Edit tour

Windows Analysis Report
https://login.microsoftonline.com/redeem?rd=https%3a%2f%2finvitations.microsoft.com%2fredeem%2f%3ftenant%3dac16fc13-eed0-45a8-a4cd-092120207ca4%26user%3d7d35c074-f1ce-4806-8732-1a64869fa060%26ticket%3dPqbSUkJjPpJW0yIMqaUTQLRg3kmINldPr4uL7BaqWvg%25253d%26ver%3d2.0

Overview

General Information

Sample URL:	https://login.microsoftonline.com/redeem?rd=https%3a%2f%2finvitations.microsoft.com%2fredeem%2f%3ftenant%3dac16fc13-eed0-45a8-a4cd-092120207ca4%26user%3d7d35c074-f1ce-4806-8732-1a64869fa060%26ticket%3
Analysis ID:	1533086
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected hidden input values containing email addresses (often used in phishing pages)

HTML body contains low number of good links

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6880 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7064 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1960,i,17662341715992215995,799854014391982021,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6504 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://login.microsoftonline.com/redeem?rd=https%3a%2f%2finvitations.microsoft.com%2fredeem%2f%3ftenant%3dac16fc13-eed0-45a8-a4cd-092120207ca4%26user%3d7d35c074-f1ce-4806-8732-1a64869fa060%26ticket%3dPqbSUkJjPpJW0yIMqaUTQLRg3kmINldPr4uL7BaqWvg%25253d%26ver%3d2.0" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://login.microsoftonline.com/ac16fc13-eed0-45a8-a4cd-092120207ca4/oauth2/authorize?client_id=4660504c-45b3-4674-a709-71951a6b0763&redirect_uri=https%3A%2F%2Finvitations.microsoft.com&response_type=id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DPJp1H17W53fkYTX1QCKICogJZ8R5V_mYuQeJtujFe92PlIBQ8Ja9tSjAJPwssWmcs9J5AYl1pRf-MtPM1UsrrLbwHS6CR5I_9OYkYuqFndEEGEg_7cOOqHDgRQzBAagj0t5R2Oqbmg3NlYJx4a6hkSiB3xQ_nuAg7ASxUk09DmtqZEpow9kSoyD6HaqLp5DK4zCTtK1GvWjrjWk5zex3v1EnoRWibch9RJHObSH98eM0LUl6QukUGr57V3ics8bO7OEqSji0HiRJM4Klx4Tx2_YpySmTAY4QTMjAzHwrSbvWbzvvD1s1rTxsDpTkWCg2s24wQjrSHXlkDKHGVcaVaXnmsS3puNc-z0sKXv43W_vAzMhpAn2m7iPpXunoMHLYOYmh-x3F9z6qavEnuMPErXocnmXlpZYW-hwPsk_Hm4OoFSIvE_Bj5sCiwzSlhHksEitB_cqyCFzXzZ7exJI4hKqeMV4lg7QH8VPspf5Ad04d66g2Lm3SbsNuO8swP6CeVoaFqA-XerOS9Z_4MV4CCbLFBKhO0oAxVC33P1FbBroorQ9HhiuMKbrN7zGDZj3DvZbQIYvvVAWrIL_BXfGp-oAJl5E0PvbYkG_YxGSlSEfALc73vReA9yS8HAY1jTVvFELwtpAPWz9d7tuUzchbivj97ZJ07n2QmEcaQQYLnlw_aQANQ33jhWZv52401gBrCstj7Q-SVtEIiolNP9XWAGxYtD21hYmXEOuZ3dtdQ7PWMMiLBhSdK7ZzUDwSaRN2XK_ioJLvxLsgsGJIlXfdWZPmmb2SFrJiBTZkFiQbx2c&response_mode=form_post&nonce=6d534fb1-6601-4f18-aba0-37454ac6c712&lc=1033&login_hint=Torres.Lopez.Irene%40DEME-GROUP.COM&invitation_username=Torres.Lopez.Irene%40deme-group.com&invite_redirect_url=https%3A%2F%2Fmyapplications.microsoft.com%2F%3Ftenantid%3Dac16fc13-eed0-45a8-a4cd-092120207ca4&x-client-SKU=ID_NET462&x-client-ver=8.0.1.0&sso_reload=true

HTTP Parser: torres.lopez.irene@deme-group.com

HTTP Parser: Number of links: 0

Source: https://login.microsoftonline.com/ac16fc13-eed0-45a8-a4cd-092120207ca4/oauth2/authorize?client_id=4660504c-45b3-4674-a709-71951a6b0763&redirect_uri=https%3A%2F%2Finvitations.microsoft.com&response_type=id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DPJp1H17W53fkYTX1QCKICogJZ8R5V_mYuQeJtujFe92PlIBQ8Ja9tSjAJPwssWmcs9J5AYl1pRf-MtPM1UsrrLbwHS6CR5I_9OYkYuqFndEEGEg_7cOOqHDgRQzBAagj0t5R2Oqbmg3NlYJx4a6hkSiB3xQ_nuAg7ASxUk09DmtqZEpow9kSoyD6HaqLp5DK4zCTtK1GvWjrjWk5zex3v1EnoRWibch9RJHObSH98eM0LUl6QukUGr57V3ics8bO7OEqSji0HiRJM4Klx4Tx2_YpySmTAY4QTMjAzHwrSbvWbzvvD1s1rTxsDpTkWCg2s24wQjrSHXlkDKHGVcaVaXnmsS3puNc-z0sKXv43W_vAzMhpAn2m7iPpXunoMHLYOYmh-x3F9z6qavEnuMPErXocnmXlpZYW-hwPsk_Hm4OoFSIvE_Bj5sCiwzSlhHksEitB_cqyCFzXzZ7exJI4hKqeMV4lg7QH8VPspf5Ad04d66g2Lm3SbsNuO8swP6CeVoaFqA-XerOS9Z_4MV4CCbLFBKhO0oAxVC33P1FbBroorQ9HhiuMKbrN7zGDZj3DvZbQIYvvVAWrIL_BXfGp-oAJl5E0PvbYkG_YxGSlSEfALc73vReA9yS8HAY1jTVvFELwtpAPWz9d7tuUzchbivj97ZJ07n2QmEcaQQYLnlw_aQANQ33jhWZv52401gBrCstj7Q-SVtEIiolNP9XWAGxYtD21hYmXEOuZ3dt...	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/ac16fc13-eed0-45a8-a4cd-092120207ca4/login	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://login.microsoftonline.com/ac16fc13-eed0-45a8-a4cd-092120207ca4/oauth2/authorize?client_id=4660504c-45b3-4674-a709-71951a6b0763&redirect_uri=https%3A%2F%2Finvitations.microsoft.com&response_type=id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DPJp1H17W53fkYTX1QCKICogJZ8R5V_mYuQeJtujFe92PlIBQ8Ja9tSjAJPwssWmcs9J5AYl1pRf-MtPM1UsrrLbwHS6CR5I_9OYkYuqFndEEGEg_7cOOqHDgRQzBAagj0t5R2Oqbmg3NlYJx4a6hkSiB3xQ_nuAg7ASxUk09DmtqZEpow9kSoyD6HaqLp5DK4zCTtK1GvWjrjWk5zex3v1EnoRWibch9RJHObSH98eM0LUl6QukUGr57V3ics8bO7OEqSji0HiRJM4Klx4Tx2_YpySmTAY4QTMjAzHwrSbvWbzvvD1s1rTxsDpTkWCg2s24wQjrSHXlkDKHGVcaVaXnmsS3puNc-z0sKXv43W_vAzMhpAn2m7iPpXunoMHLYOYmh-x3F9z6qavEnuMPErXocnmXlpZYW-hwPsk_Hm4OoFSIvE_Bj5sCiwzSlhHksEitB_cqyCFzXzZ7exJI4hKqeMV4lg7QH8VPspf5Ad04d66g2Lm3SbsNuO8swP6CeVoaFqA-XerOS9Z_4MV4CCbLFBKhO0oAxVC33P1FbBroorQ9HhiuMKbrN7zGDZj3DvZbQIYvvVAWrIL_BXfGp-oAJl5E0PvbYkG_YxGSlSEfALc73vReA9yS8HAY1jTVvFELwtpAPWz9d7tuUzchbivj97ZJ07n2QmEcaQQYLnlw_aQANQ33jhWZv52401gBrCstj7Q-SVtEIiolNP9XWAGxYtD21hYmXEOuZ3dt...	HTTP Parser: <input type="password" .../> found
Source: https://login.microsoftonline.com/ac16fc13-eed0-45a8-a4cd-092120207ca4/login	HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

Source: https://login.microsoftonline.com/ac16fc13-eed0-45a8-a4cd-092120207ca4/oauth2/authorize?client_id=4660504c-45b3-4674-a709-71951a6b0763&redirect_uri=https%3A%2F%2Finvitations.microsoft.com&response_type=id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DPJp1H17W53fkYTX1QCKICogJZ8R5V_mYuQeJtujFe92PlIBQ8Ja9tSjAJPwssWmcs9J5AYl1pRf-MtPM1UsrrLbwHS6CR5I_9OYkYuqFndEEGEg_7cOOqHDgRQzBAagj0t5R2Oqbmg3NlYJx4a6hkSiB3xQ_nuAg7ASxUk09DmtqZEpow9kSoyD6HaqLp5DK4zCTtK1GvWjrjWk5zex3v1EnoRWibch9RJHObSH98eM0LUl6QukUGr57V3ics8bO7OEqSji0HiRJM4Klx4Tx2_YpySmTAY4QTMjAzHwrSbvWbzvvD1s1rTxsDpTkWCg2s24wQjrSHXlkDKHGVcaVaXnmsS3puNc-z0sKXv43W_vAzMhpAn2m7iPpXunoMHLYOYmh-x3F9z6qavEnuMPErXocnmXlpZYW-hwPsk_Hm4OoFSIvE_Bj5sCiwzSlhHksEitB_cqyCFzXzZ7exJI4hKqeMV4lg7QH8VPspf5Ad04d66g2Lm3SbsNuO8swP6CeVoaFqA-XerOS9Z_4MV4CCbLFBKhO0oAxVC33P1FbBroorQ9HhiuMKbrN7zGDZj3DvZbQIYvvVAWrIL_BXfGp-oAJl5E0PvbYkG_YxGSlSEfALc73vReA9yS8HAY1jTVvFELwtpAPWz9d7tuUzchbivj97ZJ07n2QmEcaQQYLnlw_aQANQ33jhWZv52401gBrCstj7Q-SVtEIiolNP9XWAGxYtD21hYmXEOuZ3dt	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/ac16fc13-eed0-45a8-a4cd-092120207ca4/oauth2/authorize?client_id=4660504c-45b3-4674-a709-71951a6b0763&redirect_uri=https%3A%2F%2Finvitations.microsoft.com&response_type=id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DPJp1H17W53fkYTX1QCKICogJZ8R5V_mYuQeJtujFe92PlIBQ8Ja9tSjAJPwssWmcs9J5AYl1pRf-MtPM1UsrrLbwHS6CR5I_9OYkYuqFndEEGEg_7cOOqHDgRQzBAagj0t5R2Oqbmg3NlYJx4a6hkSiB3xQ_nuAg7ASxUk09DmtqZEpow9kSoyD6HaqLp5DK4zCTtK1GvWjrjWk5zex3v1EnoRWibch9RJHObSH98eM0LUl6QukUGr57V3ics8bO7OEqSji0HiRJM4Klx4Tx2_YpySmTAY4QTMjAzHwrSbvWbzvvD1s1rTxsDpTkWCg2s24wQjrSHXlkDKHGVcaVaXnmsS3puNc-z0sKXv43W_vAzMhpAn2m7iPpXunoMHLYOYmh-x3F9z6qavEnuMPErXocnmXlpZYW-hwPsk_Hm4OoFSIvE_Bj5sCiwzSlhHksEitB_cqyCFzXzZ7exJI4hKqeMV4lg7QH8VPspf5Ad04d66g2Lm3SbsNuO8swP6CeVoaFqA-XerOS9Z_4MV4CCbLFBKhO0oAxVC33P1FbBroorQ9HhiuMKbrN7zGDZj3DvZbQIYvvVAWrIL_BXfGp-oAJl5E0PvbYkG_YxGSlSEfALc73vReA9yS8HAY1jTVvFELwtpAPWz9d7tuUzchbivj97ZJ07n2QmEcaQQYLnlw_aQANQ33jhWZv52401gBrCstj7Q-SVtEIiolNP9XWAGxYtD21hYmXEOuZ3dt	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/ac16fc13-eed0-45a8-a4cd-092120207ca4/oauth2/authorize?client_id=4660504c-45b3-4674-a709-71951a6b0763&redirect_uri=https%3A%2F%2Finvitations.microsoft.com&response_type=id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DPJp1H17W53fkYTX1QCKICogJZ8R5V_mYuQeJtujFe92PlIBQ8Ja9tSjAJPwssWmcs9J5AYl1pRf-MtPM1UsrrLbwHS6CR5I_9OYkYuqFndEEGEg_7cOOqHDgRQzBAagj0t5R2Oqbmg3NlYJx4a6hkSiB3xQ_nuAg7ASxUk09DmtqZEpow9kSoyD6HaqLp5DK4zCTtK1GvWjrjWk5zex3v1EnoRWibch9RJHObSH98eM0LUl6QukUGr57V3ics8bO7OEqSji0HiRJM4Klx4Tx2_YpySmTAY4QTMjAzHwrSbvWbzvvD1s1rTxsDpTkWCg2s24wQjrSHXlkDKHGVcaVaXnmsS3puNc-z0sKXv43W_vAzMhpAn2m7iPpXunoMHLYOYmh-x3F9z6qavEnuMPErXocnmXlpZYW-hwPsk_Hm4OoFSIvE_Bj5sCiwzSlhHksEitB_cqyCFzXzZ7exJI4hKqeMV4lg7QH8VPspf5Ad04d66g2Lm3SbsNuO8swP6CeVoaFqA-XerOS9Z_4MV4CCbLFBKhO0oAxVC33P1FbBroorQ9HhiuMKbrN7zGDZj3DvZbQIYvvVAWrIL_BXfGp-oAJl5E0PvbYkG_YxGSlSEfALc73vReA9yS8HAY1jTVvFELwtpAPWz9d7tuUzchbivj97ZJ07n2QmEcaQQYLnlw_aQANQ33jhWZv52401gBrCstj7Q-SVtEIiolNP9XWAGxYtD21hYmXEOuZ3dt	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/ac16fc13-eed0-45a8-a4cd-092120207ca4/oauth2/authorize?client_id=4660504c-45b3-4674-a709-71951a6b0763&redirect_uri=https%3A%2F%2Finvitations.microsoft.com&response_type=id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DPJp1H17W53fkYTX1QCKICogJZ8R5V_mYuQeJtujFe92PlIBQ8Ja9tSjAJPwssWmcs9J5AYl1pRf-MtPM1UsrrLbwHS6CR5I_9OYkYuqFndEEGEg_7cOOqHDgRQzBAagj0t5R2Oqbmg3NlYJx4a6hkSiB3xQ_nuAg7ASxUk09DmtqZEpow9kSoyD6HaqLp5DK4zCTtK1GvWjrjWk5zex3v1EnoRWibch9RJHObSH98eM0LUl6QukUGr57V3ics8bO7OEqSji0HiRJM4Klx4Tx2_YpySmTAY4QTMjAzHwrSbvWbzvvD1s1rTxsDpTkWCg2s24wQjrSHXlkDKHGVcaVaXnmsS3puNc-z0sKXv43W_vAzMhpAn2m7iPpXunoMHLYOYmh-x3F9z6qavEnuMPErXocnmXlpZYW-hwPsk_Hm4OoFSIvE_Bj5sCiwzSlhHksEitB_cqyCFzXzZ7exJI4hKqeMV4lg7QH8VPspf5Ad04d66g2Lm3SbsNuO8swP6CeVoaFqA-XerOS9Z_4MV4CCbLFBKhO0oAxVC33P1FbBroorQ9HhiuMKbrN7zGDZj3DvZbQIYvvVAWrIL_BXfGp-oAJl5E0PvbYkG_YxGSlSEfALc73vReA9yS8HAY1jTVvFELwtpAPWz9d7tuUzchbivj97ZJ07n2QmEcaQQYLnlw_aQANQ33jhWZv52401gBrCstj7Q-SVtEIiolNP9XWAGxYtD21hYmXEOuZ3dt	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/ac16fc13-eed0-45a8-a4cd-092120207ca4/login	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/ac16fc13-eed0-45a8-a4cd-092120207ca4/login	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/ac16fc13-eed0-45a8-a4cd-092120207ca4/oauth2/authorize?client_id=4660504c-45b3-4674-a709-71951a6b0763&redirect_uri=https%3A%2F%2Finvitations.microsoft.com&response_type=id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DPJp1H17W53fkYTX1QCKICogJZ8R5V_mYuQeJtujFe92PlIBQ8Ja9tSjAJPwssWmcs9J5AYl1pRf-MtPM1UsrrLbwHS6CR5I_9OYkYuqFndEEGEg_7cOOqHDgRQzBAagj0t5R2Oqbmg3NlYJx4a6hkSiB3xQ_nuAg7ASxUk09DmtqZEpow9kSoyD6HaqLp5DK4zCTtK1GvWjrjWk5zex3v1EnoRWibch9RJHObSH98eM0LUl6QukUGr57V3ics8bO7OEqSji0HiRJM4Klx4Tx2_YpySmTAY4QTMjAzHwrSbvWbzvvD1s1rTxsDpTkWCg2s24wQjrSHXlkDKHGVcaVaXnmsS3puNc-z0sKXv43W_vAzMhpAn2m7iPpXunoMHLYOYmh-x3F9z6qavEnuMPErXocnmXlpZYW-hwPsk_Hm4OoFSIvE_Bj5sCiwzSlhHksEitB_cqyCFzXzZ7exJI4hKqeMV4lg7QH8VPspf5Ad04d66g2Lm3SbsNuO8swP6CeVoaFqA-XerOS9Z_4MV4CCbLFBKhO0oAxVC33P1FbBroorQ9HhiuMKbrN7zGDZj3DvZbQIYvvVAWrIL_BXfGp-oAJl5E0PvbYkG_YxGSlSEfALc73vReA9yS8HAY1jTVvFELwtpAPWz9d7tuUzchbivj97ZJ07n2QmEcaQQYLnlw_aQANQ33jhWZv52401gBrCstj7Q-SVtEIiolNP9XWAGxYtD21hYmXEOuZ3dt...	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/ac16fc13-eed0-45a8-a4cd-092120207ca4/oauth2/authorize?client_id=4660504c-45b3-4674-a709-71951a6b0763&redirect_uri=https%3A%2F%2Finvitations.microsoft.com&response_type=id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DPJp1H17W53fkYTX1QCKICogJZ8R5V_mYuQeJtujFe92PlIBQ8Ja9tSjAJPwssWmcs9J5AYl1pRf-MtPM1UsrrLbwHS6CR5I_9OYkYuqFndEEGEg_7cOOqHDgRQzBAagj0t5R2Oqbmg3NlYJx4a6hkSiB3xQ_nuAg7ASxUk09DmtqZEpow9kSoyD6HaqLp5DK4zCTtK1GvWjrjWk5zex3v1EnoRWibch9RJHObSH98eM0LUl6QukUGr57V3ics8bO7OEqSji0HiRJM4Klx4Tx2_YpySmTAY4QTMjAzHwrSbvWbzvvD1s1rTxsDpTkWCg2s24wQjrSHXlkDKHGVcaVaXnmsS3puNc-z0sKXv43W_vAzMhpAn2m7iPpXunoMHLYOYmh-x3F9z6qavEnuMPErXocnmXlpZYW-hwPsk_Hm4OoFSIvE_Bj5sCiwzSlhHksEitB_cqyCFzXzZ7exJI4hKqeMV4lg7QH8VPspf5Ad04d66g2Lm3SbsNuO8swP6CeVoaFqA-XerOS9Z_4MV4CCbLFBKhO0oAxVC33P1FbBroorQ9HhiuMKbrN7zGDZj3DvZbQIYvvVAWrIL_BXfGp-oAJl5E0PvbYkG_YxGSlSEfALc73vReA9yS8HAY1jTVvFELwtpAPWz9d7tuUzchbivj97ZJ07n2QmEcaQQYLnlw_aQANQ33jhWZv52401gBrCstj7Q-SVtEIiolNP9XWAGxYtD21hYmXEOuZ3dt...	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/ac16fc13-eed0-45a8-a4cd-092120207ca4/oauth2/authorize?client_id=4660504c-45b3-4674-a709-71951a6b0763&redirect_uri=https%3A%2F%2Finvitations.microsoft.com&response_type=id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DPJp1H17W53fkYTX1QCKICogJZ8R5V_mYuQeJtujFe92PlIBQ8Ja9tSjAJPwssWmcs9J5AYl1pRf-MtPM1UsrrLbwHS6CR5I_9OYkYuqFndEEGEg_7cOOqHDgRQzBAagj0t5R2Oqbmg3NlYJx4a6hkSiB3xQ_nuAg7ASxUk09DmtqZEpow9kSoyD6HaqLp5DK4zCTtK1GvWjrjWk5zex3v1EnoRWibch9RJHObSH98eM0LUl6QukUGr57V3ics8bO7OEqSji0HiRJM4Klx4Tx2_YpySmTAY4QTMjAzHwrSbvWbzvvD1s1rTxsDpTkWCg2s24wQjrSHXlkDKHGVcaVaXnmsS3puNc-z0sKXv43W_vAzMhpAn2m7iPpXunoMHLYOYmh-x3F9z6qavEnuMPErXocnmXlpZYW-hwPsk_Hm4OoFSIvE_Bj5sCiwzSlhHksEitB_cqyCFzXzZ7exJI4hKqeMV4lg7QH8VPspf5Ad04d66g2Lm3SbsNuO8swP6CeVoaFqA-XerOS9Z_4MV4CCbLFBKhO0oAxVC33P1FbBroorQ9HhiuMKbrN7zGDZj3DvZbQIYvvVAWrIL_BXfGp-oAJl5E0PvbYkG_YxGSlSEfALc73vReA9yS8HAY1jTVvFELwtpAPWz9d7tuUzchbivj97ZJ07n2QmEcaQQYLnlw_aQANQ33jhWZv52401gBrCstj7Q-SVtEIiolNP9XWAGxYtD21hYmXEOuZ3dt...	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/ac16fc13-eed0-45a8-a4cd-092120207ca4/oauth2/authorize?client_id=4660504c-45b3-4674-a709-71951a6b0763&redirect_uri=https%3A%2F%2Finvitations.microsoft.com&response_type=id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DPJp1H17W53fkYTX1QCKICogJZ8R5V_mYuQeJtujFe92PlIBQ8Ja9tSjAJPwssWmcs9J5AYl1pRf-MtPM1UsrrLbwHS6CR5I_9OYkYuqFndEEGEg_7cOOqHDgRQzBAagj0t5R2Oqbmg3NlYJx4a6hkSiB3xQ_nuAg7ASxUk09DmtqZEpow9kSoyD6HaqLp5DK4zCTtK1GvWjrjWk5zex3v1EnoRWibch9RJHObSH98eM0LUl6QukUGr57V3ics8bO7OEqSji0HiRJM4Klx4Tx2_YpySmTAY4QTMjAzHwrSbvWbzvvD1s1rTxsDpTkWCg2s24wQjrSHXlkDKHGVcaVaXnmsS3puNc-z0sKXv43W_vAzMhpAn2m7iPpXunoMHLYOYmh-x3F9z6qavEnuMPErXocnmXlpZYW-hwPsk_Hm4OoFSIvE_Bj5sCiwzSlhHksEitB_cqyCFzXzZ7exJI4hKqeMV4lg7QH8VPspf5Ad04d66g2Lm3SbsNuO8swP6CeVoaFqA-XerOS9Z_4MV4CCbLFBKhO0oAxVC33P1FbBroorQ9HhiuMKbrN7zGDZj3DvZbQIYvvVAWrIL_BXfGp-oAJl5E0PvbYkG_YxGSlSEfALc73vReA9yS8HAY1jTVvFELwtpAPWz9d7tuUzchbivj97ZJ07n2QmEcaQQYLnlw_aQANQ33jhWZv52401gBrCstj7Q-SVtEIiolNP9XWAGxYtD21hYmXEOuZ3dt...	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/ac16fc13-eed0-45a8-a4cd-092120207ca4/login	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/ac16fc13-eed0-45a8-a4cd-092120207ca4/login	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49757 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10

Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_qzvqnltrxpy99ajspyxbgq2.css HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_ELtAAt2Ya8ISGuc0PJcBKA2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_ELtAAt2Ya8ISGuc0PJcBKA2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=uZ7EuV5AC6Durxu&MD=UrhV8gVN HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c1c6b6c8-yw-iky5-oitv6m8bxnlvjqeioua2sjr-bhiob-yiudy/logintenantbranding/0/illustration?ts=637255507111143881 HTTP/1.1Host: aadcdn.msftauthimages.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c1c6b6c8-yw-iky5-oitv6m8bxnlvjqeioua2sjr-bhiob-yiudy/logintenantbranding/0/bannerlogo?ts=637255507118990034 HTTP/1.1Host: aadcdn.msftauthimages.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /deme-group.com/winauth/ssoprobe?client-request-id=b183b832-0872-4686-93c7-8f9e002bea48&_=1728903861708 HTTP/1.1Host: autologon.microsoftazuread-sso.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c1c6b6c8-yw-iky5-oitv6m8bxnlvjqeioua2sjr-bhiob-yiudy/logintenantbranding/0/bannerlogo?ts=637255507118990034 HTTP/1.1Host: aadcdn.msftauthimages.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_89db715e3340a2e8ecd8.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c1c6b6c8-yw-iky5-oitv6m8bxnlvjqeioua2sjr-bhiob-yiudy/logintenantbranding/0/illustration?ts=637255507111143881 HTTP/1.1Host: aadcdn.msftauthimages.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_89db715e3340a2e8ecd8.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c1c6b6c8-gu93kzcvv9nfo0jjjijxe9133mrsglit9lh2ikhkvmm/logintenantbranding/0/bannerlogo?ts=637271955782382065 HTTP/1.1Host: aadcdn.msftauthimages.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c1c6b6c8-gu93kzcvv9nfo0jjjijxe9133mrsglit9lh2ikhkvmm/logintenantbranding/0/bannerlogo?ts=637271955782382065 HTTP/1.1Host: aadcdn.msftauthimages.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=uZ7EuV5AC6Durxu&MD=UrhV8gVN HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauthimages.net
Source: global traffic	DNS traffic detected: DNS query: autologon.microsoftazuread-sso.com

Source: chromecache_104.1.dr, chromecache_100.1.dr	String found in binary or memory: http://feross.org
Source: chromecache_89.1.dr, chromecache_101.1.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_89.1.dr, chromecache_101.1.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_104.1.dr, chromecache_105.1.dr, chromecache_109.1.dr, chromecache_87.1.dr, chromecache_89.1.dr, chromecache_100.1.dr, chromecache_101.1.dr, chromecache_95.1.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_84.1.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_84.1.dr	String found in binary or memory: https://login.windows-ppe.net

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49757 version: TLS 1.2

Source: classification engine

Classification label: clean2.win@17/48@20/9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1960,i,17662341715992215995,799854014391982021,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://login.microsoftonline.com/redeem?rd=https%3a%2f%2finvitations.microsoft.com%2fredeem%2f%3ftenant%3dac16fc13-eed0-45a8-a4cd-092120207ca4%26user%3d7d35c074-f1ce-4806-8732-1a64869fa060%26ticket%3dPqbSUkJjPpJW0yIMqaUTQLRg3kmINldPr4uL7BaqWvg%25253d%26ver%3d2.0"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1960,i,17662341715992215995,799854014391982021,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://login.microsoftonline.com	0%	URL Reputation	safe
http://www.opensource.org/licenses/mit-license.php)	0%	URL Reputation	safe
http://www.opensource.org/licenses/mit-license.php)	0%	URL Reputation	safe
http://knockoutjs.com/	0%	URL Reputation	safe
http://feross.org	0%	URL Reputation	safe
https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_ELtAAt2Ya8ISGuc0PJcBKA2.js	0%	Virustotal		Browse
https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif	0%	Virustotal		Browse
https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	0%	Virustotal		Browse
https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif	0%	Virustotal		Browse
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js	0%	Virustotal		Browse
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_89db715e3340a2e8ecd8.js	0%	Virustotal		Browse
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js	0%	Virustotal		Browse
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js	0%	Virustotal		Browse
https://login.windows-ppe.net	1%	Virustotal		Browse
https://github.com/douglascrockford/JSON-js	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
sni1gl.wpc.omegacdn.net	152.199.21.175	true	false	unknown
www.google.com	142.250.181.228	true	false	unknown
s-part-0039.t-0009.t-msedge.net	13.107.246.67	true	false	unknown
s-part-0039.t-0009.fb-t-msedge.net	13.107.253.67	true	false	unknown
autologon.microsoftazuread-sso.com	40.126.32.74	true	false	unknown
identity.nel.measure.office.net	unknown	unknown	false	unknown
aadcdn.msftauth.net	unknown	unknown	false	unknown
login.microsoftonline.com	unknown	unknown	false	unknown
aadcdn.msftauthimages.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://login.microsoftonline.com/ac16fc13-eed0-45a8-a4cd-092120207ca4/login	false		unknown
https://aadcdn.msftauthimages.net/c1c6b6c8-yw-iky5-oitv6m8bxnlvjqeioua2sjr-bhiob-yiudy/logintenantbranding/0/illustration?ts=637255507111143881	false		unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_ELtAAt2Ya8ISGuc0PJcBKA2.js	false	0%, Virustotal, Browse	unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js	false	0%, Virustotal, Browse	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif	false	0%, Virustotal, Browse	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif	false	0%, Virustotal, Browse	unknown
https://aadcdn.msftauthimages.net/c1c6b6c8-yw-iky5-oitv6m8bxnlvjqeioua2sjr-bhiob-yiudy/logintenantbranding/0/bannerlogo?ts=637255507118990034	false		unknown
https://aadcdn.msftauthimages.net/c1c6b6c8-gu93kzcvv9nfo0jjjijxe9133mrsglit9lh2ikhkvmm/logintenantbranding/0/bannerlogo?ts=637271955782382065	false		unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	false	0%, Virustotal, Browse	unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_89db715e3340a2e8ecd8.js	false	0%, Virustotal, Browse	unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js	false	0%, Virustotal, Browse	unknown
https://autologon.microsoftazuread-sso.com/deme-group.com/winauth/ssoprobe?client-request-id=b183b832-0872-4686-93c7-8f9e002bea48&_=1728903861708	false		unknown
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://login.microsoftonline.com	chromecache_84.1.dr	false	URL Reputation: safe	unknown
http://www.opensource.org/licenses/mit-license.php)	chromecache_89.1.dr, chromecache_101.1.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://knockoutjs.com/	chromecache_89.1.dr, chromecache_101.1.dr	false	URL Reputation: safe	unknown
https://github.com/douglascrockford/JSON-js	chromecache_104.1.dr, chromecache_105.1.dr, chromecache_109.1.dr, chromecache_87.1.dr, chromecache_89.1.dr, chromecache_100.1.dr, chromecache_101.1.dr, chromecache_95.1.dr	false	0%, Virustotal, Browse	unknown
https://login.windows-ppe.net	chromecache_84.1.dr	false	1%, Virustotal, Browse	unknown
http://feross.org	chromecache_104.1.dr, chromecache_100.1.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.67	s-part-0039.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.253.67	s-part-0039.t-0009.fb-t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.126.32.74	autologon.microsoftazuread-sso.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.181.228	www.google.com	United States	15169	GOOGLEUS	false
172.217.23.100	unknown	United States	15169	GOOGLEUS	false
152.199.21.175	sni1gl.wpc.omegacdn.net	United States	15133	EDGECASTUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1533086
Start date and time:	2024-10-14 13:03:38 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://login.microsoftonline.com/redeem?rd=https%3a%2f%2finvitations.microsoft.com%2fredeem%2f%3ftenant%3dac16fc13-eed0-45a8-a4cd-092120207ca4%26user%3d7d35c074-f1ce-4806-8732-1a64869fa060%26ticket%3dPqbSUkJjPpJW0yIMqaUTQLRg3kmINldPr4uL7BaqWvg%25253d%26ver%3d2.0
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean2.win@17/48@20/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.99, 142.250.185.206, 64.233.166.84, 20.190.160.20, 40.126.32.133, 40.126.32.68, 40.126.32.140, 40.126.32.138, 20.190.160.22, 20.190.160.17, 40.126.32.136, 34.104.35.123, 40.126.32.66, 40.126.32.131, 40.126.32.6, 40.126.32.129, 199.232.214.172, 2.20.245.137, 2.20.245.134, 40.126.32.72, 40.126.32.134, 40.126.32.76, 20.190.159.71, 20.190.159.0, 20.190.159.4, 20.190.159.2, 20.190.159.73, 40.126.31.71, 40.126.31.73, 40.126.31.69, 216.58.212.170, 142.250.185.74, 142.250.184.234, 142.250.185.106, 142.250.186.42, 142.250.185.234, 142.250.181.234, 142.250.185.170, 142.250.185.138, 142.250.185.202, 142.250.186.106, 172.217.18.10, 142.250.186.74, 172.217.16.138, 142.250.186.138, 172.217.16.202, 216.58.206.74, 172.217.16.195, 2.16.100.168, 142.250.184.206
Excluded domains from analysis (whitelisted): azurefd-t-fb-prod.trafficmanager.net, slscr.update.microsoft.com, na.privatelink.msidentity.com, clientservices.googleapis.com, ak.privatelink.msidentity.com, a1894.dscb.akamai.net, clients2.google.com, login.live.com, update.googleapis.com, login.mso.msidentity.com, invitations.microsoft.com, clients1.google.com, www.tm.ak.prd.aadg.trafficmanager.net, prdv4a.aadg.msidentity.com, fs.microsoft.com, accounts.google.com, prdf.aadg.msidentity.com, content-autofill.googleapis.com, aadcdnoriginwus2.azureedge.net, aadcdn-msft.azureedge.net, www.tm.ak.prd.aadg.akadns.net, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, aadcdn-msft.afd.azureedge.net, aadcdn.msauth.net, www.googleapis.com, firstparty-azurefd-prod.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, www.tm.f.prd.aadg.trafficmanager.net, nel.measure.office.net.edgesuite.net, aadcdnoriginwus2.afd.azureedge.net, clients.l.google.com, www.tm.lg.prod.aadmsa.
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Input	Output
URL: https://login.microsoftonline.com/ac16fc13-eed0-45a8-a4cd-092120207ca4/oauth2/authorize?client_id=4660504c-45b3-4674-a709-71951a6b0763&redirect_uri=https%3A%2F%2Finvitations.microsoft.com&response_type=id_token&scope=openid%20profile&state=OpenIdConnect.A Model: jbxai	{ "brands":["DEME"], "text":"Enter password", "contains_trigger_text":true, "trigger_text":"Enter password", "prominent_button_name":"Sign in", "text_input_field_labels":["Forgot my password", "Sign in with another account"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://login.microsoftonline.com/ac16fc13-eed0-45a8-a4cd-092120207ca4/login Model: jbxai	{ "brands":["DEME"], "text":"Enter password", "contains_trigger_text":true, "trigger_text":"Your account or password is incorrect. If you don't remember your password, reset it now.", "prominent_button_name":"Sign in", "text_input_field_labels":["Password", "Forgot my password", "Sign in with another account"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://login.microsoftonline.com/ac16fc13-eed0-45a8-a4cd-092120207ca4/login Model: jbxai	{ "brands":["DEME"], "text":"Enter password", "contains_trigger_text":true, "trigger_text":"Your account or password is incorrect. If you don't remember your password, reset it now.", "prominent_button_name":"Sign in", "text_input_field_labels":["Password", "Forgot my password", "Sign in with another account"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 10:04:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9893920508038914
Encrypted:	false
SSDEEP:	48:8peYWdcTggwHwidAKZdA1FehwiZUklqehry+3:8wCHX8y
MD5:	C2EF360CC5796B2999E9248A4AB2A837
SHA1:	5B79D030F82665CF6F1912FBE074A193EFBC6DDD
SHA-256:	734CC9B11D206A042EDD6629A55EFB5B5A47224F75102A9698B87B51EA5F5259
SHA-512:	707EFD71592BE2A976EAF0BCF529976B7863411A5B7185D6B678BF6740123ED1A85697284DF600241A90033A4AB2CE86376A3DA2E78A31BFC20C8510DF51CA70
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......'.(...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.INYyX....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VNY.X....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VNY.X....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VNY.X..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VNY.X...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............r.`.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 10:04:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.008281040953387
Encrypted:	false
SSDEEP:	48:85WdcTggwHwidAKZdA1seh/iZUkAQkqehsy+2:8THh9Qxy
MD5:	89E71D2724C76488D519D47429B95E5C
SHA1:	7AB7611045B75B8F3FA6DEA5B9B0473AD8EE16AD
SHA-256:	2DB7D3055D9B0E472967EAC09F0595B2E129BADFB42FE5F795ABA7C5DE9207F9
SHA-512:	90472A4C1AE70C4565C7906639B17398E0E8A5CE699ED85AA3D13EAF0D9574DA8D01F0B0ADB8954C36A8F73C5111575150438B408DB684A483A81D00FD35BDEB
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....#..(...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.INYyX....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VNY.X....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VNY.X....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VNY.X..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VNY.X...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............r.`.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.01013001429718
Encrypted:	false
SSDEEP:	48:8VWdcTggAHwidAKZdA14meh7sFiZUkmgqeh7sqy+BX:8vHNnwy
MD5:	DCF380C5966DBEAD8B79619DF3D68761
SHA1:	31109358DA92060441E5A999ECD816A16056923D
SHA-256:	4219561A91BD832580E0E1680D257F8AADCAE298514770738DFA99DE9C046E6E
SHA-512:	91ED82D11FF2FDA2F2F9D2438AB4C2191B247734ECEEA143169920327B23DBE44045779BC6A1BBD96DF5C700219713874A047B520193710E5350A2BEEADCFF7F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.INYyX....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VNY.X....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VNY.X....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VNY.X..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............r.`.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 10:04:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.004808111103899
Encrypted:	false
SSDEEP:	48:8bWdcTggwHwidAKZdA1TehDiZUkwqehYy+R:8xHSyy
MD5:	9BE5668DCB19A945B04D8D087CB72E79
SHA1:	5EEB1B077ED439F4676AC51E4EB79B1F05BB4688
SHA-256:	35E6A397C7694C4D4A3191BF059645808CF9994660123EEC745825D7C760955C
SHA-512:	75BC8E69C6CEFB78E1D4C7661572FECBC1E656CB1D12059F606B78CD8666A7FD4B83D5581E0E34C6E14E43C7338CC1C2AEA188DD3BC27F6E4A34A9A728CEAF77
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........(...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.INYyX....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VNY.X....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VNY.X....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VNY.X..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VNY.X...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............r.`.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 10:04:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.992852261702238
Encrypted:	false
SSDEEP:	48:8BWdcTggwHwidAKZdA1dehBiZUk1W1qehuy+C:8rHC9Oy
MD5:	10828178CB185D3C694BE87C6D0AE232
SHA1:	17C541F0F8634FE13492B42DC2EB291F971D0AC1
SHA-256:	FB37CBB6D234D14A3916FF694FEFBDCCD8EE330773261ADB38AFC1FB99C1EF0B
SHA-512:	4480143F16AE89A7379321AAD59D933AB92DA800FFE72676B46ED66B8816887C0882A67701620506298F2B54AEE651FD6329164991E3882FA4F2918799A325B5
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......".(...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.INYyX....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VNY.X....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VNY.X....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VNY.X..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VNY.X...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............r.`.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 10:04:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9999822600720507
Encrypted:	false
SSDEEP:	48:8DWdcTggwHwidAKZdA1duTeehOuTbbiZUk5OjqehOuTbwy+yT+:8pHYTfTbxWOvTbwy7T
MD5:	502619E9FA6A18C0324F05FAE269A1B4
SHA1:	9461B26CB4C847BD3984F93A5E9A764771E6200E
SHA-256:	D85175B6AD370717A9093F6D5E1E721EF8EB4A62D6A504DE526F925831C1C5E4
SHA-512:	6CDE37657EAE8FF50C417880B887144A04872B5842CE3F06486C0912C42D4FFB0B991DA3DAAAE1A5AF5F104DC6E95BCC260388F7434D6475DC6431AF2EFEED45
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....d...(...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.INYyX....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VNY.X....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VNY.X....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VNY.X..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VNY.X...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............r.`.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (45797)
Category:	downloaded
Size (bytes):	406986
Entropy (8bit):	5.31836569617146
Encrypted:	false
SSDEEP:	3072:f5+ROkZBKxn7oW/sKni2JcPwRTQx4J77m7mBdhh2uZifxOjrCpaLmnF:uOkWxp/Fi9Nxe7maZc7F
MD5:	E40761677762EAB0692F86B259C7D744
SHA1:	34A9B50CEC6E1163CEEFCD4D394DB6524C89A854
SHA-256:	DA4A8DF0C326292B5BEE9C732B3C962FD67AAF2F99D850F1BF65068D573C5619
SHA-512:	04FA1D6074AD24E3ABAB53D1DE116A6B39B4BE3DFABC082427F1C5A169E50527561F160CC133C2AC4AEDC4E7AC404572F60E531A4618111EA74D138B2B0DD034
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[8],Array(533).concat([f

