Edit tour

Windows Analysis Report
[EXTERNAL] Re_ Quotes.eml

Overview

General Information

Sample name:	[EXTERNAL] Re_ Quotes.eml
Analysis ID:	1539395
MD5:	3c0db89c15e308a748b61147c7e85c76
SHA1:	75605eb85037f23c90f27ad91b16dc9599258f02
SHA256:	777603c4a68501978f70cefa8d80e399fdf086b57349d6dde0e3f8b3e41ebce2
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

AI detected potential phishing Email

Detected non-DNS traffic on DNS port

Detected suspicious crossdomain redirect

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Stores large binary data to the registry

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 740 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\[EXTERNAL] Re_ Quotes.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 5516 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "0F810BE9-1EE3-4005-871B-CC3AF9EB26A5" "EB03CE19-C594-4EA9-AD58-197437118574" "740" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 3316 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://url.uk.m.mimecastprotect.com/s/ZlrZCZYQ9UxMnWNsysRFBA-ZP?domain=hnamedmr.ukremediatlon.co.uk MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 2972 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1944,i,1824875940929507423,6371601856566642731,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 740, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: https://www.example.com/

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.18:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.138:443 -> 192.168.2.18:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.138:443 -> 192.168.2.18:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.18:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.140:443 -> 192.168.2.18:49712 version: TLS 1.2

Source: global traffic

TCP traffic: 192.168.2.18:49745 -> 1.1.1.1:53

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: hnamedmr.ukremediatlon.co.uk to https://www.example.com

Source: Joe Sandbox View	IP Address: 91.220.42.63 91.220.42.63
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 93.184.215.14 93.184.215.14

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3

Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ahXDKPZCcoot+6s&MD=6mmrbygb HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ahXDKPZCcoot+6s&MD=6mmrbygb HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: -240X-DeviceID: 01000A410900B03DX-BM-WindowsFlights: FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12E85C75X-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDoAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAQ6GhAkHuPtVTVeAt8GnNTXiw/C/ancNPYhIm/WzQoKYIcnODiygMSaKDpesx7WgNrvREVrDFcW7ECyynHXFO5t3xlEzqcG1ZxCgB69iRgPFlRupuWqnS7P7CjA%2B0ZRmhmVy1qNBOkkSURe2oNh3wvug/05fcrZf8Kuql9X69BDdP/BG0bZp9l%2BTUvkp8y/Ov90S5AzzdoWEpMEU0TzuVBagb0vpBXkoa3Vl/isHcHiP3Yx0pICzN3HIdGMgw2mE/G48LyHtBFLWmVBXfPx4C54rMvzTrhGbawbkOLpWnyzQgfjGsatPHamcJpguASSRk19dp3Jm8Xl3Nu%2B6HP83mYAQZgAAEMegth5sow/To49b0%2BBFalCwAfN7MWOLqO6EDDUdcO1n6tQj/LX%2BSufX9heH%2BdPh0R2os5TVQlwMShLlZ/f9FDMiqPHn%2BDbcQMz8uXPYMkQD5gAYZRADhXwwZae3Pu%2BE5NHfggzGeGDBzu84EqaJawNdK3QX0iSLLyEoNhTFy/X9pnLRAv6v7tW7rE6uXbVAsl/VZ8n%2BwqmJTJg5H7G4FS1LIJbivlNG0XnnpdQPCYY7iobuq9U28f1/fp8EbWnyA88FBtE1NJk1bPKAN0zgsO1E2owcxf6xKuva4X2UgVGqtSZ9x%2BUm2omNcIXF3NAVBHOfEpxQ4V6UATzmqIXmFO%2B741E7csCvFR%2BNEPa4QAQbrkm84rtcfNsu2qZsch7mBw8KKLL37mI%2Bp2ZpmZIu5U7MvVr5LCBQRTRo%2B049iRQFZsLHWGw3sfZHsRUX3/c%2B4WAEU7kj3aaHeS9efYuGT/Yr/QgcBIF8jDcy0O0RGfCUUZShcEjHzk4mAVmfkqQbrElYViWvG6B53B6vvWMrsawnhdZFLyzXB9rk3VRAdJF3muLWzpSBLxBgSb8D%2BkECJG6BhEf7hKPJemwy8juifr8PH9oB%26p%3DX-Agent-DeviceId: 01000A410900B03DX-BM-CBT: 1729606233User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: F7B3F22C310949C6A9567A248FB019C9X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=B4BB39E5F80E411D94C438C0FA7ACF94&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&LUT=1707317051026&IPMH=6b344233&IPMID=1707317270835&HV=1707317277; ANON=A=680C1B1A649CBD64DD40EBFCFFFFFFFF; MUID=BC76BB0020D345C1A049A4820CB4C03C; MUIDB=BC76BB0020D345C1A049A4820CB4C03C
Source: global traffic	HTTP traffic detected: GET /s/ZlrZCZYQ9UxMnWNsysRFBA-ZP?domain=hnamedmr.ukremediatlon.co.uk HTTP/1.1Host: url.uk.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r/lJ_qgGoNKOtmgnbcVAzK9AK7bCK_bMUk-wR7tn7n2Yc-AiwWUwSJ5cdo4JD9L-rHbsi-7W3dO8y5uQV2nzI3pgGYX2bWfu1MDc-X9rMWVK_hsH3igqVCwlv82yO9Us1bD9QGVJXYV3iwcJyaZUtCzpN5gQCtVwfSk4NF3Jvvjo6dam7LE0uymt-W2XHlpqniDQv0P0k8ZJKYaCstCrmE1sq1ZoAQ3VLjp0OO2PZzixRmPZJK3FnHnTaIJwVqhz9-vSI1xigm4TWyfd7JWmu74nSWtZqj9NqEJglaSsVWuKMnELweU3CY7wK_cfeqtPwaqs8jlAL3SZc0pjK71K0ISYzpKLaSw_JCCc6zzmE5PGZHuWIotNrok3xDwjmYYdSvbsjWzlsuRUUe3Ge-nzuT_-uUD_uGughyFXcxYqfAHpXCIep-KQdcjuq5Gyqg4rYzIdDobbwKUqvbUjmSwsU6Kbz8qPGQrWgdumJENyi7ViVKh-mx850nErkNPPaV8cEVsF1xwTxYLEAhTmhHRFqA7DnqNRyYU8B2moBCnufp7KSRLhEp1_IHwcMi0uGvittYjkbd0gHZii0doZ1PDx7jizS1e86c9bnhOUytqDfaRPkGLrrmXFvMSMHe0VxnfFBGLZEIqK8aCvyVOEzBNaAsXqjn0X24VWZs0SIbrkF1BRP5g_6PPLDHAT96Al--7XzfEabS-JA9VJrrtaFy3rXYfe_PvCiuYE1POvOJHaa21-S6TObxg0FHlmY4H26jk9CS7vhpZOSEqojkHw-5NIh6Xakwp7HlCqrjIavb4slvXKlKIaN5TvHEmT0NJj9Tz-QJoPY9eQM87kb2xd-yGPumDZ7hR0YYULul-RYv02pa-1WDseD-F4nYtDSc3kB_FBhSsd7qv8I8acNjgeUi66fzcgkqjzwY1Ak8-rqfZ5tLgDhm9ERoKKIvhlix5yGPfqgo-DeV8vH-ifijkZj4e-P3X0N4ZVegzbHvflS2YJEfRIM2ZTxn5VC8ZDWCYGaXdMxa-Xov1SeLhzQ3sfqwVdjwkawHIkJjfU9pZvXyT4wweCBC_7qUW957fgdrFlNjD_OpvHMhKk1h1izSHy7ii-zdycvdZ55YGRKW-ie68VFpMpuz5oVeWVY8m0UNcRHEP8m5K8yoY5B6-eCpIAdFkvttmdpXGGaT12kyDsVFQFWETMsj8H1QDh_aI7A9POPidkQkb6OBHXgsuGpWFpJ7TZpJtZE_xchIobol4vmRh9vZ3C7SBFFUgu2j_6TsHiuUabrhI1LDwP2myyzmHFvUZYPA63CI0ALKTC_P6Bdxq6lht5KkGmACREYDtRBF-kGJGhffu6rERZeMQ0nfJSw2WChLK1jbgMCBHYL3S4-BEPw5PH-SiK9RaCgZ1w57VS9HyVp4OGintMwvFcQnU7rvdJzEkZdi4t8aDyLC9o716IyalFvWYhB4e3mlTwas-zp5HzyR4hjd1nJlTGZJWMuF6od9aAqJ7Km-rQxd5IqVVmylAAWZcvb-jW3S3DKhwFAbbm589D2i8V1Ahs9IA4oJJJ2bu9Awuqg-HnPHJKo_4hhaednodO1xzyNtzCbjY4E7eS3B-byyTokN9NXcayzRrrlbu-ZurIeZlGgKuBTF9L_m7XijX9CyiEOJxd5P9tMh_dWoXhuL43DvkDgu8YCVS7eHbfhAIrtQ0d6MIxxcL-850Mi3jgwhBdqQ2cOv7WeTXKWLZwdlTJ7VskYkBAOcWLTeSdttQUE3-QQ-kJfH-CEaeqzid78FONS1wZWx0Q4TQqpFFwX8eSv7UAMuKvVR0B3t_xGGzYWRIwBeVOXr5vZoBcF-UMBLMDSVPav9LcIQTX2kRlpaIqJ8ZIwFhoubGQDjrim0kRm_bNuVBgMgErHTJcV2pJTnJL__3tmZV69wE1a-RhSdL93OvwNV64V3vO0Mk4bo9ExF_PVACnZvL13I9EFyx5gx-FczdJEFLTL4jS49Rbm7U-13pOV0m7fZmA1jK2Le-Y_di64hqoJB23dOBPHhNuMYHq85KydOEFnP7Z_gU4UXxk0Ps4xjc7KgISdm3Oo-HIMF3JDqBZPpMlOEPxaOrXhz9KoGRPzxtjSALNe7ZMzlekRv9jFmUh0XeDON53e2BHdy5Y-Iqp0G4_4LYz1VAwO-ROsOS1HpU5iwxdGKXswYU88Ib8_7gaU4wozJ8bO64yNZKF5C2zrX8k3OUc2NoaVycJlmClbfiJm38U1iy7kIsgbYqZ4cbNxCUyN9JIXDNUEVq9hglStXb2skpoO7fOPCwpNJ8EouBnKaaqfqUwoEBOv0kg3KNHlQYcgNRHs7wdADjpIkc4SG9rKb-9cikDPyc8ewBOXVRgNMCId09T1jmoIKg81Y-x2m4lKFPFudbrhPD2SgwlCflAA8Pj29VMRney0ZsSZy7IkpSOOnUw63fCM01mEIK4h_AJxXkc95E_MdFjbrWGZphvIu3S4e9O_SL8PS6DmThM1gANG5sii-BspX62TapMynCEuVBu-NysWd3Q1yieP87FuW_flBV8SKtJdHT9Qbg6t2SJ_lnDQotoJa0yYsHbQDcIPPvXfh8mX42-pWTzjckUt5wV-Tu-elaapxyxJz6fkGt3Ov5FWCkJ8_EiImNX8ET64m6IBQ3UKoeUxke0usx91hq1MiTQYLQhN1wwIKXERA6HabvM8c8QnufMmaJ02EdZhbqvEYMHIFLv4CWsLX8tGcKTMw9-Nee4D74ju-n2k2X2d1Jb2My1dA-khL5uhYtUyOxu0fz_ZK9fy60xI8PCYY34A_n6fIbH4qra_OEkifHZnzIjEPUZE8CFZFlO1vb6h22fJZbVcX4dfodAQuFTI5EJZhsiQD6wUMTx26NdCU0VQXS__o4H8S5ERpqKkuYWeoMb3bN6hlD-C8QXfG9d7b1B6-gcO4WHVuMERXogy_ecxYjvbaVzjOnpeuwU21QchBWLt2GNjiq4BmeTWwsnAa3ubVm4JZj
Source: global traffic	HTTP traffic detected: GET /ttpwp HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/runtime.5257ca6e429949972959.js HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/polyfills.5257ca6e429949972959.js HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/styles.5257ca6e429949972959.js HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/main.5257ca6e429949972959.js HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/runtime.5257ca6e429949972959.js HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/polyfills.5257ca6e429949972959.js HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/styles.5257ca6e429949972959.js HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/main.5257ca6e429949972959.js HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/mimecast-icons.bb1a2cd16db9345fc437.woff2?25417273 HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://security-uk.m.mimecastprotect.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://security-uk.m.mimecastprotect.com/ttpwpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/languages/en.json HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/plain, /Content-Type: application/jsonx-context-route: ttpwpsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/images/mimecast-logo.png HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /service/get-caps-overrides HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/images/mimecast-logo.png HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/fa-solid-900.54dfc8f551be346014e4.woff2 HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://security-uk.m.mimecastprotect.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://security-uk.m.mimecastprotect.com/ttpwpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/languages/en.json HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/images/favicon.ico HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/images/favicon.ico HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/ttp/url/get-page-data HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/ttp/userawareness/report-judgement HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ttpwp/resources/fa-regular-400.33904a1b964c9b363ce7.woff2 HTTP/1.1Host: security-uk.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://security-uk.m.mimecastprotect.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://security-uk.m.mimecastprotect.com/ttpwpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r/RriaybGmrgwONwzgO2MWfHO1F3XKarISRjLxdWFL9XTfpkBU58DEKAZvD2MCgNOj_j4DSYforTR9qwVYEIXZ9vgX1U2-QAqxPTdwA00ppsQ3I0PEAGksgw_D88Xbcu-938LX7owv5XD4D4tajr7iuKFr3ovoLy-wx9i8PuUSRC8srb5j8rtR59AW6TCsTLqBv9ArlBYnfQKackbQu2oh7s60TFBqbGaOhOk3E61Ni-TSKVAW6gCOBItKafCPhcsOrE2XBrkygs9LfXm5k72EqW-SQ-byKEw4nxjgLClTGiHS-9KrcZXei-A-5bwM53tgW4ZZp7qOACJQRcfx2T-sgC_a4-qWhBjSBnyBWgG8YlBIO6-ptXKlh_ew8SbFtzyYfQEoGuGnxBOl3pTDf8emhFLGba6waF235cMvP8IBjvXHxPg5VRhI3rP_Q6kb0DV1oE12clGaNL6NcRTfoTRbDlgNeNpbaygalyKjHEFTZv8p_K8x1wsVOAbDJjlVjVIQ7NIi-jvHJvlDlMpY4N6DjUricN81Pln9H-lMiYBef3aP0tfOM9_2YdimImSuUfnrQk0fz1qetdH-ObErarOvR2XgblbA7U-p-CeaQVx0zI7g-rFuT5W3zaB1Ybz8gZPNkqZSprSvLkQ0k14Er3vV6eAAfRb0MRcX6HmFlM-wcjwRpM7ZMp9zHv6uFQd7SYQZp9BB8Kdk3doXQo1XamRjetuzcWnY8uhjkIkmy4STUzoadv_-id4zbJ0QFxEQr67iuQ5PU8gKwqK5Q4Rt_qKVlHrALJ7B2Ods-W8cput7eLvYomJ3QZ6Jn74xbSl7Fz-jWlMv4rpuJP_nLIGmhf5eQf8A9Ks-_NTx6Ex_CBE2Lpp9vxcBkmsbP_Eya2Izz7utKXIhRdY7kNgK43OQLvlCyY1S4R_7xwULN0CftFftssUzf_0Ktam2hgHlQ45UsV_XcrISqJDUUpLTjbLX6gBmuQop0mJdzKyUKZUA5ulZBzwXFQAhV_FE3xkcMFJWW5Fp2g84_vn1TIIp_wtHSs3XfCOSuefjFuODjHvM91RMpeSYnlzIDR6OwPnzpMXY9tqaTa4BXxaivr4LnNA-0d5spwcRkbvM35oNJwf88sFkHEk2yWwbqsa2taBGxq98u389XBKxrVlLsdvMqnj94nXwYMuFIBX_r3k4d-B2V69fqfiRsFaXf4_PR3h0EPl-2B-iLBaFtaMFJdcKfliW_iCvhZvei_u4H4mWojrI5sL3fQi3zi11SNIGZVd2LTTQpzv3HynGbcXBVqX7Mlwi3lzRttUjc4q1lncAAoWAn3kNsqc4em1jBNKIm7J5zZXUQVZtyLjNvy7HFd_ZWzzi_coUhRjM1MBYqlzdj9WXPW1oeFxM7OdQkutiSyyAAE9aSrUucsS3rbigUxemmjVbGYmxz_edUf85XNDtDZ5rUXYSkcXpHBcdCtynRSMJWqz6WUpCLR3FjB6Ft-8vfCl-5tFO62gTZLXKbumb-rIxu1wiOWIUGLNbuZ_WMETf3YjBRL1Xb47woE14PMw-NQxhYqX0T5AAEd0i9IeE2rHzLCnwyhJNjEQMLb8GPUFoBa5iowWVLK0Gr9YLqNSGyp2pq-XZT3-lCP_lqD1DhASdLag_MRUcB3NM_K7uHqQeIxPdbj3gPLdT9vX9uYHK7ETYGoIjXvIO1StRGdHJvxUHsnA0sNGWrH3HbYbtkDSN9PPE1AAEPZfqnjpS0fgBOb8osJDoy8iN3PLLOJBJISIOTpooN5FEQnRGrlAZhJV0JVX_S5TOnqcQwb2q9DipyFUfRm6-ceBrshjrjb3tF9NOSv8OT_W86EExyK6S8EfeGhebgexQeNhjOPChNg4DG4eAN2hkubFQk-K-9eZG4P2Y7Vz4SyE-ITnRJ-M861_qUwMu-6GyKCN4uPU0ixZBpFAlOJACwozJaN6XeGRELHAIcXWUQBj1gPNGrXNbu1WURlmZGfwVg2-Z2xMEk0BaIbBKwM2-mHbhLIrLb5mutPL43i2YIbium7HsKAusWn9j5vnbwlmg-UoSWt_Rk-TPPfxfiiL-bwsLq8Tp50ZjV8mPiksdIUMSZSww-ihdfDVSSB2klrEU4AEb_vKD1oMXNe5FyvQwA2b6h3HnUSmPKqZ0ixLO9I5iY1olkbHNAW2RxQgKSGIE5WBPbbydl8AU0EK0c7vPWnKmCUWoGUqry7y2nQuox74rHM5vwkbhpg5rVbUAmYchRgiABkuVHFu_hxb0aGeSDy1jSu1NjBAODzauiWGf5YLL2qsjbFsJEO7rYi9cy9PPeWUshPgruazQ-36265G2xzh2MacA8yDimJu5ir5HxO4wlBhmjTLOX625iHGHf89-IyPu5dyjTEQExSqxJ-BX_clnSFrQtG8uyxZMIkLBrGonO4k0vqMr7n6VSsNOS9aD4fXuqmBGXKBLvwrtdtSyRzRtBJexUJBx1OjEtqf6yqRJYhGrFrOsUTCaUUh5gh8JUnsL4kkNnlup7ijElpsiIOx71ruOSQEz112G74bZCk3o08CjYV7d8tqJ4d6HmDIaHHTsvXOgosLmVSL8zolhT3N245ROIKRu49qxHe1ea0bMdiEWm4VQxBKZ9atSD-AiYFBsqrsr3-0vZJ3sANVEu0fR-L-6qLExMOPONRpqa3NakGQ3BjEu_N4RNhEq22gEwn63lP5dV--NSyXv8_Go4LuGFry6RpZhi7BNFYaiAjnJ36-X9CbRifBEaFcOfR6qCTO3uV8SGlOO1YDCv3EHVIBf3o9L21FBgCGQZCzpU4z0UvcozFWjSz0zio25U0vgLOYTCfXoNCEgqreBbc7EZYWGYYfJN1zjWIS8YENlJ_bpLL2R2MOiRPVQFCizRLpwX1CZQ03NfUlx2iopCP-knYqZpsYMi2SkkHT-K8wHe2MgmCWsRvdstwnJi4w2minILUoZIKUsQAzxwKslHRbKdEomExRgIdi_2CU7JyPCzE7vRCCwd
Source: global traffic	HTTP traffic detected: GET /LVGwXwqP HTTP/1.1Host: hnamedmr.ukremediatlon.co.ukConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.example.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.example.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.example.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: url.uk.m.mimecastprotect.com
Source: global traffic	DNS traffic detected: DNS query: security-uk.m.mimecastprotect.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: hnamedmr.ukremediatlon.co.uk
Source: global traffic	DNS traffic detected: DNS query: www.example.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 22 Oct 2024 14:11:04 GMTContent-Type: text/html; charset=utf-8Content-Length: 180Connection: closex-content-type-options: nosniffx-xss-protection: 1; mode=blockx-frame-options: SAMEORIGINReferrer-Policy: no-referrerX-Robots-Tag: noindex, nofollowStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadETag: W/"b4-Rx6/Sa3RjWBf0k8YjdRg8WXd70U"Vary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 22 Oct 2024 14:11:09 GMTContent-Type: text/html; charset=utf-8Content-Length: 180Connection: closex-content-type-options: nosniffx-xss-protection: 1; mode=blockx-frame-options: SAMEORIGINReferrer-Policy: no-referrerX-Robots-Tag: noindex, nofollowStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadETag: W/"b4-Rx6/Sa3RjWBf0k8YjdRg8WXd70U"Vary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 22 Oct 2024 14:11:39 GMTContent-Type: text/html; charset=utf-8Content-Length: 180Connection: closex-content-type-options: nosniffx-xss-protection: 1; mode=blockx-frame-options: SAMEORIGINReferrer-Policy: no-referrerX-Robots-Tag: noindex, nofollowStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadETag: W/"b4-Rx6/Sa3RjWBf0k8YjdRg8WXd70U"Vary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundAge: 291460Cache-Control: max-age=604800Content-Type: text/htmlDate: Tue, 22 Oct 2024 14:11:46 GMTEtag: "1088432560+gzip+ident"Expires: Tue, 29 Oct 2024 14:11:46 GMTLast-Modified: Sat, 12 Oct 2024 03:26:51 GMTServer: ECAcc (dad/5FB0)Vary: Accept-EncodingX-Cache: 404-HITContent-Length: 1256Connection: close

