__(200),arrayMethodIsStrict=__webpack_require__(9863),min=Math.min,$lastIndexOf=[].lastIndexOf,NEGATIVE_ZERO=!!$lastIndexOf&&1/[1].lastIndexOf(1,-0)<0,STRICT_METHOD=arrayMethodIsStrict("lastIndexOf"),FORCED=NEGATIVE_ZERO\|\|!STRICT_
2024-10-01 17:04:07 UTC	16384	IN	Data Raw: 28 37 32 30 37 29 3b 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 6f 62 6a 65 63 74 2c 6b 65 79 2c 76 61 6c 75 65 29 7b 76 61 72 20 70 72 6f 70 65 72 74 79 4b 65 79 3d 74 6f 50 72 69 6d 69 74 69 76 65 28 6b 65 79 29 3b 70 72 6f 70 65 72 74 79 4b 65 79 20 69 6e 20 6f 62 6a 65 63 74 3f 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 4d 6f 64 75 6c 65 2e 66 28 6f 62 6a 65 63 74 2c 70 72 6f 70 65 72 74 79 4b 65 79 2c 63 72 65 61 74 65 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 30 2c 76 61 6c 75 65 29 29 3a 6f 62 6a 65 63 74 5b 70 72 6f 70 65 72 74 79 4b 65 79 5d 3d 76 61 6c 75 65 7d 7d 2c 35 36 33 38 3a 66 75 6e 63 74 69 6f 6e 28 6d 6f 64 75 6c 65 2c 5f 5f 75 6e 75 73 65 64 5f 77 65 62 70 61 63 6b 5f 65 78 70 6f 72 74 73 2c Data Ascii: (7207);module.exports=function(object,key,value){var propertyKey=toPrimitive(key);propertyKey in object?definePropertyModule.f(object,propertyKey,createPropertyDescriptor(0,value)):object[propertyKey]=value}},5638:function(module,__unused_webpack_exports,
2024-10-01 17:04:07 UTC	16384	IN	Data Raw: 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 7b 76 61 72 20 73 74 6f 72 65 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 39 39 35 34 29 2c 66 75 6e 63 74 69 6f 6e 54 6f 53 74 72 69 6e 67 3d 46 75 6e 63 74 69 6f 6e 2e 74 6f 53 74 72 69 6e 67 3b 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 73 74 6f 72 65 2e 69 6e 73 70 65 63 74 53 6f 75 72 63 65 26 26 28 73 74 6f 72 65 2e 69 6e 73 70 65 63 74 53 6f 75 72 63 65 3d 66 75 6e 63 74 69 6f 6e 28 69 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 54 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 69 74 29 7d 29 2c 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 73 74 6f 72 65 2e 69 6e 73 70 65 63 74 53 6f 75 72 63 65 7d 2c 34 31 37 33 3a 66 75 6e 63 74 69 6f 6e 28 6d 6f 64 75 6c Data Ascii: _webpack_require__){var store=__webpack_require__(9954),functionToString=Function.toString;"function"!=typeof store.inspectSource&&(store.inspectSource=function(it){return functionToString.call(it)}),module.exports=store.inspectSource},4173:function(modul
2024-10-01 17:04:07 UTC	16384	IN	Data Raw: 65 5f 5f 28 35 35 33 30 29 2e 69 6e 64 65 78 4f 66 2c 68 69 64 64 65 6e 4b 65 79 73 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 34 36 38 36 29 3b 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 6f 62 6a 65 63 74 2c 6e 61 6d 65 73 29 7b 76 61 72 20 6b 65 79 2c 4f 3d 74 6f 49 6e 64 65 78 65 64 4f 62 6a 65 63 74 28 6f 62 6a 65 63 74 29 2c 69 3d 30 2c 72 65 73 75 6c 74 3d 5b 5d 3b 66 6f 72 28 6b 65 79 20 69 6e 20 4f 29 21 68 61 73 28 68 69 64 64 65 6e 4b 65 79 73 2c 6b 65 79 29 26 26 68 61 73 28 4f 2c 6b 65 79 29 26 26 72 65 73 75 6c 74 2e 70 75 73 68 28 6b 65 79 29 3b 66 6f 72 28 3b 6e 61 6d 65 73 2e 6c 65 6e 67 74 68 3e 69 3b 29 68 61 73 28 4f 2c 6b 65 79 3d 6e 61 6d 65 73 5b 69 2b 2b 5d 29 26 26 28 7e 69 6e 64 65 Data Ascii: e__(5530).indexOf,hiddenKeys=__webpack_require__(4686);module.exports=function(object,names){var key,O=toIndexedObject(object),i=0,result=[];for(key in O)!has(hiddenKeys,key)&&has(O,key)&&result.push(key);for(;names.length>i;)has(O,key=names[i++])&&(~inde
2024-10-01 17:04:07 UTC	16384	IN	Data Raw: 65 71 75 69 72 65 5f 5f 28 36 33 31 39 29 2c 61 6e 49 6e 73 74 61 6e 63 65 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 31 31 37 37 29 2c 63 72 65 61 74 65 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 37 32 30 37 29 2c 63 72 65 61 74 65 4e 6f 6e 45 6e 75 6d 65 72 61 62 6c 65 50 72 6f 70 65 72 74 79 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 33 35 32 29 2c 74 6f 4c 65 6e 67 74 68 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 32 30 30 29 2c 74 6f 49 6e 64 65 78 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 37 31 39 38 29 2c 74 6f 4f 66 66 73 65 74 3d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 33 31 Data Ascii: equire__(6319),anInstance=__webpack_require__(1177),createPropertyDescriptor=__webpack_require__(7207),createNonEnumerableProperty=__webpack_require__(352),toLength=__webpack_require__(200),toIndex=__webpack_require__(7198),toOffset=__webpack_require__(31