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64616)
Category:	downloaded
Size (bytes):	449703
Entropy (8bit):	5.448833304498656
Encrypted:	false
SSDEEP:	6144:87LuGB2clRK2d/ZkpOYKsyA2pmBe9OpRUJ3cEHKE0H3NX44T:873NZkpbjyhpsUJ5E
MD5:	10BB4002DD986BC2121AE7343C970128
SHA1:	3EA61169BD06FF06B405CB59CE11506C301DF16B
SHA-256:	7DC87D100FFDA0B44300291491BBE7AC8A6EAE94937CCEC0494D5F154C07C3A0
SHA-512:	69EADB93E28BF35D0B6DDD2F3AE03C07CE4E6CB5893F7B4E1046E8343D9A1271DB6C04D650B06EEF933EDC6DC4F73B123044842D99FF383A269995FE191F1057
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_ELtAAt2Ya8ISGuc0PJcBKA2.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */!function(e){function n(n){for(var t,i,o=n[0],r=n[1],s=0,c=[];s<o.length;s++)

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 280 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6297
Entropy (8bit):	7.950489490026617
Encrypted:	false
SSDEEP:	192:fNIkYJa5hK1h7XcNxAx9OLQY2s0enNDwSdN:fCkf5hK1ZXqxO8LQYHVwSj
MD5:	74CABA060BC836E70D4F5D5F667040B1
SHA1:	0ADDEA394E0CC6C8D58145C767BB8AE245620BD9
SHA-256:	F91A4538E7B7789D0B53325D90E0D6661B774F01A5336A4B56BC3947560E9AF1
SHA-512:	8BC559C21BAFBE9C4FAC82663E25E0FC40198ECE08BBDC0E606676FE1C9D8FC391C579D3E4FBACC9B48D87C7BA1A89E95D94CE0B917E3AB5F0A359664EEB9E9C
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......<............pHYs..........+......tIME.....,...R....tEXtAuthor....H....tEXtDescription...!#....tEXtCopyright....:....tEXtCreation time.5.......tEXtSoftware.]p.:....tEXtDisclaimer.........tEXtWarning........tEXtSource.........tEXtComment........tEXtTitle....'...dIDATx..{...u...VUw.[B.....0`;FK..wY0~ .B.53....^...l6..l..]..... ..F.!@.$...$@l,..`.,4 .a,i..LwW.{....H..<z.GP...O..[..[]u.s.WT........Z...../.......-.....H.....2.....Q0.q..X.9}..w.+. [..)....S.h..j%cLL....F6.....8....>p..#.g3.{...9....)...........I.... .9.+..8...2&.......W>m....m....L.......ZRp4.....sW=S....\|.....lj_LK.yR..G.z.1.>..L..kT.W.....@..$!..7.Qmz...3.,.Y..z&O....Z.Y0....z.e...4.....\.....4.p4.D....W.Q...../.F6...3N{...W8.B.B..........y<).\ o.D..e...C...l\x..."&&f.q.`dS..H...>....ZV..xA.Se...\|...^.=Y...'......tPa.cbb.Ps.#].![...).W.cF@$o.....L#7D...$<....x.g6..-..8g&&f..k..~.......{..m.d..8..u.t7..Gh.<.."..w..^...0.F..w.#(..l..9....!.g4.{0x...SYj.`...<\|y

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (32009)
Category:	dropped
Size (bytes):	57443
Entropy (8bit):	5.372940573746363
Encrypted:	false
SSDEEP:	1536:ABqF1tlfretkF7IKbVaqDRx3D7ym+d/Px25+1wtvGixn/TPRUbx3VDg/MvA5Gl:ABrkF7IyJz7ym+d/Po5+1wtvGiJig/Ml
MD5:	D580777BB3A28B94F6F1D18EE17AEDA3
SHA1:	E78833A2DB1AA97DA3F4A1994E6AF1F0D74D7CC7
SHA-256:	81188E8A76162C79DB4A5C10AC933C9E874C5B9EAE10E47956AD9DF704E01B28
SHA-512:	E3F5FFE3E7E54A7D640DF3BC06D336C9F936635D2594159B3EA5EDAEFBA6D6774060A532E0CBE0664FDC65806BD53E9BFC19C11F7946A5E157A9EC935C564378
Malicious:	false
Reputation:	low
Preview:	!function(e){function o(n){if(i[n])return i[n].exports;var t=i[n]={exports:{},id:n,loaded:!1};return e[n].call(t.exports,t,t.exports,o),t.loaded=!0,t.exports}var i={};return o.m=e,o.c=i,o.p="",o(0)}([function(e,o,i){i(2);var n=i(1),t=i(5),r=i(6),a=r.StringsVariantId,s=r.AllowedIdentitiesType;n.registerSource("str",function(e,o){if(e.WF_STR_SignupLink_AriaLabel_Text="Create a Microsoft account",e.WF_STR_SignupLink_AriaLabel_Generic_Text="Create a new account",e.CT_STR_CookieBanner_Link_AriaLabel="Learn more about Microsoft's Cookie Policy",e.WF_STR_HeaderDefault_Title=o.iLoginStringsVariantId===a.CombinedSigninSignupV2WelcomeTitle?"Welcome":"Sign in",e.STR_Footer_IcpLicense_Text=".ICP.13015306.-10",o.oAppCobranding&&o.oAppCobranding.friendlyAppName){var i=o.fBreakBrandingSigninString?"to continue to {0}":"Continue to {0}";e.WF_STR_App_Title=t.format(i,o.oAppCobranding.friendlyAppName)}switch(o.oAppCobranding&&o.oAppCobranding.signinDescription&&(e.WF_STR_Default_Desc=o.oAppCobrand

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (45797)
Category:	dropped
Size (bytes):	406986
Entropy (8bit):	5.31836569617146
Encrypted:	false
SSDEEP:	3072:f5+ROkZBKxn7oW/sKni2JcPwRTQx4J77m7mBdhh2uZifxOjrCpaLmnF:uOkWxp/Fi9Nxe7maZc7F
MD5:	E40761677762EAB0692F86B259C7D744
SHA1:	34A9B50CEC6E1163CEEFCD4D394DB6524C89A854
SHA-256:	DA4A8DF0C326292B5BEE9C732B3C962FD67AAF2F99D850F1BF65068D573C5619
SHA-512:	04FA1D6074AD24E3ABAB53D1DE116A6B39B4BE3DFABC082427F1C5A169E50527561F160CC133C2AC4AEDC4E7AC404572F60E531A4618111EA74D138B2B0DD034
Malicious:	false
Reputation:	low
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[8],Array(533).concat([f

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14782)
Category:	downloaded
Size (bytes):	15755
Entropy (8bit):	5.366543080044668
Encrypted:	false
SSDEEP:	384:DveX/4OSgcn2ZU2ZfeXOh+rF3X1qDZD4zfXdv79HU:q/9i57hU
MD5:	630831903F4BA9060856520624E34CFC
SHA1:	36DC15B9CCC3FC8EF627354BF55EF44EBD10E203
SHA-256:	BC6804D058D5BD5B24FC04E479FC8973BEF5D3EFEAFAA9C19C60A009BF0FAC0B
SHA-512:	1B0759972BBAB0B1A11D54849051E6782600B74FADB1CAF1BD58D214F484E35154907CA7F396EDB1C81A7CDC6F264D138267FB58FD89E1BA3A4D67366EE7E8B0
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[17],{519:function(e,n,s

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (61177)
Category:	downloaded
Size (bytes):	113401
Entropy (8bit):	5.284985933216009
Encrypted:	false
SSDEEP:	1536:QpHDgBvguhw+EViazA/PWrF7qvEAFiQcpmchSeC1Jzc6VUW3:xkNhp6VU0
MD5:	41955034BB6BC6963DF5A8ECA72C5B81
SHA1:	D4B9E8C46100BDDACE8DFA08BDFF1F6F3D3B0A81
SHA-256:	1F8CEB44FE7CFCF7E71DBD5122210335CA3821D697A851D2900B95AF7D92D69D
SHA-512:	A52DF8961AC9964DE5202A52B4C38242368DC8898593BF3E8B3AFD3FC77C2C12FE72F27BB410DD4F7498643B69EEEFCCA1A566371E211F874C0BE22CF7E2A4E8
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_qzvqnltrxpy99ajspyxbgq2.css
Preview:	/! Copyright (C) Microsoft Corporation. All rights reserved. //*!.------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------..This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise...//-----------------------------------------------------------------------------.twbs-bootstrap-sass (3.3.0).//-----------------------------------------------------------------------------..The MIT License (MIT)..Copyright (c) 2013 Twitter, Inc..Permission is hereby granted, free of charge, to any person

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (32009)
Category:	downloaded
Size (bytes):	57443
Entropy (8bit):	5.372940573746363
Encrypted:	false
SSDEEP:	1536:ABqF1tlfretkF7IKbVaqDRx3D7ym+d/Px25+1wtvGixn/TPRUbx3VDg/MvA5Gl:ABrkF7IyJz7ym+d/Po5+1wtvGiJig/Ml
MD5:	D580777BB3A28B94F6F1D18EE17AEDA3
SHA1:	E78833A2DB1AA97DA3F4A1994E6AF1F0D74D7CC7
SHA-256:	81188E8A76162C79DB4A5C10AC933C9E874C5B9EAE10E47956AD9DF704E01B28
SHA-512:	E3F5FFE3E7E54A7D640DF3BC06D336C9F936635D2594159B3EA5EDAEFBA6D6774060A532E0CBE0664FDC65806BD53E9BFC19C11F7946A5E157A9EC935C564378
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js
Preview:	!function(e){function o(n){if(i[n])return i[n].exports;var t=i[n]={exports:{},id:n,loaded:!1};return e[n].call(t.exports,t,t.exports,o),t.loaded=!0,t.exports}var i={};return o.m=e,o.c=i,o.p="",o(0)}([function(e,o,i){i(2);var n=i(1),t=i(5),r=i(6),a=r.StringsVariantId,s=r.AllowedIdentitiesType;n.registerSource("str",function(e,o){if(e.WF_STR_SignupLink_AriaLabel_Text="Create a Microsoft account",e.WF_STR_SignupLink_AriaLabel_Generic_Text="Create a new account",e.CT_STR_CookieBanner_Link_AriaLabel="Learn more about Microsoft's Cookie Policy",e.WF_STR_HeaderDefault_Title=o.iLoginStringsVariantId===a.CombinedSigninSignupV2WelcomeTitle?"Welcome":"Sign in",e.STR_Footer_IcpLicense_Text=".ICP.13015306.-10",o.oAppCobranding&&o.oAppCobranding.friendlyAppName){var i=o.fBreakBrandingSigninString?"to continue to {0}":"Continue to {0}";e.WF_STR_App_Title=t.format(i,o.oAppCobranding.friendlyAppName)}switch(o.oAppCobranding&&o.oAppCobranding.signinDescription&&(e.WF_STR_Default_Desc=o.oAppCobrand

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14782)
Category:	dropped
Size (bytes):	15755
Entropy (8bit):	5.366543080044668
Encrypted:	false
SSDEEP:	384:DveX/4OSgcn2ZU2ZfeXOh+rF3X1qDZD4zfXdv79HU:q/9i57hU
MD5:	630831903F4BA9060856520624E34CFC
SHA1:	36DC15B9CCC3FC8EF627354BF55EF44EBD10E203
SHA-256:	BC6804D058D5BD5B24FC04E479FC8973BEF5D3EFEAFAA9C19C60A009BF0FAC0B
SHA-512:	1B0759972BBAB0B1A11D54849051E6782600B74FADB1CAF1BD58D214F484E35154907CA7F396EDB1C81A7CDC6F264D138267FB58FD89E1BA3A4D67366EE7E8B0
Malicious:	false
Reputation:	low
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[17],{519:function(e,n,s

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 141866
Category:	dropped
Size (bytes):	49804
Entropy (8bit):	7.994672288751266
Encrypted:	true
SSDEEP:	1536:SMuttwJ0uUmAcZjNL6nnQlL+mwKLiQC7Mn3dxPErr:SwJ0vmAcKnnQF+8LJOMn3DPE/
MD5:	6DE768A4DF1E0D0061CDB52EF06346C4
SHA1:	3829A667B97668008023DDA98F4C0772174C8EF6
SHA-256:	58732EEE2ED9091F4F5776DC8A8A14116CBE5A2BA1CCDA0256896BAB08A52128
SHA-512:	CC6966D2C2B43E762750102E734DA6B88D7BFB92DDB5D482EE25029337D95E997466E83001586F2B63DAEE890B5F3188E8EC0F1B084D5EB67CFEA55EDDFAD47D
Malicious:	false
Reputation:	low
Preview:	...........m[.8.0........OL....;w..nf.0.ff.X.'V......4.r~........=........,..JU.......T~.l..?..E.....X..\|t~P9...TN..G..?^.~.............Xx.0..Q..Fa4.#7.q...F.;......4...Q.W&~.@....O.T.y.37J.+Ggf...P....Pz.N...>..a.D..<.m./A,...Q.....WN.Q...8.Db$.G.H<...'....J,..8..{nG.2@HYkL../......=.pL....A?.&Ng.i,......2lo...$.<.3...?~pW..=...L..&x.QR.u3..#6q2....U.Y1..".M. .<W."7@......w..."H,@......0..P....p:...[...E].A..%..V.K\.......F.ir.}.Lc{s..O.g..(\|.........9o..A.t.K....Wv.l6..T.......t.........+..........-w {l..g...V..\=W.j.oaT}t.J`E..$W......;.k.\.t.w~}".....jf..W..."..a..0y........@.T.1.G0........Y_....../..........@.....]+....q\.cR.....t.3S-5g....'U.j.d......y.n,:).\|.?.FW...d...\|.......*.`.3....kMKf...#..,DM.TY+..g.........e+.>...{y..N/..g-#FV.V.p.......Xs.(..{..}..-.O..H=."...........8M.g..!H..0.~.Tdf.;...$D%N .)..!..V...'r\.... ...&....J\|."Nd%D:uw:.<W.+...H&.Z...L=..U.v....J.t.0%+...U..3M....y...L..G...p='.....pB"-..\|.....j .a".i=O.R Q2..."...

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (3450), with CRLF line terminators
Category:	downloaded
Size (bytes):	3452
Entropy (8bit):	5.117912766689607
Encrypted:	false
SSDEEP:	96:3qO9I9Sz9KHULI5m4UidBGLosqAsosushswsosry:a2IYz95qTdBac
MD5:	CB06E9A552B197D5C0EA600B431A3407
SHA1:	04E167433F2F1038C78F387F8A166BB6542C2008
SHA-256:	1F4EDBD2416E15BD82E61BA1A8E5558D44C4E914536B1B07712181BF57934021
SHA-512:	1B4A3919E442EE4D2F30AE29B1C70DF7274E5428BCB6B3EDD84DCB92D60A0D6BDD9FA6D9DDE8EAB341FF4C12DE00A50858BF1FC5B6135B71E9E177F5A9ED34B9
Malicious:	false
Reputation:	low
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(t,e){for(var s in e)t[s]=e[s]}(this,function(t){function e(n){if(s[n])return s[n].exports;var i=s[n]={exports:{},id:n,loaded:!1};return t[n].call(i.exports,i,i.exports,e),i.loaded=!0,i.exports}var s={};return e.m=t,e.c=s,e.p="",e(0)}([function(t,e){function s(t){for(var e=f[S],s=0,n=e.length;s<n;++s)if(e[s]===t)return!0;return!1}function n(t){if(!t)return null;for(var e=t+"=",s=document.cookie.split(";"),n=0,i=s.length;n<i;n++){var a=s[n].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===a.indexOf(e))return a.substring(e.length)}return null}function i(t,e,s){if(t)for(var n=t.split(":"),i=null,a=0,r=n.length;a<r;++a){var c=null,S=n[a].split("$");if(0===a&&(i=parseInt(S.shift()),!i))return;var l=S.length;if(l>=1){var p=o(i,S[0]);if(!p\|\|s[p])continue;c={signInName:p,idp:"msa",isSignedIn:!0}}if(l>=3&&(c.firstName=o(i,S[1]),c.lastName=o(i,S[2])),l>=4){var f=S[3],d=f.split("\|");c.otherHashedAliases=d}if(l>=5){var h=parseInt(S[4],16);h&&(c.

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	36
Entropy (8bit):	4.392147223664534
Encrypted:	false
SSDEEP:	3:ErsczNDr9ks:ErVBys
MD5:	E786B8707C2AADBA4CFBAFD5684951C3
SHA1:	39ABEF2A3C940F92AFE7EA15B970F29973579E6B
SHA-256:	152F3C8D160B5B7EADACD91EE152BE84B7A925B576DF619D93A4A2EA6D9EAD5A
SHA-512:	A1D7C980415F4406555C3CFE64AF473E76048D2FCA66CFBA7949A2BD7A116DD5F5891C1C40AB93ECC3DE0B900124E8B0D749DF618102CE65AB1DE9A966131459
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwmCAmly1gHbXRIFDU9-u70SBQ1Xevf9?alt=proto
Preview:	ChgKDQ1Pfru9GgQIVhgCIAEKBw1Xevf9GgA=

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (25695)
Category:	downloaded
Size (bytes):	26668
Entropy (8bit):	5.187975659586246
Encrypted:	false
SSDEEP:	384:DipbpSfn+aiGAhZUf3nsCVcgfTnLiylcURq0/A3bFphX/S5Q:qtVBUPnVcgbnrblQ
MD5:	23FC7EC7A5AEF418D4A703034E6F3F83
SHA1:	A36BB28ACC4F8943189AB4A7436B9C4716D48EED
SHA-256:	D53D9957A7073B965147291AE6F4D812DF1CC06DA4D2BB3E98622FEDC5809265
SHA-512:	0C387D5B621EF6A6B8053DEC083FECB8F7C7823755C85505A5CF0B20267AAD5805BBDCD20FCC465C3B7FD24280C6459BCC3D5E991D571DBBF8BEE12275146A81
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_89db715e3340a2e8ecd8.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[26],{496:function(e,n,t

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64616)
Category:	dropped
Size (bytes):	449703
Entropy (8bit):	5.448833304498656
Encrypted:	false
SSDEEP:	6144:87LuGB2clRK2d/ZkpOYKsyA2pmBe9OpRUJ3cEHKE0H3NX44T:873NZkpbjyhpsUJ5E
MD5:	10BB4002DD986BC2121AE7343C970128
SHA1:	3EA61169BD06FF06B405CB59CE11506C301DF16B
SHA-256:	7DC87D100FFDA0B44300291491BBE7AC8A6EAE94937CCEC0494D5F154C07C3A0
SHA-512:	69EADB93E28BF35D0B6DDD2F3AE03C07CE4E6CB5893F7B4E1046E8343D9A1271DB6C04D650B06EEF933EDC6DC4F73B123044842D99FF383A269995FE191F1057
Malicious:	false
Reputation:	low
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */!function(e){function n(n){for(var t,i,o=n[0],r=n[1],s=0,c=[];s<o.length;s++)

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 280 x 60, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	6297
Entropy (8bit):	7.950489490026617
Encrypted:	false
SSDEEP:	192:fNIkYJa5hK1h7XcNxAx9OLQY2s0enNDwSdN:fCkf5hK1ZXqxO8LQYHVwSj
MD5:	74CABA060BC836E70D4F5D5F667040B1
SHA1:	0ADDEA394E0CC6C8D58145C767BB8AE245620BD9
SHA-256:	F91A4538E7B7789D0B53325D90E0D6661B774F01A5336A4B56BC3947560E9AF1
SHA-512:	8BC559C21BAFBE9C4FAC82663E25E0FC40198ECE08BBDC0E606676FE1C9D8FC391C579D3E4FBACC9B48D87C7BA1A89E95D94CE0B917E3AB5F0A359664EEB9E9C
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauthimages.net/c1c6b6c8-gu93kzcvv9nfo0jjjijxe9133mrsglit9lh2ikhkvmm/logintenantbranding/0/bannerlogo?ts=637271955782382065
Preview:	.PNG........IHDR.......<............pHYs..........+......tIME.....,...R....tEXtAuthor....H....tEXtDescription...!#....tEXtCopyright....:....tEXtCreation time.5.......tEXtSoftware.]p.:....tEXtDisclaimer.........tEXtWarning........tEXtSource.........tEXtComment........tEXtTitle....'...dIDATx..{...u...VUw.[B.....0`;FK..wY0~ .B.53....^...l6..l..]..... ..F.!@.$...$@l,..`.,4 .a,i..LwW.{....H..<z.GP...O..[..[]u.s.WT........Z...../.......-.....H.....2.....Q0.q..X.9}..w.+. [..)....S.h..j%cLL....F6.....8....>p..#.g3.{...9....)...........I.... .9.+..8...2&.......W>m....m....L.......ZRp4.....sW=S....\|.....lj_LK.yR..G.z.1.>..L..kT.W.....@..$!..7.Qmz...3.,.Y..z&O....Z.Y0....z.e...4.....\.....4.p4.D....W.Q...../.F6...3N{...W8.B.B..........y<).\ o.D..e...C...l\x..."&&f.q.`dS..H...>....ZV..xA.Se...\|...^.=Y...'......tPa.cbb.Ps.#].![...).W.cF@$o.....L#7D...$<....x.g6..-..8g&&f..k..~.......{..m.d..8..u.t7..Gh.<.."..w..^...0.F..w.#(..l..9....!.g4.{0x...SYj.`...<\|y

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=3, software=Adobe Photoshop 21.1 (Windows), datetime=2020:05:20 08:50:11], baseline, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	260198
Entropy (8bit):	7.7989912757437345
Encrypted:	false
SSDEEP:	6144:1dJZdJyY1hkXBFz56pyHQhlJPjlXefkzJlInkpUGjtD5Hl:79QY1hkxFt6p5tQfkonKUSD5Hl
MD5:	9A600534959BE4CEBB4D40210618729A
SHA1:	C509AFC66D9C3A8944AE47D7EA96C4C25B4A408A
SHA-256:	8A184884242A776FE964ADD5201901D13D38C5625CC2C3EC7536AB89165E011D
SHA-512:	111C56CD390C882AD09544FEE5A8C0D4609FC62817C8D68A99604948DC7C3F607EBE8316294566D109B2071CF536E497CE990C500E3AB79DA0989A4B6F6563ED
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauthimages.net/c1c6b6c8-yw-iky5-oitv6m8bxnlvjqeioua2sjr-bhiob-yiudy/logintenantbranding/0/illustration?ts=637255507111143881
Preview:	.....lExif..MM..............................b...........j.(...........1.........r.2...........i...............-....'..-....'.Adobe Photoshop 21.1 (Windows).2020:05:20 08:50:11.........................................8..............................."............(.....................2...........2.......H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................Z...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...<LLN.....4W.h.....znq....W...?.W.5.}W.bd~.Vv....sN..I....W.....^...........E9_X...T....Q.-.-...h..w~.......'.g?....U.3.d..f.....1.4g9.nVS[..o.J.....Sg

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 280x60, components 3
Category:	dropped
Size (bytes):	3444
Entropy (8bit):	7.655798209301478
Encrypted:	false
SSDEEP:	48:NJwvntyIJfbvabPqC5QTli1ZEe1FIBEoI2vgUAHPsOEhvCaCmktwcyyQpjqmjqqZ:PwoSbvEPj5QizsBEx+EvsFvC3lynYM
MD5:	7DF096CBE4C334A620E8A7DFB90C5ECB
SHA1:	D3DEB2259E78B3490FEAC5DD65BBA4947BA17DC7
SHA-256:	8DC749F17978416EBD7B4618DB677D96AEEBA1FC03A20C5FEDEB0203BABF8D6D
SHA-512:	E5A8DE6FCF16577B87E03C030830306663553AA750AFC1463490FB19F89DCD25B5FFC33D458A5AA197C7E818EBBD40162EB47FDBD115DE2B0B3B72EC47F69EDE
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.............Phttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164360, 2020/02/13-01:07:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:AF2670A99A5A11EAA4EABB2C4D6A73FA" xmpMM:InstanceID="xmp.iid:AF2670A89A5A11EAA4EABB2C4D6A73FA" xmp:CreatorTool="Adobe Photoshop 21.1 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="adobe:docid:photoshop:38e54cfa-64b4-734c-ae95-98c16b2ea7b7" stRef:documentID="adobe:docid:photoshop:38e54cfa-64b4-734c-ae95-98c16b2ea7b7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................................#%'%#.//33//@@@@@@@@@@@@@@@..................

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (25695)
Category:	dropped
Size (bytes):	26668
Entropy (8bit):	5.187975659586246
Encrypted:	false
SSDEEP:	384:DipbpSfn+aiGAhZUf3nsCVcgfTnLiylcURq0/A3bFphX/S5Q:qtVBUPnVcgbnrblQ
MD5:	23FC7EC7A5AEF418D4A703034E6F3F83
SHA1:	A36BB28ACC4F8943189AB4A7436B9C4716D48EED
SHA-256:	D53D9957A7073B965147291AE6F4D812DF1CC06DA4D2BB3E98622FEDC5809265
SHA-512:	0C387D5B621EF6A6B8053DEC083FECB8F7C7823755C85505A5CF0B20267AAD5805BBDCD20FCC465C3B7FD24280C6459BCC3D5E991D571DBBF8BEE12275146A81
Malicious:	false
Reputation:	low
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[26],{496:function(e,n,t

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 280x60, components 3
Category:	downloaded
Size (bytes):	3444
Entropy (8bit):	7.655798209301478
Encrypted:	false
SSDEEP:	48:NJwvntyIJfbvabPqC5QTli1ZEe1FIBEoI2vgUAHPsOEhvCaCmktwcyyQpjqmjqqZ:PwoSbvEPj5QizsBEx+EvsFvC3lynYM
MD5:	7DF096CBE4C334A620E8A7DFB90C5ECB
SHA1:	D3DEB2259E78B3490FEAC5DD65BBA4947BA17DC7
SHA-256:	8DC749F17978416EBD7B4618DB677D96AEEBA1FC03A20C5FEDEB0203BABF8D6D
SHA-512:	E5A8DE6FCF16577B87E03C030830306663553AA750AFC1463490FB19F89DCD25B5FFC33D458A5AA197C7E818EBBD40162EB47FDBD115DE2B0B3B72EC47F69EDE
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauthimages.net/c1c6b6c8-yw-iky5-oitv6m8bxnlvjqeioua2sjr-bhiob-yiudy/logintenantbranding/0/bannerlogo?ts=637255507118990034
Preview:	......Exif..II*.................Ducky.............Phttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164360, 2020/02/13-01:07:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:AF2670A99A5A11EAA4EABB2C4D6A73FA" xmpMM:InstanceID="xmp.iid:AF2670A89A5A11EAA4EABB2C4D6A73FA" xmp:CreatorTool="Adobe Photoshop 21.1 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="adobe:docid:photoshop:38e54cfa-64b4-734c-ae95-98c16b2ea7b7" stRef:documentID="adobe:docid:photoshop:38e54cfa-64b4-734c-ae95-98c16b2ea7b7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................................#%'%#.//33//@@@@@@@@@@@@@@@..................

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 141866
Category:	downloaded
Size (bytes):	49804
Entropy (8bit):	7.994672288751266
Encrypted:	true
SSDEEP:	1536:SMuttwJ0uUmAcZjNL6nnQlL+mwKLiQC7Mn3dxPErr:SwJ0vmAcKnnQF+8LJOMn3DPE/
MD5:	6DE768A4DF1E0D0061CDB52EF06346C4
SHA1:	3829A667B97668008023DDA98F4C0772174C8EF6
SHA-256:	58732EEE2ED9091F4F5776DC8A8A14116CBE5A2BA1CCDA0256896BAB08A52128
SHA-512:	CC6966D2C2B43E762750102E734DA6B88D7BFB92DDB5D482EE25029337D95E997466E83001586F2B63DAEE890B5F3188E8EC0F1B084D5EB67CFEA55EDDFAD47D
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js
Preview:	...........m[.8.0........OL....;w..nf.0.ff.X.'V......4.r~........=........,..JU.......T~.l..?..E.....X..\|t~P9...TN..G..?^.~.............Xx.0..Q..Fa4.#7.q...F.;......4...Q.W&~.@....O.T.y.37J.+Ggf...P....Pz.N...>..a.D..<.m./A,...Q.....WN.Q...8.Db$.G.H<...'....J,..8..{nG.2@HYkL../......=.pL....A?.&Ng.i,......2lo...$.<.3...?~pW..=...L..&x.QR.u3..#6q2....U.Y1..".M. .<W."7@......w..."H,@......0..P....p:...[...E].A..%..V.K\.......F.ir.}.Lc{s..O.g..(\|.........9o..A.t.K....Wv.l6..T.......t.........+..........-w {l..g...V..\=W.j.oaT}t.J`E..$W......;.k.\.t.w~}".....jf..W..."..a..0y........@.T.1.G0........Y_....../..........@.....]+....q\.cR.....t.3S-5g....'U.j.d......y.n,:).\|.?.FW...d...\|.......*.`.3....kMKf...#..,DM.TY+..g.........e+.>...{y..N/..g-#FV.V.p.......Xs.(..{..}..-.O..H=."...........8M.g..!H..0.~.Tdf.;...$D%N .)..!..V...'r\.... ...&....J\|."Nd%D:uw:.<W.+...H&.Z...L=..U.v....J.t.0%+...U..3M....y...L..G...p='.....pB"-..\|.....j .a".i=O.R Q2..."...