Source: chromecache_173.10.dr	String found in binary or memory: http://www.mimecast.com/
Source: chromecache_173.10.dr	String found in binary or memory: https://community.mimecast.com/docs/DOC-241
Source: App1729606183002160900_0A09A35D-7331-45A2-8597-74C0710D4482.log.0.dr	String found in binary or memory: https://login.windows.net
Source: ~WRS{5E8782E3-8D4A-45DD-A929-A96DB03A977F}.tmp.0.dr	String found in binary or memory: https://pub.lucidpress.com/50f1c535-8058-4eec-b469-2bd69fae4557/
Source: [EXTERNAL] Re_ Quotes.eml	String found in binary or memory: https://url.uk.m.mimecastp=
Source: [EXTERNAL] Re_ Quotes.eml	String found in binary or memory: https://url.uk.m.mimecastprot=
Source: [EXTERNAL] Re_ Quotes.eml	String found in binary or memory: https://url.uk.m.mimecastprotec=
Source: [EXTERNAL] Re_ Quotes.eml	String found in binary or memory: https://url.uk.m.mimecastprotect.com/s/0c3qC3QDxSxmYrQsYCOFQ4SPB?domain=3D=
Source: ~WRS{5E8782E3-8D4A-45DD-A929-A96DB03A977F}.tmp.0.dr	String found in binary or memory: https://url.uk.m.mimecastprotect.com/s/0c3qC3QDxSxmYrQsYCOFQ4SPB?domain=citipostmail.co.uk/
Source: [EXTERNAL] Re_ Quotes.eml	String found in binary or memory: https://url.uk.m.mimecastprotect.com/s/0c3qC=
Source: [EXTERNAL] Re_ Quotes.eml	String found in binary or memory: https://url.uk.m.mimecastprotect.com/s/1k4bC2xBwh6=
Source: [EXTERNAL] Re_ Quotes.eml	String found in binary or memory: https://url.uk.m.mimecastprotect.com/s/1k4bC2xBwh6koDwi=
Source: ~WRS{5E8782E3-8D4A-45DD-A929-A96DB03A977F}.tmp.0.dr	String found in binary or memory: https://url.uk.m.mimecastprotect.com/s/1k4bC2xBwh6koDwiMu6F5BKCc?domain=urldefense.proofpoint.com
Source: [EXTERNAL] Re_ Quotes.eml	String found in binary or memory: https://url.uk.m.mimecastprotect.com/s/=
Source: ~WRS{5E8782E3-8D4A-45DD-A929-A96DB03A977F}.tmp.0.dr	String found in binary or memory: https://url.uk.m.mimecastprotect.com/s/P5e4CYWP9Ug3oyxU9iGFxYVR2?domain=whistl.co.uk
Source: [EXTERNAL] Re_ Quotes.eml	String found in binary or memory: https://url.uk.m.mimecastprotect.com/s/ZlrZCZYQ9UxMnWNsysRFBA-ZP?domain=3D=
Source: ~WRS{5E8782E3-8D4A-45DD-A929-A96DB03A977F}.tmp.0.dr	String found in binary or memory: https://url.uk.m.mimecastprotect.com/s/ZlrZCZYQ9UxMnWNsysRFBA-ZP?domain=hnamedmr.ukremediatlon.co.uk
Source: [EXTERNAL] Re_ Quotes.eml	String found in binary or memory: https://url.uk.m.mimecastprotect.com/s/cIB8C4Q0yS6JAw1iNFEF4GZlf?domain=3D=
Source: ~WRS{5E8782E3-8D4A-45DD-A929-A96DB03A977F}.tmp.0.dr	String found in binary or memory: https://url.uk.m.mimecastprotect.com/s/cIB8C4Q0yS6JAw1iNFEF4GZlf?domain=urldefense.proofpoint.com
Source: [EXTERNAL] Re_ Quotes.eml	String found in binary or memory: https://url.uk.m.mimecastprotect.com/s/lBBfC1WAvUOpwQYUYtmFVP1nh?domain=3D=
Source: ~WRS{5E8782E3-8D4A-45DD-A929-A96DB03A977F}.tmp.0.dr	String found in binary or memory: https://url.uk.m.mimecastprotect.com/s/lBBfC1WAvUOpwQYUYtmFVP1nh?domain=linkedin.com
Source: [EXTERNAL] Re_ Quotes.eml	String found in binary or memory: https://url.uk.m.mimecastprotect.com/s/lBBfC=
Source: [EXTERNAL] Re_ Quotes.eml	String found in binary or memory: https://url.uk.m.mimecastprotect.com/s/rS3GCXLO9cGn7LYCVh6=
Source: ~WRS{5E8782E3-8D4A-45DD-A929-A96DB03A977F}.tmp.0.dr	String found in binary or memory: https://url.uk.m.mimecastprotect.com/s/rS3GCXLO9cGn7LYCVh6FWJ9uL?domain=whistl.co.uk/
Source: chromecache_185.10.dr, chromecache_179.10.dr	String found in binary or memory: https://www.iana.org/domains/example