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.16	49773	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:06 UTC	1207	OUT	POST /frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive Content-Length: 492 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://api-5092fa72.duosecurity.com Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:06 UTC	492	OUT	Data Raw: 73 69 64 3d 66 72 61 6d 65 6c 65 73 73 26 61 6b 65 79 3d 44 41 38 4c 38 49 53 45 4b 53 55 35 34 52 51 48 32 4b 59 56 26 74 78 69 64 3d 64 30 64 31 36 63 66 39 2d 65 65 33 65 2d 34 62 63 35 2d 62 37 34 31 2d 31 65 30 66 36 37 62 34 35 30 35 33 26 72 65 73 70 6f 6e 73 65 5f 74 69 6d 65 6f 75 74 3d 31 35 26 70 61 72 65 6e 74 3d 26 64 75 6f 5f 61 70 70 5f 75 72 6c 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 31 32 37 2e 30 2e 30 2e 31 25 32 46 72 65 70 6f 72 74 26 65 68 5f 73 65 72 76 69 63 65 5f 75 72 6c 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 32 2e 65 6e 64 70 6f 69 6e 74 68 65 61 6c 74 68 2e 64 75 6f 73 65 63 75 72 69 74 79 2e 63 6f 6d 25 32 46 76 32 25 32 46 68 65 61 6c 74 68 61 70 70 25 32 46 64 65 76 69 63 65 25 32 46 68 65 61 6c 74 68 25 33 46 5f Data Ascii: sid=frameless&akey=DA8L8ISEKSU54RQH2KYV&txid=d0d16cf9-ee3e-4bc5-b741-1e0f67b45053&response_timeout=15&parent=&duo_app_url=https%3A%2F%2F127.0.0.1%2Freport&eh_service_url=https%3A%2F%2F2.endpointhealth.duosecurity.com%2Fv2%2Fhealthapp%2Fdevice%2Fhealth%3F_
2024-10-01 17:04:07 UTC	803	IN	HTTP/1.1 302 Found Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Cache-Control: no-store Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Origin-Trial: AhDE/Lkj7FwOtGMAMOH+LFvCJDt7seggZcsOJ+7Xkiji+/RG3zSsocNA4l+7sDJTlbc/jN4ctAgiZwCPsdTZ2Q0AAABteyJvcmlnaW4iOiJodHRwczovL2R1b3NlY3VyaXR5LmNvbTo0NDMiLCJmZWF0dXJlIjoiVTJGU2VjdXJpdHlLZXlBUEkiLCJleHBpcnkiOjE2NjM3MTgzOTksImlzU3ViZG9tYWluIjp0cnVlfQ== Location: /frame/enroll?sid=frameless Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.16	49788	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:07 UTC	1046	OUT	GET /frame/enroll?sid=frameless HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:07 UTC	814	IN	HTTP/1.1 200 OK Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5819 Connection: close Cache-Control: no-store Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Origin-Trial: AhDE/Lkj7FwOtGMAMOH+LFvCJDt7seggZcsOJ+7Xkiji+/RG3zSsocNA4l+7sDJTlbc/jN4ctAgiZwCPsdTZ2Q0AAABteyJvcmlnaW4iOiJodHRwczovL2R1b3NlY3VyaXR5LmNvbTo0NDMiLCJmZWF0dXJlIjoiVTJGU2VjdXJpdHlLZXlBUEkiLCJleHBpcnkiOjE2NjM3MTgzOTksImlzU3ViZG9tYWluIjp0cnVlfQ== Etag: "06439d247566698a472575acb5a690cba7c0c4a3" Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff
2024-10-01 17:04:07 UTC	5819	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 5d 3e 20 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 69 65 20 69 65 39 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 39 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 0a 3c 21 2d 2d 20 53 65 74 20 6c 61 74 65 73 74 20 63 6f 6d 70 61 74 69 62 69 6c 69 74 79 20 66 Data Ascii: <!DOCTYPE html>...[if IE 8]> <html lang="en" class="ie ie8"> <![endif]-->...[if IE 9]> <html lang="en" class="ie ie9"> <![endif]-->...[if gt IE 9]>...> <html lang="en"> ...<![endif]--><head><meta charset="utf-8">... Set latest compatibility f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.16	49789	52.32.63.141	443	3600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 17:04:07 UTC	856	OUT	GET /favicon.ico HTTP/1.1 Host: api-5092fa72.duosecurity.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://api-5092fa72.duosecurity.com/frame/enroll?sid=frameless Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid="YjhiMWQxYTMwYzAzNDg2NmJiNDNiMGVjMjU3NmRlN2Q=\|1727802239\|f1db4176e144da872509c0de057da1a5bc6c1637"; _xsrf="ZDZkY2NiMjEwYTU2NGEwOGIzMWZlZTI2OTcyNThjYTQ=\|1727802239\|db5758f8232b0e33402da314bd9ae81a29e55ef4"
2024-10-01 17:04:08 UTC	366	IN	HTTP/1.1 301 Moved Permanently Server: Duo/1.0 Date: Tue, 01 Oct 2024 17:04:08 GMT Content-Type: text/html Content-Length: 164 Connection: close Location: https://duo.com/ Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; frame-src 'self' ; img-src 'self' ; connect-src 'self' X-Content-Type-Options: nosniff
2024-10-01 17:04:08 UTC	164	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 44 75 6f 2f 31 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>Duo/1.0</center></body></html>