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=3, software=Adobe Photoshop 21.1 (Windows), datetime=2020:05:20 08:50:11], baseline, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	260198
Entropy (8bit):	7.7989912757437345
Encrypted:	false
SSDEEP:	6144:1dJZdJyY1hkXBFz56pyHQhlJPjlXefkzJlInkpUGjtD5Hl:79QY1hkxFt6p5tQfkonKUSD5Hl
MD5:	9A600534959BE4CEBB4D40210618729A
SHA1:	C509AFC66D9C3A8944AE47D7EA96C4C25B4A408A
SHA-256:	8A184884242A776FE964ADD5201901D13D38C5625CC2C3EC7536AB89165E011D
SHA-512:	111C56CD390C882AD09544FEE5A8C0D4609FC62817C8D68A99604948DC7C3F607EBE8316294566D109B2071CF536E497CE990C500E3AB79DA0989A4B6F6563ED
Malicious:	false
Reputation:	low
Preview:	.....lExif..MM..............................b...........j.(...........1.........r.2...........i...............-....'..-....'.Adobe Photoshop 21.1 (Windows).2020:05:20 08:50:11.........................................8..............................."............(.....................2...........2.......H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................Z...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...<LLN.....4W.h.....znq....W...?.W.5.}W.bd~.Vv....sN..I....W.....^...........E9_X...T....Q.-.-...h..w~.......'.g?....U.3.d..f.....1.4g9.nVS[..o.J.....Sg

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 14, 2024 13:04:09.700875044 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 14, 2024 13:04:10.004317045 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 14, 2024 13:04:10.611186028 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 14, 2024 13:04:11.818197012 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 14, 2024 13:04:12.650480032 CEST	49689	80	192.168.2.16	192.229.211.108
Oct 14, 2024 13:04:14.225240946 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 14, 2024 13:04:14.387098074 CEST	49711	443	192.168.2.16	142.250.181.228
Oct 14, 2024 13:04:14.387186050 CEST	443	49711	142.250.181.228	192.168.2.16
Oct 14, 2024 13:04:14.387280941 CEST	49711	443	192.168.2.16	142.250.181.228
Oct 14, 2024 13:04:14.387501955 CEST	49711	443	192.168.2.16	142.250.181.228
Oct 14, 2024 13:04:14.387522936 CEST	443	49711	142.250.181.228	192.168.2.16
Oct 14, 2024 13:04:15.092694998 CEST	443	49711	142.250.181.228	192.168.2.16
Oct 14, 2024 13:04:15.093044043 CEST	49711	443	192.168.2.16	142.250.181.228
Oct 14, 2024 13:04:15.093133926 CEST	443	49711	142.250.181.228	192.168.2.16
Oct 14, 2024 13:04:15.094765902 CEST	443	49711	142.250.181.228	192.168.2.16
Oct 14, 2024 13:04:15.094846010 CEST	49711	443	192.168.2.16	142.250.181.228
Oct 14, 2024 13:04:15.095777035 CEST	49711	443	192.168.2.16	142.250.181.228
Oct 14, 2024 13:04:15.095871925 CEST	443	49711	142.250.181.228	192.168.2.16
Oct 14, 2024 13:04:15.148334980 CEST	49711	443	192.168.2.16	142.250.181.228
Oct 14, 2024 13:04:15.148396015 CEST	443	49711	142.250.181.228	192.168.2.16
Oct 14, 2024 13:04:15.196331978 CEST	49711	443	192.168.2.16	142.250.181.228
Oct 14, 2024 13:04:15.649945974 CEST	49712	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:15.650057077 CEST	443	49712	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:15.650187969 CEST	49712	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:15.653755903 CEST	49712	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:15.653793097 CEST	443	49712	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:15.918282032 CEST	49713	443	192.168.2.16	184.28.90.27
Oct 14, 2024 13:04:15.918395996 CEST	443	49713	184.28.90.27	192.168.2.16
Oct 14, 2024 13:04:15.918517113 CEST	49713	443	192.168.2.16	184.28.90.27
Oct 14, 2024 13:04:15.920490980 CEST	49713	443	192.168.2.16	184.28.90.27
Oct 14, 2024 13:04:15.920526028 CEST	443	49713	184.28.90.27	192.168.2.16
Oct 14, 2024 13:04:16.322248936 CEST	443	49712	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:16.322549105 CEST	49712	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:16.322592020 CEST	443	49712	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:16.323568106 CEST	443	49712	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:16.323645115 CEST	49712	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:16.324661970 CEST	49712	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:16.324711084 CEST	443	49712	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:16.324825048 CEST	49712	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:16.324832916 CEST	443	49712	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:16.375226021 CEST	49712	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:16.434557915 CEST	443	49712	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:16.434583902 CEST	443	49712	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:16.434592009 CEST	443	49712	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:16.434657097 CEST	443	49712	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:16.434668064 CEST	49712	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:16.434706926 CEST	443	49712	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:16.434721947 CEST	443	49712	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:16.434736967 CEST	49712	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:16.434746981 CEST	49712	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:16.434773922 CEST	49712	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:16.516371965 CEST	443	49712	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:16.516392946 CEST	443	49712	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:16.516498089 CEST	49712	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:16.516570091 CEST	443	49712	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:16.516638994 CEST	49712	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:16.524053097 CEST	443	49712	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:16.524068117 CEST	443	49712	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:16.524137020 CEST	49712	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:16.524137974 CEST	443	49712	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:16.524189949 CEST	443	49712	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:16.524197102 CEST	49712	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:16.524225950 CEST	49712	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:16.524247885 CEST	49712	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:16.524674892 CEST	49712	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:16.524713039 CEST	443	49712	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:16.539280891 CEST	49714	443	192.168.2.16	13.107.246.67
Oct 14, 2024 13:04:16.539426088 CEST	443	49714	13.107.246.67	192.168.2.16
Oct 14, 2024 13:04:16.539493084 CEST	49714	443	192.168.2.16	13.107.246.67
Oct 14, 2024 13:04:16.539725065 CEST	49714	443	192.168.2.16	13.107.246.67
Oct 14, 2024 13:04:16.539753914 CEST	443	49714	13.107.246.67	192.168.2.16
Oct 14, 2024 13:04:16.649226904 CEST	443	49713	184.28.90.27	192.168.2.16
Oct 14, 2024 13:04:16.649308920 CEST	49713	443	192.168.2.16	184.28.90.27
Oct 14, 2024 13:04:16.654448986 CEST	49713	443	192.168.2.16	184.28.90.27
Oct 14, 2024 13:04:16.654472113 CEST	443	49713	184.28.90.27	192.168.2.16
Oct 14, 2024 13:04:16.654831886 CEST	443	49713	184.28.90.27	192.168.2.16
Oct 14, 2024 13:04:16.706290960 CEST	49713	443	192.168.2.16	184.28.90.27
Oct 14, 2024 13:04:16.751414061 CEST	443	49713	184.28.90.27	192.168.2.16
Oct 14, 2024 13:04:16.977544069 CEST	443	49713	184.28.90.27	192.168.2.16
Oct 14, 2024 13:04:16.977636099 CEST	443	49713	184.28.90.27	192.168.2.16
Oct 14, 2024 13:04:16.977699995 CEST	49713	443	192.168.2.16	184.28.90.27
Oct 14, 2024 13:04:16.977747917 CEST	49713	443	192.168.2.16	184.28.90.27
Oct 14, 2024 13:04:16.977776051 CEST	443	49713	184.28.90.27	192.168.2.16
Oct 14, 2024 13:04:16.977802992 CEST	49713	443	192.168.2.16	184.28.90.27
Oct 14, 2024 13:04:16.977812052 CEST	443	49713	184.28.90.27	192.168.2.16
Oct 14, 2024 13:04:17.025904894 CEST	49718	443	192.168.2.16	184.28.90.27
Oct 14, 2024 13:04:17.025978088 CEST	443	49718	184.28.90.27	192.168.2.16
Oct 14, 2024 13:04:17.026052952 CEST	49718	443	192.168.2.16	184.28.90.27
Oct 14, 2024 13:04:17.026386023 CEST	49718	443	192.168.2.16	184.28.90.27
Oct 14, 2024 13:04:17.026401043 CEST	443	49718	184.28.90.27	192.168.2.16
Oct 14, 2024 13:04:17.201869965 CEST	443	49714	13.107.246.67	192.168.2.16
Oct 14, 2024 13:04:17.202466011 CEST	49714	443	192.168.2.16	13.107.246.67
Oct 14, 2024 13:04:17.202533960 CEST	443	49714	13.107.246.67	192.168.2.16
Oct 14, 2024 13:04:17.204065084 CEST	443	49714	13.107.246.67	192.168.2.16
Oct 14, 2024 13:04:17.204170942 CEST	49714	443	192.168.2.16	13.107.246.67
Oct 14, 2024 13:04:17.204540014 CEST	49714	443	192.168.2.16	13.107.246.67
Oct 14, 2024 13:04:17.204628944 CEST	443	49714	13.107.246.67	192.168.2.16
Oct 14, 2024 13:04:17.204684973 CEST	49714	443	192.168.2.16	13.107.246.67
Oct 14, 2024 13:04:17.250263929 CEST	49714	443	192.168.2.16	13.107.246.67
Oct 14, 2024 13:04:17.250288010 CEST	443	49714	13.107.246.67	192.168.2.16
Oct 14, 2024 13:04:17.298299074 CEST	49714	443	192.168.2.16	13.107.246.67
Oct 14, 2024 13:04:17.324424982 CEST	443	49714	13.107.246.67	192.168.2.16
Oct 14, 2024 13:04:17.324484110 CEST	443	49714	13.107.246.67	192.168.2.16
Oct 14, 2024 13:04:17.324503899 CEST	443	49714	13.107.246.67	192.168.2.16
Oct 14, 2024 13:04:17.324544907 CEST	443	49714	13.107.246.67	192.168.2.16
Oct 14, 2024 13:04:17.324549913 CEST	49714	443	192.168.2.16	13.107.246.67
Oct 14, 2024 13:04:17.324564934 CEST	443	49714	13.107.246.67	192.168.2.16
Oct 14, 2024 13:04:17.324583054 CEST	443	49714	13.107.246.67	192.168.2.16
Oct 14, 2024 13:04:17.324611902 CEST	49714	443	192.168.2.16	13.107.246.67
Oct 14, 2024 13:04:17.324637890 CEST	443	49714	13.107.246.67	192.168.2.16
Oct 14, 2024 13:04:17.324666023 CEST	49714	443	192.168.2.16	13.107.246.67
Oct 14, 2024 13:04:17.324691057 CEST	49714	443	192.168.2.16	13.107.246.67
Oct 14, 2024 13:04:17.411226034 CEST	443	49714	13.107.246.67	192.168.2.16
Oct 14, 2024 13:04:17.411295891 CEST	443	49714	13.107.246.67	192.168.2.16
Oct 14, 2024 13:04:17.411355019 CEST	49714	443	192.168.2.16	13.107.246.67
Oct 14, 2024 13:04:17.411401987 CEST	443	49714	13.107.246.67	192.168.2.16
Oct 14, 2024 13:04:17.411437035 CEST	49714	443	192.168.2.16	13.107.246.67
Oct 14, 2024 13:04:17.411458015 CEST	49714	443	192.168.2.16	13.107.246.67
Oct 14, 2024 13:04:17.414844036 CEST	443	49714	13.107.246.67	192.168.2.16
Oct 14, 2024 13:04:17.414895058 CEST	443	49714	13.107.246.67	192.168.2.16
Oct 14, 2024 13:04:17.414954901 CEST	49714	443	192.168.2.16	13.107.246.67
Oct 14, 2024 13:04:17.414992094 CEST	443	49714	13.107.246.67	192.168.2.16
Oct 14, 2024 13:04:17.415014029 CEST	443	49714	13.107.246.67	192.168.2.16
Oct 14, 2024 13:04:17.415019989 CEST	49714	443	192.168.2.16	13.107.246.67
Oct 14, 2024 13:04:17.415067911 CEST	49714	443	192.168.2.16	13.107.246.67
Oct 14, 2024 13:04:17.415081978 CEST	443	49714	13.107.246.67	192.168.2.16
Oct 14, 2024 13:04:17.415132046 CEST	49714	443	192.168.2.16	13.107.246.67
Oct 14, 2024 13:04:17.415185928 CEST	443	49714	13.107.246.67	192.168.2.16
Oct 14, 2024 13:04:17.415246964 CEST	49714	443	192.168.2.16	13.107.246.67
Oct 14, 2024 13:04:17.415605068 CEST	49714	443	192.168.2.16	13.107.246.67
Oct 14, 2024 13:04:17.415637016 CEST	443	49714	13.107.246.67	192.168.2.16
Oct 14, 2024 13:04:17.726022005 CEST	443	49718	184.28.90.27	192.168.2.16
Oct 14, 2024 13:04:17.726236105 CEST	49718	443	192.168.2.16	184.28.90.27
Oct 14, 2024 13:04:17.727308035 CEST	49718	443	192.168.2.16	184.28.90.27
Oct 14, 2024 13:04:17.727330923 CEST	443	49718	184.28.90.27	192.168.2.16
Oct 14, 2024 13:04:17.727595091 CEST	443	49718	184.28.90.27	192.168.2.16
Oct 14, 2024 13:04:17.728713036 CEST	49718	443	192.168.2.16	184.28.90.27
Oct 14, 2024 13:04:17.771414042 CEST	443	49718	184.28.90.27	192.168.2.16
Oct 14, 2024 13:04:17.856697083 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 14, 2024 13:04:17.875602961 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:17.875646114 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:17.875710011 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:17.876059055 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:17.876070023 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:17.968986988 CEST	49721	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:17.969079018 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:17.969187975 CEST	49721	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:17.969540119 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:17.969559908 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:17.969624996 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:17.969824076 CEST	49721	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:17.969851017 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:17.970027924 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:17.970056057 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:18.170195103 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 14, 2024 13:04:18.360151052 CEST	443	49718	184.28.90.27	192.168.2.16
Oct 14, 2024 13:04:18.360239983 CEST	443	49718	184.28.90.27	192.168.2.16
Oct 14, 2024 13:04:18.360299110 CEST	49718	443	192.168.2.16	184.28.90.27
Oct 14, 2024 13:04:18.361085892 CEST	49718	443	192.168.2.16	184.28.90.27
Oct 14, 2024 13:04:18.361085892 CEST	49718	443	192.168.2.16	184.28.90.27
Oct 14, 2024 13:04:18.361134052 CEST	443	49718	184.28.90.27	192.168.2.16
Oct 14, 2024 13:04:18.361177921 CEST	443	49718	184.28.90.27	192.168.2.16
Oct 14, 2024 13:04:18.762789011 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:18.763052940 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:18.763087988 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:18.764564991 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:18.764630079 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:18.765602112 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:18.765681982 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:18.765916109 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:18.765925884 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:18.774213076 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 14, 2024 13:04:18.806212902 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:18.839900017 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:18.840181112 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:18.840229988 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:18.840517044 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:18.840693951 CEST	49721	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:18.840713024 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:18.841675997 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:18.841746092 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:18.842051983 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:18.842140913 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:18.842179060 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:18.842231989 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:18.842298031 CEST	49721	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:18.842530966 CEST	49721	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:18.842612028 CEST	49721	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:18.842624903 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:18.842647076 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:18.883445978 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:18.886337042 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:18.886409044 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:18.886450052 CEST	49721	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:18.886466026 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:18.934344053 CEST	49721	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:18.934344053 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.024785995 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.031116962 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 14, 2024 13:04:19.074340105 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.074359894 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.074381113 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.074549913 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.074549913 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.074596882 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.074613094 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.074654102 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.107948065 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.108120918 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.109313965 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.109323978 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.109399080 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.109441996 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.109453917 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.109477043 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.109529972 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.109579086 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.109579086 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.109579086 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.109616995 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.109628916 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.109678030 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.118088007 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.118118048 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.118163109 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.118201017 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.118227959 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.118256092 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.120603085 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.120613098 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.120628119 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.120667934 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.120682001 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.120723009 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.120734930 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.120734930 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.156250000 CEST	49721	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.172211885 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.200658083 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.200676918 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.200767040 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.200779915 CEST	49721	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.200819016 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.200862885 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.200891972 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.200925112 CEST	49721	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.200925112 CEST	49721	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.200926065 CEST	49721	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.200954914 CEST	49721	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.201452017 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.201472998 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.201538086 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.201538086 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.201558113 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.201611042 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.201713085 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.201721907 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.201761961 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.201781034 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.201793909 CEST	49721	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.201819897 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.201847076 CEST	49721	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.201847076 CEST	49721	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.201874971 CEST	49721	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.202918053 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.202938080 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.203011990 CEST	49721	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.203026056 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.203090906 CEST	49721	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.203618050 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.203639030 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.203696012 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.203710079 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.203766108 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.210254908 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.210270882 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.210289955 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.210328102 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.210333109 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.210354090 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.210372925 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.210397959 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.211868048 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.211894989 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.211936951 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.211942911 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.211967945 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.211985111 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.212660074 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.212680101 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.212722063 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.212727070 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.212755919 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.212774992 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.214286089 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.214323997 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.214363098 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.214369059 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.214401007 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.214427948 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.214476109 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.214539051 CEST	49720	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.214555025 CEST	443	49720	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.288522005 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.288549900 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.288605928 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.288644075 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.288671970 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.288712978 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.289473057 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.289547920 CEST	49721	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.289563894 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.289596081 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.289637089 CEST	49721	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.290014029 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.290033102 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.290070057 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.290070057 CEST	49721	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.290096998 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.290132046 CEST	443	49721	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.290157080 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.290157080 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.291774988 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.291794062 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.291846991 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.291886091 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.291917086 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.291944027 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.292645931 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.292665005 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.292706013 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.292726040 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.292749882 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.292774916 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.301445007 CEST	49725	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.301474094 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.301537037 CEST	49725	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.301768064 CEST	49725	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.301784039 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.376761913 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.376784086 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.376841068 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.376857996 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.376897097 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.376905918 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.377054930 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.377074957 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.377106905 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.377115965 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.377142906 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.377170086 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.377711058 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.377731085 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.377760887 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.377770901 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.377799034 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.377810955 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.378755093 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.378776073 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.378806114 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.378815889 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.378848076 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.378865004 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.379682064 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.379700899 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.379730940 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.379739046 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.379787922 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.379796982 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.380458117 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.380476952 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.380511999 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.380520105 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.380551100 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.380573988 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.381377935 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.381397963 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.381443977 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.381449938 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.381475925 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.381491899 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.465029955 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.465050936 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.465137959 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.465172052 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.465250015 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.465672970 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.465692043 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.465747118 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.465759993 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.465826988 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.466186047 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.466204882 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.466259003 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.466273069 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.466337919 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.471971035 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.471991062 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.472079039 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.472114086 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.472182989 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.472456932 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.472475052 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.472522020 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.472537041 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.472573996 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.472573996 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.473038912 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.473059893 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.473117113 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.473129034 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.473155022 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.473196983 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.473540068 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.473560095 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.473620892 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.473638058 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.473663092 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.473685980 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.552653074 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.552720070 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.552747011 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.552778959 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.552814007 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.552834988 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.553116083 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.553158998 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.553201914 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.553215981 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.553242922 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.553277969 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.553289890 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.553625107 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.553675890 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.553687096 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.553709030 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.553736925 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.553961992 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.554003000 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.554027081 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.554040909 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.554068089 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.554514885 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.554558992 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.554584980 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.554598093 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.554625034 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.554972887 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.555011988 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.555031061 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.555044889 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.555073023 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.555135965 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.555192947 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.555206060 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.555324078 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.555418968 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.555543900 CEST	49722	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.555568933 CEST	443	49722	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.558912992 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.558959961 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.559025049 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.559236050 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.559258938 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.587909937 CEST	49727	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.587959051 CEST	443	49727	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.588027000 CEST	49727	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.588290930 CEST	49727	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.588306904 CEST	443	49727	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.616976976 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.617072105 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.617146969 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.617597103 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:19.617619038 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:19.982227087 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 14, 2024 13:04:20.143723965 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.144028902 CEST	49725	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.144062996 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.145076990 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.145153999 CEST	49725	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.145530939 CEST	49725	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.145585060 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.145689011 CEST	49725	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.190220118 CEST	49725	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.190229893 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.238209009 CEST	49725	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.308562040 CEST	49729	443	192.168.2.16	4.245.163.56
Oct 14, 2024 13:04:20.308657885 CEST	443	49729	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:20.308795929 CEST	49729	443	192.168.2.16	4.245.163.56
Oct 14, 2024 13:04:20.309837103 CEST	49729	443	192.168.2.16	4.245.163.56
Oct 14, 2024 13:04:20.309874058 CEST	443	49729	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:20.368191957 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.369132996 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.369168997 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.370644093 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.370714903 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.379580021 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.379777908 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.379817009 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.401225090 CEST	443	49727	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.401774883 CEST	49727	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.401793957 CEST	443	49727	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.403244972 CEST	443	49727	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.403323889 CEST	49727	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.403616905 CEST	49727	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.403695107 CEST	443	49727	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.403738976 CEST	49727	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.409698009 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.427396059 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.428688049 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.428715944 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.437446117 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.445540905 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.445580959 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.447104931 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.447210073 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.447452068 CEST	443	49727	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.448205948 CEST	49727	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.448223114 CEST	443	49727	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.449105024 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.449254036 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.449276924 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.450030088 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.450042009 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.450108051 CEST	49725	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.450139046 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.450156927 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.450210094 CEST	49725	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.450232029 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.450283051 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.450310946 CEST	49725	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.450315952 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.450330019 CEST	49725	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.476195097 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.491451025 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.492268085 CEST	49725	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.492600918 CEST	49727	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.492908955 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.492961884 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.499403000 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.499417067 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.499463081 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.499464989 CEST	49725	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.499485970 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.499505043 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.499510050 CEST	49725	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.499515057 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.499531031 CEST	49725	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.499552011 CEST	49725	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.501332998 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.501343012 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.501368999 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.501389980 CEST	49725	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.501403093 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.501418114 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.501430035 CEST	49725	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.505207062 CEST	49725	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.541856050 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.585733891 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.585813999 CEST	49725	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.585830927 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.586103916 CEST	49725	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.588294983 CEST	49725	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.588311911 CEST	443	49725	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.633158922 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.666275978 CEST	443	49727	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.678208113 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.678220034 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.678258896 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.678282022 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.678280115 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.678293943 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.678328037 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.678347111 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.678347111 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.678356886 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.678369045 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.704329967 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.710131884 CEST	443	49727	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.710144043 CEST	443	49727	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.710175037 CEST	443	49727	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.710191965 CEST	443	49727	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.710206032 CEST	443	49727	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.710241079 CEST	49727	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.710241079 CEST	49727	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.710267067 CEST	443	49727	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.710280895 CEST	443	49727	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.710295916 CEST	49727	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.710304976 CEST	443	49727	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.710320950 CEST	49727	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.710354090 CEST	49727	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.710644960 CEST	49727	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.710661888 CEST	443	49727	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.713224888 CEST	49730	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.713258028 CEST	443	49730	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.713309050 CEST	49730	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.713550091 CEST	49730	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.713562965 CEST	443	49730	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.722770929 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.722783089 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.722806931 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.722831964 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.722843885 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.722887993 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.722893000 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.722904921 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.722908020 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.722939014 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.724679947 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.724689960 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.724705935 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.724739075 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.724745035 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.724756002 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.724785089 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.724812984 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.746218920 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.747277021 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.747303963 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.747347116 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.747375965 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.747435093 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.747435093 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.747500896 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.747519970 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.747562885 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.747574091 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.747598886 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.747622967 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.798309088 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.798336029 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.798402071 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.798434973 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.798460007 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.798470974 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.798491001 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.798518896 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.798518896 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.798541069 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.799962997 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.800005913 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.800034046 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.800046921 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.800071955 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.800091028 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.817953110 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.817981005 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.818012953 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.818023920 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.818061113 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.818075895 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.819359064 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.819380045 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.819423914 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.819437027 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.819453955 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.819488049 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.821347952 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.821366072 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.821412086 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.821422100 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.821434021 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.821486950 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.886771917 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.886828899 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.886878014 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.886914968 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.886940956 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.887906075 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.887955904 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.887989998 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.888003111 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.888029099 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.888048887 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.889611959 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.889656067 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.889703035 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.889714003 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.889738083 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.889758110 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.890898943 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.890944004 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.890985012 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.890994072 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.891021013 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.891037941 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.906274080 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.906296968 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.906358957 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.906394005 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.906413078 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.907042980 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.907068014 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.907114029 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.907123089 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.907141924 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.907183886 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.907778978 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.907799006 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.907841921 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.907850027 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.907872915 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.907886028 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.908689022 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.908706903 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.908766985 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.908775091 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.908817053 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.909612894 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.909631014 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.909696102 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.909703970 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.909746885 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.910532951 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.910552025 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.910600901 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.910609007 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.910640001 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.910659075 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.976344109 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.976393938 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.976450920 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.976475000 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.976501942 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.976522923 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.977099895 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.977144957 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.977194071 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.977204084 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.977231026 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.977250099 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.977864027 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.977904081 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.977937937 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.977946997 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.977973938 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.977992058 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.978725910 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.978764057 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.978804111 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.978816986 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.978841066 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.978859901 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.979681015 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.979722023 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.979759932 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.979769945 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.979794025 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.979810953 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.980725050 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.980781078 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.980813980 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.980823994 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.980850935 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.980870008 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.981432915 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.981472969 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.981498957 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.981508017 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.981538057 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.981556892 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.994851112 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.994873047 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.995035887 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.995066881 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.995172977 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.995285034 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.995285034 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.995316982 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.995405912 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.995743990 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.995763063 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.995821953 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.995836973 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.995892048 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.996372938 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.996391058 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.996443033 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.996453047 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.996495008 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.999847889 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.999866009 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.999928951 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.999937057 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:20.999963045 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:20.999979973 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.000051022 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.000070095 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.000124931 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.000133038 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.000188112 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.000612020 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.000629902 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.000674009 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.000680923 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.000719070 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.000729084 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.033495903 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.033533096 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.033711910 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.033757925 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.033809900 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.066185951 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.066245079 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.066286087 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.066322088 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.066345930 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.066366911 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.066529036 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.066574097 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.066595078 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.066612005 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.066632032 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.066657066 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.066750050 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.067012072 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.067054033 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.067075968 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.067094088 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.067116022 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.067250967 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.067306995 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.067327023 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.067342997 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.067369938 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.067893028 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.067934036 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.067962885 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.067980051 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.067998886 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.068142891 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.068202019 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.068227053 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.068242073 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.068260908 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.072318077 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.072356939 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.072402954 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.072415113 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.072444916 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.083834887 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.083853960 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.083928108 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.083959103 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.084012985 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.084255934 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.084275007 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.084338903 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.084347963 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.084388971 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.084630966 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.084646940 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.084697008 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.084705114 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.084742069 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.085030079 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.085047960 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.085102081 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.085110903 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.085153103 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.085448980 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.085485935 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.085515976 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.085522890 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.085541964 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.085565090 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.085815907 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.085834026 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.085896969 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.085906029 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.085944891 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.086195946 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.086215019 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.086251974 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.086258888 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.086287022 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.086307049 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.086342096 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.086397886 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.086404085 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.086425066 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.086467981 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.086571932 CEST	49726	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.086585999 CEST	443	49726	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.092930079 CEST	443	49729	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:21.093055010 CEST	49729	443	192.168.2.16	4.245.163.56
Oct 14, 2024 13:04:21.095679998 CEST	49729	443	192.168.2.16	4.245.163.56
Oct 14, 2024 13:04:21.095706940 CEST	443	49729	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:21.096117973 CEST	443	49729	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:21.113219976 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.145435095 CEST	49729	443	192.168.2.16	4.245.163.56
Oct 14, 2024 13:04:21.163017035 CEST	49729	443	192.168.2.16	4.245.163.56
Oct 14, 2024 13:04:21.207400084 CEST	443	49729	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:21.426584959 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.426635027 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.426676035 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.426703930 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.426723957 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.426744938 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.426939964 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.426981926 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.427001953 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.427017927 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.427038908 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.427053928 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.427177906 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.427218914 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.427239895 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.427254915 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.427274942 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.427294016 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.427412987 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.427491903 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.427521944 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.427547932 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.427558899 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.427615881 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.427728891 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.427762032 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.427779913 CEST	443	49728	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.427799940 CEST	49728	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.431068897 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.431126118 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.431226969 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.431452990 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.431480885 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.449660063 CEST	49732	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.449704885 CEST	443	49732	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.449776888 CEST	49732	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.450047970 CEST	49732	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.450062037 CEST	443	49732	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.451455116 CEST	49733	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.451483011 CEST	443	49733	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.451541901 CEST	49733	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.451757908 CEST	49734	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.451767921 CEST	443	49734	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.451816082 CEST	49734	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.451983929 CEST	49733	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.452001095 CEST	443	49733	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.452142954 CEST	49734	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.452153921 CEST	443	49734	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.611500025 CEST	443	49730	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.611793041 CEST	49730	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.611829996 CEST	443	49730	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.612211943 CEST	443	49730	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.612668991 CEST	49730	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.612752914 CEST	443	49730	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.612838984 CEST	49730	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.659415960 CEST	443	49730	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.677555084 CEST	443	49729	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:21.677582026 CEST	443	49729	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:21.677592039 CEST	443	49729	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:21.677608013 CEST	443	49729	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:21.677647114 CEST	443	49729	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:21.677670002 CEST	49729	443	192.168.2.16	4.245.163.56
Oct 14, 2024 13:04:21.677715063 CEST	443	49729	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:21.677733898 CEST	49729	443	192.168.2.16	4.245.163.56
Oct 14, 2024 13:04:21.677741051 CEST	443	49729	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:21.677774906 CEST	49729	443	192.168.2.16	4.245.163.56
Oct 14, 2024 13:04:21.677799940 CEST	49729	443	192.168.2.16	4.245.163.56
Oct 14, 2024 13:04:21.677808046 CEST	443	49729	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:21.677833080 CEST	443	49729	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:21.677870035 CEST	49729	443	192.168.2.16	4.245.163.56
Oct 14, 2024 13:04:21.687688112 CEST	49729	443	192.168.2.16	4.245.163.56
Oct 14, 2024 13:04:21.687704086 CEST	443	49729	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:21.687720060 CEST	49729	443	192.168.2.16	4.245.163.56
Oct 14, 2024 13:04:21.687726021 CEST	443	49729	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:21.878644943 CEST	443	49730	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.924240112 CEST	49730	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.928414106 CEST	443	49730	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.928421974 CEST	443	49730	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.928493977 CEST	49730	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.928498983 CEST	443	49730	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.928540945 CEST	443	49730	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.928556919 CEST	443	49730	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:21.928569078 CEST	49730	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.928631067 CEST	49730	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.928631067 CEST	49730	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.928994894 CEST	49730	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:21.929022074 CEST	443	49730	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.275073051 CEST	443	49732	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.275337934 CEST	49732	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.275352955 CEST	443	49732	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.275844097 CEST	443	49732	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.276179075 CEST	49732	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.276245117 CEST	443	49732	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.276319027 CEST	49732	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.285063982 CEST	443	49734	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.285264015 CEST	49734	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.285286903 CEST	443	49734	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.286267042 CEST	443	49734	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.286330938 CEST	49734	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.286592007 CEST	49734	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.286653042 CEST	443	49734	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.286705971 CEST	49734	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.286715031 CEST	443	49734	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.290901899 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.291188002 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.291230917 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.291745901 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.292150974 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.292258024 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.292314053 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.293656111 CEST	443	49733	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.293864965 CEST	49733	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.293874979 CEST	443	49733	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.294986963 CEST	443	49733	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.295269966 CEST	49733	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.295378923 CEST	49733	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.295389891 CEST	443	49733	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.295464039 CEST	443	49733	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.321217060 CEST	49732	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.321225882 CEST	443	49732	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.337198973 CEST	49734	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.337218046 CEST	49733	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.337248087 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.337292910 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.337615013 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 14, 2024 13:04:22.385240078 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 14, 2024 13:04:22.546220064 CEST	443	49732	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.547187090 CEST	443	49732	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.547208071 CEST	443	49732	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.547246933 CEST	443	49732	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.547271013 CEST	49732	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.547280073 CEST	443	49732	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.547286987 CEST	443	49732	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.547328949 CEST	49732	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.547328949 CEST	49732	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.547336102 CEST	443	49732	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.547451019 CEST	443	49732	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.547629118 CEST	49732	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.547790051 CEST	49732	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.547790051 CEST	49732	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.547804117 CEST	443	49732	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.547861099 CEST	49732	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.550443888 CEST	49735	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.550462961 CEST	443	49735	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.550589085 CEST	49735	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.550921917 CEST	49735	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.550931931 CEST	443	49735	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.553385973 CEST	443	49734	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.553432941 CEST	443	49734	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.553479910 CEST	443	49734	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.553530931 CEST	49734	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.554352999 CEST	49734	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.554371119 CEST	443	49734	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.561954021 CEST	49736	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.562041998 CEST	443	49736	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.562149048 CEST	49736	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.562369108 CEST	49736	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.562403917 CEST	443	49736	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.562484980 CEST	443	49733	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.562592983 CEST	443	49733	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.562640905 CEST	49733	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.562664032 CEST	443	49733	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.562704086 CEST	49733	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.562735081 CEST	443	49733	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.562793016 CEST	49733	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.563220024 CEST	49733	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.563232899 CEST	443	49733	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.570679903 CEST	49737	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.570751905 CEST	443	49737	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.570883036 CEST	49737	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.571048975 CEST	49737	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.571080923 CEST	443	49737	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.584808111 CEST	49738	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:22.584849119 CEST	443	49738	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:22.584927082 CEST	49738	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:22.584999084 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:22.585025072 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:22.585084915 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:22.585249901 CEST	49738	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:22.585270882 CEST	443	49738	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:22.585444927 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:22.585467100 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:22.585910082 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.614851952 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.614876986 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.614922047 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.614923000 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.614975929 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.615006924 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.615006924 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.615011930 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.615046978 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.638266087 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 14, 2024 13:04:22.666760921 CEST	49740	443	192.168.2.16	40.126.32.74
Oct 14, 2024 13:04:22.666806936 CEST	443	49740	40.126.32.74	192.168.2.16
Oct 14, 2024 13:04:22.666886091 CEST	49740	443	192.168.2.16	40.126.32.74
Oct 14, 2024 13:04:22.667099953 CEST	49740	443	192.168.2.16	40.126.32.74
Oct 14, 2024 13:04:22.667114019 CEST	443	49740	40.126.32.74	192.168.2.16
Oct 14, 2024 13:04:22.669470072 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.676476002 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.676493883 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.676517963 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.676529884 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.676577091 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.676620960 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.676676989 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.676676989 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.676700115 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.678390026 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.678410053 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.678438902 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.678478003 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.678499937 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.678522110 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.742219925 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.763864994 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.763883114 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.763904095 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.763916016 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.763957977 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.763978004 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.764005899 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.764030933 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.765336037 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.765364885 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.765409946 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.765423059 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.765451908 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.765489101 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.766321898 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.766340971 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.766392946 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.766403913 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.766428947 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.766486883 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.767997980 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.768018961 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.768059969 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.768071890 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.768111944 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.768141031 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.853058100 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.853092909 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.853169918 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.853246927 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.853292942 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.853544950 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.853588104 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.853605986 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.853645086 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.853660107 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.853684902 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.853701115 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.854219913 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.854239941 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.854315042 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.854329109 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.854371071 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.855151892 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.855173111 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.855272055 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.855287075 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.855334044 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.856029987 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.856050968 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.856133938 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.856148005 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.856198072 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.857079029 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.857100010 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.857197046 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.857214928 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.857261896 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.857924938 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.857948065 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.858015060 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.858025074 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.858062983 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.941989899 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.942023039 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.942076921 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.942116022 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.942137003 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.942367077 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.942394972 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.942429066 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.942439079 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.942454100 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.942478895 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.942853928 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.942873001 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.942908049 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.942918062 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.942931890 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.942955017 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.943339109 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.943356037 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.943393946 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.943402052 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.943418980 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.943438053 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.943825006 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.943850040 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.943886042 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.943895102 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.943918943 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.943933964 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.944319963 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.944339991 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.944370985 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.944382906 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.944402933 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.944421053 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.950258017 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.950278044 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.950337887 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.950357914 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.950392962 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.950699091 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.950716019 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.950745106 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.950752020 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:22.950773954 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:22.950787067 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.030330896 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.030354023 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.030450106 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.030520916 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.030587912 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.030811071 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.030829906 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.030874968 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.030889988 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.030931950 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.031125069 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.031173944 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.031205893 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.031220913 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.031246901 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.031248093 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.031275988 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.031303883 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.031469107 CEST	49731	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.031502008 CEST	443	49731	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.242366076 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 14, 2024 13:04:23.278634071 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:23.278908968 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:23.278970957 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:23.279031992 CEST	443	49738	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:23.279211044 CEST	49738	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:23.279273987 CEST	443	49738	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:23.279978991 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:23.280049086 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:23.280316114 CEST	443	49738	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:23.280391932 CEST	49738	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:23.281054974 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:23.281124115 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:23.281217098 CEST	49738	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:23.281306982 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:23.281311035 CEST	443	49738	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:23.281323910 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:23.281393051 CEST	49738	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:23.281415939 CEST	443	49738	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:23.321228027 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:23.321351051 CEST	49738	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:23.381735086 CEST	443	49736	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.382030964 CEST	49736	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.382091999 CEST	443	49736	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.382592916 CEST	443	49736	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.382906914 CEST	49736	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.382998943 CEST	443	49736	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.383028030 CEST	49736	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.386409998 CEST	443	49737	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.386667967 CEST	49737	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.386692047 CEST	443	49737	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.389708042 CEST	443	49737	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.389780045 CEST	49737	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.390055895 CEST	49737	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.390137911 CEST	443	49737	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.390177011 CEST	49737	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.427400112 CEST	443	49736	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.432326078 CEST	49737	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.432334900 CEST	49736	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.432343006 CEST	443	49737	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.441303968 CEST	443	49735	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.441504955 CEST	49735	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.441514969 CEST	443	49735	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.441834927 CEST	443	49735	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.442122936 CEST	49735	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.442177057 CEST	443	49735	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.442234993 CEST	49735	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.480221987 CEST	49737	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.487425089 CEST	443	49735	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.491703987 CEST	443	49740	40.126.32.74	192.168.2.16
Oct 14, 2024 13:04:23.491898060 CEST	49740	443	192.168.2.16	40.126.32.74
Oct 14, 2024 13:04:23.491913080 CEST	443	49740	40.126.32.74	192.168.2.16
Oct 14, 2024 13:04:23.493066072 CEST	443	49740	40.126.32.74	192.168.2.16
Oct 14, 2024 13:04:23.493139982 CEST	49740	443	192.168.2.16	40.126.32.74
Oct 14, 2024 13:04:23.494213104 CEST	49740	443	192.168.2.16	40.126.32.74
Oct 14, 2024 13:04:23.494281054 CEST	443	49740	40.126.32.74	192.168.2.16
Oct 14, 2024 13:04:23.494302988 CEST	49740	443	192.168.2.16	40.126.32.74
Oct 14, 2024 13:04:23.496217012 CEST	49735	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.537044048 CEST	443	49738	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:23.537060976 CEST	443	49738	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:23.537112951 CEST	443	49738	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:23.537167072 CEST	49738	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:23.537442923 CEST	49738	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:23.537817955 CEST	49738	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:23.537859917 CEST	443	49738	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:23.539419889 CEST	443	49740	40.126.32.74	192.168.2.16
Oct 14, 2024 13:04:23.544225931 CEST	49740	443	192.168.2.16	40.126.32.74
Oct 14, 2024 13:04:23.544245958 CEST	443	49740	40.126.32.74	192.168.2.16
Oct 14, 2024 13:04:23.549333096 CEST	49741	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:23.549396992 CEST	443	49741	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:23.549478054 CEST	49741	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:23.549715042 CEST	49741	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:23.549750090 CEST	443	49741	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:23.590234041 CEST	49740	443	192.168.2.16	40.126.32.74
Oct 14, 2024 13:04:23.646106005 CEST	443	49736	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.647193909 CEST	443	49736	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.647203922 CEST	443	49736	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.647278070 CEST	443	49736	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.647376060 CEST	443	49736	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.647423029 CEST	49736	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.647423029 CEST	49736	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.647492886 CEST	443	49736	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.647562027 CEST	49736	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.647562027 CEST	49736	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.647906065 CEST	49736	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.647967100 CEST	443	49736	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.650480986 CEST	443	49737	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.650590897 CEST	443	49737	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.650650978 CEST	49737	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.650669098 CEST	443	49737	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.650736094 CEST	443	49737	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.650846004 CEST	49737	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.651140928 CEST	49737	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.651171923 CEST	443	49737	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.743581057 CEST	443	49735	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.743629932 CEST	443	49735	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.743690968 CEST	49735	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.743704081 CEST	443	49735	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.743762970 CEST	49735	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.744415998 CEST	49735	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.744436026 CEST	443	49735	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.753142118 CEST	443	49740	40.126.32.74	192.168.2.16
Oct 14, 2024 13:04:23.753365993 CEST	443	49740	40.126.32.74	192.168.2.16
Oct 14, 2024 13:04:23.753439903 CEST	49740	443	192.168.2.16	40.126.32.74
Oct 14, 2024 13:04:23.785219908 CEST	49740	443	192.168.2.16	40.126.32.74
Oct 14, 2024 13:04:23.785248041 CEST	443	49740	40.126.32.74	192.168.2.16
Oct 14, 2024 13:04:23.789860964 CEST	49743	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.789906025 CEST	443	49743	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.790160894 CEST	49743	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.790160894 CEST	49743	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:23.790232897 CEST	443	49743	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:23.980242014 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:23.980264902 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:23.980272055 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:23.980305910 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:23.980334044 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:23.980339050 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:23.980380058 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:23.980411053 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:23.980411053 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:23.980441093 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.073729038 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.073753119 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.073832035 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.073894024 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.073961973 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.075424910 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.075439930 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.075508118 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.075525045 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.075581074 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.075648069 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.418565989 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.418591976 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.418663979 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.418704033 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.418776035 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.419104099 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.419123888 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.419181108 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.419195890 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.419248104 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.419271946 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.419295073 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.419327021 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.419337034 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.419364929 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.419369936 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.419379950 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.419406891 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.419419050 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.419420004 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.419471025 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.421927929 CEST	443	49741	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:24.422368050 CEST	49741	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:24.422431946 CEST	443	49741	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:24.423897028 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.423911095 CEST	443	49741	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:24.423914909 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.423974037 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.423985958 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.424010992 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.424041033 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.424074888 CEST	49741	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:24.424246073 CEST	49741	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:24.424345016 CEST	443	49741	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:24.424487114 CEST	49741	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:24.424518108 CEST	443	49741	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:24.424879074 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.424897909 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.424947023 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.424958944 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.424990892 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.424990892 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.425791025 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.425808907 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.425863981 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.425878048 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.426139116 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.426986933 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.427006006 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.427052021 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.427063942 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.427094936 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.427154064 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.428855896 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.428873062 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.428920984 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.428937912 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.428963900 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.429162025 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.429706097 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.429723024 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.429779053 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.429791927 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.430030107 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.430597067 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.430613041 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.430668116 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.430681944 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.430896997 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.431891918 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.431909084 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.431984901 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.431997061 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.432252884 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.432833910 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.432902098 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.432913065 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.432950974 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.432984114 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.433007956 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.433151960 CEST	49739	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:24.433182001 CEST	443	49739	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:24.436219931 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:24.436312914 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:24.436496019 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:24.436685085 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:24.436707973 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:24.450378895 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 14, 2024 13:04:24.466348886 CEST	49741	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:24.541980982 CEST	443	49741	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:24.542009115 CEST	443	49741	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:24.542146921 CEST	49741	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:24.542210102 CEST	443	49741	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:24.542315960 CEST	443	49741	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:24.542383909 CEST	49741	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:24.542912960 CEST	49741	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:24.542975903 CEST	443	49741	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:24.602746010 CEST	443	49743	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:24.603079081 CEST	49743	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:24.603142023 CEST	443	49743	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:24.603687048 CEST	443	49743	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:24.604044914 CEST	49743	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:24.604140997 CEST	443	49743	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:24.604147911 CEST	49743	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:24.651437998 CEST	443	49743	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:24.658332109 CEST	49743	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:24.868609905 CEST	443	49743	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:24.912446976 CEST	49743	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:24.914747000 CEST	443	49743	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:24.914758921 CEST	443	49743	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:24.914891005 CEST	443	49743	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:24.914906979 CEST	443	49743	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:24.914922953 CEST	443	49743	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:24.914980888 CEST	49743	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:24.914980888 CEST	49743	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:24.915052891 CEST	443	49743	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:24.915106058 CEST	49743	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:24.946783066 CEST	443	49711	142.250.181.228	192.168.2.16
Oct 14, 2024 13:04:24.946923018 CEST	443	49711	142.250.181.228	192.168.2.16
Oct 14, 2024 13:04:24.947094917 CEST	49711	443	192.168.2.16	142.250.181.228
Oct 14, 2024 13:04:24.957691908 CEST	443	49743	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:24.957704067 CEST	443	49743	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:24.957730055 CEST	443	49743	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:24.957775116 CEST	443	49743	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:24.957851887 CEST	49743	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:24.957853079 CEST	49743	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:24.957853079 CEST	49743	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:24.958093882 CEST	49743	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:24.958122969 CEST	443	49743	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:24.960324049 CEST	49711	443	192.168.2.16	142.250.181.228
Oct 14, 2024 13:04:24.960340023 CEST	443	49711	142.250.181.228	192.168.2.16
Oct 14, 2024 13:04:24.960695028 CEST	49746	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:24.960724115 CEST	443	49746	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:24.960772991 CEST	49746	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:24.960971117 CEST	49746	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:24.960983992 CEST	443	49746	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:25.156007051 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.156296015 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.156336069 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.157433033 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.157764912 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.157860041 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.157882929 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.199481010 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.211226940 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.256341934 CEST	49747	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:25.256385088 CEST	443	49747	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:25.256484032 CEST	49747	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:25.256741047 CEST	49747	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:25.256753922 CEST	443	49747	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:25.443727016 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.443805933 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.443881989 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.443906069 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.443965912 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.443989992 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.444036961 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.444037914 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.444037914 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.444080114 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.444117069 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.444137096 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.450695038 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.450762987 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.450779915 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.450809956 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.450834036 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.450850964 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.453830957 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.453910112 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.453934908 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.453964949 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.453975916 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.454019070 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.498193026 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.498248100 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.498420000 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.498420000 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.498435974 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.498481989 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.499090910 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.499150038 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.499172926 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.499197960 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.499222040 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.499238014 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.503570080 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.503626108 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.503655910 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.503665924 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.503710985 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.505388975 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.505441904 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.505461931 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.505490065 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.505512953 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.505533934 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.593161106 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.593220949 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.593269110 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.593283892 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.593321085 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.593348026 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.593511105 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.593564034 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.593583107 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.593610048 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.593628883 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.593657017 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.593950033 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.594008923 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.594022036 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.594048977 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.594067097 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.594088078 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.594305038 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.594362020 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.594372988 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.594392061 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.594424009 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.594439983 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.595246077 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.595304966 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.595315933 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.595346928 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.595367908 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.595400095 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.596070051 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.596128941 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.596141100 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.596158981 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.596209049 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.599828005 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.599881887 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.599906921 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.599916935 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.599941969 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.599957943 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.687501907 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.687578917 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.687608957 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.687644005 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.687669039 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.687714100 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.687818050 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.687870979 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.687882900 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.687889099 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.687915087 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.687997103 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.688035011 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.689579010 CEST	49744	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:25.689594984 CEST	443	49744	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:25.800007105 CEST	443	49746	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:25.800347090 CEST	49746	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:25.800369024 CEST	443	49746	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:25.801481962 CEST	443	49746	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:25.801774025 CEST	49746	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:25.801872015 CEST	49746	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:25.801938057 CEST	443	49746	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:25.846318960 CEST	49746	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:26.067543983 CEST	443	49746	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:26.086894035 CEST	443	49747	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:26.087125063 CEST	49747	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:26.087136030 CEST	443	49747	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:26.087474108 CEST	443	49747	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:26.087752104 CEST	49747	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:26.087807894 CEST	443	49747	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:26.087872982 CEST	49747	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:26.114343882 CEST	443	49746	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:26.114367962 CEST	443	49746	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:26.114408970 CEST	443	49746	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:26.114413023 CEST	49746	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:26.114443064 CEST	49746	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:26.114454031 CEST	443	49746	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:26.114463091 CEST	49746	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:26.114471912 CEST	443	49746	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:26.114500999 CEST	49746	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:26.114510059 CEST	49746	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:26.135394096 CEST	443	49747	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:26.160355091 CEST	443	49746	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:26.160423040 CEST	49746	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:26.160428047 CEST	443	49746	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:26.160474062 CEST	49746	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:26.160506010 CEST	443	49746	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:26.160554886 CEST	49746	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:26.160597086 CEST	49746	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:26.160609961 CEST	443	49746	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:26.289983034 CEST	443	49747	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:26.290021896 CEST	443	49747	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:26.290080070 CEST	49747	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:26.290096045 CEST	443	49747	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:26.290107965 CEST	443	49747	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:26.290149927 CEST	49747	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:26.290627956 CEST	49747	443	192.168.2.16	13.107.246.45
Oct 14, 2024 13:04:26.290638924 CEST	443	49747	13.107.246.45	192.168.2.16
Oct 14, 2024 13:04:26.293637991 CEST	49749	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:26.293683052 CEST	443	49749	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:26.293770075 CEST	49749	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:26.293961048 CEST	49749	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:26.293979883 CEST	443	49749	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:26.852430105 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 14, 2024 13:04:27.188368082 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 14, 2024 13:04:27.271426916 CEST	443	49749	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:27.271778107 CEST	49749	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:27.271811962 CEST	443	49749	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:27.272964001 CEST	443	49749	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:27.273277998 CEST	49749	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:27.273374081 CEST	49749	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:27.273467064 CEST	443	49749	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:27.315337896 CEST	49749	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:27.395555019 CEST	443	49749	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:27.395611048 CEST	443	49749	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:27.395693064 CEST	443	49749	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:27.395915031 CEST	49749	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:27.395948887 CEST	443	49749	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:27.395998955 CEST	49749	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:27.396047115 CEST	443	49749	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:27.396168947 CEST	443	49749	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:27.396325111 CEST	49749	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:27.407035112 CEST	49749	443	192.168.2.16	13.107.253.67
Oct 14, 2024 13:04:27.407067060 CEST	443	49749	13.107.253.67	192.168.2.16
Oct 14, 2024 13:04:28.639270067 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 14, 2024 13:04:31.661365986 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 14, 2024 13:04:34.019812107 CEST	49753	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:34.019876003 CEST	443	49753	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:34.019943953 CEST	49753	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:34.020606995 CEST	49753	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:34.020636082 CEST	443	49753	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:34.856779099 CEST	443	49753	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:34.857043028 CEST	49753	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:34.857080936 CEST	443	49753	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:34.857815027 CEST	443	49753	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:34.858180046 CEST	49753	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:34.858268023 CEST	443	49753	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:34.902477026 CEST	49753	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:35.729909897 CEST	49754	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:35.730000019 CEST	443	49754	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:35.730309010 CEST	49754	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:35.730421066 CEST	49754	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:35.730452061 CEST	443	49754	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:36.632613897 CEST	443	49754	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:36.632922888 CEST	49754	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:36.632951975 CEST	443	49754	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:36.633383989 CEST	443	49754	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:36.633722067 CEST	49754	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:36.633800983 CEST	443	49754	152.199.21.175	192.168.2.16
Oct 14, 2024 13:04:36.686276913 CEST	49754	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:04:36.797274113 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 14, 2024 13:04:41.271348953 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 14, 2024 13:04:58.193084002 CEST	49757	443	192.168.2.16	4.245.163.56
Oct 14, 2024 13:04:58.193176031 CEST	443	49757	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:58.193309069 CEST	49757	443	192.168.2.16	4.245.163.56
Oct 14, 2024 13:04:58.193759918 CEST	49757	443	192.168.2.16	4.245.163.56
Oct 14, 2024 13:04:58.193828106 CEST	443	49757	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:59.109852076 CEST	443	49757	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:59.110074997 CEST	49757	443	192.168.2.16	4.245.163.56
Oct 14, 2024 13:04:59.111784935 CEST	49757	443	192.168.2.16	4.245.163.56
Oct 14, 2024 13:04:59.111838102 CEST	443	49757	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:59.112260103 CEST	443	49757	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:59.114249945 CEST	49757	443	192.168.2.16	4.245.163.56
Oct 14, 2024 13:04:59.159446955 CEST	443	49757	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:59.443445921 CEST	443	49757	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:59.443505049 CEST	443	49757	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:59.443547964 CEST	443	49757	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:59.443726063 CEST	49757	443	192.168.2.16	4.245.163.56
Oct 14, 2024 13:04:59.443789959 CEST	443	49757	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:59.443836927 CEST	443	49757	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:59.444029093 CEST	49757	443	192.168.2.16	4.245.163.56
Oct 14, 2024 13:04:59.444042921 CEST	443	49757	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:59.444293976 CEST	49757	443	192.168.2.16	4.245.163.56
Oct 14, 2024 13:04:59.447139025 CEST	49757	443	192.168.2.16	4.245.163.56
Oct 14, 2024 13:04:59.447139025 CEST	49757	443	192.168.2.16	4.245.163.56
Oct 14, 2024 13:04:59.447206020 CEST	443	49757	4.245.163.56	192.168.2.16
Oct 14, 2024 13:04:59.447244883 CEST	443	49757	4.245.163.56	192.168.2.16
Oct 14, 2024 13:05:14.440047979 CEST	49759	443	192.168.2.16	142.250.181.228
Oct 14, 2024 13:05:14.440135956 CEST	443	49759	142.250.181.228	192.168.2.16
Oct 14, 2024 13:05:14.440607071 CEST	49759	443	192.168.2.16	142.250.181.228
Oct 14, 2024 13:05:14.440812111 CEST	49759	443	192.168.2.16	142.250.181.228
Oct 14, 2024 13:05:14.440824032 CEST	443	49759	142.250.181.228	192.168.2.16
Oct 14, 2024 13:05:15.117881060 CEST	443	49759	142.250.181.228	192.168.2.16
Oct 14, 2024 13:05:15.118834019 CEST	49759	443	192.168.2.16	142.250.181.228
Oct 14, 2024 13:05:15.118906975 CEST	443	49759	142.250.181.228	192.168.2.16
Oct 14, 2024 13:05:15.119442940 CEST	443	49759	142.250.181.228	192.168.2.16
Oct 14, 2024 13:05:15.120028973 CEST	49759	443	192.168.2.16	142.250.181.228
Oct 14, 2024 13:05:15.120160103 CEST	443	49759	142.250.181.228	192.168.2.16
Oct 14, 2024 13:05:15.173569918 CEST	49759	443	192.168.2.16	142.250.181.228
Oct 14, 2024 13:05:19.863446951 CEST	49753	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:05:19.863509893 CEST	443	49753	152.199.21.175	192.168.2.16
Oct 14, 2024 13:05:21.648510933 CEST	49754	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:05:21.648569107 CEST	443	49754	152.199.21.175	192.168.2.16
Oct 14, 2024 13:05:25.017065048 CEST	443	49759	142.250.181.228	192.168.2.16
Oct 14, 2024 13:05:25.017163992 CEST	443	49759	142.250.181.228	192.168.2.16
Oct 14, 2024 13:05:25.017246962 CEST	49759	443	192.168.2.16	142.250.181.228
Oct 14, 2024 13:05:25.755228043 CEST	49759	443	192.168.2.16	142.250.181.228
Oct 14, 2024 13:05:25.755260944 CEST	443	49759	142.250.181.228	192.168.2.16
Oct 14, 2024 13:05:35.487793922 CEST	443	49753	152.199.21.175	192.168.2.16
Oct 14, 2024 13:05:35.487895966 CEST	443	49753	152.199.21.175	192.168.2.16
Oct 14, 2024 13:05:35.488090038 CEST	49753	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:05:35.756102085 CEST	49753	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:05:35.756165981 CEST	443	49753	152.199.21.175	192.168.2.16
Oct 14, 2024 13:05:36.891976118 CEST	443	49754	152.199.21.175	192.168.2.16
Oct 14, 2024 13:05:36.892159939 CEST	443	49754	152.199.21.175	192.168.2.16
Oct 14, 2024 13:05:36.892427921 CEST	49754	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:05:37.382446051 CEST	49754	443	192.168.2.16	152.199.21.175
Oct 14, 2024 13:05:37.382514954 CEST	443	49754	152.199.21.175	192.168.2.16
Oct 14, 2024 13:06:14.513209105 CEST	49762	443	192.168.2.16	172.217.23.100
Oct 14, 2024 13:06:14.513298035 CEST	443	49762	172.217.23.100	192.168.2.16
Oct 14, 2024 13:06:14.513426065 CEST	49762	443	192.168.2.16	172.217.23.100
Oct 14, 2024 13:06:14.513756037 CEST	49762	443	192.168.2.16	172.217.23.100
Oct 14, 2024 13:06:14.513796091 CEST	443	49762	172.217.23.100	192.168.2.16
Oct 14, 2024 13:06:15.158293962 CEST	443	49762	172.217.23.100	192.168.2.16
Oct 14, 2024 13:06:15.158960104 CEST	49762	443	192.168.2.16	172.217.23.100
Oct 14, 2024 13:06:15.159058094 CEST	443	49762	172.217.23.100	192.168.2.16
Oct 14, 2024 13:06:15.159807920 CEST	443	49762	172.217.23.100	192.168.2.16
Oct 14, 2024 13:06:15.160326958 CEST	49762	443	192.168.2.16	172.217.23.100
Oct 14, 2024 13:06:15.160600901 CEST	443	49762	172.217.23.100	192.168.2.16
Oct 14, 2024 13:06:15.202578068 CEST	49762	443	192.168.2.16	172.217.23.100