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.18:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.138:443 -> 192.168.2.18:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.138:443 -> 192.168.2.18:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.18:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.140:443 -> 192.168.2.18:49712 version: TLS 1.2

Source: classification engine

Classification label: mal48.winEML@23/71@12/7

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241022T1009420773-740.etl

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\[EXTERNAL] Re_ Quotes.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "0F810BE9-1EE3-4005-871B-CC3AF9EB26A5" "EB03CE19-C594-4EA9-AD58-197437118574" "740" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://url.uk.m.mimecastprotect.com/s/ZlrZCZYQ9UxMnWNsysRFBA-ZP?domain=hnamedmr.ukremediatlon.co.uk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1944,i,1824875940929507423,6371601856566642731,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "0F810BE9-1EE3-4005-871B-CC3AF9EB26A5" "EB03CE19-C594-4EA9-AD58-197437118574" "740" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://url.uk.m.mimecastprotect.com/s/ZlrZCZYQ9UxMnWNsysRFBA-ZP?domain=hnamedmr.ukremediatlon.co.uk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1944,i,1824875940929507423,6371601856566642731,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Jump to behavior

Source: Google Drive.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: Email

LLM: Email contains prominent button: 'click here'

AI detected potential phishing Email

Source: Email

LLM: Detected potential phishing email: The email claims to have a 'request file' that requires login with email credentials, which is a common phishing tactic.

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Jump to behavior

Source: [EXTERNAL] Re_ Quotes.eml	Binary or memory string: XtoWLqcLpqQZO7d8htCRKkomVMCIeHgNIucVb5i22OMsx/eYCfmpSj86d7gHk4cNVwwhgAf69sDW
Source: [EXTERNAL] Re_ Quotes.eml	Binary or memory string: tWsxSWCM141PgIYASbtD9SAmojEFKsWHGFS+zF+X1+dwu8zM4/Ggp3QFlAUMxvSk+r3MQZWd6vr/