Target ID:	0
Start time:	13:03:44
Start date:	01/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Duo Security Enrollment.eml"
Imagebase:	0xc90000
File size:	34'446'744 bytes
MD5 hash:	91A5292942864110ED734005B7E005C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:03:52
Start date:	01/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "D425C529-60C1-490C-80E7-D928799F2E41" "042A5341-4343-4029-B74A-D1D0E548CAF2" "1540" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Imagebase:	0x7ff61ce50000
File size:	710'048 bytes
MD5 hash:	EC652BEDD90E089D9406AFED89A8A8BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:03:57
Start date:	01/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://api-5092fa72.duosecurity.com/frame/portal/v4/enroll?code=3183a500b32b7883&akey=DA8L8ISEKSU54RQH2KYV
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:03:57
Start date:	01/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1856,i,8083216875807871860,9760922534198285399,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Duo Security Enrollment.eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.CampaignStates.json

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.GovernedChannelStates.json

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.Settings.json

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.SurveyEventActivityStats.json

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.SurveyHistoryStats.json

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{AC2E539E-9AB7-437E-89C7-6EA6311180E7}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1727802231175321100_C07B0954-4273-4D4D-922B-457ADD72F429.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1727802231175906200_C07B0954-4273-4D4D-922B-457ADD72F429.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241001T1303450010-1540.etl

C:\Users\user\AppData\Local\Temp\~DF4DFD3A9C0D157725.TMP

C:\Users\user\AppData\Local\Temp\~DF56DDA899FBEA8372.TMP

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

C:\Users\user\AppData\Roaming\Microsoft\Templates\NormalEmail.dotm (copy)

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm

C:\Users\user\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp

Windows Analysis Report
Duo Security Enrollment.eml