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 14, 2024 13:04:09.510322094 CEST	53	57563	1.1.1.1	192.168.2.16
Oct 14, 2024 13:04:09.530400991 CEST	53	52805	1.1.1.1	192.168.2.16
Oct 14, 2024 13:04:10.507448912 CEST	55880	53	192.168.2.16	1.1.1.1
Oct 14, 2024 13:04:10.507601023 CEST	62089	53	192.168.2.16	1.1.1.1
Oct 14, 2024 13:04:11.247560024 CEST	53	51551	1.1.1.1	192.168.2.16
Oct 14, 2024 13:04:14.378597021 CEST	64945	53	192.168.2.16	1.1.1.1
Oct 14, 2024 13:04:14.378753901 CEST	57250	53	192.168.2.16	1.1.1.1
Oct 14, 2024 13:04:14.386178970 CEST	53	64945	1.1.1.1	192.168.2.16
Oct 14, 2024 13:04:14.386291027 CEST	53	57250	1.1.1.1	192.168.2.16
Oct 14, 2024 13:04:17.628210068 CEST	52610	53	192.168.2.16	1.1.1.1
Oct 14, 2024 13:04:17.628554106 CEST	62007	53	192.168.2.16	1.1.1.1
Oct 14, 2024 13:04:17.865142107 CEST	53784	53	192.168.2.16	1.1.1.1
Oct 14, 2024 13:04:17.865726948 CEST	50658	53	192.168.2.16	1.1.1.1
Oct 14, 2024 13:04:17.872241974 CEST	53	53784	1.1.1.1	192.168.2.16
Oct 14, 2024 13:04:17.872451067 CEST	53	50658	1.1.1.1	192.168.2.16
Oct 14, 2024 13:04:19.293699980 CEST	51753	53	192.168.2.16	1.1.1.1
Oct 14, 2024 13:04:19.293888092 CEST	54593	53	192.168.2.16	1.1.1.1
Oct 14, 2024 13:04:19.300667048 CEST	53	51753	1.1.1.1	192.168.2.16
Oct 14, 2024 13:04:19.300961971 CEST	53	54593	1.1.1.1	192.168.2.16
Oct 14, 2024 13:04:22.575565100 CEST	64612	53	192.168.2.16	1.1.1.1
Oct 14, 2024 13:04:22.575793982 CEST	54250	53	192.168.2.16	1.1.1.1
Oct 14, 2024 13:04:22.658399105 CEST	62674	53	192.168.2.16	1.1.1.1
Oct 14, 2024 13:04:22.658549070 CEST	63628	53	192.168.2.16	1.1.1.1
Oct 14, 2024 13:04:22.665240049 CEST	53	62674	1.1.1.1	192.168.2.16
Oct 14, 2024 13:04:22.666366100 CEST	53	63628	1.1.1.1	192.168.2.16
Oct 14, 2024 13:04:23.540266991 CEST	63767	53	192.168.2.16	1.1.1.1
Oct 14, 2024 13:04:23.540412903 CEST	53511	53	192.168.2.16	1.1.1.1
Oct 14, 2024 13:04:24.855065107 CEST	49675	53	192.168.2.16	1.1.1.1
Oct 14, 2024 13:04:24.855122089 CEST	52456	53	192.168.2.16	1.1.1.1
Oct 14, 2024 13:04:25.445694923 CEST	53	55642	1.1.1.1	192.168.2.16
Oct 14, 2024 13:04:28.300256014 CEST	53	56853	1.1.1.1	192.168.2.16
Oct 14, 2024 13:04:39.358530045 CEST	53	63090	1.1.1.1	192.168.2.16
Oct 14, 2024 13:04:47.314393044 CEST	53	56729	1.1.1.1	192.168.2.16
Oct 14, 2024 13:05:09.512197971 CEST	53	63409	1.1.1.1	192.168.2.16
Oct 14, 2024 13:05:10.292639017 CEST	53	52690	1.1.1.1	192.168.2.16
Oct 14, 2024 13:05:14.033221960 CEST	138	138	192.168.2.16	192.168.2.255
Oct 14, 2024 13:05:37.390214920 CEST	53	63441	1.1.1.1	192.168.2.16
Oct 14, 2024 13:06:14.502886057 CEST	53819	53	192.168.2.16	1.1.1.1
Oct 14, 2024 13:06:14.503062963 CEST	57121	53	192.168.2.16	1.1.1.1
Oct 14, 2024 13:06:14.511943102 CEST	53	57121	1.1.1.1	192.168.2.16
Oct 14, 2024 13:06:14.512056112 CEST	53	53819	1.1.1.1	192.168.2.16

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 14, 2024 13:04:11.645787954 CEST	192.168.2.16	1.1.1.1	c2a4	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 14, 2024 13:04:10.507448912 CEST	192.168.2.16	1.1.1.1	0xafc4	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Oct 14, 2024 13:04:10.507601023 CEST	192.168.2.16	1.1.1.1	0x5623	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
Oct 14, 2024 13:04:14.378597021 CEST	192.168.2.16	1.1.1.1	0x7c4c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 14, 2024 13:04:14.378753901 CEST	192.168.2.16	1.1.1.1	0x16ed	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 14, 2024 13:04:17.628210068 CEST	192.168.2.16	1.1.1.1	0x47d5	Standard query (0)	identity.nel.measure.office.net	A (IP address)	IN (0x0001)	false
Oct 14, 2024 13:04:17.628554106 CEST	192.168.2.16	1.1.1.1	0xa321	Standard query (0)	identity.nel.measure.office.net	65	IN (0x0001)	false
Oct 14, 2024 13:04:17.865142107 CEST	192.168.2.16	1.1.1.1	0x71ee	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Oct 14, 2024 13:04:17.865726948 CEST	192.168.2.16	1.1.1.1	0x6b93	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Oct 14, 2024 13:04:19.293699980 CEST	192.168.2.16	1.1.1.1	0xc8c6	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Oct 14, 2024 13:04:19.293888092 CEST	192.168.2.16	1.1.1.1	0xa2da	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Oct 14, 2024 13:04:22.575565100 CEST	192.168.2.16	1.1.1.1	0xae36	Standard query (0)	aadcdn.msftauthimages.net	A (IP address)	IN (0x0001)	false
Oct 14, 2024 13:04:22.575793982 CEST	192.168.2.16	1.1.1.1	0xbb6c	Standard query (0)	aadcdn.msftauthimages.net	65	IN (0x0001)	false
Oct 14, 2024 13:04:22.658399105 CEST	192.168.2.16	1.1.1.1	0xec4f	Standard query (0)	autologon.microsoftazuread-sso.com	A (IP address)	IN (0x0001)	false
Oct 14, 2024 13:04:22.658549070 CEST	192.168.2.16	1.1.1.1	0x2173	Standard query (0)	autologon.microsoftazuread-sso.com	65	IN (0x0001)	false
Oct 14, 2024 13:04:23.540266991 CEST	192.168.2.16	1.1.1.1	0xad0	Standard query (0)	aadcdn.msftauthimages.net	A (IP address)	IN (0x0001)	false
Oct 14, 2024 13:04:23.540412903 CEST	192.168.2.16	1.1.1.1	0x76d9	Standard query (0)	aadcdn.msftauthimages.net	65	IN (0x0001)	false
Oct 14, 2024 13:04:24.855065107 CEST	192.168.2.16	1.1.1.1	0x33da	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Oct 14, 2024 13:04:24.855122089 CEST	192.168.2.16	1.1.1.1	0x914d	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
Oct 14, 2024 13:06:14.502886057 CEST	192.168.2.16	1.1.1.1	0x1c2c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 14, 2024 13:06:14.503062963 CEST	192.168.2.16	1.1.1.1	0x3ea5	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 14, 2024 13:04:10.514575005 CEST	1.1.1.1	192.168.2.16	0xafc4	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 14, 2024 13:04:10.514811039 CEST	1.1.1.1	192.168.2.16	0x5623	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 14, 2024 13:04:14.386178970 CEST	1.1.1.1	192.168.2.16	0x7c4c	No error (0)	www.google.com		142.250.181.228	A (IP address)	IN (0x0001)	false
Oct 14, 2024 13:04:14.386291027 CEST	1.1.1.1	192.168.2.16	0x16ed	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 14, 2024 13:04:15.641006947 CEST	1.1.1.1	192.168.2.16	0x7338	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 14, 2024 13:04:15.641006947 CEST	1.1.1.1	192.168.2.16	0x7338	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 14, 2024 13:04:16.537579060 CEST	1.1.1.1	192.168.2.16	0xa175	No error (0)	shed.dual-low.s-part-0039.t-0009.t-msedge.net	s-part-0039.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 14, 2024 13:04:16.537579060 CEST	1.1.1.1	192.168.2.16	0xa175	No error (0)	s-part-0039.t-0009.t-msedge.net		13.107.246.67	A (IP address)	IN (0x0001)	false
Oct 14, 2024 13:04:17.635905027 CEST	1.1.1.1	192.168.2.16	0x47d5	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 14, 2024 13:04:17.636161089 CEST	1.1.1.1	192.168.2.16	0xa321	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 14, 2024 13:04:17.872241974 CEST	1.1.1.1	192.168.2.16	0x71ee	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 14, 2024 13:04:17.872241974 CEST	1.1.1.1	192.168.2.16	0x71ee	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 14, 2024 13:04:17.872241974 CEST	1.1.1.1	192.168.2.16	0x71ee	No error (0)	sni1gl.wpc.omegacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 14, 2024 13:04:17.872451067 CEST	1.1.1.1	192.168.2.16	0x6b93	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 14, 2024 13:04:17.872451067 CEST	1.1.1.1	192.168.2.16	0x6b93	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 14, 2024 13:04:19.300667048 CEST	1.1.1.1	192.168.2.16	0xc8c6	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 14, 2024 13:04:19.300667048 CEST	1.1.1.1	192.168.2.16	0xc8c6	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 14, 2024 13:04:19.300667048 CEST	1.1.1.1	192.168.2.16	0xc8c6	No error (0)	sni1gl.wpc.omegacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 14, 2024 13:04:19.300961971 CEST	1.1.1.1	192.168.2.16	0xa2da	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 14, 2024 13:04:19.300961971 CEST	1.1.1.1	192.168.2.16	0xa2da	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 14, 2024 13:04:22.584039927 CEST	1.1.1.1	192.168.2.16	0xbb6c	No error (0)	aadcdn.msftauthimages.net	aadcdn-msft.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 14, 2024 13:04:22.584114075 CEST	1.1.1.1	192.168.2.16	0xae36	No error (0)	aadcdn.msftauthimages.net	aadcdn-msft.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 14, 2024 13:04:22.584114075 CEST	1.1.1.1	192.168.2.16	0xae36	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 14, 2024 13:04:22.584114075 CEST	1.1.1.1	192.168.2.16	0xae36	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 14, 2024 13:04:22.665240049 CEST	1.1.1.1	192.168.2.16	0xec4f	No error (0)	autologon.microsoftazuread-sso.com		40.126.32.74	A (IP address)	IN (0x0001)	false
Oct 14, 2024 13:04:22.665240049 CEST	1.1.1.1	192.168.2.16	0xec4f	No error (0)	autologon.microsoftazuread-sso.com		40.126.32.138	A (IP address)	IN (0x0001)	false
Oct 14, 2024 13:04:22.665240049 CEST	1.1.1.1	192.168.2.16	0xec4f	No error (0)	autologon.microsoftazuread-sso.com		40.126.32.134	A (IP address)	IN (0x0001)	false
Oct 14, 2024 13:04:22.665240049 CEST	1.1.1.1	192.168.2.16	0xec4f	No error (0)	autologon.microsoftazuread-sso.com		40.126.32.72	A (IP address)	IN (0x0001)	false
Oct 14, 2024 13:04:22.665240049 CEST	1.1.1.1	192.168.2.16	0xec4f	No error (0)	autologon.microsoftazuread-sso.com		20.190.160.22	A (IP address)	IN (0x0001)	false
Oct 14, 2024 13:04:22.665240049 CEST	1.1.1.1	192.168.2.16	0xec4f	No error (0)	autologon.microsoftazuread-sso.com		40.126.32.68	A (IP address)	IN (0x0001)	false
Oct 14, 2024 13:04:22.665240049 CEST	1.1.1.1	192.168.2.16	0xec4f	No error (0)	autologon.microsoftazuread-sso.com		40.126.32.136	A (IP address)	IN (0x0001)	false
Oct 14, 2024 13:04:22.665240049 CEST	1.1.1.1	192.168.2.16	0xec4f	No error (0)	autologon.microsoftazuread-sso.com		40.126.32.76	A (IP address)	IN (0x0001)	false
Oct 14, 2024 13:04:23.548729897 CEST	1.1.1.1	192.168.2.16	0x76d9	No error (0)	aadcdn.msftauthimages.net	aadcdn-msft.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 14, 2024 13:04:23.548748970 CEST	1.1.1.1	192.168.2.16	0xad0	No error (0)	aadcdn.msftauthimages.net	aadcdn-msft.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 14, 2024 13:04:23.548748970 CEST	1.1.1.1	192.168.2.16	0xad0	No error (0)	shed.dual-low.s-part-0039.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 14, 2024 13:04:23.548748970 CEST	1.1.1.1	192.168.2.16	0xad0	No error (0)	dual.s-part-0039.t-0009.fb-t-msedge.net	s-part-0039.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 14, 2024 13:04:23.548748970 CEST	1.1.1.1	192.168.2.16	0xad0	No error (0)	s-part-0039.t-0009.fb-t-msedge.net		13.107.253.67	A (IP address)	IN (0x0001)	false
Oct 14, 2024 13:04:24.861974955 CEST	1.1.1.1	192.168.2.16	0x33da	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 14, 2024 13:04:24.862041950 CEST	1.1.1.1	192.168.2.16	0x914d	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 14, 2024 13:06:14.511943102 CEST	1.1.1.1	192.168.2.16	0x3ea5	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 14, 2024 13:06:14.512056112 CEST	1.1.1.1	192.168.2.16	0x1c2c	No error (0)	www.google.com		172.217.23.100	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