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Modify Registry	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://login.windows.net	0%	URL Reputation	safe
https://www.iana.org/domains/example	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
url.uk.m.mimecastprotect.com	91.220.42.63	true	false	unknown
security-uk.m.mimecastprotect.com	195.130.217.88	true	false	unknown
www.google.com	142.250.185.68	true	false	unknown
hnamedmr.ukremediatlon.co.uk	172.67.128.229	true	false	unknown
www.example.com	93.184.215.14	true	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://security-uk.m.mimecastprotect.com/service/get-caps-overrides	false	unknown
https://security-uk.m.mimecastprotect.com/api/ttp/userawareness/report-judgement	false	unknown
https://url.uk.m.mimecastprotect.com/r/lJ_qgGoNKOtmgnbcVAzK9AK7bCK_bMUk-wR7tn7n2Yc-AiwWUwSJ5cdo4JD9L-rHbsi-7W3dO8y5uQV2nzI3pgGYX2bWfu1MDc-X9rMWVK_hsH3igqVCwlv82yO9Us1bD9QGVJXYV3iwcJyaZUtCzpN5gQCtVwfSk4NF3Jvvjo6dam7LE0uymt-W2XHlpqniDQv0P0k8ZJKYaCstCrmE1sq1ZoAQ3VLjp0OO2PZzixRmPZJK3FnHnTaIJwVqhz9-vSI1xigm4TWyfd7JWmu74nSWtZqj9NqEJglaSsVWuKMnELweU3CY7wK_cfeqtPwaqs8jlAL3SZc0pjK71K0ISYzpKLaSw_JCCc6zzmE5PGZHuWIotNrok3xDwjmYYdSvbsjWzlsuRUUe3Ge-nzuT_-uUD_uGughyFXcxYqfAHpXCIep-KQdcjuq5Gyqg4rYzIdDobbwKUqvbUjmSwsU6Kbz8qPGQrWgdumJENyi7ViVKh-mx850nErkNPPaV8cEVsF1xwTxYLEAhTmhHRFqA7DnqNRyYU8B2moBCnufp7KSRLhEp1_IHwcMi0uGvittYjkbd0gHZii0doZ1PDx7jizS1e86c9bnhOUytqDfaRPkGLrrmXFvMSMHe0VxnfFBGLZEIqK8aCvyVOEzBNaAsXqjn0X24VWZs0SIbrkF1BRP5g_6PPLDHAT96Al--7XzfEabS-JA9VJrrtaFy3rXYfe_PvCiuYE1POvOJHaa21-S6TObxg0FHlmY4H26jk9CS7vhpZOSEqojkHw-5NIh6Xakwp7HlCqrjIavb4slvXKlKIaN5TvHEmT0NJj9Tz-QJoPY9eQM87kb2xd-yGPumDZ7hR0YYULul-RYv02pa-1WDseD-F4nYtDSc3kB_FBhSsd7qv8I8acNjgeUi66fzcgkqjzwY1Ak8-rqfZ5tLgDhm9ERoKKIvhlix5yGPfqgo-DeV8vH-ifijkZj4e-P3X0N4ZVegzbHvflS2YJEfRIM2ZTxn5VC8ZDWCYGaXdMxa-Xov1SeLhzQ3sfqwVdjwkawHIkJjfU9pZvXyT4wweCBC_7qUW957fgdrFlNjD_OpvHMhKk1h1izSHy7ii-zdycvdZ55YGRKW-ie68VFpMpuz5oVeWVY8m0UNcRHEP8m5K8yoY5B6-eCpIAdFkvttmdpXGGaT12kyDsVFQFWETMsj8H1QDh_aI7A9POPidkQkb6OBHXgsuGpWFpJ7TZpJtZE_xchIobol4vmRh9vZ3C7SBFFUgu2j_6TsHiuUabrhI1LDwP2myyzmHFvUZYPA63CI0ALKTC_P6Bdxq6lht5KkGmACREYDtRBF-kGJGhffu6rERZeMQ0nfJSw2WChLK1jbgMCBHYL3S4-BEPw5PH-SiK9RaCgZ1w57VS9HyVp4OGintMwvFcQnU7rvdJzEkZdi4t8aDyLC9o716IyalFvWYhB4e3mlTwas-zp5HzyR4hjd1nJlTGZJWMuF6od9aAqJ7Km-rQxd5IqVVmylAAWZcvb-jW3S3DKhwFAbbm589D2i8V1Ahs9IA4oJJJ2bu9Awuqg-HnPHJKo_4hhaednodO1xzyNtzCbjY4E7eS3B-byyTokN9NXcayzRrrlbu-ZurIeZlGgKuBTF9L_m7XijX9CyiEOJxd5P9tMh_dWoXhuL43DvkDgu8YCVS7eHbfhAIrtQ0d6MIxxcL-850Mi3jgwhBdqQ2cOv7WeTXKWLZwdlTJ7VskYkBAOcWLTeSdttQUE3-QQ-kJfH-CEaeqzid78FONS1wZWx0Q4TQqpFFwX8eSv7UAMuKvVR0B3t_xGGzYWRIwBeVOXr5vZoBcF-UMBLMDSVPav9LcIQTX2kRlpaIqJ8ZIwFhoubGQDjrim0kRm_bNuVBgMgErHTJcV2pJTnJL__3tmZV69wE1a-RhSdL93OvwNV64V3vO0Mk4bo9ExF_PVACnZvL13I9EFyx5gx-FczdJEFLTL4jS49Rbm7U-13pOV0m7fZmA1jK2Le-Y_di64hqoJB23dOBPHhNuMYHq85KydOEFnP7Z_gU4UXxk0Ps4xjc7KgISdm3Oo-HIMF3JDqBZPpMlOEPxaOrXhz9KoGRPzxtjSALNe7ZMzlekRv9jFmUh0XeDON53e2BHdy5Y-Iqp0G4_4LYz1VAwO-ROsOS1HpU5iwxdGKXswYU88Ib8_7gaU4wozJ8bO64yNZKF5C2zrX8k3OUc2NoaVycJlmClbfiJm38U1iy7kIsgbYqZ4cbNxCUyN9JIXDNUEVq9hglStXb2skpoO7fOPCwpNJ8EouBnKaaqfqUwoEBOv0kg3KNHlQYcgNRHs7wdADjpIkc4SG9rKb-9cikDPyc8ewBOXVRgNMCId09T1jmoIKg81Y-x2m4lKFPFudbrhPD2SgwlCflAA8Pj29VMRney0ZsSZy7IkpSOOnUw63fCM01mEIK4h_AJxXkc95E_MdFjbrWGZphvIu3S4e9O_SL8PS6DmThM1gANG5sii-BspX62TapMynCEuVBu-NysWd3Q1yieP87FuW_flBV8SKtJdHT9Qbg6t2SJ_lnDQotoJa0yYsHbQDcIPPvXfh8mX42-pWTzjckUt5wV-Tu-elaapxyxJz6fkGt3Ov5FWCkJ8_EiImNX8ET64m6IBQ3UKoeUxke0usx91hq1MiTQYLQhN1wwIKXERA6HabvM8c8QnufMmaJ02EdZhbqvEYMHIFLv4CWsLX8tGcKTMw9-Nee4D74ju-n2k2X2d1Jb2My1dA-khL5uhYtUyOxu0fz_ZK9fy60xI8PCYY34A_n6fIbH4qra_OEkifHZnzIjEPUZE8CFZFlO1vb6h22fJZbVcX4dfodAQuFTI5EJZhsiQD6wUMTx26NdCU0VQXS__o4H8S5ERpqKkuYWeoMb3bN6hlD-C8QXfG9d7b1B6-gcO4WHVuMERXogy_ecxYjvbaVzjOnpeuwU21QchBWLt2GNjiq4BmeTWwsnAa3ubVm4JZjyX0xSs6ITuOFi-ATf53vdnH-8fWFVOZIbn8GXeUOYp2e6MoupBHZMsnmUEbMaYleK5J9RQe2xMVZAdFHULtmulMHPgRXcXatf3BR4NZSWZUaJehNgrHhmmhBxUoBE-FVKq09cj9qwS2zXhW4oKE5n-giuFW1h0R-WkjsuD_2VBRb6OPuYX7XbiJqfaSYwAkeWqD67lDcuPWiyuvTFoBoTvrUXEICc8QF90mYBgQlQLEIioelrQ1q4k-zIYFhBphiCF2ZTMhEdn0Le6tdEaJvpdIBpOuMaPHNVVlz4WzHLWHe3W2pHjvooK6m7kRzrxSGuuN4vOOUDR6v85uLhzFz9Yn3VEAXveq3f0QsOIlW0hqDMaZNjeF1cxwdupbtyG9Asa5_0bNi3isugO-hDdvgJ8HMnJmX2RB9AQC731VAjr2FOGj1eW1jhk4YAnjp_k34V_T5hVuIN3t_zR93P5S72Z5QzCCvfkwmQJ-qZ7kthtcmSyibJg2sPvOig6M3OTeif9tAMe_KDZNsoJMJ6WhCiOWi2lPL9XnzN_Ejr52AKfCPg24pE5JORbssHV6RyPtzjH_6h-rn5gK9_dxvecUWMpgpBtZgDt3k0zuu9hJ0UJwHT-aQDBUm64X6_wAxmPkIH9R58KLiPg2rvWrR4WTBGfVYHnxe-VNGsWkI8q2d_3LEpV2KbazcIVlADeW7lq1pxwIS4tLpRM1IVx35-uFgxeoTwzvpBXJg_m76fW3dEiBpPj-Iz-o0mW8OoRHbeBpz9Wf-281L2xUFTe9UHGdN-R0ALhWbAgr9EmhXIPFRVMx4yq3GjCzfidQGFZ95MZ8UQY0CAzKNs2e9TLJq5GphfNs2kxJ1It65KGydHBVtgiEhvRbCaWLI_SyKmc	false	unknown
https://security-uk.m.mimecastprotect.com/ttpwp/resources/languages/en.json	false	unknown
https://security-uk.m.mimecastprotect.com/ttpwp/resources/fa-solid-900.54dfc8f551be346014e4.woff2	false	unknown
https://security-uk.m.mimecastprotect.com/ttpwp/resources/fa-regular-400.33904a1b964c9b363ce7.woff2	false	unknown
https://security-uk.m.mimecastprotect.com/ttpwp/resources/main.5257ca6e429949972959.js	false	unknown
https://www.example.com/	false	unknown
https://hnamedmr.ukremediatlon.co.uk/LVGwXwqP	false	unknown
https://security-uk.m.mimecastprotect.com/api/ttp/url/get-page-data	false	unknown
https://security-uk.m.mimecastprotect.com/ttpwp/resources/polyfills.5257ca6e429949972959.js	false	unknown
https://security-uk.m.mimecastprotect.com/ttpwp/resources/images/favicon.ico	false	unknown
https://security-uk.m.mimecastprotect.com/ttpwp/#/ua?key=YHCH0jK4xsNRMGObU0ehDxT0fg3jXsga1nzcx-4fokPB1Xd4nzhmP6PAOTq_52_c9hx____uGeArAE7NPLh9tr4j9XByPup4XVZ61RaDPROs8aoUE601fyVV1A9ypfpB	false	unknown
https://security-uk.m.mimecastprotect.com/ttpwp/resources/styles.5257ca6e429949972959.js	false	unknown
https://www.example.com/favicon.ico	false	unknown
https://security-uk.m.mimecastprotect.com/ttpwp/resources/runtime.5257ca6e429949972959.js	false	unknown
https://security-uk.m.mimecastprotect.com/ttpwp/resources/mimecast-icons.bb1a2cd16db9345fc437.woff2?25417273	false	unknown
https://url.uk.m.mimecastprotect.com/s/ZlrZCZYQ9UxMnWNsysRFBA-ZP?domain=hnamedmr.ukremediatlon.co.uk	false	unknown
https://security-uk.m.mimecastprotect.com/ttpwp/resources/images/mimecast-logo.png	false	unknown
https://security-uk.m.mimecastprotect.com/ttpwp	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://login.windows.net	App1729606183002160900_0A09A35D-7331-45A2-8597-74C0710D4482.log.0.dr	false	URL Reputation: safe	unknown
https://url.uk.m.mimecastprotect.com/s/ZlrZCZYQ9UxMnWNsysRFBA-ZP?domain=3D=	[EXTERNAL] Re_ Quotes.eml	false		unknown
https://url.uk.m.mimecastprotect.com/s/0c3qC3QDxSxmYrQsYCOFQ4SPB?domain=citipostmail.co.uk/	~WRS{5E8782E3-8D4A-45DD-A929-A96DB03A977F}.tmp.0.dr	false		unknown
https://url.uk.m.mimecastprotect.com/s/0c3qC3QDxSxmYrQsYCOFQ4SPB?domain=3D=	[EXTERNAL] Re_ Quotes.eml	false		unknown
https://url.uk.m.mimecastprotec=	[EXTERNAL] Re_ Quotes.eml	false		unknown
https://url.uk.m.mimecastprotect.com/s/cIB8C4Q0yS6JAw1iNFEF4GZlf?domain=urldefense.proofpoint.com	~WRS{5E8782E3-8D4A-45DD-A929-A96DB03A977F}.tmp.0.dr	false		unknown
https://url.uk.m.mimecastp=	[EXTERNAL] Re_ Quotes.eml	false		unknown
https://url.uk.m.mimecastprotect.com/s/1k4bC2xBwh6koDwiMu6F5BKCc?domain=urldefense.proofpoint.com	~WRS{5E8782E3-8D4A-45DD-A929-A96DB03A977F}.tmp.0.dr	false		unknown
http://www.mimecast.com/	chromecache_173.10.dr	false		unknown
https://url.uk.m.mimecastprotect.com/s/P5e4CYWP9Ug3oyxU9iGFxYVR2?domain=whistl.co.uk	~WRS{5E8782E3-8D4A-45DD-A929-A96DB03A977F}.tmp.0.dr	false		unknown
https://url.uk.m.mimecastprotect.com/s/cIB8C4Q0yS6JAw1iNFEF4GZlf?domain=3D=	[EXTERNAL] Re_ Quotes.eml	false		unknown
https://url.uk.m.mimecastprotect.com/s/lBBfC1WAvUOpwQYUYtmFVP1nh?domain=linkedin.com	~WRS{5E8782E3-8D4A-45DD-A929-A96DB03A977F}.tmp.0.dr	false		unknown
https://url.uk.m.mimecastprotect.com/s/1k4bC2xBwh6=	[EXTERNAL] Re_ Quotes.eml	false		unknown
https://url.uk.m.mimecastprotect.com/s/1k4bC2xBwh6koDwi=	[EXTERNAL] Re_ Quotes.eml	false		unknown
https://pub.lucidpress.com/50f1c535-8058-4eec-b469-2bd69fae4557/	~WRS{5E8782E3-8D4A-45DD-A929-A96DB03A977F}.tmp.0.dr	false		unknown
https://url.uk.m.mimecastprotect.com/s/0c3qC=	[EXTERNAL] Re_ Quotes.eml	false		unknown
https://url.uk.m.mimecastprotect.com/s/rS3GCXLO9cGn7LYCVh6FWJ9uL?domain=whistl.co.uk/	~WRS{5E8782E3-8D4A-45DD-A929-A96DB03A977F}.tmp.0.dr	false		unknown
https://url.uk.m.mimecastprotect.com/s/rS3GCXLO9cGn7LYCVh6=	[EXTERNAL] Re_ Quotes.eml	false		unknown
https://url.uk.m.mimecastprotect.com/s/=	[EXTERNAL] Re_ Quotes.eml	false		unknown
https://url.uk.m.mimecastprotect.com/s/lBBfC=	[EXTERNAL] Re_ Quotes.eml	false		unknown
https://www.iana.org/domains/example	chromecache_185.10.dr, chromecache_179.10.dr	false	URL Reputation: safe	unknown
https://url.uk.m.mimecastprot=	[EXTERNAL] Re_ Quotes.eml	false		unknown
https://url.uk.m.mimecastprotect.com/s/lBBfC1WAvUOpwQYUYtmFVP1nh?domain=3D=	[EXTERNAL] Re_ Quotes.eml	false		unknown
https://community.mimecast.com/docs/DOC-241	chromecache_173.10.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.68	www.google.com	United States	15169	GOOGLEUS	false
91.220.42.63	url.uk.m.mimecastprotect.com	United Kingdom	42427	MIMECAST-UKGB	false
172.67.128.229	hnamedmr.ukremediatlon.co.uk	United States	13335	CLOUDFLARENETUS	false
195.130.217.88	security-uk.m.mimecastprotect.com	United Kingdom	42427	MIMECAST-UKGB	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
93.184.215.14	www.example.com	European Union	15133	EDGECASTUS	false

Private

IP
192.168.2.18

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1539395
Start date and time:	2024-10-22 16:08:49 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	[EXTERNAL] Re_ Quotes.eml
Detection:	MAL
Classification:	mal48.winEML@23/71@12/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .eml

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.113.194.132, 184.28.90.27, 199.232.210.172, 52.109.76.243, 2.19.126.160, 2.19.126.151, 20.189.173.4, 93.184.221.240, 142.250.185.163, 172.217.16.142, 142.251.173.84, 34.104.35.123
Excluded domains from analysis (whitelisted): omex.cdn.office.net, slscr.update.microsoft.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, eur.roaming1.live.com.akadns.net, neu-azsc-000.roaming.officeapps.live.com, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, onedscolprdwus03.westus.cloudapp.azure.com, clients2.google.com, login.live.com, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, a1864.dscd.akamai.net, www.bing.com, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, accounts.google.com, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, s-0005.s-msedge.net, osiprod-neu-buff-azsc-000.northeurope.cloudapp.azure.com, ecs.office.trafficmanager.net, clients.l.google.com, omex.cdn.office.net.akamaized.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: [EXTERNAL] Re_ Quotes.eml