aadcdn.msauth.net

aadcdn.msftauth.net

aadcdn.msftauthimages.net

autologon.microsoftazuread-sso.com

fs.microsoft.com

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49712	13.107.246.45	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:16 UTC	633	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-14 11:04:16 UTC	797	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:04:16 GMT Content-Type: application/x-javascript Content-Length: 49804 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Mon, 05 Aug 2024 15:32:28 GMT ETag: 0x8DCB563D09FF90F x-ms-request-id: 3cbf5c41-301e-001a-5722-1cd536000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241014T110416Z-17db6f7c8cfmhggkx889x958tc00000003d000000000a4z8 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-14 11:04:16 UTC	15587	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e4 bd 6d 5b e3 38 d2 30 fa fd fe 15 c1 bb 0f 1d 4f 4c c8 0b d0 e0 b4 3b 77 1a e8 6e 66 80 30 04 66 66 17 58 2e 27 56 c0 dd c1 ce da 0e 34 13 72 7e fb a9 17 c9 96 1d 87 ee d9 3d d7 f9 f2 cc 0b b1 a5 92 2c 95 aa 4a 55 a5 92 b4 f9 d3 da ff 54 7e aa 6c fc f8 3f 95 c1 45 ef fc a2 d2 ff 58 b9 f8 7c 74 7e 50 39 83 b7 7f 54 4e fb 17 47 fb 87 3f 5e 0f 7e 14 ff bf b8 f7 e3 ca d8 9f 88 0a fc 0e dd 58 78 95 30 a8 84 51 c5 0f 46 61 34 0d 23 37 11 71 e5 01 fe 46 be 3b a9 8c a3 f0 a1 92 dc 8b ca 34 0a bf 88 51 12 57 26 7e 9c 40 a1 a1 98 84 4f 95 2a 54 17 79 95 33 37 4a 9e 2b 47 67 66 1d ea 17 50 9b 7f e7 07 50 7a 14 4e 9f e1 f9 3e a9 04 61 e2 8f 44 c5 0d 3c aa 6d 02 2f 41 2c 2a b3 c0 13 51 e5 e9 de 1f dd 57 4e fc 51 14 c6 e1 38 a9 44 62 24 Data Ascii: m[80OL;wnf0ffX.'V4r~=,JUT~l?EX\|t~P9TNG?^~Xx0QFa4#7qF;4QW&~@OTy37J+GgfPPzN>aD<m/A,QWNQ8Db$
2024-10-14 11:04:16 UTC	16384	IN	Data Raw: a1 fe a6 75 c8 0d 27 1c c8 cc 3b 47 70 68 d3 97 de 38 51 da 2b 6d ae c3 c3 92 66 30 2c c7 e2 0e a7 d6 2d 0d 94 23 88 9f 19 2d 1f 22 de b2 95 e2 e1 43 fe ba 22 db f8 db c7 de c7 bd 8f bb 46 5e a9 e2 79 8b bb 39 80 f2 13 69 1c da 46 ac bd 01 17 40 95 be ca 7a c8 5e 78 9e 4e f0 34 2a 49 07 20 d2 55 18 4e aa f9 a9 79 19 46 01 fd be 74 21 2c 48 25 ed 0b d8 5c e1 21 97 5b fb 1f fa e7 08 c5 f1 db 24 52 d4 24 94 ea 86 a0 ac 71 9b a5 70 df 6e 64 32 7d bb 49 7e 1c 3a 35 86 3a 0b bc 11 b9 bc 63 53 13 db b6 21 b2 17 b6 8c 6c 3a de c8 b0 48 30 1a 78 e1 93 b1 f2 84 d9 a0 da 32 3b 49 9d 0e a3 ba 0c c0 20 f1 60 44 0e bf e1 b1 1f 00 db 07 eb f8 0b 93 7a ee 80 51 71 65 d0 f1 46 c6 4d b5 e4 80 4a d1 c1 db 33 01 93 60 94 84 63 3e bb 8d 4e f6 d7 4e 72 4b bf 55 91 07 da 56 22 Data Ascii: u';Gph8Q+mf0,-#-"C"F^y9iF@z^xN4*I UNyFt!,H%\![$R$qpnd2}I~:5:cS!l:H0x2;I `DzQqeFMJ3`c>NNrKUV"
2024-10-14 11:04:16 UTC	16384	IN	Data Raw: 49 49 78 a3 6d 90 4f f2 d1 5f e3 49 57 25 53 20 30 da 2c 5f 9e fb be 25 d9 53 ac e2 06 6d fc 67 4d 28 10 b5 f0 53 88 c0 7e 3e c3 5e b0 96 88 a4 6a 56 81 ac 3c e2 4c 74 3e 79 ed bb 38 fd f9 09 7e 74 9f 32 42 c7 41 04 97 ac e7 a6 59 52 fe 59 8b 9a b4 f3 4a 8b b4 d6 10 bd d9 0f af 84 78 1b c9 34 c0 e1 99 a8 cd 23 a0 ce 8d b4 0e 00 99 43 46 38 aa 5e e1 a4 f2 b1 1e 2b 7f d5 16 32 3e 8d f2 99 ec b5 f7 ea 3d de 6a 55 6b ab 45 a6 da 10 6c 86 da dd 41 0a 35 3a 57 9c 6d af f8 17 dd 86 fe 9a 8f 67 27 ed 3a 5b 96 b7 fe 68 25 95 d8 2b b0 d4 b5 c8 c6 c9 ae 2d 62 2a 76 b4 6a a4 5b 48 7c 83 75 29 d5 f1 80 c1 6d 15 f3 46 e2 9d 67 bd 75 10 d5 0f fa 52 85 d6 65 ac 67 bd 66 c1 72 a4 33 6d ea 5c 99 93 86 6e a9 fd 34 e0 24 b4 0d 56 b1 61 56 94 05 d2 f1 9b 06 fa d6 bf 56 69 91 Data Ascii: IIxmO_IW%S 0,_%SmgM(S~>^jV<Lt>y8~t2BAYRYJx4#CF8^+2>=jUkElA5:Wmg':[h%+-b*vj[H\|u)mFguRegfr3m\n4$VaVVi
2024-10-14 11:04:16 UTC	1449	IN	Data Raw: 45 2f 63 f8 e4 e0 0e d0 f4 68 6c d8 37 44 70 d3 c6 9c 6a 8d 33 2e 82 62 3b 12 9c f1 56 32 89 89 b7 1c f8 4d 92 80 1d 13 a3 81 6b 0f 74 b0 f6 84 70 e9 e9 2c 49 af 92 78 a0 74 57 ec ad 25 df 18 38 c3 d4 53 29 e6 ae 8e 8b 93 b1 d2 56 e2 b7 bf 85 b6 94 6e 6e da cf 4a 54 d6 75 6d ac a3 fc 6d 23 e6 09 04 32 6d 06 4d 28 cf 16 35 28 24 8a d7 e3 11 0c 87 53 1f 83 11 24 c4 fc c3 89 41 42 39 c4 98 16 56 9e 4f 6d b3 c6 ef 84 26 af d9 dd a3 84 63 8c fa 7b eb 2a bd af dc 00 b7 88 03 05 8e ec fa fd 82 bd 9f 8c 0b 40 5f cc ab 16 c9 2c 13 c1 24 45 9b f2 c5 95 32 0f ac 16 0c f7 e9 05 a9 ed 10 12 2b 87 10 71 c9 25 6e 4c d0 b4 d8 26 e3 b3 13 af d7 74 bb 7d 5f d3 95 83 db 5b 37 ea 39 ca bb f7 00 bc c7 7d 71 70 80 36 07 87 17 11 46 47 79 ad 8b 01 fd 00 09 4b 55 8e 3a 38 8f 1e Data Ascii: E/chl7Dpj3.b;V2Mktp,IxtW%8S)VnnJTumm#2mM(5($S$AB9VOm&c{*@_,$E2+q%nL&t}_[79}qp6FGyKU:8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49713	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:16 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-14 11:04:16 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=106879 Date: Mon, 14 Oct 2024 11:04:16 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49714	13.107.246.67	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:17 UTC	408	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-14 11:04:17 UTC	797	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:04:17 GMT Content-Type: application/x-javascript Content-Length: 49804 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Mon, 05 Aug 2024 15:32:28 GMT ETag: 0x8DCB563D09FF90F x-ms-request-id: e20fe720-101e-0032-05e2-1ab49e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241014T110417Z-17db6f7c8cf6qp7g7r97wxgbqc00000005n0000000006a0f x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-14 11:04:17 UTC	15587	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e4 bd 6d 5b e3 38 d2 30 fa fd fe 15 c1 bb 0f 1d 4f 4c c8 0b d0 e0 b4 3b 77 1a e8 6e 66 80 30 04 66 66 17 58 2e 27 56 c0 dd c1 ce da 0e 34 13 72 7e fb a9 17 c9 96 1d 87 ee d9 3d d7 f9 f2 cc 0b b1 a5 92 2c 95 aa 4a 55 a5 92 b4 f9 d3 da ff 54 7e aa 6c fc f8 3f 95 c1 45 ef fc a2 d2 ff 58 b9 f8 7c 74 7e 50 39 83 b7 7f 54 4e fb 17 47 fb 87 3f 5e 0f 7e 14 ff bf b8 f7 e3 ca d8 9f 88 0a fc 0e dd 58 78 95 30 a8 84 51 c5 0f 46 61 34 0d 23 37 11 71 e5 01 fe 46 be 3b a9 8c a3 f0 a1 92 dc 8b ca 34 0a bf 88 51 12 57 26 7e 9c 40 a1 a1 98 84 4f 95 2a 54 17 79 95 33 37 4a 9e 2b 47 67 66 1d ea 17 50 9b 7f e7 07 50 7a 14 4e 9f e1 f9 3e a9 04 61 e2 8f 44 c5 0d 3c aa 6d 02 2f 41 2c 2a b3 c0 13 51 e5 e9 de 1f dd 57 4e fc 51 14 c6 e1 38 a9 44 62 24 Data Ascii: m[80OL;wnf0ffX.'V4r~=,JUT~l?EX\|t~P9TNG?^~Xx0QFa4#7qF;4QW&~@OTy37J+GgfPPzN>aD<m/A,QWNQ8Db$
2024-10-14 11:04:17 UTC	16384	IN	Data Raw: a1 fe a6 75 c8 0d 27 1c c8 cc 3b 47 70 68 d3 97 de 38 51 da 2b 6d ae c3 c3 92 66 30 2c c7 e2 0e a7 d6 2d 0d 94 23 88 9f 19 2d 1f 22 de b2 95 e2 e1 43 fe ba 22 db f8 db c7 de c7 bd 8f bb 46 5e a9 e2 79 8b bb 39 80 f2 13 69 1c da 46 ac bd 01 17 40 95 be ca 7a c8 5e 78 9e 4e f0 34 2a 49 07 20 d2 55 18 4e aa f9 a9 79 19 46 01 fd be 74 21 2c 48 25 ed 0b d8 5c e1 21 97 5b fb 1f fa e7 08 c5 f1 db 24 52 d4 24 94 ea 86 a0 ac 71 9b a5 70 df 6e 64 32 7d bb 49 7e 1c 3a 35 86 3a 0b bc 11 b9 bc 63 53 13 db b6 21 b2 17 b6 8c 6c 3a de c8 b0 48 30 1a 78 e1 93 b1 f2 84 d9 a0 da 32 3b 49 9d 0e a3 ba 0c c0 20 f1 60 44 0e bf e1 b1 1f 00 db 07 eb f8 0b 93 7a ee 80 51 71 65 d0 f1 46 c6 4d b5 e4 80 4a d1 c1 db 33 01 93 60 94 84 63 3e bb 8d 4e f6 d7 4e 72 4b bf 55 91 07 da 56 22 Data Ascii: u';Gph8Q+mf0,-#-"C"F^y9iF@z^xN4*I UNyFt!,H%\![$R$qpnd2}I~:5:cS!l:H0x2;I `DzQqeFMJ3`c>NNrKUV"
2024-10-14 11:04:17 UTC	16384	IN	Data Raw: 49 49 78 a3 6d 90 4f f2 d1 5f e3 49 57 25 53 20 30 da 2c 5f 9e fb be 25 d9 53 ac e2 06 6d fc 67 4d 28 10 b5 f0 53 88 c0 7e 3e c3 5e b0 96 88 a4 6a 56 81 ac 3c e2 4c 74 3e 79 ed bb 38 fd f9 09 7e 74 9f 32 42 c7 41 04 97 ac e7 a6 59 52 fe 59 8b 9a b4 f3 4a 8b b4 d6 10 bd d9 0f af 84 78 1b c9 34 c0 e1 99 a8 cd 23 a0 ce 8d b4 0e 00 99 43 46 38 aa 5e e1 a4 f2 b1 1e 2b 7f d5 16 32 3e 8d f2 99 ec b5 f7 ea 3d de 6a 55 6b ab 45 a6 da 10 6c 86 da dd 41 0a 35 3a 57 9c 6d af f8 17 dd 86 fe 9a 8f 67 27 ed 3a 5b 96 b7 fe 68 25 95 d8 2b b0 d4 b5 c8 c6 c9 ae 2d 62 2a 76 b4 6a a4 5b 48 7c 83 75 29 d5 f1 80 c1 6d 15 f3 46 e2 9d 67 bd 75 10 d5 0f fa 52 85 d6 65 ac 67 bd 66 c1 72 a4 33 6d ea 5c 99 93 86 6e a9 fd 34 e0 24 b4 0d 56 b1 61 56 94 05 d2 f1 9b 06 fa d6 bf 56 69 91 Data Ascii: IIxmO_IW%S 0,_%SmgM(S~>^jV<Lt>y8~t2BAYRYJx4#CF8^+2>=jUkElA5:Wmg':[h%+-b*vj[H\|u)mFguRegfr3m\n4$VaVVi
2024-10-14 11:04:17 UTC	1449	IN	Data Raw: 45 2f 63 f8 e4 e0 0e d0 f4 68 6c d8 37 44 70 d3 c6 9c 6a 8d 33 2e 82 62 3b 12 9c f1 56 32 89 89 b7 1c f8 4d 92 80 1d 13 a3 81 6b 0f 74 b0 f6 84 70 e9 e9 2c 49 af 92 78 a0 74 57 ec ad 25 df 18 38 c3 d4 53 29 e6 ae 8e 8b 93 b1 d2 56 e2 b7 bf 85 b6 94 6e 6e da cf 4a 54 d6 75 6d ac a3 fc 6d 23 e6 09 04 32 6d 06 4d 28 cf 16 35 28 24 8a d7 e3 11 0c 87 53 1f 83 11 24 c4 fc c3 89 41 42 39 c4 98 16 56 9e 4f 6d b3 c6 ef 84 26 af d9 dd a3 84 63 8c fa 7b eb 2a bd af dc 00 b7 88 03 05 8e ec fa fd 82 bd 9f 8c 0b 40 5f cc ab 16 c9 2c 13 c1 24 45 9b f2 c5 95 32 0f ac 16 0c f7 e9 05 a9 ed 10 12 2b 87 10 71 c9 25 6e 4c d0 b4 d8 26 e3 b3 13 af d7 74 bb 7d 5f d3 95 83 db 5b 37 ea 39 ca bb f7 00 bc c7 7d 71 70 80 36 07 87 17 11 46 47 79 ad 8b 01 fd 00 09 4b 55 8e 3a 38 8f 1e Data Ascii: E/chl7Dpj3.b;V2Mktp,IxtW%8S)VnnJTumm#2mM(5($S$AB9VOm&c{*@_,$E2+q%nL&t}_[79}qp6FGyKU:8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49718	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:17 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-14 11:04:18 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=106819 Date: Mon, 14 Oct 2024 11:04:17 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-14 11:04:18 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49720	152.199.21.175	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:18 UTC	660	OUT	GET /ests/2.1/content/cdnbundles/converged.v2.login.min_qzvqnltrxpy99ajspyxbgq2.css HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-14 11:04:19 UTC	734	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 8810129 Cache-Control: public, max-age=31536000 Content-MD5: SJgdPPV+fFjKfj6FHvk1Tg== Content-Type: text/css Date: Mon, 14 Oct 2024 11:04:18 GMT Etag: 0x8DC9BAA0E5931F9 Last-Modified: Wed, 03 Jul 2024 21:49:46 GMT Server: ECAcc (lhc/794C) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 6c7d298f-b01e-00dc-1d08-ce9a59000000 x-ms-version: 2009-09-19 Content-Length: 113401 Connection: close
2024-10-14 11:04:19 UTC	16383	IN	Data Raw: 2f 2a 21 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2a 2f 2f 2a 21 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 0a 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 Data Ascii: /! Copyright (C) Microsoft Corporation. All rights reserved. //*!------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------This file is based on or incorporates material from the projects listed
2024-10-14 11:04:19 UTC	16383	IN	Data Raw: 73 2d 31 2c 2e 63 6f 6c 2d 78 73 2d 32 2c 2e 63 6f 6c 2d 78 73 2d 33 2c 2e 63 6f 6c 2d 78 73 2d 34 2c 2e 63 6f 6c 2d 78 73 2d 35 2c 2e 63 6f 6c 2d 78 73 2d 36 2c 2e 63 6f 6c 2d 78 73 2d 37 2c 2e 63 6f 6c 2d 78 73 2d 38 2c 2e 63 6f 6c 2d 78 73 2d 39 2c 2e 63 6f 6c 2d 78 73 2d 31 30 2c 2e 63 6f 6c 2d 78 73 2d 31 31 2c 2e 63 6f 6c 2d 78 73 2d 31 32 2c 2e 63 6f 6c 2d 78 73 2d 31 33 2c 2e 63 6f 6c 2d 78 73 2d 31 34 2c 2e 63 6f 6c 2d 78 73 2d 31 35 2c 2e 63 6f 6c 2d 78 73 2d 31 36 2c 2e 63 6f 6c 2d 78 73 2d 31 37 2c 2e 63 6f 6c 2d 78 73 2d 31 38 2c 2e 63 6f 6c 2d 78 73 2d 31 39 2c 2e 63 6f 6c 2d 78 73 2d 32 30 2c 2e 63 6f 6c 2d 78 73 2d 32 31 2c 2e 63 6f 6c 2d 78 73 2d 32 32 2c 2e 63 6f 6c 2d 78 73 2d 32 33 2c 2e 63 6f 6c 2d 78 73 2d 32 34 7b 66 6c 6f 61 74 3a Data Ascii: s-1,.col-xs-2,.col-xs-3,.col-xs-4,.col-xs-5,.col-xs-6,.col-xs-7,.col-xs-8,.col-xs-9,.col-xs-10,.col-xs-11,.col-xs-12,.col-xs-13,.col-xs-14,.col-xs-15,.col-xs-16,.col-xs-17,.col-xs-18,.col-xs-19,.col-xs-20,.col-xs-21,.col-xs-22,.col-xs-23,.col-xs-24{float:
2024-10-14 11:04:19 UTC	2	IN	Data Raw: 72 67 Data Ascii: rg
2024-10-14 11:04:19 UTC	16383	IN	Data Raw: 69 6e 2d 6c 65 66 74 3a 39 35 2e 38 33 33 33 33 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 32 34 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 31 30 30 25 7d 7d 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 62 6f 72 64 65 72 3a 30 3b 6d 69 6e 2d 77 69 64 74 68 3a 30 7d 6c 65 67 65 6e 64 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 31 30 30 25 3b 70 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 7d 6c 61 62 65 6c 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 65 61 72 63 68 22 5d 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 Data Ascii: in-left:95.83333%}.col-xl-offset-24{margin-left:100%}}fieldset{padding:0;margin:0;border:0;min-width:0}legend{display:block;width:100%;padding:0;border:0}label{display:inline-block;max-width:100%}input[type="search"]{-webkit-box-sizing:border-box;-moz-box
2024-10-14 11:04:19 UTC	16383	IN	Data Raw: 6f 77 2d 78 3a 61 75 74 6f 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2e 30 31 25 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 35 33 39 70 78 29 7b 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 7b 77 69 64 74 68 3a 31 30 30 25 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 35 70 78 3b 6f 76 65 72 66 6c 6f 77 2d 79 3a 68 69 64 64 65 6e 3b 2d 6d 73 2d 6f 76 65 72 66 6c 6f 77 2d 73 74 79 6c 65 3a 2d 6d 73 2d 61 75 74 6f 68 69 64 69 6e 67 2d 73 63 72 6f 6c 6c 62 61 72 7d 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 3e 2e 74 61 62 6c 65 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 3e 2e 74 61 62 6c 65 3e 74 68 65 61 64 3e 74 72 3e 74 68 2c 2e 74 61 62 6c Data Ascii: ow-x:auto;min-height:.01%}@media screen and (max-width:539px){.table-responsive{width:100%;margin-bottom:15px;overflow-y:hidden;-ms-overflow-style:-ms-autohiding-scrollbar}.table-responsive>.table{margin-bottom:0}.table-responsive>.table>thead>tr>th,.tabl
2024-10-14 11:04:19 UTC	2	IN	Data Raw: 22 2c Data Ascii: ",
2024-10-14 11:04:19 UTC	16383	IN	Data Raw: 22 54 75 6e 67 61 22 2c 22 4c 61 6f 20 55 49 22 2c 22 52 61 61 76 69 22 2c 22 49 73 6b 6f 6f 6c 61 20 50 6f 74 61 22 2c 22 4c 61 74 68 61 22 2c 22 4c 65 65 6c 61 77 61 64 65 65 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 59 61 48 65 69 20 55 49 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 4a 68 65 6e 67 48 65 69 20 55 49 22 2c 22 4d 61 6c 67 75 6e 20 47 6f 74 68 69 63 22 2c 22 45 73 74 72 61 6e 67 65 6c 6f 20 45 64 65 73 73 61 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 48 69 6d 61 6c 61 79 61 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 4e 65 77 20 54 61 69 20 4c 75 65 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 50 68 61 67 73 50 61 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 54 61 69 20 4c 65 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 59 69 20 42 61 69 74 69 22 2c 22 4d 6f 6e 67 6f 6c 69 Data Ascii: "Tunga","Lao UI","Raavi","Iskoola Pota","Latha","Leelawadee","Microsoft YaHei UI","Microsoft JhengHei UI","Malgun Gothic","Estrangelo Edessa","Microsoft Himalaya","Microsoft New Tai Lue","Microsoft PhagsPa","Microsoft Tai Le","Microsoft Yi Baiti","Mongoli
2024-10-14 11:04:19 UTC	16383	IN	Data Raw: 70 65 3d 22 72 65 73 65 74 22 5d 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 35 64 61 36 7d 2e 62 74 6e 2e 62 74 6e 2d 70 72 69 6d 61 72 79 2d 66 6f 63 75 73 2c 2e 62 74 6e 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 66 6f 63 75 73 2c 62 75 74 74 6f 6e 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 5d 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 75 62 6d 69 74 22 5d 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 65 73 65 74 22 5d 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 66 6f 63 75 73 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f Data Ascii: pe="reset"].btn-primary:hover{background-color:#005da6}.btn.btn-primary-focus,.btn.btn-primary:focus,button.btn-primary:focus,input[type="button"].btn-primary:focus,input[type="submit"].btn-primary:focus,input[type="reset"].btn-primary:focus{background-co
2024-10-14 11:04:19 UTC	15099	IN	Data Raw: 20 4d 61 74 68 22 7d 2e 61 70 70 2d 6e 61 6d 65 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 32 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 2e 32 35 72 65 6d 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 2e 32 35 72 65 6d 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 38 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 33 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 37 35 72 65 6d 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 32 2e 33 36 33 32 70 78 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 32 2e 33 36 33 32 70 78 3b 63 6f 6c 6f 72 3a 23 31 62 31 62 31 62 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 70 61 Data Ascii: Math"}.app-name{margin-bottom:20px;margin-top:20px;margin-bottom:1.25rem;margin-top:1.25rem;font-size:24px;line-height:28px;font-weight:300;line-height:1.75rem;padding-bottom:2.3632px;padding-top:2.3632px;color:#1b1b1b;font-size:1.5rem;font-weight:600;pa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49722	152.199.21.175	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:18 UTC	637	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_ELtAAt2Ya8ISGuc0PJcBKA2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-14 11:04:19 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 3364458 Cache-Control: public, max-age=31536000 Content-MD5: ryp6SSnhPxWgRcjI2ApFQw== Content-Type: application/x-javascript Date: Mon, 14 Oct 2024 11:04:19 GMT Etag: 0x8DCCC8179585EF3 Last-Modified: Wed, 04 Sep 2024 01:32:43 GMT Server: ECAcc (lhc/790E) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: e4045618-601e-0027-728f-ff96a3000000 x-ms-version: 2009-09-19 Content-Length: 449703 Connection: close
2024-10-14 11:04:19 UTC	16383	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-10-14 11:04:19 UTC	1	IN	Data Raw: 44 Data Ascii: D
2024-10-14 11:04:19 UTC	16383	IN	Data Raw: 49 4e 47 5f 4e 4f 54 5f 41 4c 4c 4f 57 45 44 3a 22 38 30 30 34 37 38 44 37 22 2c 50 50 5f 45 5f 49 44 50 5f 42 49 4e 44 49 4e 47 5f 45 58 49 53 54 53 5f 53 41 4d 53 55 4e 47 3a 22 38 30 30 34 34 35 33 45 22 2c 50 50 5f 45 5f 54 52 41 4e 53 46 45 52 5f 54 4f 4b 45 4e 5f 49 4e 56 41 4c 49 44 5f 53 45 53 53 49 4f 4e 3a 22 38 30 30 34 33 35 41 30 22 7d 2c 6e 2e 45 73 74 73 45 72 72 6f 72 3d 7b 55 73 65 72 41 63 63 6f 75 6e 74 53 65 6c 65 63 74 69 6f 6e 49 6e 76 61 6c 69 64 3a 22 31 36 30 30 31 22 2c 55 73 65 72 55 6e 61 75 74 68 6f 72 69 7a 65 64 3a 22 35 30 30 32 30 22 2c 55 73 65 72 55 6e 61 75 74 68 6f 72 69 7a 65 64 41 70 69 56 65 72 73 69 6f 6e 4e 6f 74 53 75 70 70 6f 72 74 65 64 3a 22 35 30 30 32 30 31 22 2c 55 73 65 72 55 6e 61 75 74 68 6f 72 69 7a 65 Data Ascii: ING_NOT_ALLOWED:"800478D7",PP_E_IDP_BINDING_EXISTS_SAMSUNG:"8004453E",PP_E_TRANSFER_TOKEN_INVALID_SESSION:"800435A0"},n.EstsError={UserAccountSelectionInvalid:"16001",UserUnauthorized:"50020",UserUnauthorizedApiVersionNotSupported:"500201",UserUnauthorize
2024-10-14 11:04:19 UTC	16383	IN	Data Raw: 61 72 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 3f 65 2e 74 61 72 67 65 74 3f 65 2e 74 61 72 67 65 74 3a 65 2e 73 72 63 45 6c 65 6d 65 6e 74 3f 65 2e 73 72 63 45 6c 65 6d 65 6e 74 3a 6e 75 6c 6c 3a 6e 75 6c 6c 7d 7d 2c 44 3d 6e 2e 51 75 65 72 79 53 74 72 69 6e 67 3d 7b 70 61 72 73 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2c 74 3d 6e 75 6c 6c 2c 69 3d 6e 75 6c 6c 3b 69 66 28 65 29 7b 76 61 72 20 61 3d 65 2e 69 6e 64 65 78 4f 66 28 22 3f 22 29 2c 6f 3d 65 2e 69 6e 64 65 78 4f 66 28 22 23 22 29 3b 2d 31 21 3d 3d 6f 26 26 28 2d 31 3d 3d 3d 61 7c 7c 6f 3c 61 29 3f 28 6e 3d 65 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 6f 29 2c 69 3d 64 2e 64 6f 75 62 6c 65 53 70 6c 69 74 28 65 2e 73 75 62 73 74 72 69 6e 67 28 6f Data Ascii: arget:function(e){return e?e.target?e.target:e.srcElement?e.srcElement:null:null}},D=n.QueryString={parse:function(e){var n=e,t=null,i=null;if(e){var a=e.indexOf("?"),o=e.indexOf("#");-1!==o&&(-1===a\|\|o<a)?(n=e.substring(0,o),i=d.doubleSplit(e.substring(o
2024-10-14 11:04:19 UTC	16383	IN	Data Raw: 6c 74 54 65 78 74 42 6f 78 50 72 6f 70 65 72 74 79 4c 6f 67 4f 70 74 69 6f 6e 28 65 2c 6e 29 7d 2c 73 2e 67 65 74 50 61 73 73 77 6f 72 64 54 65 78 74 42 6f 78 50 72 6f 70 65 72 74 79 4c 6f 67 4f 70 74 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 72 65 74 75 72 6e 28 6e 3d 6e 7c 7c 7b 7d 29 2e 68 69 64 69 6e 67 4d 6f 64 65 3d 69 2e 48 69 64 69 6e 67 4d 6f 64 65 2e 48 69 64 65 2c 73 2e 67 65 74 44 65 66 61 75 6c 74 54 65 78 74 42 6f 78 50 72 6f 70 65 72 74 79 4c 6f 67 4f 70 74 69 6f 6e 28 65 2c 6e 29 7d 2c 73 2e 67 65 74 44 65 66 61 75 6c 74 45 76 65 6e 74 54 72 61 63 69 6e 67 4f 70 74 69 6f 6e 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 72 65 74 75 72 6e 7b 65 76 65 6e 74 49 64 3a 65 2c 65 76 65 6e 74 4c 65 76 65 6c 3a 74 7c 7c 69 2e 45 Data Ascii: ltTextBoxPropertyLogOption(e,n)},s.getPasswordTextBoxPropertyLogOption=function(e,n){return(n=n\|\|{}).hidingMode=i.HidingMode.Hide,s.getDefaultTextBoxPropertyLogOption(e,n)},s.getDefaultEventTracingOptions=function(e,n,t){return{eventId:e,eventLevel:t\|\|i.E
2024-10-14 11:04:19 UTC	16383	IN	Data Raw: 28 74 68 69 73 5b 75 2e 50 72 6f 6f 66 43 6f 6e 66 69 72 6d 61 74 69 6f 6e 5d 3d 62 29 2c 76 26 26 28 74 68 69 73 5b 75 2e 43 61 6e 61 72 79 46 6c 6f 77 54 6f 6b 65 6e 5d 3d 76 29 7d 2c 6e 2e 52 65 71 75 65 73 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 2c 74 2c 61 2c 63 2c 64 3d 74 68 69 73 2c 6c 3d 70 2e 4e 6f 6e 65 2c 75 3d 22 22 2c 66 3d 22 22 2c 67 3d 22 22 2c 6d 3d 65 2e 64 61 74 61 2c 62 3d 65 2e 6f 6e 53 65 6e 64 2c 76 3d 65 2e 6f 6e 53 65 6e 64 46 61 69 6c 2c 68 3d 65 2e 6f 6e 46 6c 6f 77 45 78 70 69 72 65 64 2c 5f 3d 65 2e 74 69 6d 65 6f 75 74 7c 7c 33 65 34 2c 43 3d 65 2e 73 69 74 65 49 64 2c 53 3d 65 2e 63 6c 69 65 6e 74 49 64 2c 78 3d 65 2e 66 6f 72 77 61 72 64 65 64 43 6c 69 65 6e 74 49 64 2c 77 3d 65 2e 6e 6f 50 61 42 75 62 62 Data Ascii: (this[u.ProofConfirmation]=b),v&&(this[u.CanaryFlowToken]=v)},n.Request=function(e){var n,t,a,c,d=this,l=p.None,u="",f="",g="",m=e.data,b=e.onSend,v=e.onSendFail,h=e.onFlowExpired,_=e.timeout\|\|3e4,C=e.siteId,S=e.clientId,x=e.forwardedClientId,w=e.noPaBubb
2024-10-14 11:04:19 UTC	4	IN	Data Raw: 72 61 6d 73 Data Ascii: rams
2024-10-14 11:04:19 UTC	16383	IN	Data Raw: 7c 7c 6e 2e 43 72 65 64 65 6e 74 69 61 6c 73 2e 46 61 63 65 62 6f 6f 6b 50 61 72 61 6d 73 29 29 29 72 65 74 75 72 6e 20 69 3b 73 77 69 74 63 68 28 61 29 7b 63 61 73 65 20 6d 2e 52 65 6d 6f 74 65 4e 47 43 3a 63 61 73 65 20 6d 2e 46 65 64 65 72 61 74 69 6f 6e 3a 63 61 73 65 20 6d 2e 41 63 63 65 73 73 50 61 73 73 3a 63 61 73 65 20 6d 2e 4e 6f 50 72 65 66 65 72 72 65 64 43 72 65 64 65 6e 74 69 61 6c 3a 6f 26 26 6f 2e 53 61 6d 6c 52 65 71 75 65 73 74 26 26 6f 2e 52 65 6c 61 79 53 74 61 74 65 3f 28 69 2e 69 64 70 52 65 64 69 72 65 63 74 55 72 6c 3d 6e 2e 43 72 65 64 65 6e 74 69 61 6c 73 2e 46 65 64 65 72 61 74 69 6f 6e 52 65 64 69 72 65 63 74 55 72 6c 2c 69 2e 69 64 70 52 65 64 69 72 65 63 74 50 6f 73 74 50 61 72 61 6d 73 3d 7b 53 41 4d 4c 52 65 71 75 65 73 74 Data Ascii: \|\|n.Credentials.FacebookParams)))return i;switch(a){case m.RemoteNGC:case m.Federation:case m.AccessPass:case m.NoPreferredCredential:o&&o.SamlRequest&&o.RelayState?(i.idpRedirectUrl=n.Credentials.FederationRedirectUrl,i.idpRedirectPostParams={SAMLRequest
2024-10-14 11:04:19 UTC	16383	IN	Data Raw: 28 29 2c 6e 2e 6f 6e 52 65 64 69 72 65 63 74 3d 6f 2e 63 72 65 61 74 65 28 29 2c 6e 2e 6f 6e 52 65 67 69 73 74 65 72 44 69 61 6c 6f 67 3d 6f 2e 63 72 65 61 74 65 28 29 2c 6e 2e 6f 6e 55 6e 72 65 67 69 73 74 65 72 44 69 61 6c 6f 67 3d 6f 2e 63 72 65 61 74 65 28 29 2c 6e 2e 6f 6e 53 68 6f 77 44 69 61 6c 6f 67 3d 6f 2e 63 72 65 61 74 65 28 29 2c 6e 2e 6f 6e 53 65 74 50 65 6e 64 69 6e 67 52 65 71 75 65 73 74 3d 6f 2e 63 72 65 61 74 65 28 29 2c 6e 2e 6f 6e 55 70 64 61 74 65 46 6c 6f 77 54 6f 6b 65 6e 3d 6f 2e 63 72 65 61 74 65 28 29 2c 6e 2e 63 72 65 64 65 6e 74 69 61 6c 43 6f 75 6e 74 3d 30 2c 6e 2e 73 65 6c 65 63 74 65 64 43 72 65 64 54 79 70 65 3d 6e 75 6c 6c 2c 6e 2e 73 65 6c 65 63 74 65 64 43 72 65 64 53 68 6f 77 6e 4f 6e 6c 79 4f 6e 50 69 63 6b 65 72 3d Data Ascii: (),n.onRedirect=o.create(),n.onRegisterDialog=o.create(),n.onUnregisterDialog=o.create(),n.onShowDialog=o.create(),n.onSetPendingRequest=o.create(),n.onUpdateFlowToken=o.create(),n.credentialCount=0,n.selectedCredType=null,n.selectedCredShownOnlyOnPicker=
2024-10-14 11:04:19 UTC	16383	IN	Data Raw: 68 65 6e 74 69 63 61 74 65 64 53 74 61 74 65 7c 7c 32 3d 3d 3d 65 2e 61 75 74 68 65 6e 74 69 63 61 74 65 64 53 74 61 74 65 2c 69 73 57 69 6e 64 6f 77 73 53 73 6f 3a 65 2e 69 73 57 69 6e 64 6f 77 73 53 73 6f 7c 7c 21 31 2c 69 73 4d 65 43 6f 6e 74 72 6f 6c 53 65 73 73 69 6f 6e 3a 21 30 2c 69 73 47 69 74 48 75 62 46 65 64 3a 65 2e 69 73 47 69 74 48 75 62 46 65 64 7c 7c 21 31 7d 7d 29 29 7d 2c 70 61 72 73 65 42 73 73 6f 53 65 73 73 69 6f 6e 73 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 2e 6d 61 70 28 65 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 7b 73 73 6f 55 6e 69 71 75 65 49 64 3a 65 2e 73 73 6f 55 6e 69 71 75 65 49 64 2c 6e 61 6d 65 3a 65 2e 6e 61 6d 65 2c 64 69 73 70 6c 61 79 4e 61 6d 65 3a 65 2e 64 69 73 70 6c 61 79 Data Ascii: henticatedState\|\|2===e.authenticatedState,isWindowsSso:e.isWindowsSso\|\|!1,isMeControlSession:!0,isGitHubFed:e.isGitHubFed\|\|!1}}))},parseBssoSessions:function(e){return o.map(e,(function(e){return{ssoUniqueId:e.ssoUniqueId,name:e.name,displayName:e.display

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49721	152.199.21.175	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:18 UTC	656	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-14 11:04:19 UTC	749	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 4066333 Cache-Control: public, max-age=31536000 Content-MD5: wheuNbhZLcnx5oBIfa0JTw== Content-Type: application/x-javascript Date: Mon, 14 Oct 2024 11:04:19 GMT Etag: 0x8DCC6D4DD76DEA7 Last-Modified: Tue, 27 Aug 2024 20:14:33 GMT Server: ECAcc (lhc/794B) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 5fcf6533-b01e-000b-222d-f97a0c000000 x-ms-version: 2009-09-19 Content-Length: 57443 Connection: close
2024-10-14 11:04:19 UTC	16383	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 69 5b 6e 5d 29 72 65 74 75 72 6e 20 69 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 74 3d 69 5b 6e 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 2c 69 64 3a 6e 2c 6c 6f 61 64 65 64 3a 21 31 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 74 2e 65 78 70 6f 72 74 73 2c 74 2c 74 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 74 2e 6c 6f 61 64 65 64 3d 21 30 2c 74 2e 65 78 70 6f 72 74 73 7d 76 61 72 20 69 3d 7b 7d 3b 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 69 2c 6f 2e 70 3d 22 22 2c 6f 28 30 29 7d 28 5b 66 75 6e 63 74 69 6f 6e 28 65 2c 6f 2c 69 29 7b 69 28 32 29 3b 76 61 72 20 6e 3d 69 28 31 29 2c 74 3d 69 28 35 29 2c 72 3d 69 28 36 29 2c 61 3d 72 2e 53 74 72 69 6e Data Ascii: !function(e){function o(n){if(i[n])return i[n].exports;var t=i[n]={exports:{},id:n,loaded:!1};return e[n].call(t.exports,t,t.exports,o),t.loaded=!0,t.exports}var i={};return o.m=e,o.c=i,o.p="",o(0)}([function(e,o,i){i(2);var n=i(1),t=i(5),r=i(6),a=r.Strin
2024-10-14 11:04:19 UTC	16383	IN	Data Raw: 44 65 73 63 72 69 70 74 69 6f 6e 5f 55 6e 66 61 6d 69 6c 69 61 72 44 65 76 69 63 65 3d 22 54 6f 20 73 69 67 6e 20 69 6e 20 77 69 74 68 20 7b 30 7d 2c 20 70 6c 65 61 73 65 20 66 6f 6c 6c 6f 77 20 74 68 65 20 69 6e 73 74 72 75 63 74 69 6f 6e 73 20 6f 6e 20 79 6f 75 72 20 70 68 6f 6e 65 20 61 6e 64 20 65 6e 74 65 72 20 74 68 65 20 6e 75 6d 62 65 72 20 79 6f 75 20 73 65 65 20 62 65 6c 6f 77 2e 22 2c 65 2e 43 54 5f 52 4e 47 43 5f 53 54 52 5f 4c 53 5f 54 69 6d 65 6f 75 74 5f 54 69 74 6c 65 3d 22 52 65 71 75 65 73 74 20 74 69 6d 65 6f 75 74 22 2c 65 2e 43 54 5f 52 4e 47 43 5f 53 54 52 5f 4c 53 5f 54 69 6d 65 6f 75 74 5f 50 61 67 65 44 65 73 63 72 69 70 74 69 6f 6e 3d 22 57 65 20 64 69 64 6e 27 74 20 68 65 61 72 20 66 72 6f 6d 20 79 6f 75 20 69 6e 20 74 69 6d 65 Data Ascii: Description_UnfamiliarDevice="To sign in with {0}, please follow the instructions on your phone and enter the number you see below.",e.CT_RNGC_STR_LS_Timeout_Title="Request timeout",e.CT_RNGC_STR_LS_Timeout_PageDescription="We didn't hear from you in time
2024-10-14 11:04:19 UTC	2	IN	Data Raw: 22 2c Data Ascii: ",
2024-10-14 11:04:19 UTC	16383	IN	Data Raw: 65 2e 53 54 52 5f 4e 61 74 69 76 65 5f 53 53 50 52 5f 45 6e 74 65 72 43 6f 64 65 5f 44 65 73 63 3d 22 45 6e 74 65 72 20 74 68 65 20 63 6f 64 65 20 77 65 20 6a 75 73 74 20 73 65 6e 74 20 74 6f 20 7b 30 7d 20 74 6f 20 72 65 73 65 74 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 2e 22 2c 65 2e 53 54 52 5f 43 65 72 74 42 61 73 65 41 75 74 68 50 6f 6c 69 63 79 5f 42 6c 6f 63 6b 3d 22 59 6f 75 20 63 61 6e 27 74 20 73 69 67 6e 20 69 6e 20 77 69 74 68 20 61 20 63 65 72 74 69 66 69 63 61 74 65 2e 20 54 72 79 20 73 69 67 6e 69 6e 67 20 69 6e 20 77 69 74 68 20 61 6e 6f 74 68 65 72 20 6d 65 74 68 6f 64 2e 22 2c 65 2e 53 54 52 5f 49 6e 76 61 6c 69 64 43 72 65 64 65 6e 74 69 61 6c 44 75 65 54 6f 4d 66 61 43 6c 61 73 73 69 66 69 63 61 74 69 6f 6e 3d 22 4d 75 6c 74 69 66 61 Data Ascii: e.STR_Native_SSPR_EnterCode_Desc="Enter the code we just sent to {0} to reset your password.",e.STR_CertBaseAuthPolicy_Block="You can't sign in with a certificate. Try signing in with another method.",e.STR_InvalidCredentialDueToMfaClassification="Multifa
2024-10-14 11:04:19 UTC	8292	IN	Data Raw: 55 73 65 72 56 6f 69 63 65 41 75 74 68 46 61 69 6c 65 64 43 61 6c 6c 57 65 6e 74 54 6f 56 6f 69 63 65 6d 61 69 6c 3a 22 55 73 65 72 56 6f 69 63 65 41 75 74 68 46 61 69 6c 65 64 43 61 6c 6c 57 65 6e 74 54 6f 56 6f 69 63 65 6d 61 69 6c 22 2c 55 73 65 72 56 6f 69 63 65 41 75 74 68 46 61 69 6c 65 64 49 6e 76 61 6c 69 64 50 68 6f 6e 65 49 6e 70 75 74 3a 22 55 73 65 72 56 6f 69 63 65 41 75 74 68 46 61 69 6c 65 64 49 6e 76 61 6c 69 64 50 68 6f 6e 65 49 6e 70 75 74 22 2c 55 73 65 72 56 6f 69 63 65 41 75 74 68 46 61 69 6c 65 64 50 68 6f 6e 65 48 75 6e 67 55 70 3a 22 55 73 65 72 56 6f 69 63 65 41 75 74 68 46 61 69 6c 65 64 50 68 6f 6e 65 48 75 6e 67 55 70 22 2c 55 73 65 72 56 6f 69 63 65 41 75 74 68 46 61 69 6c 65 64 49 6e 76 61 6c 69 64 50 68 6f 6e 65 4e 75 6d 62 Data Ascii: UserVoiceAuthFailedCallWentToVoicemail:"UserVoiceAuthFailedCallWentToVoicemail",UserVoiceAuthFailedInvalidPhoneInput:"UserVoiceAuthFailedInvalidPhoneInput",UserVoiceAuthFailedPhoneHungUp:"UserVoiceAuthFailedPhoneHungUp",UserVoiceAuthFailedInvalidPhoneNumb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49725	152.199.21.175	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:20 UTC	431	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-14 11:04:20 UTC	749	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 4066334 Cache-Control: public, max-age=31536000 Content-MD5: wheuNbhZLcnx5oBIfa0JTw== Content-Type: application/x-javascript Date: Mon, 14 Oct 2024 11:04:20 GMT Etag: 0x8DCC6D4DD76DEA7 Last-Modified: Tue, 27 Aug 2024 20:14:33 GMT Server: ECAcc (lhc/794B) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 5fcf6533-b01e-000b-222d-f97a0c000000 x-ms-version: 2009-09-19 Content-Length: 57443 Connection: close
2024-10-14 11:04:20 UTC	16383	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 69 5b 6e 5d 29 72 65 74 75 72 6e 20 69 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 74 3d 69 5b 6e 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 2c 69 64 3a 6e 2c 6c 6f 61 64 65 64 3a 21 31 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 74 2e 65 78 70 6f 72 74 73 2c 74 2c 74 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 74 2e 6c 6f 61 64 65 64 3d 21 30 2c 74 2e 65 78 70 6f 72 74 73 7d 76 61 72 20 69 3d 7b 7d 3b 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 69 2c 6f 2e 70 3d 22 22 2c 6f 28 30 29 7d 28 5b 66 75 6e 63 74 69 6f 6e 28 65 2c 6f 2c 69 29 7b 69 28 32 29 3b 76 61 72 20 6e 3d 69 28 31 29 2c 74 3d 69 28 35 29 2c 72 3d 69 28 36 29 2c 61 3d 72 2e 53 74 72 69 6e Data Ascii: !function(e){function o(n){if(i[n])return i[n].exports;var t=i[n]={exports:{},id:n,loaded:!1};return e[n].call(t.exports,t,t.exports,o),t.loaded=!0,t.exports}var i={};return o.m=e,o.c=i,o.p="",o(0)}([function(e,o,i){i(2);var n=i(1),t=i(5),r=i(6),a=r.Strin
2024-10-14 11:04:20 UTC	16383	IN	Data Raw: 44 65 73 63 72 69 70 74 69 6f 6e 5f 55 6e 66 61 6d 69 6c 69 61 72 44 65 76 69 63 65 3d 22 54 6f 20 73 69 67 6e 20 69 6e 20 77 69 74 68 20 7b 30 7d 2c 20 70 6c 65 61 73 65 20 66 6f 6c 6c 6f 77 20 74 68 65 20 69 6e 73 74 72 75 63 74 69 6f 6e 73 20 6f 6e 20 79 6f 75 72 20 70 68 6f 6e 65 20 61 6e 64 20 65 6e 74 65 72 20 74 68 65 20 6e 75 6d 62 65 72 20 79 6f 75 20 73 65 65 20 62 65 6c 6f 77 2e 22 2c 65 2e 43 54 5f 52 4e 47 43 5f 53 54 52 5f 4c 53 5f 54 69 6d 65 6f 75 74 5f 54 69 74 6c 65 3d 22 52 65 71 75 65 73 74 20 74 69 6d 65 6f 75 74 22 2c 65 2e 43 54 5f 52 4e 47 43 5f 53 54 52 5f 4c 53 5f 54 69 6d 65 6f 75 74 5f 50 61 67 65 44 65 73 63 72 69 70 74 69 6f 6e 3d 22 57 65 20 64 69 64 6e 27 74 20 68 65 61 72 20 66 72 6f 6d 20 79 6f 75 20 69 6e 20 74 69 6d 65 Data Ascii: Description_UnfamiliarDevice="To sign in with {0}, please follow the instructions on your phone and enter the number you see below.",e.CT_RNGC_STR_LS_Timeout_Title="Request timeout",e.CT_RNGC_STR_LS_Timeout_PageDescription="We didn't hear from you in time
2024-10-14 11:04:20 UTC	2	IN	Data Raw: 22 2c Data Ascii: ",
2024-10-14 11:04:20 UTC	16383	IN	Data Raw: 65 2e 53 54 52 5f 4e 61 74 69 76 65 5f 53 53 50 52 5f 45 6e 74 65 72 43 6f 64 65 5f 44 65 73 63 3d 22 45 6e 74 65 72 20 74 68 65 20 63 6f 64 65 20 77 65 20 6a 75 73 74 20 73 65 6e 74 20 74 6f 20 7b 30 7d 20 74 6f 20 72 65 73 65 74 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 2e 22 2c 65 2e 53 54 52 5f 43 65 72 74 42 61 73 65 41 75 74 68 50 6f 6c 69 63 79 5f 42 6c 6f 63 6b 3d 22 59 6f 75 20 63 61 6e 27 74 20 73 69 67 6e 20 69 6e 20 77 69 74 68 20 61 20 63 65 72 74 69 66 69 63 61 74 65 2e 20 54 72 79 20 73 69 67 6e 69 6e 67 20 69 6e 20 77 69 74 68 20 61 6e 6f 74 68 65 72 20 6d 65 74 68 6f 64 2e 22 2c 65 2e 53 54 52 5f 49 6e 76 61 6c 69 64 43 72 65 64 65 6e 74 69 61 6c 44 75 65 54 6f 4d 66 61 43 6c 61 73 73 69 66 69 63 61 74 69 6f 6e 3d 22 4d 75 6c 74 69 66 61 Data Ascii: e.STR_Native_SSPR_EnterCode_Desc="Enter the code we just sent to {0} to reset your password.",e.STR_CertBaseAuthPolicy_Block="You can't sign in with a certificate. Try signing in with another method.",e.STR_InvalidCredentialDueToMfaClassification="Multifa
2024-10-14 11:04:20 UTC	8292	IN	Data Raw: 55 73 65 72 56 6f 69 63 65 41 75 74 68 46 61 69 6c 65 64 43 61 6c 6c 57 65 6e 74 54 6f 56 6f 69 63 65 6d 61 69 6c 3a 22 55 73 65 72 56 6f 69 63 65 41 75 74 68 46 61 69 6c 65 64 43 61 6c 6c 57 65 6e 74 54 6f 56 6f 69 63 65 6d 61 69 6c 22 2c 55 73 65 72 56 6f 69 63 65 41 75 74 68 46 61 69 6c 65 64 49 6e 76 61 6c 69 64 50 68 6f 6e 65 49 6e 70 75 74 3a 22 55 73 65 72 56 6f 69 63 65 41 75 74 68 46 61 69 6c 65 64 49 6e 76 61 6c 69 64 50 68 6f 6e 65 49 6e 70 75 74 22 2c 55 73 65 72 56 6f 69 63 65 41 75 74 68 46 61 69 6c 65 64 50 68 6f 6e 65 48 75 6e 67 55 70 3a 22 55 73 65 72 56 6f 69 63 65 41 75 74 68 46 61 69 6c 65 64 50 68 6f 6e 65 48 75 6e 67 55 70 22 2c 55 73 65 72 56 6f 69 63 65 41 75 74 68 46 61 69 6c 65 64 49 6e 76 61 6c 69 64 50 68 6f 6e 65 4e 75 6d 62 Data Ascii: UserVoiceAuthFailedCallWentToVoicemail:"UserVoiceAuthFailedCallWentToVoicemail",UserVoiceAuthFailedInvalidPhoneInput:"UserVoiceAuthFailedInvalidPhoneInput",UserVoiceAuthFailedPhoneHungUp:"UserVoiceAuthFailedPhoneHungUp",UserVoiceAuthFailedInvalidPhoneNumb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49726	152.199.21.175	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:20 UTC	412	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_ELtAAt2Ya8ISGuc0PJcBKA2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-14 11:04:20 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 3364459 Cache-Control: public, max-age=31536000 Content-MD5: ryp6SSnhPxWgRcjI2ApFQw== Content-Type: application/x-javascript Date: Mon, 14 Oct 2024 11:04:20 GMT Etag: 0x8DCCC8179585EF3 Last-Modified: Wed, 04 Sep 2024 01:32:43 GMT Server: ECAcc (lhc/790E) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: e4045618-601e-0027-728f-ff96a3000000 x-ms-version: 2009-09-19 Content-Length: 449703 Connection: close
2024-10-14 11:04:20 UTC	16383	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-10-14 11:04:20 UTC	16383	IN	Data Raw: 44 49 4e 47 5f 4e 4f 54 5f 41 4c 4c 4f 57 45 44 3a 22 38 30 30 34 37 38 44 37 22 2c 50 50 5f 45 5f 49 44 50 5f 42 49 4e 44 49 4e 47 5f 45 58 49 53 54 53 5f 53 41 4d 53 55 4e 47 3a 22 38 30 30 34 34 35 33 45 22 2c 50 50 5f 45 5f 54 52 41 4e 53 46 45 52 5f 54 4f 4b 45 4e 5f 49 4e 56 41 4c 49 44 5f 53 45 53 53 49 4f 4e 3a 22 38 30 30 34 33 35 41 30 22 7d 2c 6e 2e 45 73 74 73 45 72 72 6f 72 3d 7b 55 73 65 72 41 63 63 6f 75 6e 74 53 65 6c 65 63 74 69 6f 6e 49 6e 76 61 6c 69 64 3a 22 31 36 30 30 31 22 2c 55 73 65 72 55 6e 61 75 74 68 6f 72 69 7a 65 64 3a 22 35 30 30 32 30 22 2c 55 73 65 72 55 6e 61 75 74 68 6f 72 69 7a 65 64 41 70 69 56 65 72 73 69 6f 6e 4e 6f 74 53 75 70 70 6f 72 74 65 64 3a 22 35 30 30 32 30 31 22 2c 55 73 65 72 55 6e 61 75 74 68 6f 72 69 7a Data Ascii: DING_NOT_ALLOWED:"800478D7",PP_E_IDP_BINDING_EXISTS_SAMSUNG:"8004453E",PP_E_TRANSFER_TOKEN_INVALID_SESSION:"800435A0"},n.EstsError={UserAccountSelectionInvalid:"16001",UserUnauthorized:"50020",UserUnauthorizedApiVersionNotSupported:"500201",UserUnauthoriz
2024-10-14 11:04:20 UTC	16383	IN	Data Raw: 54 61 72 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 3f 65 2e 74 61 72 67 65 74 3f 65 2e 74 61 72 67 65 74 3a 65 2e 73 72 63 45 6c 65 6d 65 6e 74 3f 65 2e 73 72 63 45 6c 65 6d 65 6e 74 3a 6e 75 6c 6c 3a 6e 75 6c 6c 7d 7d 2c 44 3d 6e 2e 51 75 65 72 79 53 74 72 69 6e 67 3d 7b 70 61 72 73 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2c 74 3d 6e 75 6c 6c 2c 69 3d 6e 75 6c 6c 3b 69 66 28 65 29 7b 76 61 72 20 61 3d 65 2e 69 6e 64 65 78 4f 66 28 22 3f 22 29 2c 6f 3d 65 2e 69 6e 64 65 78 4f 66 28 22 23 22 29 3b 2d 31 21 3d 3d 6f 26 26 28 2d 31 3d 3d 3d 61 7c 7c 6f 3c 61 29 3f 28 6e 3d 65 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 6f 29 2c 69 3d 64 2e 64 6f 75 62 6c 65 53 70 6c 69 74 28 65 2e 73 75 62 73 74 72 69 6e 67 28 Data Ascii: Target:function(e){return e?e.target?e.target:e.srcElement?e.srcElement:null:null}},D=n.QueryString={parse:function(e){var n=e,t=null,i=null;if(e){var a=e.indexOf("?"),o=e.indexOf("#");-1!==o&&(-1===a\|\|o<a)?(n=e.substring(0,o),i=d.doubleSplit(e.substring(
2024-10-14 11:04:20 UTC	3	IN	Data Raw: 75 6c 74 Data Ascii: ult
2024-10-14 11:04:20 UTC	16383	IN	Data Raw: 54 65 78 74 42 6f 78 50 72 6f 70 65 72 74 79 4c 6f 67 4f 70 74 69 6f 6e 28 65 2c 6e 29 7d 2c 73 2e 67 65 74 50 61 73 73 77 6f 72 64 54 65 78 74 42 6f 78 50 72 6f 70 65 72 74 79 4c 6f 67 4f 70 74 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 72 65 74 75 72 6e 28 6e 3d 6e 7c 7c 7b 7d 29 2e 68 69 64 69 6e 67 4d 6f 64 65 3d 69 2e 48 69 64 69 6e 67 4d 6f 64 65 2e 48 69 64 65 2c 73 2e 67 65 74 44 65 66 61 75 6c 74 54 65 78 74 42 6f 78 50 72 6f 70 65 72 74 79 4c 6f 67 4f 70 74 69 6f 6e 28 65 2c 6e 29 7d 2c 73 2e 67 65 74 44 65 66 61 75 6c 74 45 76 65 6e 74 54 72 61 63 69 6e 67 4f 70 74 69 6f 6e 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 72 65 74 75 72 6e 7b 65 76 65 6e 74 49 64 3a 65 2c 65 76 65 6e 74 4c 65 76 65 6c 3a 74 7c 7c 69 2e 45 76 65 Data Ascii: TextBoxPropertyLogOption(e,n)},s.getPasswordTextBoxPropertyLogOption=function(e,n){return(n=n\|\|{}).hidingMode=i.HidingMode.Hide,s.getDefaultTextBoxPropertyLogOption(e,n)},s.getDefaultEventTracingOptions=function(e,n,t){return{eventId:e,eventLevel:t\|\|i.Eve
2024-10-14 11:04:20 UTC	16383	IN	Data Raw: 68 69 73 5b 75 2e 50 72 6f 6f 66 43 6f 6e 66 69 72 6d 61 74 69 6f 6e 5d 3d 62 29 2c 76 26 26 28 74 68 69 73 5b 75 2e 43 61 6e 61 72 79 46 6c 6f 77 54 6f 6b 65 6e 5d 3d 76 29 7d 2c 6e 2e 52 65 71 75 65 73 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 2c 74 2c 61 2c 63 2c 64 3d 74 68 69 73 2c 6c 3d 70 2e 4e 6f 6e 65 2c 75 3d 22 22 2c 66 3d 22 22 2c 67 3d 22 22 2c 6d 3d 65 2e 64 61 74 61 2c 62 3d 65 2e 6f 6e 53 65 6e 64 2c 76 3d 65 2e 6f 6e 53 65 6e 64 46 61 69 6c 2c 68 3d 65 2e 6f 6e 46 6c 6f 77 45 78 70 69 72 65 64 2c 5f 3d 65 2e 74 69 6d 65 6f 75 74 7c 7c 33 65 34 2c 43 3d 65 2e 73 69 74 65 49 64 2c 53 3d 65 2e 63 6c 69 65 6e 74 49 64 2c 78 3d 65 2e 66 6f 72 77 61 72 64 65 64 43 6c 69 65 6e 74 49 64 2c 77 3d 65 2e 6e 6f 50 61 42 75 62 62 6c 65 Data Ascii: his[u.ProofConfirmation]=b),v&&(this[u.CanaryFlowToken]=v)},n.Request=function(e){var n,t,a,c,d=this,l=p.None,u="",f="",g="",m=e.data,b=e.onSend,v=e.onSendFail,h=e.onFlowExpired,_=e.timeout\|\|3e4,C=e.siteId,S=e.clientId,x=e.forwardedClientId,w=e.noPaBubble
2024-10-14 11:04:20 UTC	16383	IN	Data Raw: 6d 73 7c 7c 6e 2e 43 72 65 64 65 6e 74 69 61 6c 73 2e 46 61 63 65 62 6f 6f 6b 50 61 72 61 6d 73 29 29 29 72 65 74 75 72 6e 20 69 3b 73 77 69 74 63 68 28 61 29 7b 63 61 73 65 20 6d 2e 52 65 6d 6f 74 65 4e 47 43 3a 63 61 73 65 20 6d 2e 46 65 64 65 72 61 74 69 6f 6e 3a 63 61 73 65 20 6d 2e 41 63 63 65 73 73 50 61 73 73 3a 63 61 73 65 20 6d 2e 4e 6f 50 72 65 66 65 72 72 65 64 43 72 65 64 65 6e 74 69 61 6c 3a 6f 26 26 6f 2e 53 61 6d 6c 52 65 71 75 65 73 74 26 26 6f 2e 52 65 6c 61 79 53 74 61 74 65 3f 28 69 2e 69 64 70 52 65 64 69 72 65 63 74 55 72 6c 3d 6e 2e 43 72 65 64 65 6e 74 69 61 6c 73 2e 46 65 64 65 72 61 74 69 6f 6e 52 65 64 69 72 65 63 74 55 72 6c 2c 69 2e 69 64 70 52 65 64 69 72 65 63 74 50 6f 73 74 50 61 72 61 6d 73 3d 7b 53 41 4d 4c 52 65 71 75 65 Data Ascii: ms\|\|n.Credentials.FacebookParams)))return i;switch(a){case m.RemoteNGC:case m.Federation:case m.AccessPass:case m.NoPreferredCredential:o&&o.SamlRequest&&o.RelayState?(i.idpRedirectUrl=n.Credentials.FederationRedirectUrl,i.idpRedirectPostParams={SAMLReque
2024-10-14 11:04:20 UTC	16383	IN	Data Raw: 74 65 28 29 2c 6e 2e 6f 6e 52 65 64 69 72 65 63 74 3d 6f 2e 63 72 65 61 74 65 28 29 2c 6e 2e 6f 6e 52 65 67 69 73 74 65 72 44 69 61 6c 6f 67 3d 6f 2e 63 72 65 61 74 65 28 29 2c 6e 2e 6f 6e 55 6e 72 65 67 69 73 74 65 72 44 69 61 6c 6f 67 3d 6f 2e 63 72 65 61 74 65 28 29 2c 6e 2e 6f 6e 53 68 6f 77 44 69 61 6c 6f 67 3d 6f 2e 63 72 65 61 74 65 28 29 2c 6e 2e 6f 6e 53 65 74 50 65 6e 64 69 6e 67 52 65 71 75 65 73 74 3d 6f 2e 63 72 65 61 74 65 28 29 2c 6e 2e 6f 6e 55 70 64 61 74 65 46 6c 6f 77 54 6f 6b 65 6e 3d 6f 2e 63 72 65 61 74 65 28 29 2c 6e 2e 63 72 65 64 65 6e 74 69 61 6c 43 6f 75 6e 74 3d 30 2c 6e 2e 73 65 6c 65 63 74 65 64 43 72 65 64 54 79 70 65 3d 6e 75 6c 6c 2c 6e 2e 73 65 6c 65 63 74 65 64 43 72 65 64 53 68 6f 77 6e 4f 6e 6c 79 4f 6e 50 69 63 6b 65 Data Ascii: te(),n.onRedirect=o.create(),n.onRegisterDialog=o.create(),n.onUnregisterDialog=o.create(),n.onShowDialog=o.create(),n.onSetPendingRequest=o.create(),n.onUpdateFlowToken=o.create(),n.credentialCount=0,n.selectedCredType=null,n.selectedCredShownOnlyOnPicke
2024-10-14 11:04:20 UTC	4	IN	Data Raw: 75 74 68 65 Data Ascii: uthe
2024-10-14 11:04:20 UTC	16383	IN	Data Raw: 6e 74 69 63 61 74 65 64 53 74 61 74 65 7c 7c 32 3d 3d 3d 65 2e 61 75 74 68 65 6e 74 69 63 61 74 65 64 53 74 61 74 65 2c 69 73 57 69 6e 64 6f 77 73 53 73 6f 3a 65 2e 69 73 57 69 6e 64 6f 77 73 53 73 6f 7c 7c 21 31 2c 69 73 4d 65 43 6f 6e 74 72 6f 6c 53 65 73 73 69 6f 6e 3a 21 30 2c 69 73 47 69 74 48 75 62 46 65 64 3a 65 2e 69 73 47 69 74 48 75 62 46 65 64 7c 7c 21 31 7d 7d 29 29 7d 2c 70 61 72 73 65 42 73 73 6f 53 65 73 73 69 6f 6e 73 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 2e 6d 61 70 28 65 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 7b 73 73 6f 55 6e 69 71 75 65 49 64 3a 65 2e 73 73 6f 55 6e 69 71 75 65 49 64 2c 6e 61 6d 65 3a 65 2e 6e 61 6d 65 2c 64 69 73 70 6c 61 79 4e 61 6d 65 3a 65 2e 64 69 73 70 6c 61 79 4e 61 Data Ascii: nticatedState\|\|2===e.authenticatedState,isWindowsSso:e.isWindowsSso\|\|!1,isMeControlSession:!0,isGitHubFed:e.isGitHubFed\|\|!1}}))},parseBssoSessions:function(e){return o.map(e,(function(e){return{ssoUniqueId:e.ssoUniqueId,name:e.name,displayName:e.displayNa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49727	152.199.21.175	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:20 UTC	651	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-14 11:04:20 UTC	720	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 17645138 Cache-Control: public, max-age=31536000 Content-MD5: EuPayFgGHQiAI7K9SOL6lg== Content-Type: image/x-icon Date: Mon, 14 Oct 2024 11:04:20 GMT Etag: 0x8D8731240E548EB Last-Modified: Sun, 18 Oct 2020 03:02:30 GMT Server: ECAcc (lhc/7944) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 1c016ee5-901e-008a-08ad-7d0366000000 x-ms-version: 2009-09-19 Content-Length: 17174 Connection: close
2024-10-14 11:04:20 UTC	15682	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-10-14 11:04:20 UTC	1492	IN	Data Raw: 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 Data Ascii: {L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49728	152.199.21.175	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:20 UTC	620	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-14 11:04:20 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 5095958 Cache-Control: public, max-age=31536000 Content-MD5: LT++1t3XGfzBv7UAthL87A== Content-Type: application/x-javascript Date: Mon, 14 Oct 2024 11:04:20 GMT Etag: 0x8DCBD52F37806EC Last-Modified: Thu, 15 Aug 2024 17:51:54 GMT Server: ECAcc (lhc/7888) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 10a7d1b4-001e-005d-7bcf-ef5e4a000000 x-ms-version: 2009-09-19 Content-Length: 406986 Connection: close
2024-10-14 11:04:20 UTC	15652	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-10-14 11:04:20 UTC	16383	IN	Data Raw: 73 28 6e 29 2c 6f 28 72 29 3f 28 65 3f 74 28 72 2c 6e 29 3a 72 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 6e 2c 72 29 3a 72 7d 7d 28 29 3a 75 6e 64 65 66 69 6e 65 64 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 72 28 35 37 30 29 2c 6f 3d 54 79 70 65 45 72 72 6f 72 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 6e 28 65 2c 74 29 29 72 65 74 75 72 6e 20 74 3b 74 68 72 6f 77 20 6e 65 77 20 6f 28 22 49 6e 63 6f 72 72 65 63 74 20 69 6e 76 6f 63 61 74 69 6f 6e 22 29 7d 7d 2c 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 2c 6f 2c 69 3d 72 28 35 33 39 29 2c 73 3d 72 28 35 38 39 29 2c 75 3d 69 2e 70 72 6f 63 65 Data Ascii: s(n),o(r)?(e?t(r,n):r.__proto__=n,r):r}}():undefined)},function(t,e,r){"use strict";var n=r(570),o=TypeError;t.exports=function(t,e){if(n(e,t))return t;throw new o("Incorrect invocation")}},,function(t,e,r){"use strict";var n,o,i=r(539),s=r(589),u=i.proce
2024-10-14 11:04:20 UTC	16383	IN	Data Raw: 29 29 72 65 74 75 72 6e 20 65 28 72 2c 6e 29 7d 29 29 3a 74 68 69 73 2e 77 61 6c 6b 28 28 66 75 6e 63 74 69 6f 6e 28 72 2c 6e 29 7b 69 66 28 22 64 65 63 6c 22 3d 3d 3d 72 2e 74 79 70 65 26 26 72 2e 70 72 6f 70 3d 3d 3d 74 29 72 65 74 75 72 6e 20 65 28 72 2c 6e 29 7d 29 29 3a 28 65 3d 74 2c 74 68 69 73 2e 77 61 6c 6b 28 28 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 69 66 28 22 64 65 63 6c 22 3d 3d 3d 74 2e 74 79 70 65 29 72 65 74 75 72 6e 20 65 28 74 2c 72 29 7d 29 29 29 7d 7d 2c 7b 6b 65 79 3a 22 77 61 6c 6b 52 75 6c 65 73 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 65 3f 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 52 65 67 45 78 70 3f 74 68 69 73 2e 77 61 6c 6b 28 28 66 75 6e 63 74 69 6f 6e 28 72 2c 6e 29 7b 69 66 28 Data Ascii: ))return e(r,n)})):this.walk((function(r,n){if("decl"===r.type&&r.prop===t)return e(r,n)})):(e=t,this.walk((function(t,r){if("decl"===t.type)return e(t,r)})))}},{key:"walkRules",value:function(t,e){return e?t instanceof RegExp?this.walk((function(r,n){if(
2024-10-14 11:04:20 UTC	16383	IN	Data Raw: 75 66 66 65 72 22 3d 3d 3d 65 2e 74 79 70 65 26 26 69 28 65 2e 64 61 74 61 29 29 72 65 74 75 72 6e 20 68 28 74 2c 65 2e 64 61 74 61 29 7d 76 61 72 20 6e 3b 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 6d 75 73 74 20 62 65 20 61 20 73 74 72 69 6e 67 2c 20 42 75 66 66 65 72 2c 20 41 72 72 61 79 42 75 66 66 65 72 2c 20 41 72 72 61 79 2c 20 6f 72 20 61 72 72 61 79 2d 6c 69 6b 65 20 6f 62 6a 65 63 74 2e 22 29 7d 28 74 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 66 28 74 29 7b 69 66 28 22 6e 75 6d 62 65 72 22 21 3d 74 79 70 65 6f 66 20 74 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 27 22 73 69 7a 65 22 20 61 72 67 75 6d 65 6e 74 20 6d 75 73 74 20 62 65 20 61 20 6e 75 6d 62 65 72 27 29 Data Ascii: uffer"===e.type&&i(e.data))return h(t,e.data)}var n;throw new TypeError("First argument must be a string, Buffer, ArrayBuffer, Array, or array-like object.")}(t,e)}function f(t){if("number"!=typeof t)throw new TypeError('"size" argument must be a number')
2024-10-14 11:04:20 UTC	16383	IN	Data Raw: 6f 74 6f 74 79 70 65 2e 66 69 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 2c 6e 29 7b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 29 7b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 3f 28 6e 3d 65 2c 65 3d 30 2c 72 3d 74 68 69 73 2e 6c 65 6e 67 74 68 29 3a 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 72 26 26 28 6e 3d 72 2c 72 3d 74 68 69 73 2e 6c 65 6e 67 74 68 29 2c 31 3d 3d 3d 74 2e 6c 65 6e 67 74 68 29 7b 76 61 72 20 6f 3d 74 2e 63 68 61 72 43 6f 64 65 41 74 28 30 29 3b 6f 3c 32 35 36 26 26 28 74 3d 6f 29 7d 69 66 28 6e 21 3d 3d 75 6e 64 65 66 69 6e 65 64 26 26 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 6e 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 65 6e 63 6f 64 69 6e 67 Data Ascii: ototype.fill=function(t,e,r,n){if("string"==typeof t){if("string"==typeof e?(n=e,e=0,r=this.length):"string"==typeof r&&(n=r,r=this.length),1===t.length){var o=t.charCodeAt(0);o<256&&(t=o)}if(n!==undefined&&"string"!=typeof n)throw new TypeError("encoding
2024-10-14 11:04:20 UTC	16383	IN	Data Raw: 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 74 3d 21 42 6f 6f 6c 65 61 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 4f 66 2e 63 61 6c 6c 28 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 42 6f 6f 6c 65 61 6e 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 29 29 7d 63 61 74 63 68 28 74 29 7b 7d 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 21 74 7d 28 29 7d 28 29 3f 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 65 2c 72 7c 7c 5b 5d 2c 66 28 74 29 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 3a 65 2e 61 70 70 6c 79 28 74 2c 72 29 29 7d 66 75 6e 63 74 69 6f 6e 20 66 28 74 29 7b 72 65 74 75 72 6e 28 66 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3f 4f 62 6a 65 63 74 2e 67 65 74 50 72 Data Ascii: ction(){try{var t=!Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],(function(){})))}catch(t){}return function(){return!!t}()}()?Reflect.construct(e,r\|\|[],f(t).constructor):e.apply(t,r))}function f(t){return(f=Object.setPrototypeOf?Object.getPr
2024-10-14 11:04:20 UTC	16383	IN	Data Raw: 6e 7d 28 28 28 6e 3d 72 28 37 32 37 29 29 26 26 6e 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3f 6e 3a 7b 22 64 65 66 61 75 6c 74 22 3a 6e 7d 29 5b 22 64 65 66 61 75 6c 74 22 5d 29 3b 65 5b 22 64 65 66 61 75 6c 74 22 5d 3d 6f 2c 74 2e 65 78 70 6f 72 74 73 3d 65 5b 22 64 65 66 61 75 6c 74 22 5d 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 74 29 7b 72 65 74 75 72 6e 28 6e 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 22 73 79 6d 62 6f 6c 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 3f 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 74 7d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 Data Ascii: n}(((n=r(727))&&n.__esModule?n:{"default":n})["default"]);e["default"]=o,t.exports=e["default"]},function(t,e,r){"use strict";function n(t){return(n="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(t){return typeof t}:function(t){retur
2024-10-14 11:04:20 UTC	16383	IN	Data Raw: 7a 22 2c 74 2e 65 78 70 6f 72 74 73 3d 22 5b 6f 62 6a 65 63 74 20 7a 5d 22 3d 3d 3d 53 74 72 69 6e 67 28 6e 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 72 28 35 34 30 29 2c 6f 3d 72 28 38 30 38 29 2c 69 3d 72 28 35 35 36 29 2c 73 3d 72 28 35 34 33 29 2c 75 3d 72 28 35 36 30 29 2c 61 3d 72 28 36 33 32 29 3b 65 2e 66 3d 6e 26 26 21 6f 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 73 28 74 29 3b 66 6f 72 28 76 61 72 20 72 2c 6e 3d 75 28 65 29 2c 6f 3d 61 28 65 29 2c 63 3d 6f 2e 6c 65 6e 67 74 68 2c 66 3d 30 3b 63 3e 66 3b 29 69 2e 66 28 74 2c 72 3d 6f 5b 66 2b 2b 5d 2c 6e 5b 72 5d 29 3b 72 65 74 75 72 6e 20 74 7d 7d 2c Data Ascii: z",t.exports="[object z]"===String(n)},function(t,e,r){"use strict";var n=r(540),o=r(808),i=r(556),s=r(543),u=r(560),a=r(632);e.f=n&&!o?Object.defineProperties:function(t,e){s(t);for(var r,n=u(e),o=a(e),c=o.length,f=0;c>f;)i.f(t,r=o[f++],n[r]);return t}},
2024-10-14 11:04:20 UTC	16383	IN	Data Raw: 65 3d 21 30 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 69 28 6e 2e 6b 65 79 29 2c 6e 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 69 28 74 29 7b 76 61 72 20 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 21 3d 6e 28 74 29 7c 7c 21 74 29 72 65 74 75 72 6e 20 74 3b 76 61 72 20 72 3d 74 5b 53 79 6d 62 6f 6c 2e 74 6f 50 72 69 6d 69 74 69 76 65 5d 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 72 29 7b 76 61 72 20 6f 3d 72 2e 63 61 6c 6c 28 74 2c 65 7c 7c 22 64 65 66 61 75 6c 74 22 29 3b 69 66 28 22 6f 62 6a 65 63 74 22 21 3d 6e 28 6f 29 29 72 65 74 75 72 6e 20 6f 3b 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 40 40 74 6f 50 72 69 6d 69 74 69 76 65 20 6d 75 73 74 20 72 65 74 75 72 6e 20 61 Data Ascii: e=!0),Object.defineProperty(t,i(n.key),n)}}function i(t){var e=function(t,e){if("object"!=n(t)\|\|!t)return t;var r=t[Symbol.toPrimitive];if(void 0!==r){var o=r.call(t,e\|\|"default");if("object"!=n(o))return o;throw new TypeError("@@toPrimitive must return a
2024-10-14 11:04:20 UTC	16383	IN	Data Raw: 3d 74 2e 70 72 6f 74 6f 74 79 70 65 3b 72 65 74 75 72 6e 20 6c 2e 77 61 72 6e 69 6e 67 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 73 79 6e 63 28 29 2e 77 61 72 6e 69 6e 67 73 28 29 7d 2c 6c 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 63 73 73 7d 2c 6c 2e 74 68 65 6e 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 61 73 79 6e 63 28 29 2e 74 68 65 6e 28 74 2c 65 29 7d 2c 6c 5b 22 63 61 74 63 68 22 5d 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 61 73 79 6e 63 28 29 5b 22 63 61 74 63 68 22 5d 28 74 29 7d 2c 6c 5b 22 66 69 6e 61 6c 6c 79 22 5d 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 68 69 Data Ascii: =t.prototype;return l.warnings=function(){return this.sync().warnings()},l.toString=function(){return this.css},l.then=function(t,e){return this.async().then(t,e)},l["catch"]=function(t){return this.async()["catch"](t)},l["finally"]=function(t){return thi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49729	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:21 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=uZ7EuV5AC6Durxu&MD=UrhV8gVN HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-14 11:04:21 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: e1fd32d1-03c5-47a8-9d9e-72a9e6d41bcd MS-RequestId: 92ddae6a-3c10-4b35-8c8e-afed8fc15416 MS-CV: HamkAy00g0CvA5WC.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 14 Oct 2024 11:04:20 GMT Connection: close Content-Length: 24490
2024-10-14 11:04:21 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-14 11:04:21 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49730	152.199.21.175	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:21 UTC	406	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-14 11:04:21 UTC	720	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 17645139 Cache-Control: public, max-age=31536000 Content-MD5: EuPayFgGHQiAI7K9SOL6lg== Content-Type: image/x-icon Date: Mon, 14 Oct 2024 11:04:21 GMT Etag: 0x8D8731240E548EB Last-Modified: Sun, 18 Oct 2020 03:02:30 GMT Server: ECAcc (lhc/7944) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 1c016ee5-901e-008a-08ad-7d0366000000 x-ms-version: 2009-09-19 Content-Length: 17174 Connection: close
2024-10-14 11:04:21 UTC	16383	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-10-14 11:04:21 UTC	791	IN	Data Raw: 01 80 00 00 01 80 00 28 00 00 00 18 00 00 00 30 00 00 00 01 00 04 00 00 00 00 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 Data Ascii: (0"P""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49732	152.199.21.175	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:22 UTC	622	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-14 11:04:22 UTC	749	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 4944881 Cache-Control: public, max-age=31536000 Content-MD5: betEqf4nMmbvq8MhS5mLoA== Content-Type: application/x-javascript Date: Mon, 14 Oct 2024 11:04:22 GMT Etag: 0x8DCBD52F3A242D0 Last-Modified: Thu, 15 Aug 2024 17:51:55 GMT Server: ECAcc (lhc/7941) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: bbd0cf2c-501e-006f-482f-f15e3d000000 x-ms-version: 2009-09-19 Content-Length: 15755 Connection: close
2024-10-14 11:04:22 UTC	15755	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49734	152.199.21.175	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:22 UTC	670	OUT	GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-14 11:04:22 UTC	716	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 17645089 Cache-Control: public, max-age=31536000 Content-MD5: Fm3lNHEmUlOrOkVt7+baIw== Content-Type: image/gif Date: Mon, 14 Oct 2024 11:04:22 GMT Etag: 0x8DB5C3F4982FD30 Last-Modified: Wed, 24 May 2023 10:11:48 GMT Server: ECAcc (lhc/7945) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: c8ea465c-601e-0025-11ad-7d4c1f000000 x-ms-version: 2009-09-19 Content-Length: 2672 Connection: close
2024-10-14 11:04:22 UTC	2672	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e 69 18 14 00 21 Data Ascii: GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~i!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49731	152.199.21.175	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:22 UTC	435	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-14 11:04:22 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 5095960 Cache-Control: public, max-age=31536000 Content-MD5: LT++1t3XGfzBv7UAthL87A== Content-Type: application/x-javascript Date: Mon, 14 Oct 2024 11:04:22 GMT Etag: 0x8DCBD52F37806EC Last-Modified: Thu, 15 Aug 2024 17:51:54 GMT Server: ECAcc (lhc/7888) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 10a7d1b4-001e-005d-7bcf-ef5e4a000000 x-ms-version: 2009-09-19 Content-Length: 406986 Connection: close
2024-10-14 11:04:22 UTC	16383	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-10-14 11:04:22 UTC	16383	IN	Data Raw: 69 3d 4d 61 74 68 2e 6d 69 6e 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 72 3d 6e 28 74 29 3b 72 65 74 75 72 6e 20 72 3c 30 3f 6f 28 72 2b 65 2c 30 29 3a 69 28 72 2c 65 29 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 72 28 35 33 37 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 72 3d 5b 5d 5b 74 5d 3b 72 65 74 75 72 6e 21 21 72 26 26 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 2e 63 61 6c 6c 28 6e 75 6c 6c 2c 65 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 31 7d 2c 31 29 7d 29 29 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 Data Ascii: i=Math.min;t.exports=function(t,e){var r=n(t);return r<0?o(r+e,0):i(r,e)}},function(t,e,r){"use strict";var n=r(537);t.exports=function(t,e){var r=[][t];return!!r&&n((function(){r.call(null,e\|\|function(){return 1},1)}))}},function(t,e,r){"use strict";var
2024-10-14 11:04:22 UTC	2	IN	Data Raw: 21 31 Data Ascii: !1
2024-10-14 11:04:22 UTC	16383	IN	Data Raw: 7d 29 2c 65 7d 28 72 28 36 38 32 29 29 3b 45 2e 72 65 67 69 73 74 65 72 50 61 72 73 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 3d 74 7d 2c 45 2e 72 65 67 69 73 74 65 72 52 75 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 67 3d 74 7d 2c 45 2e 72 65 67 69 73 74 65 72 41 74 52 75 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 6d 3d 74 7d 2c 45 2e 72 65 67 69 73 74 65 72 52 6f 6f 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 62 3d 74 7d 2c 74 2e 65 78 70 6f 72 74 73 3d 45 2c 45 5b 22 64 65 66 61 75 6c 74 22 5d 3d 45 2c 45 2e 72 65 62 75 69 6c 64 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 61 74 72 75 6c 65 22 3d 3d 3d 74 2e 74 79 70 65 3f 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 74 2c 6d 2e 70 72 6f 74 6f 74 79 70 65 29 3a 22 72 75 6c 65 22 Data Ascii: }),e}(r(682));E.registerParse=function(t){v=t},E.registerRule=function(t){g=t},E.registerAtRule=function(t){m=t},E.registerRoot=function(t){b=t},t.exports=E,E["default"]=E,E.rebuild=function(t){"atrule"===t.type?Object.setPrototypeOf(t,m.prototype):"rule"
2024-10-14 11:04:22 UTC	16383	IN	Data Raw: 21 3d 74 79 70 65 6f 66 20 41 72 72 61 79 42 75 66 66 65 72 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 41 72 72 61 79 42 75 66 66 65 72 2e 69 73 56 69 65 77 26 26 28 41 72 72 61 79 42 75 66 66 65 72 2e 69 73 56 69 65 77 28 74 29 7c 7c 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 42 75 66 66 65 72 29 29 72 65 74 75 72 6e 20 74 2e 62 79 74 65 4c 65 6e 67 74 68 3b 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 74 26 26 28 74 3d 22 22 2b 74 29 3b 76 61 72 20 72 3d 74 2e 6c 65 6e 67 74 68 3b 69 66 28 30 3d 3d 3d 72 29 72 65 74 75 72 6e 20 30 3b 66 6f 72 28 76 61 72 20 6e 3d 21 31 3b 3b 29 73 77 69 74 63 68 28 65 29 7b 63 61 73 65 22 61 73 63 69 69 22 3a 63 61 73 65 22 6c 61 74 69 6e 31 22 3a 63 61 73 65 22 62 69 6e 61 72 79 22 Data Ascii: !=typeof ArrayBuffer&&"function"==typeof ArrayBuffer.isView&&(ArrayBuffer.isView(t)\|\|t instanceof ArrayBuffer))return t.byteLength;"string"!=typeof t&&(t=""+t);var r=t.length;if(0===r)return 0;for(var n=!1;;)switch(e){case"ascii":case"latin1":case"binary"
2024-10-14 11:04:22 UTC	16383	IN	Data Raw: 3b 66 75 6e 63 74 69 6f 6e 20 4e 28 74 29 7b 72 65 74 75 72 6e 20 74 3c 31 36 3f 22 30 22 2b 74 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 3a 74 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 74 2c 65 29 7b 76 61 72 20 72 3b 65 3d 65 7c 7c 49 6e 66 69 6e 69 74 79 3b 66 6f 72 28 76 61 72 20 6e 3d 74 2e 6c 65 6e 67 74 68 2c 6f 3d 6e 75 6c 6c 2c 69 3d 5b 5d 2c 73 3d 30 3b 73 3c 6e 3b 2b 2b 73 29 7b 69 66 28 28 72 3d 74 2e 63 68 61 72 43 6f 64 65 41 74 28 73 29 29 3e 35 35 32 39 35 26 26 72 3c 35 37 33 34 34 29 7b 69 66 28 21 6f 29 7b 69 66 28 72 3e 35 36 33 31 39 29 7b 28 65 2d 3d 33 29 3e 2d 31 26 26 69 2e 70 75 73 68 28 32 33 39 2c 31 39 31 2c 31 38 39 29 3b 63 6f 6e 74 69 6e 75 65 7d 69 66 28 73 2b 31 3d 3d 3d 6e 29 7b 28 65 2d 3d Data Ascii: ;function N(t){return t<16?"0"+t.toString(16):t.toString(16)}function F(t,e){var r;e=e\|\|Infinity;for(var n=t.length,o=null,i=[],s=0;s<n;++s){if((r=t.charCodeAt(s))>55295&&r<57344){if(!o){if(r>56319){(e-=3)>-1&&i.push(239,191,189);continue}if(s+1===n){(e-=
2024-10-14 11:04:22 UTC	16383	IN	Data Raw: 61 72 20 72 2c 6e 2c 6f 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 65 26 26 6e 75 6c 6c 21 3d 3d 65 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 75 73 74 20 65 69 74 68 65 72 20 62 65 20 6e 75 6c 6c 20 6f 72 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 74 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 65 26 26 65 2e 70 72 6f 74 6f 74 79 70 65 2c 7b 63 6f 6e 73 74 72 75 63 74 6f 72 3a 7b 76 61 6c 75 65 3a 74 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 7d 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 Data Ascii: ar r,n,o;return function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Super expression must either be null or a function");t.prototype=Object.create(e&&e.prototype,{constructor:{value:t,writable:!0,configurable:!0}}),Object.defineProperty(t
2024-10-14 11:04:22 UTC	16383	IN	Data Raw: 7d 72 65 74 75 72 6e 20 6e 65 77 20 6f 5b 22 64 65 66 61 75 6c 74 22 5d 28 74 29 7d 2c 65 2e 77 61 72 6e 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 76 61 72 20 6e 3d 7b 6e 6f 64 65 3a 74 68 69 73 7d 3b 66 6f 72 28 76 61 72 20 6f 20 69 6e 20 72 29 6e 5b 6f 5d 3d 72 5b 6f 5d 3b 72 65 74 75 72 6e 20 74 2e 77 61 72 6e 28 65 2c 6e 29 7d 2c 65 2e 72 65 6d 6f 76 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 61 72 65 6e 74 26 26 74 68 69 73 2e 70 61 72 65 6e 74 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 68 69 73 29 2c 74 68 69 73 2e 70 61 72 65 6e 74 3d 75 6e 64 65 66 69 6e 65 64 2c 74 68 69 73 7d 2c 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 6f 69 64 20 30 3d 3d 3d 74 26 26 28 74 3d 73 5b 22 64 Data Ascii: }return new o["default"](t)},e.warn=function(t,e,r){var n={node:this};for(var o in r)n[o]=r[o];return t.warn(e,n)},e.remove=function(){return this.parent&&this.parent.removeChild(this),this.parent=undefined,this},e.toString=function(t){void 0===t&&(t=s["d
2024-10-14 11:04:22 UTC	16383	IN	Data Raw: 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 61 26 26 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 21 6f 2e 70 72 65 70 61 72 65 53 74 61 63 6b 54 72 61 63 65 29 66 6f 72 28 3b 65 2d 2d 3b 29 74 3d 69 28 74 2c 75 2c 22 22 29 3b 72 65 74 75 72 6e 20 74 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 72 28 35 33 37 29 3b 74 2e 65 78 70 6f 72 74 73 3d 21 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 7d 72 65 74 75 72 6e 20 74 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 6e 75 6c 6c 2c 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 6e 65 77 20 74 29 21 3d 3d 74 2e 70 72 6f 74 Data Ascii: xports=function(t,e){if(a&&"string"==typeof t&&!o.prepareStackTrace)for(;e--;)t=i(t,u,"");return t}},function(t,e,r){"use strict";var n=r(537);t.exports=!n((function(){function t(){}return t.prototype.constructor=null,Object.getPrototypeOf(new t)!==t.prot
2024-10-14 11:04:22 UTC	16383	IN	Data Raw: 61 72 67 75 6d 65 6e 74 73 5b 31 5d 21 3d 3d 75 6e 64 65 66 69 6e 65 64 3f 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3a 7b 7d 3b 65 2e 70 6c 75 67 69 6e 7c 7c 74 68 69 73 2e 6c 61 73 74 50 6c 75 67 69 6e 26 26 74 68 69 73 2e 6c 61 73 74 50 6c 75 67 69 6e 2e 70 6f 73 74 63 73 73 50 6c 75 67 69 6e 26 26 28 65 2e 70 6c 75 67 69 6e 3d 74 68 69 73 2e 6c 61 73 74 50 6c 75 67 69 6e 2e 70 6f 73 74 63 73 73 50 6c 75 67 69 6e 29 3b 76 61 72 20 72 3d 6e 65 77 20 73 28 74 2c 65 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 6d 65 73 73 61 67 65 73 2e 70 75 73 68 28 72 29 2c 72 7d 7d 2c 7b 6b 65 79 3a 22 77 61 72 6e 69 6e 67 73 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6d 65 73 73 61 67 65 73 2e 66 69 6c 74 65 72 28 28 66 75 6e Data Ascii: arguments[1]!==undefined?arguments[1]:{};e.plugin\|\|this.lastPlugin&&this.lastPlugin.postcssPlugin&&(e.plugin=this.lastPlugin.postcssPlugin);var r=new s(t,e);return this.messages.push(r),r}},{key:"warnings",value:function(){return this.messages.filter((fun