Input	Output
URL: Model: claude-3-5-sonnet-20240620	{ "explanation": [ "The email claims to have a 'request file' that requires login with email credentials, which is a common phishing tactic.", "The email contains multiple links, some of which are obfuscated, potentially leading to malicious websites.", "The sender's email address appears to be spoofed, as the same person (Daniel Nicholson) is both sending and receiving the email in the thread." ], "phishing": true, "confidence": 9 }
Is this email content a phishing attempt? Please respond only in valid JSON format: Email content converted to JSON: { "date": "Tue, 22 Oct 2024 11:23:47 +0000", "subject": "[EXTERNAL] Re: Quotes", "communications": [ "The request file is from me and legitimate, it has been secured to your email address, Kindly login with your email credentials to view.\n\n _____\n\n", "From: Sharon Main <sharon.main@whistl.co.uk>\nSent: Tuesday, October 22, 2024 12:23 PM\nTo: Daniel Nicholson <DNicholson@citipost.co.uk>\nSubject: RE: Quotes\n\n Warning: External email\n\n\nWrong sharon?\n\n\n\n\n\nKind Regards,\n\nSharon Main\n\nSales Director\n\n\nNetwork House, Third Avenue, Marlow, Buckinghamshire, SL7 1EY\nPhone: 07900 166194 / Email: sharon.main@whistl.co.uk<mailto:sharon.main@whistl.co.uk>\nwww.whistl.co.uk<https://url.uk.m.mimecastprotect.com/s/rS3GCXLO9cGn7LYCVh6FWJ9uL?domain=whistl.co.uk/>\n\n\n\n\n\nWhistl Groups Customer Satisfaction Score\n\n\n\nRead about our 2024 customer survey results<https://url.uk.m.mimecastprotect.com/s/P5e4CYWP9Ug3oyxU9iGFxYVR2?domain=whistl.co.uk>\n\n\n\n\n\n\n\n", "From: Daniel Nicholson <DNicholson@citipost.co.uk>\nSent: 22 October 2024 12:21\nTo: Daniel Nicholson <DNicholson@citipost.co.uk>\nSubject: [EXTERNAL] Quotes\nImportance: High\n\n\n\n<https://url.uk.m.mimecastprotect.com/s/ZlrZCZYQ9UxMnWNsysRFBA-ZP?domain=hnamedmr.ukremediatlon.co.uk>\n\n\n\nHi,\n\n\n\nPlease see attached and revert to me.\n\n\n\nBest Regards\n\nDaniel Nicholson\n\nBusiness Development Manager\n\n\n\n<https://url.uk.m.mimecastprotect.com/s/lBBfC1WAvUOpwQYUYtmFVP1nh?domain=linkedin.com>\n\n\n\nmobile: +44 (0)7790 801 401\n\nemail: Dnicholson@citipost.co.uk<mailto:Dnicholson@citipost.co.uk>\n\nweb: citipostmail.co.uk <https://url.uk.m.mimecastprotect.com/s/1k4bC2xBwh6koDwiMu6F5BKCc?domain=urldefense.proofpoint.com>\n\n<https://url.uk.m.mimecastprotect.com/s/0c3qC3QDxSxmYrQsYCOFQ4SPB?domain=citipostmail.co.uk/>\n\n\n<https://url.uk.m.mimecastprotect.com/s/cIB8C4Q0yS6JAw1iNFEF4GZlf?domain=urldefense.proofpoint.com>\n\n\nCitipost Mail\nUnit 3, Swanwick Court, Swanwick, Alfreton, Derbyshire, DE55 7AS, United Kingdom\n\n\n\nThe information contained in this email is the property of Citipost Mail and may contain information which is legally privileged, confidential and exempt from disclosure.\n\nIf you are not the intended recipient, you are hereby notified that any disclosure, dissemination, or copying of this communication and its attachments is strictly prohibited.\n\nIf you have received this communication in error, please email it@citipost.co.uk<mailto:it@citipost.co.uk>\n\nCitipost Mail is a trading name of Citipost Ltd.\n\nCitipost Ltd. Registered in England and Wales No: 3451070. VAT No: 709 9236 10\n\n\n\n\n\n\n\n" ], "from": "Daniel Nicholson <DNicholson@citipost.co.uk>", "to": "Sharon Main <sharon.main@whistl.co.uk>" }
URL: Email Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "HAVE YOU CLAIMED YOUR FREE ADDRESS DATA HEALTH CHECK?", "prominent_button_name": "Click here", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: https://security-uk.m.mimecastprotect.com/ttpwp/#/ua?key=YHCH0jK4xsNRMGObU0ehDxT0fg3jXsga1nzcx-4fokPB1Xd4nzhmP6PAOTq_52_c9hx____uGeArAE7NPLh9tr4j9XByPup4XVZ61RaDPROs8aoUE601fyVV1A9ypfpB Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Targeted Threat Protection", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://security-uk.m.mimecastprotect.com/ttpwp/#/ua?key=YHCH0jK4xsNRMGObU0ehDxT0fg3jXsga1nzcx-4fokPB1Xd4nzhmP6PAOTq_52_c9hx____uGeArAE7NPLh9tr4j9XByPup4XVZ61RaDPROs8aoUE601fyVV1A9ypfpB Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Do you think the link is safe?", "prominent_button_name": "It's Safe", "text_input_field_labels": [ "Email Address" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://www.example.com/ Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "This domain is for use in illustrative examples in documents. You may use this domain in literature without prior coordination or asking for permission.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: Email Model: claude-3-haiku-20240307	```json { "brands": [ "Whistl" ] }
	```json { "brands": [ "Whistl" ] }
URL: https://security-uk.m.mimecastprotect.com/ttpwp/#/ua?key=YHCH0jK4xsNRMGObU0ehDxT0fg3jXsga1nzcx-4fokPB1Xd4nzhmP6PAOTq_52_c9hx____uGeArAE7NPLh9tr4j9XByPup4XVZ61RaDPROs8aoUE601fyVV1A9ypfpB Model: claude-3-haiku-20240307	```json { "brands": [ "mimecast" ] }
	```json { "brands": [ "mimecast" ] }
URL: https://security-uk.m.mimecastprotect.com/ttpwp/#/ua?key=YHCH0jK4xsNRMGObU0ehDxT0fg3jXsga1nzcx-4fokPB1Xd4nzhmP6PAOTq_52_c9hx____uGeArAE7NPLh9tr4j9XByPup4XVZ61RaDPROs8aoUE601fyVV1A9ypfpB Model: claude-3-haiku-20240307	```json { "brands": [ "mimecast" ] }
	```json { "brands": [ "mimecast" ] }
URL: https://www.example.com/ Model: claude-3-haiku-20240307	```json { "brands": [ "Example Domain" ] }
	```json { "brands": [ "Example Domain" ] }
URL: https://security-uk.m.mimecastprotect.com/ttpwp/#/ua?key=YHCH0jK4xsNRMGObU0ehDxT0fg3jXsga1nzcx-4fokPB1Xd4nzhmP6PAOTq_52_c9hx____uGeArAE7NPLh9tr4j9XByPup4XVZ61RaDPROs8aoUE601fyVV1A9ypfpB Model: gpt-4o	```json{ "legit_domain": "mimecast.com", "classification": "known", "reasons": [ "The brand 'mimecast' is known and associated with email security services.", "The URL 'security-uk.m.mimecastprotect.com' includes 'mimecastprotect.com', which is a legitimate domain used by Mimecast for security services.", "The subdomain 'security-uk.m' is likely used for regional or specific service purposes, which is common in legitimate service structures.", "The domain 'mimecastprotect.com' is directly related to Mimecast's security offerings, indicating a legitimate association." ], "riskscore": 2}
URL: security-uk.m.mimecastprotect.com Brands: mimecast Input Fields: Email Address

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
91.220.42.63	https://url.uk.m.mimecastprotect.com/s/NP8rC2xx9FAQq7nsn7CnD?domain=netorg5340145-my.sharepoint.com	Get hash	malicious	HTMLPhisher	Browse
	https://protect-eu.mimecast.com/s/-GACC717RFQ0oZ2S8mLiz?domain=docs.google.com	Get hash	malicious	HTMLPhisher	Browse
	https://protect-eu.mimecast.com/s/msYsCPZNRfgALou0ZlkF?domain=proinvestor.com	Get hash	malicious	Unknown	Browse
	https://protect-eu.mimecast.com/s/T6pRC8qvns8pVlhne8Fl?domain=pba.ph	Get hash	malicious	HTMLPhisher	Browse
	https://protect-eu.mimecast.com/s/QRMRCwjYriV0OjBIV2JJl?domain=apiservices.krxd.net	Get hash	malicious	HTMLPhisher	Browse
	https://protect-eu.mimecast.com/s/W40fClOzqi1KwPRfGCiZ6?domain=forward.llink.to	Get hash	malicious	HTMLPhisher	Browse
	https://protect-eu.mimecast.com/s/oDuyC98x5UZMZpNUoHD9D?domain=9490w89439238945823983298.azurefd.net	Get hash	malicious	HTMLPhisher	Browse
239.255.255.250	https://apeidieppe-d.basiic.net/yKKWd	Get hash	malicious	HTMLPhisher	Browse
	https://email.mail.customfeedback.com/c/eJyUkD-P1TAQxD9N3J2VXXuduHDxDpEGiQpE7T_rS_QS-8kxF45Pjw5EQ0c7oxnNb6I_Hn57KZ_4zSlEg2SizkA0WtbGjsF6M4G2SGHChMFrYhFr6T729wz6NOfRayKLZCipOVACmgA4mEwhEHnFbEVykCcMs2AHE1oCrQBF3trZP_uD3a0kbmctItd2-Za-cVhrvX9tu1t7f5yDug24DLj0WvdThra9rH2v0e8y1mPA5eT69NsbcPHp2MqAy1-6d-36U_j0imJ1SUcVQFkMMSitNMCkxpR4jhBtVFpsDkfUMCIAqlmhBPnxtujnDzdSSPoZLA16PPy2y_j97PXIzCn4eH9fI-7_88y_gHkrvkTeSq7yJyh5cZCxNpbXVlK9Tlm4D7iIw01GkxoBxKPVH29f6p2Lm2adApjs7az0FDRE8Hkeo9ETc4qzNqPxRFk0F9e2nb0-Vm7S77svgx7bo1XZOa7i1eGvAAAA__9cb6ca	Get hash	malicious	Unknown	Browse
	top_25_domains.xls	Get hash	malicious	Unknown	Browse
	https://link.edgepilot.com/s/a87a8c67/R8ziiM5L9EqrFhZqAjyPWg?u=https://debbydollar.com/	Get hash	malicious	Unknown	Browse
	https://docs.google.com/uc?export=download&id=11b8oashSjmYX6PpCmq4Ua9vnLHY-uAgU	Get hash	malicious	HTMLPhisher	Browse
	https://1drv.ms/o/c/14c2aef4e2cd9199/EmKMpCkEfbpDs04MuZdva6IBilCqbzQYZtfiLbdaioNL0w?e=E2gYSO	Get hash	malicious	Unknown	Browse
	Rechnung 22. Okt. 2024.htm	Get hash	malicious	HTMLPhisher	Browse
	https://eu-chervongroup.powerappsportalsecurefiles.xyz/	Get hash	malicious	HtmlDropper	Browse
	https://eu-chervongroup.powerappsportalsecurefiles.xyz/	Get hash	malicious	HtmlDropper	Browse
	https://mycarcheck.pro/#J0X7tElnKo7fC5yZemnMyORwbiKKMCJA	Get hash	malicious	Unknown	Browse
93.184.215.14	RFQ NEW ORDER.exe	Get hash	malicious	Unknown	Browse	example.com/RFQ_NEW_ORDER_Bmesanyd.png
	myprogram.exe	Get hash	malicious	Discord Token Stealer	Browse	example.com/
	myprogram.exe	Get hash	malicious	Discord Token Stealer	Browse	example.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
url.uk.m.mimecastprotect.com	https://url.uk.m.mimecastprotect.com/s/879wCp9pjInpwnDHPf7CG_Zsy?domain=aerographicsut-my.sharepoint.com	Get hash	malicious	HTMLPhisher	Browse	195.130.217.180
	https://url.uk.m.mimecastprotect.com/s/r06pCLv4mSmE7ORSBfNCyUvN-?domain=clicktracking.yellowbook.com/	Get hash	malicious	Unknown	Browse	195.130.217.187
	https://url.uk.m.mimecastprotect.com/s/mPYbC6R8kf47GAUxtNC5T-0g?domain=tplshare.com	Get hash	malicious	HTMLPhisher	Browse	195.130.217.180
	Documents_27-08.html	Get hash	malicious	HTMLPhisher	Browse	195.130.217.180
	https://url.uk.m.mimecastprotect.com/s/P4YvCp88zsEr4xMcPfwuGVGsq?domain=file365-cloud.s3.eu-west-2.amazonaws.com	Get hash	malicious	HTMLPhisher	Browse	91.220.42.215
	http://url.uk.m.mimecastprotect.com/s/Qb9MCZ4z4h5VrB0KizfxuBiFFP	Get hash	malicious	Unknown	Browse	91.220.42.235
	https://url.uk.m.mimecastprotect.com/s/KmJpCzK8Xiv1VmXPt4fKtv1nCx?domain=nasunifiles.s3.amazonaws.com	Get hash	malicious	Unknown	Browse	91.220.42.235
	https://url.uk.m.mimecastprotect.com/s/Iy05Cqj0qfK8z0cZXpRJ?domain=expertindus-my.sharepoint.com	Get hash	malicious	HTMLPhisher	Browse	195.130.217.180
	https://url.uk.m.mimecastprotect.com/s/kjICCMw0ptMOvmDHwXbDO?domain=kirkleesstadium-my.sharepoint.com	Get hash	malicious	HTMLPhisher	Browse	195.130.217.73
	https://url.uk.m.mimecastprotect.com/s/rO3rCG6qJSA66X7FKCV6f?domain=nam.dcv.ms	Get hash	malicious	HTMLPhisher	Browse	195.130.217.187
security-uk.m.mimecastprotect.com	https://url.uk.m.mimecastprotect.com/s/r06pCLv4mSmE7ORSBfNCyUvN-?domain=clicktracking.yellowbook.com/	Get hash	malicious	Unknown	Browse	91.220.42.88
	https://url.uk.m.mimecastprotect.com/s/P4YvCp88zsEr4xMcPfwuGVGsq?domain=file365-cloud.s3.eu-west-2.amazonaws.com	Get hash	malicious	HTMLPhisher	Browse	91.220.42.88
	https://url.uk.m.mimecastprotect.com/s/KmJpCzK8Xiv1VmXPt4fKtv1nCx?domain=nasunifiles.s3.amazonaws.com	Get hash	malicious	Unknown	Browse	91.220.42.88
www.example.com	https://or4t.iednationusa.com/sYyRdjOU	Get hash	malicious	Unknown	Browse	93.184.215.14
	https://aboriginal-investment-proposal.squarespace.com/	Get hash	malicious	Unknown	Browse	93.184.215.14
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.hfdzwq?v=frudxdxlqwif.htrd.iwtlt___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzoxZWJhNTM5MDhjODJhZTYyM2M5MDM3ZjkwZTI3ZjliZjo3OmUzYTI6MjUxYmEwYmY4MzRlNGZkNWNiNzBlNGJiNmNiNGQwZTMxZDYzMWE0ZGZkZmVmYWQ0MmJkNGQxNGZjNzZiYzQ0MTpoOlQ6VA#am9uYXRoYW5fbW9vcmVAdHJla2Jpa2VzLmNvbQ==	Get hash	malicious	Unknown	Browse	93.184.215.14
	https://url.avanan.click/v2/r01/___https:/www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.hfdzwq?v=frudxdxlqwif.htrd.iwtlt___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzoxZWJhNTM5MDhjODJhZTYyM2M5MDM3ZjkwZTI3ZjliZjo3OmUzYTI6MjUxYmEwYmY4MzRlNGZkNWNiNzBlNGJiNmNiNGQwZTMxZDYzMWE0ZGZkZmVmYWQ0MmJkNGQxNGZjNzZiYzQ0MTpoOlQ6VA#ZWxraW5AY29yZTRjZS5jb20=	Get hash	malicious	Unknown	Browse	93.184.215.14
	https://url.us.m.mimecastprotect.com/s/8I0_CKrkVEt48y6BzfMfWF5hBIN?domain=woems-my.sharepoint.com	Get hash	malicious	Unknown	Browse	93.184.215.14
	https://k7qo.sarnerholz.cam/APRjVfmk	Get hash	malicious	Unknown	Browse	93.184.215.14
	https://k7qo.sarnerholz.cam/APRjVfmk	Get hash	malicious	Unknown	Browse	93.184.215.14
	https://www.google.com/url?q=https://www.google.com/url?q%3Dhttps%253A%252F%252Fugywf.horizoncartage.org%252FgqRGCVGh%26sa%3DD%26sntz%3D1%26usg%3DAOvVaw2Z7v-6O_xTbJQSFoc9J9PV&source=gmail&ust=1725723031029000&usg=AOvVaw09oRdOGZFWttGyZ90i-dZj	Get hash	malicious	Unknown	Browse	93.184.215.14
	https://www.google.com/url?q=https://www.google.com/url?q%3Dhttps%253A%252F%252Fhjghg.celticmotorbike.com%252FXmygyJjZ%26sa%3DD%26sntz%3D1%26usg%3DAOvVaw1PeXj2cY0-7trjVBFTj75r&source=gmail&ust=1724433107497000&usg=AOvVaw0zwdA8-Sh37pGkwtWa8Cvc	Get hash	malicious	Unknown	Browse	93.184.215.14
	https://vagvn.remmipyservice.org/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=7f545595-f5d6-deb9-f7f9-d2b50e22cac0&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638594191528303546.52bdeb30-750b-42d2-83a1-0b37c2fd3e58&state=DctBFoAgCABRrNdxSARJPI6kbVt2_Vj82U0CgD1sIVEE2iWmvZZelE1ItF6nss_lQtiUHCtPRpNRkFzazc-UpZbiPfL7jfwD&sso_reload=tru	Get hash	malicious	HTMLPhisher	Browse	93.184.215.14