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49733	152.199.21.175	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:22 UTC	664	OUT	GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-14 11:04:22 UTC	716	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 17645267 Cache-Control: public, max-age=31536000 Content-MD5: tUCo5RgDcZLjLE/li/Lbqw== Content-Type: image/gif Date: Mon, 14 Oct 2024 11:04:22 GMT Etag: 0x8DB5C3F492F3EE5 Last-Modified: Wed, 24 May 2023 10:11:48 GMT Server: ECAcc (lhc/7941) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 1d63faa2-d01e-009e-5cad-7d1f4c000000 x-ms-version: 2009-09-19 Content-Length: 3620 Connection: close
2024-10-14 11:04:22 UTC	3620	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 0f Data Ascii: GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49739	13.107.246.45	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:23 UTC	703	OUT	GET /c1c6b6c8-yw-iky5-oitv6m8bxnlvjqeioua2sjr-bhiob-yiudy/logintenantbranding/0/illustration?ts=637255507111143881 HTTP/1.1 Host: aadcdn.msftauthimages.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-14 11:04:23 UTC	772	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:04:23 GMT Content-Type: image/* Content-Length: 260198 Connection: close Cache-Control: public, max-age=86400 Last-Modified: Wed, 20 May 2020 05:51:51 GMT ETag: 0x8D7FC81E4B81B65 x-ms-request-id: 97e86189-501e-002a-2928-1e84bc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241014T110423Z-17db6f7c8cfbd7pgux3k6qfa60000000058000000000323p x-fd-int-roxy-purgeid: 50755578 X-Cache: TCP_MISS X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-14 11:04:23 UTC	15612	IN	Data Raw: ff d8 ff e1 1c 6c 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 03 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 91 87 69 00 04 00 00 00 01 00 00 00 a8 00 00 00 d4 00 2d c6 c0 00 00 27 10 00 2d c6 c0 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 30 3a 30 35 3a 32 30 20 30 38 3a 35 30 3a 31 31 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 22 01 1b 00 05 00 Data Ascii: lExifMM*bj(1r2i-'-'Adobe Photoshop 21.1 (Windows)2020:05:20 08:50:118"
2024-10-14 11:04:24 UTC	16384	IN	Data Raw: f5 33 1a 9d ae 12 c2 4d af da 32 23 65 bf cd 7e 8e b6 d6 92 9b ee 7e 5f 4a e8 35 75 46 5d fa cf 52 c9 c7 64 b8 9d de 9e 3d 16 53 73 1e ff 00 e5 da f5 b3 8e cc 36 64 e4 74 cc db d8 30 7a 00 c4 a0 58 43 58 49 b0 55 66 4d 96 5a e9 fc fc 6b 2b ad 9f bf 6a e2 32 72 b2 f2 ba 76 1f 4e b8 16 d1 d3 fd 4f 48 fa 6e f7 1b 5c 1e ff 00 55 cc b1 fe e6 ed d8 cf 67 d0 43 b6 b7 e4 db 6d d9 56 97 d9 73 b7 db 71 f5 25 c5 c6 5c e7 cd 6e f7 6e 49 4d 8c 7c ce 9a ec 2c a3 75 65 b7 d9 65 2d 63 25 c6 6b 73 df 7e 63 bf b3 e8 d0 b5 fa 97 d6 7c ec 9c cb 9b d2 a8 7d 58 6e b2 c7 34 3c 19 25 d6 3d cd b7 6b 76 b9 9f a0 f4 19 e9 fb ff 00 9b 59 dd 3f 06 8b 1d 0d 6b 2c de 46 d7 33 53 a1 f8 2e 9f 17 23 07 a7 56 5f 6b 5d 25 fe d0 c6 37 88 98 3b de c4 94 e5 5c ee b7 9e 2a 66 5b ed ae c3 8e 71 Data Ascii: 3M2#e~~_J5uF]Rd=Ss6dt0zXCXIUfMZk+j2rvNOHn\UgCmVsq%\nnIM\|,uee-c%ks~c\|}Xn4<%=kvY?k,F3S.#V_k]%7;\*f[q
2024-10-14 11:04:24 UTC	16384	IN	Data Raw: 55 30 b3 d6 ed ae cf 28 cd 71 55 79 b5 65 2d e9 8c 55 ff d3 f4 20 c5 0a a8 7e 13 8a bc 9f cf ed 5b 93 8a b1 11 4c 55 78 38 aa 95 d1 1c 71 56 31 ac 9f 80 e1 57 9c eb 1b b9 c5 52 56 f8 4e 2a f5 8f ca 4b 62 c7 96 2a f6 c0 28 80 62 aa 3e 88 97 e1 23 02 a1 6e fc bb 0c a0 f2 1d 71 56 21 ac fe 5f 89 09 78 8d 31 56 31 37 96 6e ac 9b 60 69 8a a5 f7 ff 00 5a d3 c7 d6 10 1a 8c 55 ea bf 93 9f 9b 02 e0 8b 3d 44 d3 b0 ae 2a f6 e7 92 1b 98 ff 00 76 c0 ab 0c 50 f2 8f cc df ca 38 75 38 1e e6 d9 7f 7b 42 76 c5 21 f3 dd 8c 92 79 72 e5 ed ee d4 82 0d 37 c5 5e 83 e5 9f 31 2d c1 08 1b e1 38 ab 23 d7 7c ad 6b ae 40 13 62 d8 a5 92 7e 55 f9 51 f4 09 78 fe c6 2a f4 a9 8f c5 51 8a a0 2e 9b 15 43 a9 e4 71 43 14 f3 bc d4 2a b8 aa 4f 6b fd dd 71 42 94 8e 4e 14 84 aa e7 be 2a c4 75 18 Data Ascii: U0(qUye-U ~[LUx8qV1WRVNKb(b>#nqV!_x1V17n`iZU=DvP8u8{Bv!yr7^1-8#\|k@b~UQxQ.CqCOkqBNu
2024-10-14 11:04:24 UTC	16384	IN	Data Raw: b8 67 41 4a 9c 55 8f ea b6 a1 e3 35 c5 58 7c f6 4d 52 88 28 31 55 16 b4 7b 55 e4 31 54 4e 9b e6 a6 81 b8 36 15 4f 7d 78 6f d0 b7 ed 1c 55 8b 4b 1c b6 77 81 a2 e9 5c 55 93 ea 7a 91 9a d3 8c bd 69 8a b0 32 e1 1f da b8 10 cf 74 58 a3 96 cc 9e f4 c5 2f 39 96 05 8f 52 2c dd 39 62 af 60 b1 d7 63 b6 d3 42 a0 ea 31 56 22 da 6a de 96 b9 22 bd f1 4a 4d 69 2c 82 ec c6 45 14 62 ac 9a 0d 38 cd 42 46 2a f4 2b 2b 84 b6 d2 cc 35 de 98 aa 69 e5 4d 02 3b dd 3e 59 67 ec 0d 31 57 90 79 aa c6 38 e7 91 23 ea 09 c5 58 21 d5 6f 2c e6 28 84 d2 b8 aa fb ab 97 91 84 92 7d a3 8a b2 7b 6f 2e 8b db 2f ac 37 61 8a b1 6b 79 22 8a e0 c6 7a 83 8a a7 fa 7e a4 5a 4f 4c 9f 87 15 46 5f d8 7a e2 ab 8a a0 53 4f 78 f6 38 aa 26 2b 16 53 55 c0 a9 3f 98 f9 20 a9 c2 a9 14 60 01 cb 15 5a 0f a8 d4 c5 Data Ascii: gAJU5X\|MR(1U{U1TN6O}xoUKw\Uzi2tX/9R,9b`cB1V"j"JMi,Eb8BF*++5iM;>Yg1Wy8#X!o,(}{o./7aky"z~ZOLF_zSOx8&+SU? `Z
2024-10-14 11:04:24 UTC	16384	IN	Data Raw: b4 c5 50 77 3e 77 d2 a2 52 23 90 1c 55 05 6b e7 ed 2c 03 f1 8a e2 af ff d4 ef ad 31 8f 15 79 a7 e6 79 fa c5 cc 44 ff 00 2e 2a c1 8c 05 4d 06 2a b4 41 4c 55 64 d0 ed 8a a5 57 d1 fc 07 15 79 e7 98 7e dd 31 54 92 35 a1 c5 53 6d 30 17 62 ab 8a a3 d6 20 b2 08 db b9 c5 59 c7 d4 85 8d 87 a8 9b 12 31 56 23 63 ad dc 2c 8c 0e eb 5c 55 32 b7 d5 cb ca 14 0e b8 ab d5 3c 8b e4 a4 d4 19 6e 26 4d 8e 2a f6 0b 7d 2d 34 c8 87 40 a0 62 af 32 fc cf fc c0 7b 54 30 5b 9a 93 b6 d8 ab c2 35 49 a7 b8 63 70 e0 9a ef 8a a0 3d 75 71 4a 6f 8a ad a2 8c 55 c9 c6 b8 aa e7 90 25 4e 2a ca 7f 29 67 0d aa 29 1e 38 ab e9 f6 61 22 28 f6 c5 50 97 96 c1 93 14 31 bd 42 c2 a0 e2 af 3d f3 6e 9e 56 87 df 15 4e 7c b9 1f 1b 60 3d b1 54 64 ab b6 2a 94 de fc 23 24 15 8b 6b 63 be 15 60 fa fb ee 06 2a 91 Data Ascii: Pw>wR#Uk,1yyD.MALUdWy~1T5Sm0b Y1V#c,\U2<n&M}-4@b2{T0[5Icp=uqJoU%N)g)8a"(P1B=nVN\|`=Td#$kc`
2024-10-14 11:04:24 UTC	16384	IN	Data Raw: 2f 4e 45 05 88 c0 86 07 e7 2f cb 88 6d 66 3e 98 22 b8 ab 02 d4 fc b1 73 65 f1 46 0b 0c 55 2b 82 e1 e1 7e 33 af df 8a ad bc 8e 0b b6 a2 7c 27 db 15 52 87 eb 9a 73 fe ed 89 18 aa 2a 4f 30 4f 5f df 74 c9 aa b2 5f 45 71 bd 77 c0 b4 ae 1e a3 6c 55 32 f2 8d e0 b2 bb 69 ce c6 98 15 e7 3f 9a 37 e7 50 d4 18 f6 c5 2c 22 38 81 34 3d b0 2b 20 f2 cd a0 b8 72 8d d0 62 aa 92 c5 e8 5e 08 c7 42 71 56 6b 6d a6 b3 a0 20 6d 4c 55 7b a3 45 f0 91 8a b4 c3 be 2a a3 aa b1 8e d8 9e f8 aa 4b a1 42 5c 97 38 aa bf 98 62 02 22 c7 15 61 89 c4 b6 2a f5 5f 21 06 11 02 3a 62 ac c6 49 84 bf 06 2a af 6f 6e 54 8a f4 c5 50 9e 69 d5 7e a3 10 65 eb 8a b1 53 e6 a3 75 13 07 1b d3 6c 55 e5 fa e5 f5 cb dd f3 0c 40 07 6c 55 9f 79 63 cd cd 0c 2b 1c 8d 53 8a b3 9d 33 54 37 62 aa d4 a8 c5 56 f9 5b 46 Data Ascii: /NE/mf>"seFU+~3\|'RsO0O_t_EqwlU2i?7P,"84=+ rb^BqVkm mLU{EKB\8b"a_!:bIonTPi~eSulU@lUyc+S3T7bV[F
2024-10-14 11:04:24 UTC	16384	IN	Data Raw: 2d 38 af aa 86 a3 c3 15 56 d3 3c 9f 1c 4c 7d 4e b8 ab 1c f3 3e 9d e8 48 44 63 6c 55 8d 0b b5 8d f8 36 c7 15 4d 6c 74 91 32 99 9b a5 31 54 a6 fe 30 80 a8 c5 50 96 b6 06 55 2d 8a b7 e8 14 34 38 aa 21 50 d2 a3 15 55 2f f0 50 f5 c5 54 a1 a5 77 c5 55 9a 3e 58 ab 42 15 63 c4 e2 ab e6 88 c0 36 18 aa 92 47 24 82 a7 61 8a a8 98 6a 7e 1d b1 55 e1 24 51 b3 62 aa d6 fa 8c 91 9a 1d c6 2a 99 c1 ab 44 db 48 31 55 59 f4 fb 6b b5 e4 84 57 15 4a a4 d0 5a 32 4a 1a e1 0a a2 9a 64 b1 b5 48 34 c2 aa 92 dc 70 f8 4e 2a b5 24 04 54 1d f1 55 58 cc 8d f2 c5 55 6a eb 8a aa 47 73 4a 57 73 80 ab d2 bc aa f6 f7 76 47 9d 39 01 81 58 7f 98 6d fe 37 e3 db 15 4d bc 81 64 f4 66 7e 98 aa 4b e6 66 2b 78 40 e9 5c 55 0e 24 a0 a9 18 aa 1e 28 3e bf 25 06 2a ca ac c7 e8 b8 bd f1 54 3c 9e 66 99 5f Data Ascii: -8V<L}N>HDclU6Mlt21T0PU-48!PU/PTwU>XBc6G$aj~U$QbDH1UYkWJZ2JdH4pN$TUXUjGsJWsvG9Xm7Mdf~Kf+x@\U$(>%*T<f_
2024-10-14 11:04:24 UTC	16384	IN	Data Raw: 4a 62 af 25 d4 bc 9a 59 cc d1 b6 c4 d6 98 aa 12 4d 2a 80 2b f5 18 ab 42 c1 57 a1 c5 5a 6b 45 ef 8a a9 3d a2 f6 c5 51 16 76 31 b1 f8 ce 2a 8e 9b 48 b7 23 ae 2a 84 83 4f 8e 37 eb 8a a3 a4 85 23 5e 4b d7 15 4f 3c b9 ab 85 0d 1b 77 14 c5 50 57 16 16 eb 2b 48 fd ce 2a 8c e5 6e b1 51 71 56 f4 8d 6e 5b 46 22 d8 7c 5d b1 54 75 dc 9a c5 e9 f5 9d 4d 31 55 e9 ab 6b 26 3f 46 15 df 15 5f 6d 6d e6 4f b7 1a 1e 5f 2c 55 90 69 97 de 6c 51 c0 c6 6b 8a a6 0f 61 e6 f9 c7 20 a4 62 a8 58 f4 8f 37 ce c5 2a 71 56 a6 f2 3f 9a df 77 27 15 4c 34 df cb 5d 7a 5d e5 24 62 a9 ee 9f e4 ad 56 dd b8 31 2d 8a a7 2b e5 cd 46 d4 86 2b 8a a3 a0 8a fa 42 11 b1 55 2d 54 ea 1a 3f fa 44 7d 06 2a c6 f5 0f ce 0d 45 17 d3 6e d8 aa ae 93 e7 0b bd 60 71 66 eb 8a a7 ba 7e 9c f1 d6 59 0e f8 aa 36 d3 58 Data Ascii: Jb%YM+BWZkE=Qv1H#O7#^KO<wPW+HnQqVn[F"\|]TuM1Uk&?F_mmO_,UilQka bX7qV?w'L4]z]$bV1-+F+BU-T?D}En`qf~Y6X
2024-10-14 11:04:24 UTC	16384	IN	Data Raw: bc 9c d0 50 8c 55 19 a6 79 b8 dd c8 2d e4 df 15 66 4b e4 e9 2f a1 f5 62 43 b8 f0 c5 0c 46 f7 cb 37 16 72 1e 4a 71 4a 1b 4b f3 6e a3 a1 cc 56 22 dc 6b 8a bd 25 bf 38 64 ba d3 4d bc c6 ac 56 98 a5 f3 fa c5 35 fe b8 d2 71 f8 59 b1 57 d5 df 96 de 50 69 b4 f0 c1 77 a6 2a 85 f3 47 96 1a 02 c1 97 15 79 5d fd b0 8a e3 d2 6e e7 15 44 6a 1e 55 b6 ba 80 71 00 39 18 ab 06 d5 fc b9 77 a5 02 ea 0b 0e d8 ab 13 1a 84 c2 5f de 8a 62 aa b7 9a 87 a7 f1 c5 b9 c5 50 e9 ae 34 ff 00 0b ae f8 aa 1a 4b df 4d a8 07 5c 55 11 65 aa 4b 6f 20 91 18 ad 3c 31 57 a3 f9 77 f3 6d ad 94 43 33 72 18 ab 30 b6 f3 f5 a5 ea d0 11 53 8a b5 06 ae d1 f2 96 01 5c 50 90 47 e6 9b 9b 8b f0 93 03 c6 bd f1 57 a6 cb 3a 49 64 29 b6 d8 aa 57 e5 e4 e5 31 03 15 50 9e a9 aa 6e 31 55 6f 30 39 69 17 15 5f 70 b4 Data Ascii: PUy-fK/bCF7rJqJKnV"k%8dMV5qYWPiw*Gy]nDjUq9w_bP4KM\UeKo <1WwmC3r0S\PGW:Id)W1Pn1Uo09i_p
2024-10-14 11:04:24 UTC	16384	IN	Data Raw: 83 f1 e2 ae 92 45 66 0a 8d 8a a9 5f 9e 40 2b 6e 71 55 6b e5 71 0a 78 62 aa 93 3b 08 d0 9e 83 15 6d e4 57 15 c5 58 ef 98 1a 36 1c 48 c5 56 69 76 11 32 0e 40 50 e2 a9 be 95 a1 c0 ba 84 45 36 24 8c 8a bd ea c2 47 44 44 07 60 06 36 ac 88 81 34 14 a7 51 8a bc fb cd de 52 b5 f4 64 ba e2 39 00 4e 2a f1 99 bf 31 ee b4 38 64 8e 26 a2 8a 8c 55 e7 17 ff 00 98 b7 3a b3 b7 aa c4 83 8d aa 03 4a b1 7d 52 ed 4a d6 95 c5 5e e3 67 a3 ac 76 2a ad 4a 01 8d aa 96 af 23 db 59 8f ab 2f 4f 0c 55 95 fe 5d eb d2 cb 0f 09 85 3e 78 aa cf cc eb db 4b 6b 07 77 03 91 07 15 7c c9 63 62 fa 85 f3 32 7d 92 76 c7 9a b2 ad 2e d2 48 6e d6 31 b1 07 1a 57 a7 8e 4f 1a a7 73 85 5d 35 85 cd 93 24 a4 fc 38 aa 65 a7 c2 2f f5 38 09 15 15 df 0a bd c6 4b 55 48 55 46 db 62 af 31 f3 ec 01 6b c7 15 78 b6 Data Ascii: Ef_@+nqUkqxb;mWX6HViv2@PE6$GDD`64QRd9N18d&U:J}RJ^gvJ#Y/OU]>xKkw\|cb2}v.Hn1WOs]5$8e/8KUHUFb1kx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49738	13.107.246.45	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:23 UTC	701	OUT	GET /c1c6b6c8-yw-iky5-oitv6m8bxnlvjqeioua2sjr-bhiob-yiudy/logintenantbranding/0/bannerlogo?ts=637255507118990034 HTTP/1.1 Host: aadcdn.msftauthimages.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-14 11:04:23 UTC	770	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:04:23 GMT Content-Type: image/* Content-Length: 3444 Connection: close Cache-Control: public, max-age=86400 Last-Modified: Wed, 20 May 2020 05:51:52 GMT ETag: 0x8D7FC81E51F5AAB x-ms-request-id: 07024c21-301e-0013-6f28-1e7fa0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241014T110423Z-17db6f7c8cf6f7vv3recfp4a6w00000003ag000000007p1r x-fd-int-roxy-purgeid: 50755578 X-Cache: TCP_MISS X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-14 11:04:23 UTC	3444	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 1e 00 00 ff e1 03 50 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 36 2e 30 2d 63 30 30 32 20 37 39 2e 31 36 34 33 36 30 2c 20 32 30 32 30 2f 30 32 2f 31 33 2d 30 31 3a 30 37 3a 32 32 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d Data Ascii: ExifII*DuckyPhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164360, 2020/02/13-01:07:22 "> <rdf:RDF xm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49736	152.199.21.175	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:23 UTC	437	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-14 11:04:23 UTC	749	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 4944882 Cache-Control: public, max-age=31536000 Content-MD5: betEqf4nMmbvq8MhS5mLoA== Content-Type: application/x-javascript Date: Mon, 14 Oct 2024 11:04:23 GMT Etag: 0x8DCBD52F3A242D0 Last-Modified: Thu, 15 Aug 2024 17:51:55 GMT Server: ECAcc (lhc/7941) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: bbd0cf2c-501e-006f-482f-f15e3d000000 x-ms-version: 2009-09-19 Content-Length: 15755 Connection: close
2024-10-14 11:04:23 UTC	15755	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49737	152.199.21.175	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:23 UTC	425	OUT	GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-14 11:04:23 UTC	716	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 17645090 Cache-Control: public, max-age=31536000 Content-MD5: Fm3lNHEmUlOrOkVt7+baIw== Content-Type: image/gif Date: Mon, 14 Oct 2024 11:04:23 GMT Etag: 0x8DB5C3F4982FD30 Last-Modified: Wed, 24 May 2023 10:11:48 GMT Server: ECAcc (lhc/7945) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: c8ea465c-601e-0025-11ad-7d4c1f000000 x-ms-version: 2009-09-19 Content-Length: 2672 Connection: close
2024-10-14 11:04:23 UTC	2672	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e 69 18 14 00 21 Data Ascii: GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~i!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49735	152.199.21.175	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:23 UTC	419	OUT	GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-14 11:04:23 UTC	716	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 17645268 Cache-Control: public, max-age=31536000 Content-MD5: tUCo5RgDcZLjLE/li/Lbqw== Content-Type: image/gif Date: Mon, 14 Oct 2024 11:04:23 GMT Etag: 0x8DB5C3F492F3EE5 Last-Modified: Wed, 24 May 2023 10:11:48 GMT Server: ECAcc (lhc/7941) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 1d63faa2-d01e-009e-5cad-7d1f4c000000 x-ms-version: 2009-09-19 Content-Length: 3620 Connection: close
2024-10-14 11:04:23 UTC	3620	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 0f Data Ascii: GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	49740	40.126.32.74	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:23 UTC	705	OUT	GET /deme-group.com/winauth/ssoprobe?client-request-id=b183b832-0872-4686-93c7-8f9e002bea48&_=1728903861708 HTTP/1.1 Host: autologon.microsoftazuread-sso.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-14 11:04:23 UTC	1181	IN	HTTP/1.1 401 Unauthorized Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: image/png; charset=utf-8 Expires: -1 Vary: Origin X-Content-Type-Options: nosniff Access-Control-Allow-Origin: https://login.microsoftonline.com Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, OPTIONS P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: aab9ead0-fed9-4d61-bef0-38c15b19a801 x-ms-ests-server: 2.1.19005.9 - FRC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} Referrer-Policy: strict-origin-when-cross-origin X-XSS-Protection: 0 WWW-Authenticate: Negotiate Set-Cookie: fpc=AmumGon37m9JpsKD_oEaCZU; expires=Wed, 13-Nov-2024 11:04:23 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Set-Cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly Date: Mon, 14 Oct 2024 11:04:22 GMT Connection: close Content-Length: 12
2024-10-14 11:04:23 UTC	12	IN	Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 Data Ascii: Unauthorized

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	49741	13.107.253.67	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:24 UTC	456	OUT	GET /c1c6b6c8-yw-iky5-oitv6m8bxnlvjqeioua2sjr-bhiob-yiudy/logintenantbranding/0/bannerlogo?ts=637255507118990034 HTTP/1.1 Host: aadcdn.msftauthimages.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-14 11:04:24 UTC	797	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:04:24 GMT Content-Type: image/* Content-Length: 3444 Connection: close Cache-Control: public, max-age=86400 Last-Modified: Wed, 20 May 2020 05:51:52 GMT ETag: 0x8D7FC81E51F5AAB x-ms-request-id: 07024c21-301e-0013-6f28-1e7fa0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241014T110424Z-r154656d9bcmwndmrfeb7th8z000000004b00000000029z9 x-fd-int-roxy-purgeid: 50755578 X-Cache: TCP_REMOTE_HIT X-Cache-Info: L2_T1 X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-14 11:04:24 UTC	3444	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 1e 00 00 ff e1 03 50 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 36 2e 30 2d 63 30 30 32 20 37 39 2e 31 36 34 33 36 30 2c 20 32 30 32 30 2f 30 32 2f 31 33 2d 30 31 3a 30 37 3a 32 32 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d Data Ascii: ExifII*DuckyPhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164360, 2020/02/13-01:07:22 "> <rdf:RDF xm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.16	49743	152.199.21.175	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:24 UTC	609	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_89db715e3340a2e8ecd8.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-14 11:04:24 UTC	749	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 5095960 Cache-Control: public, max-age=31536000 Content-MD5: SMJ5Ru2UEObX0bOUP7nOGw== Content-Type: application/x-javascript Date: Mon, 14 Oct 2024 11:04:24 GMT Etag: 0x8DCBD52F3E2FAB3 Last-Modified: Thu, 15 Aug 2024 17:51:55 GMT Server: ECAcc (lhc/794E) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 354c47b9-901e-004f-7ccf-ef259a000000 x-ms-version: 2009-09-19 Content-Length: 26668 Connection: close
2024-10-14 11:04:24 UTC	15653	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-10-14 11:04:24 UTC	11015	IN	Data Raw: 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 72 6d 2d 67 72 6f 75 70 20 63 6f 6c 2d 6d 64 2d 32 34 22 3e 5c 6e 20 20 20 20 20 20 20 20 3c 64 69 76 20 72 6f 6c 65 3d 22 61 6c 65 72 74 22 20 61 72 69 61 2d 6c 69 76 65 3d 22 61 73 73 65 72 74 69 76 65 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 5c 78 33 63 21 2d 2d 20 6b 6f 20 69 66 3a 20 70 61 73 73 77 6f 72 64 54 65 78 74 62 6f 78 2e 65 72 72 6f 72 20 2d 2d 5c 78 33 65 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 5c 78 33 63 21 2d 2d 20 6b 6f 20 69 66 3a 20 73 76 72 2e 66 46 69 78 55 72 6c 52 65 73 65 74 50 61 73 73 77 6f 72 64 20 2d 2d 5c 78 33 65 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 69 64 3d 22 70 61 73 73 77 6f 72 64 45 72 72 6f 72 22 20 64 61 74 61 2d 62 69 6e 64 3d 22 Data Ascii: <div class="form-group col-md-24">\n <div role="alert" aria-live="assertive">\n \x3c!-- ko if: passwordTextbox.error --\x3e\n \x3c!-- ko if: svr.fFixUrlResetPassword --\x3e\n <div id="passwordError" data-bind="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.16	49744	13.107.253.67	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:25 UTC	458	OUT	GET /c1c6b6c8-yw-iky5-oitv6m8bxnlvjqeioua2sjr-bhiob-yiudy/logintenantbranding/0/illustration?ts=637255507111143881 HTTP/1.1 Host: aadcdn.msftauthimages.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-14 11:04:25 UTC	799	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:04:25 GMT Content-Type: image/* Content-Length: 260198 Connection: close Cache-Control: public, max-age=86400 Last-Modified: Wed, 20 May 2020 05:51:51 GMT ETag: 0x8D7FC81E4B81B65 x-ms-request-id: 97e86189-501e-002a-2928-1e84bc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241014T110425Z-1597f696844c8tlv61bxv37s7000000006ag000000007nxh x-fd-int-roxy-purgeid: 50755578 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-14 11:04:25 UTC	15585	IN	Data Raw: ff d8 ff e1 1c 6c 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 03 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 91 87 69 00 04 00 00 00 01 00 00 00 a8 00 00 00 d4 00 2d c6 c0 00 00 27 10 00 2d c6 c0 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 30 3a 30 35 3a 32 30 20 30 38 3a 35 30 3a 31 31 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 22 01 1b 00 05 00 Data Ascii: lExifMM*bj(1r2i-'-'Adobe Photoshop 21.1 (Windows)2020:05:20 08:50:118"
2024-10-14 11:04:25 UTC	16384	IN	Data Raw: ea 16 96 d9 5b 1e 75 87 c8 0e 07 fa cd 77 bb fb 4b 77 eb 2f 59 b3 ad 37 01 b4 b1 f5 33 1a 9d ae 12 c2 4d af da 32 23 65 bf cd 7e 8e b6 d6 92 9b ee 7e 5f 4a e8 35 75 46 5d fa cf 52 c9 c7 64 b8 9d de 9e 3d 16 53 73 1e ff 00 e5 da f5 b3 8e cc 36 64 e4 74 cc db d8 30 7a 00 c4 a0 58 43 58 49 b0 55 66 4d 96 5a e9 fc fc 6b 2b ad 9f bf 6a e2 32 72 b2 f2 ba 76 1f 4e b8 16 d1 d3 fd 4f 48 fa 6e f7 1b 5c 1e ff 00 55 cc b1 fe e6 ed d8 cf 67 d0 43 b6 b7 e4 db 6d d9 56 97 d9 73 b7 db 71 f5 25 c5 c6 5c e7 cd 6e f7 6e 49 4d 8c 7c ce 9a ec 2c a3 75 65 b7 d9 65 2d 63 25 c6 6b 73 df 7e 63 bf b3 e8 d0 b5 fa 97 d6 7c ec 9c cb 9b d2 a8 7d 58 6e b2 c7 34 3c 19 25 d6 3d cd b7 6b 76 b9 9f a0 f4 19 e9 fb ff 00 9b 59 dd 3f 06 8b 1d 0d 6b 2c de 46 d7 33 53 a1 f8 2e 9f 17 23 07 a7 56 Data Ascii: [uwKw/Y73M2#e~~_J5uF]Rd=Ss6dt0zXCXIUfMZk+j2rvNOHn\UgCmVsq%\nnIM\|,uee-c%ks~c\|}Xn4<%=kvY?k,F3S.#V
2024-10-14 11:04:25 UTC	16384	IN	Data Raw: ce b9 7c f7 53 fa 2a 76 ae 2a ad 6b a0 cb 6e 03 8e 87 15 47 c7 ac c3 a6 fc 33 9c 55 30 b3 d6 ed ae cf 28 cd 71 55 79 b5 65 2d e9 8c 55 ff d3 f4 20 c5 0a a8 7e 13 8a bc 9f cf ed 5b 93 8a b1 11 4c 55 78 38 aa 95 d1 1c 71 56 31 ac 9f 80 e1 57 9c eb 1b b9 c5 52 56 f8 4e 2a f5 8f ca 4b 62 c7 96 2a f6 c0 28 80 62 aa 3e 88 97 e1 23 02 a1 6e fc bb 0c a0 f2 1d 71 56 21 ac fe 5f 89 09 78 8d 31 56 31 37 96 6e ac 9b 60 69 8a a5 f7 ff 00 5a d3 c7 d6 10 1a 8c 55 ea bf 93 9f 9b 02 e0 8b 3d 44 d3 b0 ae 2a f6 e7 92 1b 98 ff 00 76 c0 ab 0c 50 f2 8f cc df ca 38 75 38 1e e6 d9 7f 7b 42 76 c5 21 f3 dd 8c 92 79 72 e5 ed ee d4 82 0d 37 c5 5e 83 e5 9f 31 2d c1 08 1b e1 38 ab 23 d7 7c ad 6b ae 40 13 62 d8 a5 92 7e 55 f9 51 f4 09 78 fe c6 2a f4 a9 8f c5 51 8a a0 2e 9b 15 43 a9 e4 Data Ascii: \|SvknG3U0(qUye-U ~[LUx8qV1WRVNKb(b>#nqV!_x1V17n`iZU=DvP8u8{Bv!yr7^1-8#\|k@b~UQxQ.C
2024-10-14 11:04:25 UTC	16384	IN	Data Raw: 0f 1c 55 93 79 ae 53 1a a4 67 a1 c5 51 1a 75 a2 7d 56 a4 6c 46 2a c0 35 ad 3d 22 b8 67 41 4a 9c 55 8f ea b6 a1 e3 35 c5 58 7c f6 4d 52 88 28 31 55 16 b4 7b 55 e4 31 54 4e 9b e6 a6 81 b8 36 15 4f 7d 78 6f d0 b7 ed 1c 55 8b 4b 1c b6 77 81 a2 e9 5c 55 93 ea 7a 91 9a d3 8c bd 69 8a b0 32 e1 1f da b8 10 cf 74 58 a3 96 cc 9e f4 c5 2f 39 96 05 8f 52 2c dd 39 62 af 60 b1 d7 63 b6 d3 42 a0 ea 31 56 22 da 6a de 96 b9 22 bd f1 4a 4d 69 2c 82 ec c6 45 14 62 ac 9a 0d 38 cd 42 46 2a f4 2b 2b 84 b6 d2 cc 35 de 98 aa 69 e5 4d 02 3b dd 3e 59 67 ec 0d 31 57 90 79 aa c6 38 e7 91 23 ea 09 c5 58 21 d5 6f 2c e6 28 84 d2 b8 aa fb ab 97 91 84 92 7d a3 8a b2 7b 6f 2e 8b db 2f ac 37 61 8a b1 6b 79 22 8a e0 c6 7a 83 8a a7 fa 7e a4 5a 4f 4c 9f 87 15 46 5f d8 7a e2 ab 8a a0 53 4f 78 Data Ascii: UySgQu}VlF5="gAJU5X\|MR(1U{U1TN6O}xoUKw\Uzi2tX/9R,9b`cB1V"j"JMi,Eb8BF++5iM;>Yg1Wy8#X!o,(}{o./7aky"z~ZOLF_zSOx
2024-10-14 11:04:25 UTC	16384	IN	Data Raw: a9 69 28 79 09 92 bf 3c 55 55 bc d1 a5 b0 e2 67 4d bd f1 54 0c fe 6c d2 54 d0 ca b4 c5 50 77 3e 77 d2 a2 52 23 90 1c 55 05 6b e7 ed 2c 03 f1 8a e2 af ff d4 ef ad 31 8f 15 79 a7 e6 79 fa c5 cc 44 ff 00 2e 2a c1 8c 05 4d 06 2a b4 41 4c 55 64 d0 ed 8a a5 57 d1 fc 07 15 79 e7 98 7e dd 31 54 92 35 a1 c5 53 6d 30 17 62 ab 8a a3 d6 20 b2 08 db b9 c5 59 c7 d4 85 8d 87 a8 9b 12 31 56 23 63 ad dc 2c 8c 0e eb 5c 55 32 b7 d5 cb ca 14 0e b8 ab d5 3c 8b e4 a4 d4 19 6e 26 4d 8e 2a f6 0b 7d 2d 34 c8 87 40 a0 62 af 32 fc cf fc c0 7b 54 30 5b 9a 93 b6 d8 ab c2 35 49 a7 b8 63 70 e0 9a ef 8a a0 3d 75 71 4a 6f 8a ad a2 8c 55 c9 c6 b8 aa e7 90 25 4e 2a ca 7f 29 67 0d aa 29 1e 38 ab e9 f6 61 22 28 f6 c5 50 97 96 c1 93 14 31 bd 42 c2 a0 e2 af 3d f3 6e 9e 56 87 df 15 4e 7c b9 1f Data Ascii: i(y<UUgMTlTPw>wR#Uk,1yyD.MALUdWy~1T5Sm0b Y1V#c,\U2<n&M}-4@b2{T0[5Icp=uqJoU%N)g)8a"(P1B=nVN\|
2024-10-14 11:04:25 UTC	16384	IN	Data Raw: a3 27 d6 1b d4 c5 50 8d 18 61 8a a2 34 ab c9 21 93 89 fb 38 ab 3f d2 f4 ab 3d 62 2f 4e 45 05 88 c0 86 07 e7 2f cb 88 6d 66 3e 98 22 b8 ab 02 d4 fc b1 73 65 f1 46 0b 0c 55 2b 82 e1 e1 7e 33 af df 8a ad bc 8e 0b b6 a2 7c 27 db 15 52 87 eb 9a 73 fe ed 89 18 aa 2a 4f 30 4f 5f df 74 c9 aa b2 5f 45 71 bd 77 c0 b4 ae 1e a3 6c 55 32 f2 8d e0 b2 bb 69 ce c6 98 15 e7 3f 9a 37 e7 50 d4 18 f6 c5 2c 22 38 81 34 3d b0 2b 20 f2 cd a0 b8 72 8d d0 62 aa 92 c5 e8 5e 08 c7 42 71 56 6b 6d a6 b3 a0 20 6d 4c 55 7b a3 45 f0 91 8a b4 c3 be 2a a3 aa b1 8e d8 9e f8 aa 4b a1 42 5c 97 38 aa bf 98 62 02 22 c7 15 61 89 c4 b6 2a f5 5f 21 06 11 02 3a 62 ac c6 49 84 bf 06 2a af 6f 6e 54 8a f4 c5 50 9e 69 d5 7e a3 10 65 eb 8a b1 53 e6 a3 75 13 07 1b d3 6c 55 e5 fa e5 f5 cb dd f3 0c 40 07 Data Ascii: 'Pa4!8?=b/NE/mf>"seFU+~3\|'RsO0O_t_EqwlU2i?7P,"84=+ rb^BqVkm mLU{EKB\8b"a_!:bIonTPi~eSulU@
2024-10-14 11:04:25 UTC	16384	IN	Data Raw: c8 2a 06 2a c9 74 8d 52 d4 0e 13 a8 07 15 45 5e 68 f6 3a 89 fd dd 01 38 aa d8 bf 2d 38 af aa 86 a3 c3 15 56 d3 3c 9f 1c 4c 7d 4e b8 ab 1c f3 3e 9d e8 48 44 63 6c 55 8d 0b b5 8d f8 36 c7 15 4d 6c 74 91 32 99 9b a5 31 54 a6 fe 30 80 a8 c5 50 96 b6 06 55 2d 8a b7 e8 14 34 38 aa 21 50 d2 a3 15 55 2f f0 50 f5 c5 54 a1 a5 77 c5 55 9a 3e 58 ab 42 15 63 c4 e2 ab e6 88 c0 36 18 aa 92 47 24 82 a7 61 8a a8 98 6a 7e 1d b1 55 e1 24 51 b3 62 aa d6 fa 8c 91 9a 1d c6 2a 99 c1 ab 44 db 48 31 55 59 f4 fb 6b b5 e4 84 57 15 4a a4 d0 5a 32 4a 1a e1 0a a2 9a 64 b1 b5 48 34 c2 aa 92 dc 70 f8 4e 2a b5 24 04 54 1d f1 55 58 cc 8d f2 c5 55 6a eb 8a aa 47 73 4a 57 73 80 ab d2 bc aa f6 f7 76 47 9d 39 01 81 58 7f 98 6d fe 37 e3 db 15 4d bc 81 64 f4 66 7e 98 aa 4b e6 66 2b 78 40 e9 5c Data Ascii: *tRE^h:8-8V<L}N>HDclU6Mlt21T0PU-48!PU/PTwU>XBc6G$aj~U$QbDH1UYkWJZ2JdH4pN*$TUXUjGsJWsvG9Xm7Mdf~Kf+x@\
2024-10-14 11:04:25 UTC	16384	IN	Data Raw: c8 03 1d b1 56 7d e5 19 2c 6d a5 59 66 a6 d8 ab 3b f3 1f 9a 2c 75 0b 4f aa c6 07 4a 62 af 25 d4 bc 9a 59 cc d1 b6 c4 d6 98 aa 12 4d 2a 80 2b f5 18 ab 42 c1 57 a1 c5 5a 6b 45 ef 8a a9 3d a2 f6 c5 51 16 76 31 b1 f8 ce 2a 8e 9b 48 b7 23 ae 2a 84 83 4f 8e 37 eb 8a a3 a4 85 23 5e 4b d7 15 4f 3c b9 ab 85 0d 1b 77 14 c5 50 57 16 16 eb 2b 48 fd ce 2a 8c e5 6e b1 51 71 56 f4 8d 6e 5b 46 22 d8 7c 5d b1 54 75 dc 9a c5 e9 f5 9d 4d 31 55 e9 ab 6b 26 3f 46 15 df 15 5f 6d 6d e6 4f b7 1a 1e 5f 2c 55 90 69 97 de 6c 51 c0 c6 6b 8a a6 0f 61 e6 f9 c7 20 a4 62 a8 58 f4 8f 37 ce c5 2a 71 56 a6 f2 3f 9a df 77 27 15 4c 34 df cb 5d 7a 5d e5 24 62 a9 ee 9f e4 ad 56 dd b8 31 2d 8a a7 2b e5 cd 46 d4 86 2b 8a a3 a0 8a fa 42 11 b1 55 2d 54 ea 1a 3f fa 44 7d 06 2a c6 f5 0f ce 0d 45 17 Data Ascii: V},mYf;,uOJb%YM+BWZkE=Qv1H#O7#^KO<wPW+HnQqVn[F"\|]TuM1Uk&?F_mmO_,UilQka bX7qV?w'L4]z]$bV1-+F+BU-T?D}E
2024-10-14 11:04:25 UTC	16384	IN	Data Raw: 4f 44 9d b1 56 4c 7c b5 1c 40 b1 dc e2 af 3b f3 a5 a2 40 49 02 98 ab cd 2e af 8d bc 9c d0 50 8c 55 19 a6 79 b8 dd c8 2d e4 df 15 66 4b e4 e9 2f a1 f5 62 43 b8 f0 c5 0c 46 f7 cb 37 16 72 1e 4a 71 4a 1b 4b f3 6e a3 a1 cc 56 22 dc 6b 8a bd 25 bf 38 64 ba d3 4d bc c6 ac 56 98 a5 f3 fa c5 35 fe b8 d2 71 f8 59 b1 57 d5 df 96 de 50 69 b4 f0 c1 77 a6 2a 85 f3 47 96 1a 02 c1 97 15 79 5d fd b0 8a e3 d2 6e e7 15 44 6a 1e 55 b6 ba 80 71 00 39 18 ab 06 d5 fc b9 77 a5 02 ea 0b 0e d8 ab 13 1a 84 c2 5f de 8a 62 aa b7 9a 87 a7 f1 c5 b9 c5 50 e9 ae 34 ff 00 0b ae f8 aa 1a 4b df 4d a8 07 5c 55 11 65 aa 4b 6f 20 91 18 ad 3c 31 57 a3 f9 77 f3 6d ad 94 43 33 72 18 ab 30 b6 f3 f5 a5 ea d0 11 53 8a b5 06 ae d1 f2 96 01 5c 50 90 47 e6 9b 9b 8b f0 93 03 c6 bd f1 57 a6 cb 3a 49 64 Data Ascii: ODVL\|@;@I.PUy-fK/bCF7rJqJKnV"k%8dMV5qYWPiw*Gy]nDjUq9w_bP4KM\UeKo <1WwmC3r0S\PGW:Id
2024-10-14 11:04:25 UTC	16384	IN	Data Raw: 55 5b af 36 4d 19 59 25 dd 46 2a ad 73 e7 18 2f b8 2a 8a 62 ac 88 6b 76 73 c4 b0 83 f1 e2 ae 92 45 66 0a 8d 8a a9 5f 9e 40 2b 6e 71 55 6b e5 71 0a 78 62 aa 93 3b 08 d0 9e 83 15 6d e4 57 15 c5 58 ef 98 1a 36 1c 48 c5 56 69 76 11 32 0e 40 50 e2 a9 be 95 a1 c0 ba 84 45 36 24 8c 8a bd ea c2 47 44 44 07 60 06 36 ac 88 81 34 14 a7 51 8a bc fb cd de 52 b5 f4 64 ba e2 39 00 4e 2a f1 99 bf 31 ee b4 38 64 8e 26 a2 8a 8c 55 e7 17 ff 00 98 b7 3a b3 b7 aa c4 83 8d aa 03 4a b1 7d 52 ed 4a d6 95 c5 5e e3 67 a3 ac 76 2a ad 4a 01 8d aa 96 af 23 db 59 8f ab 2f 4f 0c 55 95 fe 5d eb d2 cb 0f 09 85 3e 78 aa cf cc eb db 4b 6b 07 77 03 91 07 15 7c c9 63 62 fa 85 f3 32 7d 92 76 c7 9a b2 ad 2e d2 48 6e d6 31 b1 07 1a 57 a7 8e 4f 1a a7 73 85 5d 35 85 cd 93 24 a4 fc 38 aa 65 a7 c2 Data Ascii: U[6MY%Fs/bkvsEf_@+nqUkqxb;mWX6HViv2@PE6$GDD`64QRd9N18d&U:J}RJ^gvJ#Y/OU]>xKkw\|cb2}v.Hn1WOs]5$8e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.16	49746	152.199.21.175	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:25 UTC	424	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_89db715e3340a2e8ecd8.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-14 11:04:26 UTC	749	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 5095961 Cache-Control: public, max-age=31536000 Content-MD5: SMJ5Ru2UEObX0bOUP7nOGw== Content-Type: application/x-javascript Date: Mon, 14 Oct 2024 11:04:25 GMT Etag: 0x8DCBD52F3E2FAB3 Last-Modified: Thu, 15 Aug 2024 17:51:55 GMT Server: ECAcc (lhc/794E) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 354c47b9-901e-004f-7ccf-ef259a000000 x-ms-version: 2009-09-19 Content-Length: 26668 Connection: close
2024-10-14 11:04:26 UTC	16383	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-10-14 11:04:26 UTC	10285	IN	Data Raw: 20 20 7d 2c 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6c 69 63 6b 3a 20 61 63 63 65 73 73 52 65 63 6f 76 65 72 79 4c 69 6e 6b 20 3f 20 6e 75 6c 6c 20 3a 20 72 65 73 65 74 50 61 73 73 77 6f 72 64 5f 6f 6e 43 6c 69 63 6b 20 7d 20 7d 22 3e 3c 2f 64 69 76 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 5c 78 33 63 21 2d 2d 20 2f 6b 6f 20 2d 2d 5c 78 33 65 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 5c 78 33 63 21 2d 2d 20 6b 6f 20 69 66 6e 6f 74 3a 20 73 76 72 2e 66 46 69 78 55 72 6c 52 65 73 65 74 50 61 73 73 77 6f 72 64 20 2d 2d 5c 78 33 65 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 69 64 3d 22 70 61 73 73 77 6f 72 64 45 72 72 6f 72 22 20 64 61 74 61 2d 62 69 6e 64 3d 22 5c 6e 20 20 20 Data Ascii: },\n click: accessRecoveryLink ? null : resetPassword_onClick } }"></div>\n \x3c!-- /ko --\x3e\n \x3c!-- ko ifnot: svr.fFixUrlResetPassword --\x3e\n <div id="passwordError" data-bind="\n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.16	49747	13.107.246.45	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:26 UTC	701	OUT	GET /c1c6b6c8-gu93kzcvv9nfo0jjjijxe9133mrsglit9lh2ikhkvmm/logintenantbranding/0/bannerlogo?ts=637271955782382065 HTTP/1.1 Host: aadcdn.msftauthimages.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-14 11:04:26 UTC	770	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:04:26 GMT Content-Type: image/* Content-Length: 6297 Connection: close Cache-Control: public, max-age=86400 Last-Modified: Mon, 08 Jun 2020 06:46:18 GMT ETag: 0x8D80B77A5E4B456 x-ms-request-id: 7f438d15-301e-0061-5828-1e78ef000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241014T110426Z-17db6f7c8cf8rgvlb86c9c009800000004ag000000009n4n x-fd-int-roxy-purgeid: 50755578 X-Cache: TCP_MISS X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-14 11:04:26 UTC	6297	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 18 00 00 00 3c 08 06 00 00 00 bd c4 a5 18 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 07 74 49 4d 45 07 e4 06 08 06 2c 06 df 2a 9c 52 00 00 00 07 74 45 58 74 41 75 74 68 6f 72 00 a9 ae cc 48 00 00 00 0c 74 45 58 74 44 65 73 63 72 69 70 74 69 6f 6e 00 13 09 21 23 00 00 00 0a 74 45 58 74 43 6f 70 79 72 69 67 68 74 00 ac 0f cc 3a 00 00 00 0e 74 45 58 74 43 72 65 61 74 69 6f 6e 20 74 69 6d 65 00 35 f7 0f 09 00 00 00 09 74 45 58 74 53 6f 66 74 77 61 72 65 00 5d 70 ff 3a 00 00 00 0b 74 45 58 74 44 69 73 63 6c 61 69 6d 65 72 00 b7 c0 b4 8f 00 00 00 08 74 45 58 74 57 61 72 6e 69 6e 67 00 c0 1b e6 87 00 00 00 07 74 45 58 74 53 6f 75 72 63 65 00 f5 ff 83 eb 00 00 00 08 74 45 58 74 Data Ascii: PNGIHDR<pHYs+tIME,*RtEXtAuthorHtEXtDescription!#tEXtCopyright:tEXtCreation time5tEXtSoftware]p:tEXtDisclaimertEXtWarningtEXtSourcetEXt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.16	49749	13.107.253.67	443	7064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:27 UTC	456	OUT	GET /c1c6b6c8-gu93kzcvv9nfo0jjjijxe9133mrsglit9lh2ikhkvmm/logintenantbranding/0/bannerlogo?ts=637271955782382065 HTTP/1.1 Host: aadcdn.msftauthimages.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-14 11:04:27 UTC	797	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:04:27 GMT Content-Type: image/* Content-Length: 6297 Connection: close Cache-Control: public, max-age=86400 Last-Modified: Mon, 08 Jun 2020 06:46:18 GMT ETag: 0x8D80B77A5E4B456 x-ms-request-id: 7f438d15-301e-0061-5828-1e78ef000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241014T110427Z-r154656d9bcsjtmnzb4r14syww000000049000000000dc0t x-fd-int-roxy-purgeid: 50755578 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-10-14 11:04:27 UTC	6297	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 18 00 00 00 3c 08 06 00 00 00 bd c4 a5 18 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 07 74 49 4d 45 07 e4 06 08 06 2c 06 df 2a 9c 52 00 00 00 07 74 45 58 74 41 75 74 68 6f 72 00 a9 ae cc 48 00 00 00 0c 74 45 58 74 44 65 73 63 72 69 70 74 69 6f 6e 00 13 09 21 23 00 00 00 0a 74 45 58 74 43 6f 70 79 72 69 67 68 74 00 ac 0f cc 3a 00 00 00 0e 74 45 58 74 43 72 65 61 74 69 6f 6e 20 74 69 6d 65 00 35 f7 0f 09 00 00 00 09 74 45 58 74 53 6f 66 74 77 61 72 65 00 5d 70 ff 3a 00 00 00 0b 74 45 58 74 44 69 73 63 6c 61 69 6d 65 72 00 b7 c0 b4 8f 00 00 00 08 74 45 58 74 57 61 72 6e 69 6e 67 00 c0 1b e6 87 00 00 00 07 74 45 58 74 53 6f 75 72 63 65 00 f5 ff 83 eb 00 00 00 08 74 45 58 74 Data Ascii: PNGIHDR<pHYs+tIME,*RtEXtAuthorHtEXtDescription!#tEXtCopyright:tEXtCreation time5tEXtSoftware]p:tEXtDisclaimertEXtWarningtEXtSourcetEXt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.16	49757	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-10-14 11:04:59 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=uZ7EuV5AC6Durxu&MD=UrhV8gVN HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-14 11:04:59 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 1f7b5134-6d70-4d61-bdea-d596d88fc8a8 MS-RequestId: b6cd2868-10d5-4f07-8fb8-9e3fde51c964 MS-CV: d7skNYyRf0eBQyLx.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 14 Oct 2024 11:04:58 GMT Connection: close Content-Length: 30005
2024-10-14 11:04:59 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-14 11:04:59 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Target ID:	0
Start time:	07:04:07
Start date:	14/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	07:04:08
Start date:	14/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1960,i,17662341715992215995,799854014391982021,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	07:04:09
Start date:	14/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://login.microsoftonline.com/redeem?rd=https%3a%2f%2finvitations.microsoft.com%2fredeem%2f%3ftenant%3dac16fc13-eed0-45a8-a4cd-092120207ca4%26user%3d7d35c074-f1ce-4806-8732-1a64869fa060%26ticket%3dPqbSUkJjPpJW0yIMqaUTQLRg3kmINldPr4uL7BaqWvg%25253d%26ver%3d2.0"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://login.microsoftonline.com/redeem?rd=https%3a%2f%2finvitations.microsoft.com%2fredeem%2f%3ftenant%3dac16fc13-eed0-45a8-a4cd-092120207ca4%26user%3d7d35c074-f1ce-4806-8732-1a64869fa060%26ticket%3dPqbSUkJjPpJW0yIMqaUTQLRg3kmINldPr4uL7BaqWvg%25253d%26ver%3d2.0

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Windows Analysis Report
https://login.microsoftonline.com/redeem?rd=https%3a%2f%2finvitations.microsoft.com%2fredeem%2f%3ftenant%3dac16fc13-eed0-45a8-a4cd-092120207ca4%26user%3d7d35c074-f1ce-4806-8732-1a64869fa060%26ticket%3dPqbSUkJjPpJW0yIMqaUTQLRg3kmINldPr4uL7BaqWvg%25253d%26ver%3d2.0