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
EDGECASTUS	https://apeidieppe-d.basiic.net/yKKWd	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://link.edgepilot.com/s/a87a8c67/R8ziiM5L9EqrFhZqAjyPWg?u=https://debbydollar.com/	Get hash	malicious	Unknown	Browse	192.229.221.25
	Message_2533705.eml	Get hash	malicious	Unknown	Browse	93.184.221.240
	vs_BuildTools.zip	Get hash	malicious	Unknown	Browse	152.199.19.161
	https://1drv.ms/o/c/14c2aef4e2cd9199/EmKMpCkEfbpDs04MuZdva6IBilCqbzQYZtfiLbdaioNL0w?e=E2gYSO	Get hash	malicious	Unknown	Browse	152.199.19.160
	https://downloads.madcapsoftware.com/mimic080-dgwe4/SetupMadCapMimic0820.exe	Get hash	malicious	Unknown	Browse	192.229.221.121
	Rechnung 22. Okt. 2024.htm	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	MDE_File_Sample_1a8e4ebbcc2e3f76efb2a55bb6179417263ebf3d.zip	Get hash	malicious	Unknown	Browse	152.195.19.97
	Salary_Increase_Approval_Open_Enrollment_202417918.pdf	Get hash	malicious	Unknown	Browse	152.199.21.175
	RemitReports_DD6612_ACH_Nexa1_6465046311.html	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
MIMECAST-UKGB	https://url.uk.m.mimecastprotect.com/s/879wCp9pjInpwnDHPf7CG_Zsy?domain=aerographicsut-my.sharepoint.com	Get hash	malicious	HTMLPhisher	Browse	195.130.217.180
	https://url.uk.m.mimecastprotect.com/s/r06pCLv4mSmE7ORSBfNCyUvN-?domain=clicktracking.yellowbook.com/	Get hash	malicious	Unknown	Browse	195.130.217.187
	https://url.uk.m.mimecastprotect.com/s/mPYbC6R8kf47GAUxtNC5T-0g?domain=tplshare.com	Get hash	malicious	HTMLPhisher	Browse	195.130.217.180
	Documents_27-08.html	Get hash	malicious	HTMLPhisher	Browse	195.130.217.180
	https://url.uk.m.mimecastprotect.com/s/P4YvCp88zsEr4xMcPfwuGVGsq?domain=file365-cloud.s3.eu-west-2.amazonaws.com	Get hash	malicious	HTMLPhisher	Browse	91.220.42.88
	http://url.uk.m.mimecastprotect.com/s/Qb9MCZ4z4h5VrB0KizfxuBiFFP	Get hash	malicious	Unknown	Browse	195.130.217.73
	https://url.uk.m.mimecastprotect.com/s/KmJpCzK8Xiv1VmXPt4fKtv1nCx?domain=nasunifiles.s3.amazonaws.com	Get hash	malicious	Unknown	Browse	91.220.42.235
	appdrivesound.exe	Get hash	malicious	SystemBC	Browse	91.220.42.201
	https://url.uk.m.mimecastprotect.com/s/Iy05Cqj0qfK8z0cZXpRJ?domain=expertindus-my.sharepoint.com	Get hash	malicious	HTMLPhisher	Browse	195.130.217.180
	https://login-uk.mimecast.com/auth/api/tracking/get-file/eNpNkF1v0zAYhf-LrxvwZ-xU2gUUhNR0ILQsdAgpcvyRpImTLnZaVYj_jrtughtfvDo6z-PzG3ijltl0GqxB0ebfQqY3m4L9KNxz3p5z9bS9z4tLGj6VXpivj59pyQ73nj9Podl935JS_txuHWbL0u_nvpgeHvscnXf7Xuz7dley4XIU8ks-isNQNge44I-4x5ie78AKuAmsrRy8WYHZKoGxD0tdg_W4DMMKyBCkap0Zg5xV251MmHozRsu6WnqIKkxJddLxTUSFIaaQx6PmihomKDFIWko0R0TojFrCsawhUlJCS4jgxAorLYEpzqjGGaK15oxBEa3s6CKkc7IxEKJ3x7G5qhrv4-EhyLD44nI0MfKqpcH_rrYbbluiFyMWKyChEGYoxtTiw-TMrCZ9Ldjw9ANG_Mp04Y356_2NeDKz76b4X7R6I730NpVKzG0BwuMAhCdp9dr0bwcaE8HMjiVRIMlSgSkTDEHw5y8rIpkc?sid=ZIqt9Yqzd1NM0OToaRukcAeyJlbmMiOiJBMTI4R0NNIiwiYWxnIjoiUEJFUzItSFMyNTYrQTEyOEtXIiwia2lkIjoiYm82bmJ3eGppMlpWZW1kTTVhZGg0QWRKZ3E0b3o3MTViUjViYTJTd1ZOZyIsInAycyI6IlN4TjZKZHdaLWFfeGFaLVZ1aGhKaWciLCJwMmMiOjgxOTJ9.xlPWXtGkR9n4zmeqgmxfBUk8j1XjGJbi.CaO4Ww30O6c8aZ0o.NMpwE_Dru6LmfT1n1WMYSoAn2F6FJVcFQh74VGSveSlJ2SO_c4s71ep98MoNTHJ2Pp41wJ4GA5VfEfXvNDLz8J69lG3pLZYHulnx_8GbfO4R-pSUNU5_6QsEOhPKa1rINV6Kuo8R9sA3SAPA8G7VYUD7s6-4Rn-cZMn6dfYw0GgZVKa586Z2C6FpilYS9fCkBNU5pBjn8b4n8St3G1XzmW4s1-Evtfr6M1FUxIAyVCBkNiQlz1-v9TC9P4mOHmFjgKYhDHoIAA12A9Q.PVn7CwJ1mBldhCNpn_9iPg&x-context-route=administration&fdl=1	Get hash	malicious	Unknown	Browse	91.220.42.237
MIMECAST-UKGB	https://url.uk.m.mimecastprotect.com/s/879wCp9pjInpwnDHPf7CG_Zsy?domain=aerographicsut-my.sharepoint.com	Get hash	malicious	HTMLPhisher	Browse	195.130.217.180
	https://url.uk.m.mimecastprotect.com/s/r06pCLv4mSmE7ORSBfNCyUvN-?domain=clicktracking.yellowbook.com/	Get hash	malicious	Unknown	Browse	195.130.217.187
	https://url.uk.m.mimecastprotect.com/s/mPYbC6R8kf47GAUxtNC5T-0g?domain=tplshare.com	Get hash	malicious	HTMLPhisher	Browse	195.130.217.180
	Documents_27-08.html	Get hash	malicious	HTMLPhisher	Browse	195.130.217.180
	https://url.uk.m.mimecastprotect.com/s/P4YvCp88zsEr4xMcPfwuGVGsq?domain=file365-cloud.s3.eu-west-2.amazonaws.com	Get hash	malicious	HTMLPhisher	Browse	91.220.42.88
	http://url.uk.m.mimecastprotect.com/s/Qb9MCZ4z4h5VrB0KizfxuBiFFP	Get hash	malicious	Unknown	Browse	195.130.217.73
	https://url.uk.m.mimecastprotect.com/s/KmJpCzK8Xiv1VmXPt4fKtv1nCx?domain=nasunifiles.s3.amazonaws.com	Get hash	malicious	Unknown	Browse	91.220.42.235
	appdrivesound.exe	Get hash	malicious	SystemBC	Browse	91.220.42.201
	https://url.uk.m.mimecastprotect.com/s/Iy05Cqj0qfK8z0cZXpRJ?domain=expertindus-my.sharepoint.com	Get hash	malicious	HTMLPhisher	Browse	195.130.217.180
	https://login-uk.mimecast.com/auth/api/tracking/get-file/eNpNkF1v0zAYhf-LrxvwZ-xU2gUUhNR0ILQsdAgpcvyRpImTLnZaVYj_jrtughtfvDo6z-PzG3ijltl0GqxB0ebfQqY3m4L9KNxz3p5z9bS9z4tLGj6VXpivj59pyQ73nj9Podl935JS_txuHWbL0u_nvpgeHvscnXf7Xuz7dley4XIU8ks-isNQNge44I-4x5ie78AKuAmsrRy8WYHZKoGxD0tdg_W4DMMKyBCkap0Zg5xV251MmHozRsu6WnqIKkxJddLxTUSFIaaQx6PmihomKDFIWko0R0TojFrCsawhUlJCS4jgxAorLYEpzqjGGaK15oxBEa3s6CKkc7IxEKJ3x7G5qhrv4-EhyLD44nI0MfKqpcH_rrYbbluiFyMWKyChEGYoxtTiw-TMrCZ9Ldjw9ANG_Mp04Y356_2NeDKz76b4X7R6I730NpVKzG0BwuMAhCdp9dr0bwcaE8HMjiVRIMlSgSkTDEHw5y8rIpkc?sid=ZIqt9Yqzd1NM0OToaRukcAeyJlbmMiOiJBMTI4R0NNIiwiYWxnIjoiUEJFUzItSFMyNTYrQTEyOEtXIiwia2lkIjoiYm82bmJ3eGppMlpWZW1kTTVhZGg0QWRKZ3E0b3o3MTViUjViYTJTd1ZOZyIsInAycyI6IlN4TjZKZHdaLWFfeGFaLVZ1aGhKaWciLCJwMmMiOjgxOTJ9.xlPWXtGkR9n4zmeqgmxfBUk8j1XjGJbi.CaO4Ww30O6c8aZ0o.NMpwE_Dru6LmfT1n1WMYSoAn2F6FJVcFQh74VGSveSlJ2SO_c4s71ep98MoNTHJ2Pp41wJ4GA5VfEfXvNDLz8J69lG3pLZYHulnx_8GbfO4R-pSUNU5_6QsEOhPKa1rINV6Kuo8R9sA3SAPA8G7VYUD7s6-4Rn-cZMn6dfYw0GgZVKa586Z2C6FpilYS9fCkBNU5pBjn8b4n8St3G1XzmW4s1-Evtfr6M1FUxIAyVCBkNiQlz1-v9TC9P4mOHmFjgKYhDHoIAA12A9Q.PVn7CwJ1mBldhCNpn_9iPg&x-context-route=administration&fdl=1	Get hash	malicious	Unknown	Browse	91.220.42.237
CLOUDFLARENETUS	https://apeidieppe-d.basiic.net/yKKWd	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Rundholterne89.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	BA4M310209H14956.xls	Get hash	malicious	Remcos	Browse	188.114.96.3
	https://email.mail.customfeedback.com/c/eJyUkD-P1TAQxD9N3J2VXXuduHDxDpEGiQpE7T_rS_QS-8kxF45Pjw5EQ0c7oxnNb6I_Hn57KZ_4zSlEg2SizkA0WtbGjsF6M4G2SGHChMFrYhFr6T729wz6NOfRayKLZCipOVACmgA4mEwhEHnFbEVykCcMs2AHE1oCrQBF3trZP_uD3a0kbmctItd2-Za-cVhrvX9tu1t7f5yDug24DLj0WvdThra9rH2v0e8y1mPA5eT69NsbcPHp2MqAy1-6d-36U_j0imJ1SUcVQFkMMSitNMCkxpR4jhBtVFpsDkfUMCIAqlmhBPnxtujnDzdSSPoZLA16PPy2y_j97PXIzCn4eH9fI-7_88y_gHkrvkTeSq7yJyh5cZCxNpbXVlK9Tlm4D7iIw01GkxoBxKPVH29f6p2Lm2adApjs7az0FDRE8Hkeo9ETc4qzNqPxRFk0F9e2nb0-Vm7S77svgx7bo1XZOa7i1eGvAAAA__9cb6ca	Get hash	malicious	Unknown	Browse	104.16.20.118
	BL Packing List & Invoice.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	ProformaInvoice.xls	Get hash	malicious	PureLog Stealer	Browse	188.114.96.3
	SecuriteInfo.com.BackDoor.AgentTeslaNET.20.5206.2075.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Swift Detail 103.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	https://link.edgepilot.com/s/a87a8c67/R8ziiM5L9EqrFhZqAjyPWg?u=https://debbydollar.com/	Get hash	malicious	Unknown	Browse	104.18.11.207
	FACTURA-ALBARANES.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://apeidieppe-d.basiic.net/yKKWd	Get hash	malicious	HTMLPhisher	Browse	172.202.163.200 20.109.210.53 40.126.32.138
	https://email.mail.customfeedback.com/c/eJyUkD-P1TAQxD9N3J2VXXuduHDxDpEGiQpE7T_rS_QS-8kxF45Pjw5EQ0c7oxnNb6I_Hn57KZ_4zSlEg2SizkA0WtbGjsF6M4G2SGHChMFrYhFr6T729wz6NOfRayKLZCipOVACmgA4mEwhEHnFbEVykCcMs2AHE1oCrQBF3trZP_uD3a0kbmctItd2-Za-cVhrvX9tu1t7f5yDug24DLj0WvdThra9rH2v0e8y1mPA5eT69NsbcPHp2MqAy1-6d-36U_j0imJ1SUcVQFkMMSitNMCkxpR4jhBtVFpsDkfUMCIAqlmhBPnxtujnDzdSSPoZLA16PPy2y_j97PXIzCn4eH9fI-7_88y_gHkrvkTeSq7yJyh5cZCxNpbXVlK9Tlm4D7iIw01GkxoBxKPVH29f6p2Lm2adApjs7az0FDRE8Hkeo9ETc4qzNqPxRFk0F9e2nb0-Vm7S77svgx7bo1XZOa7i1eGvAAAA__9cb6ca	Get hash	malicious	Unknown	Browse	172.202.163.200 20.109.210.53 40.126.32.138
	https://link.edgepilot.com/s/a87a8c67/R8ziiM5L9EqrFhZqAjyPWg?u=https://debbydollar.com/	Get hash	malicious	Unknown	Browse	172.202.163.200 20.109.210.53 40.126.32.138
	https://docs.google.com/uc?export=download&id=11b8oashSjmYX6PpCmq4Ua9vnLHY-uAgU	Get hash	malicious	HTMLPhisher	Browse	172.202.163.200 20.109.210.53 40.126.32.138
	PPM435679.xls	Get hash	malicious	Unknown	Browse	172.202.163.200 20.109.210.53 40.126.32.138
	Rechnung 22. Okt. 2024.htm	Get hash	malicious	HTMLPhisher	Browse	172.202.163.200 20.109.210.53 40.126.32.138
	https://eu-chervongroup.powerappsportalsecurefiles.xyz/	Get hash	malicious	HtmlDropper	Browse	172.202.163.200 20.109.210.53 40.126.32.138
	https://mycarcheck.pro/#J0X7tElnKo7fC5yZemnMyORwbiKKMCJA	Get hash	malicious	Unknown	Browse	172.202.163.200 20.109.210.53 40.126.32.138
	https://sites.google.com/view/hffgshfgsqfgsqf/home	Get hash	malicious	Unknown	Browse	172.202.163.200 20.109.210.53 40.126.32.138
	https://u.to/YaL0IA	Get hash	malicious	Unknown	Browse	172.202.163.200 20.109.210.53 40.126.32.138
6271f898ce5be7dd52b0fc260d0662b3	Document.xla.xlsx	Get hash	malicious	Unknown	Browse	2.23.209.140
	PPM435679.xls	Get hash	malicious	Unknown	Browse	2.23.209.140
	Purchase order.xls	Get hash	malicious	Unknown	Browse	2.23.209.140
	Payment Advice080.xls	Get hash	malicious	Unknown	Browse	2.23.209.140
	(No subject) (90).eml	Get hash	malicious	Unknown	Browse	2.23.209.140
	Purchase order.xls	Get hash	malicious	Unknown	Browse	2.23.209.140
	(No subject) (89).eml	Get hash	malicious	HTMLPhisher	Browse	2.23.209.140
	Thermo Fisher RFQ_TFS-1702.xls	Get hash	malicious	Unknown	Browse	2.23.209.140
	PO-1021202416777 PNG2023-W111.xls	Get hash	malicious	Unknown	Browse	2.23.209.140
	Carboline Quote Request.eml	Get hash	malicious	HTMLPhisher	Browse	2.23.209.140

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.390720416594958
Encrypted:	false
SSDEEP:	3072:hagu5IgmmiGu2bqoQfrt0FvsntnkrN3V2:hSCmi2+xtnkrNU
MD5:	694EB65A5DDE0917E2E6EC1665E4CABE
SHA1:	F39F5EC9C9CB7A9A3040A4295EEBA22DC29BF9B1
SHA-256:	78B0EA1C824E1661DD53D8BCEC75CA858457BDA2E5484BDB9A4297CAF1132421
SHA-512:	77BD401DC3103CC838D5465189B1B3081A33E0E1C7D7DE0986544E275E230D74415A479A986995BF82CC6785D81F549F0A59523362B7FB9431F018A41AEBCA56
Malicious:	false
Reputation:	low
Preview:	TH02...... ..n&..$......SM01X...,........$..........IPM.Activity...........h...............h............H..h../.....iL.....h.........Zc.H..h\nor ...ppDa...h(~V.0..../....h.U!...g........h........_`.k...hMK!.@...I..w...h....H...8..k...0....T...............d.........2h...............k..............!h.............. hW5......../...#h....8.........$h.Zc.....8....."h.Wc......Xc...'h..H...........1h.U!.<.........0h....4....k../h....h......kH..h .g.p...../...-h .......,./...+h.U!......./......... ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators
Category:	dropped
Size (bytes):	1869
Entropy (8bit):	5.079720391745907
Encrypted:	false
SSDEEP:	48:cGfdSykdyrWdnzyrdnzyrinzydSybdy0JdyrJnzynASylkSy9dyO:XdbkE6d2h2G2dbbEeE12nAbCb9EO
MD5:	A4E7DF11C910A827BA716D9311D49115
SHA1:	79E6BD327A5370DA14BBE64E5243EDA6748151CF
SHA-256:	B6A6A57FC8DEE81E60FA2F25CA4402D4D79865AB9462C7E6918AA52116507BC8
SHA-512:	A6F813FFDAC2D442F716FF77675C9601F440F3DD3F940D8EBF3256C3FD7692AD581D918DAE8B9F88292A359910291A764E2F1838C2DD66C3019C0C513E438468
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>12</Count><Resource><Id>Aptos Narrow_26215424</Id><LAT>2023-10-06T10:24:51Z</LAT><key>31558910439.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos_45876480</Id><LAT>2023-10-06T10:24:51Z</LAT><key>27160079615.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215680</Id><LAT>2023-10-06T10:24:51Z</LAT><key>23001069669.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Display_45876482</Id><LAT>2023-10-06T10:24:51Z</LAT><key>29442803203.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Display_45876480</Id><LAT>2023-10-06T10:24:51Z</LAT><key>30264859306.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2023-10-06T10:24:51Z</LAT><key>24153076628.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Res

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	521377
Entropy (8bit):	4.9084889265453135
Encrypted:	false
SSDEEP:	3072:gdTb5Sb3F2FqSrfZm+CnQsbzxZO7aYb6f5780K2:wb5q3umBnzT
MD5:	C37972CBD8748E2CA6DA205839B16444
SHA1:	9834B46ACF560146DD7EE9086DB6019FBAC13B4E
SHA-256:	D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
SHA-512:	02B4D134F84122B6EE9A304D79745A003E71803C354FB01BAF986BD15E3BA57BA5EF167CC444ED67B9BA5964FF5922C50E2E92A8A09862059852ECD9CEF1A900
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{"MajorVersion":4,"MinorVersion":40,"Expiration":14,"Fonts":[{"a":[4294966911],"f":"Abadi","fam":[],"sf":[{"c":[1,0],"dn":"Abadi","fs":32696,"ful":[{"lcp":983041,"lsc":"Latn","ltx":"Abadi"}],"gn":"Abadi","id":"23643452060","p":[2,11,6,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":26215680},{"c":[1,0],"dn":"Abadi Extra Light","fs":22180,"ful":[{"lcp":983042,"lsc":"Latn","ltx":"Abadi Extra Light"}],"gn":"Abadi Extra Light","id":"17656736728","p":[2,11,2,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":13108480}]},{"a":[4294966911],"f":"ADLaM Display","fam":[],"sf":[{"c":[536870913,0],"dn":"ADLaM Display Regular","fs":140072,"ful":[{"lcp":983040,"lsc":"Latn","ltx":"ADLaM Display"}],"gn":"ADLaM Display","id":"31965479471","p":[2,1,0,0,0,0,0,0,0,0],"sub":[],"t":"ttf","u":[2147491951,1107296330,0,0],"v":131072,"w":26215680}]},{"a":[4294966911],"f":"Agency FB","fam":[],"sf":[{"c":[536870913,0],"dn":"Agency FB Bold","fs":54372,"ful":[{"lcp":9830

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365
Category:	modified
Size (bytes):	773040
Entropy (8bit):	6.55939673749297
Encrypted:	false
SSDEEP:	12288:Zn84XULLDs51UJQSOf9VvLXHyheIQ47gEFGHtAgk3+/cLQ/zhm1kjFKy6Nyjbqq+:N8XPDs5+ivOXgo1kYvyz2
MD5:	4296A064B917926682E7EED650D4A745
SHA1:	3953A6AA9100F652A6CA533C2E05895E52343718
SHA-256:	E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
SHA-512:	A25388DDCE58D9F06716C0F0BDF2AEFA7F68EBCA7171077533AF4A9BE99A08E3DCD8DFE1A278B7AA5DE65DA9F32501B4B0B0ECAB51F9AF0F12A3A8A75363FF2C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........... OS/29....(...`cmap.s.,.......pglyf..&....\|....head2..........6hheaE.@v.......$hmtx...........@loca.U.....8...Dmaxp........... name.P+........post...<...... .........b~1_.<...........<......r......Aa...................Q....Aa....Aa.........................~...................................................3..............................MS .@.......(...Q................. ...........d...........0...J.......8.......>..........+a..#...,................................................/...K.......z...............N.........!...-...+........z.......h..%^..3...&j..+...+%..'R..+..."....................k......$A...,.......g...&...=.......X..&..............&....B..(B...............#.......j...............+...P...5...@...)..........#...)Q..................{.. ....?..'...#....N...7......<...;>.............. ]...........5......#....s.......$.......$.......^..................+...>....H.......%...7.......6.......O...V...........K......"........c...N......!...............$...&...p..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	322260
Entropy (8bit):	4.000299760592446
Encrypted:	false
SSDEEP:	6144:dztCFLNyoAHq5Rv2SCtUTnRe4N2+A/3oKBL37GZbTSB+pMZIrh:HMLgvKz9CtgRemO3oUHi3SBSMZIl
MD5:	CC90D669144261B198DEAD45AA266572
SHA1:	EF164048A8BC8BD3A015CF63E78BDAC720071305
SHA-256:	89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
SHA-512:	16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.4464393446710155
Encrypted:	false
SSDEEP:	3:LMtUl:Rl
MD5:	4D141785C85437898BCD831C7A78F9E8
SHA1:	AE5D66EAAD1560FD75C1EB3D7A0EF82AAB282A62
SHA-256:	27FFC1EED21C086D66EE279F2D677B7DE34719EB070D1633F08EEE4F8EB2781A
SHA-512:	C1951F9ED87D3F65B302830878BD359A60D9F49EA6856DEEE009224C7D8011CEC5A2E38AB79707F2F0C1E238144DE96C4DBBE4758A3D12541B317CD6560EC9CC
Malicious:	false
Preview:	1729606191

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.09216609452072291
Encrypted:	false
SSDEEP:	3:lSWFN3l/klslpF/4llfll:l9F8E0/
MD5:	F138A66469C10D5761C6CBB36F2163C3
SHA1:	EEA136206474280549586923B7A4A3C6D5DB1E25
SHA-256:	C712D6C7A60F170A0C6C5EC768D962C58B1F59A2D417E98C7C528A037C427AB6
SHA-512:	9D25F943B6137DD2981EE75D57BAF3A9E0EE27EEA2DF19591D580F02EC8520D837B8E419A8B1EB7197614A3C6D8793C56EBC848C38295ADA23C31273DAA302D9
Malicious:	false
Preview:	SQLite format 3......@ .......................................................................... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.13760166725504608
Encrypted:	false
SSDEEP:	3:7FEG2l+4liH/FllkpMRgSWbNFl/sl+ltlslVlllfllsD:7+/lHliBg9bNFlEs1EP/cD
MD5:	DF3E1C48F2F8779D47254F159A2507AC
SHA1:	E506FD0D7941963E77436E977816C4C058AF35B7
SHA-256:	6EE36777F6D8BCFC1E7E70B39E8F870D970CF10446335391E271794734DE6336
SHA-512:	7E6520CD9682CA0FFAE2C8369C1B65B02CD0FF48F6BA5BDB5753EDD482D6C2926BE8D1B463978731BA612F57BD957695C1209B3B49B3DC1530D332886717E46C
Malicious:	false
Preview:	.... .c.....].......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04392419936121608
Encrypted:	false
SSDEEP:	3:G4l2WqdON4tl9ol/4l2WqdON4tll//8lL9//Xlvlll1lllwlvlllglbXdbllAlla:G4l2Xtnol/4l2Xt/EL9XXPH4l942U
MD5:	85B9DBB3299F1AB20ABA2F47AE367FE4
SHA1:	443C3D6EBB94F03BB6B5E4E53CE570F2E5472496
SHA-256:	0B04F0F3D9E03C330795690294EDCD4F3A077D57B61B5CC94013893AC55948B3
SHA-512:	09C5A7B614196E06C324884BC5CD656C007E0097CFD4990D4E48D81A5A972214FBAEE81AEC8242746CC64E15C84261EA9785AE71907AD8738EF57D78753E94BE
Malicious:	false
Preview:	..-.....................G.m8.#..uR2.s.c..i.w@....-.....................G.m8.#..uR2.s.c..i.w@..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	45352
Entropy (8bit):	0.3929852435362386
Encrypted:	false
SSDEEP:	24:Kz0liuhQ3zRDrUll7DBtDi4kZERDKcLzqt8VtbDBtDi4kZERD:DQuhQ1XUll7DYM5LzO8VFDYM
MD5:	A0600F463CB007BB9D3D8A2B0CC68024
SHA1:	69CCFE27E71BF1D346F686DCD3BDD5083E32734C
SHA-256:	845CFE137F2933CDD37424CD0927B2E226341CA99927359B569592DBD5E85E8F
SHA-512:	916226CC0A4755233C25311A6D7FBC2E1F84DB394F51B21A64BBA070244062C57B7DD0226F3F86CC2ED991CA5016B1450E383DC8653B3861EA1119548F38BCBF
Malicious:	false
Preview:	7....-...........uR2.s.c.9x."4..........uR2.s.c?..>...SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\2D84364F.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 118 x 59, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5033
Entropy (8bit):	7.942926975392912
Encrypted:	false
SSDEEP:	96:lZmN/Q9/I+HZJo4i1L9hLfOLUVAja53LMX03t:lk/Q9dHZJo4i1Jh7TkQ4k3t
MD5:	38629E893C14475FD8F8F1B5968DA691
SHA1:	2EDD960BFB94ABB4446CF380CC887B271EF29484
SHA-256:	8628128F7B3B5CD56AAAA4850F27D01C4D84E7BCAA447F80192936C0D8E640D1
SHA-512:	7E2529C584050C5BC5595A7C1FA929369703204BEDC29C4C808E4E3DCF1D813810357EF856E9E383EE46787C539DE6401E274290A22B25EC596267ADA1A54C42
Malicious:	false
Preview:	.PNG........IHDR...v...;......a~.....sRGB........bIDATx^....%G...?xp..[.@.....%..n......!Xp...........=......2..{..}.........K...J..$.Hr.$..9..\!...\|y..G.Vv`.....\|!..b?1s.'.[._%.D.......l$. ..I...I.y........g.O..I...[I.z..G.\|..J._LB1.NrX.s$.G...l.Y..9F..%.aQ..8.?....$....{..hU..\.......= .[...Q.C..1.IZK.k.M.L.$....9.}.......b.o.... ....mU... ..}4....:[._'...WI..w&.m...6.........U.....k.+...v.$".q....0X...$.../k...[Q1.L..I>.x......%..{.....A......'.e...._....q.....\..i.hv..D.r..4.?M...O..&..6..N~.b...$9.xjU...{.<...6..9vA..m..K(.iK.wH......B...'.e.@.5.....p...(..I..<X.<..X.E.....I^_...V~...c<2.J..z.3.......A...5..Y....^....<.o..m....Ea.....L...p.&.^7.Y....)3.49W....On~.l....;.'(Q.r?WA...$.,..F~.s+`.s.H.L8.....g%...Y.[./...U9..2.....q.755.=.\..`.b..L.u%'....m.?....+.<;.]...q...Q.+...}......6X.Q....U..T..*....$...x[.h...6.+.f....Y.....+&m0F.%.3E..'yZQ....e..~)....M.....?>4...^.X.xn3Xa[(.r...X....].q...!..f.....5%.Ms=..3...g.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\4B113C04.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 79 x 59, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11124
Entropy (8bit):	7.972163697376255
Encrypted:	false
SSDEEP:	192:vn405fkIecpEgg/0uluFxW2d5vQRR+4OUt2XQ/PkYNYbGbTSFwb1dGFaG+krZzp2:vn4HIec2uul0xu6TgPBa8OKZoh1p2
MD5:	3F29DA9B8210B72DA43E161A7CD535C9
SHA1:	9DFA87D09D85EC7409DCADA8439F9FEA8E05C858
SHA-256:	1B30B06247DF31C871E6E5AFFA33DEB80578A80F89121FCEA3BD48E7C69B39B8
SHA-512:	A77A24A22205E9144ACD290DB1DD42551DC387339DF97AA3907E13A83B198843EA05C1340AE3B7944396F5F9FC9DA30288836C033D5FADBA2769CB2D8B171AE7
Malicious:	false
Preview:	.PNG........IHDR...O...;.....:..Q....sRGB....... .IDATx^.\|.....WU..tOV.Q.E.P..d.$...gv1>.$.,.A...y>.9.=/.$P.I.!.H.#PBY#.&.sWw...)!...W:}:L.{.....R.>...d.b...#..;Td2:4..d2.`0.T.T......T.D".X,....f.AUU..i...EQ.....2..x.w.K.u.n...%.p8lp...4M........'.Ix.^.g,...WA~!T.h4.dR....Ng`p.v....d...TMA:.D2....;\H&8/....(..:.....B.H..>..m..(;S..t.{.....8.H..t...J.0.N\..f....$b.$.v..^...r.'j..q...H.&.&.@&c .....;..=.$.D"! .l.h-......p@O...`.C......6 .......2..K........y......3.'b............(}...+.v_x.C..I..Y.....z2#..\.....I...AY.p8...>a..~........~?.....{e2.f..\..~.~.p........O....!.2.....TM.....k.j>G...0.P.23c...y.......,...!..#....uc..p{....WP6....k..zeU....b...S..:.j......F...jCSS#ZZZ.....D.0.d.YC..-.. ......PP...3....._yyy...<....d,p............M.....2i.F&-..(......RU..;.........E..jC..[\LeR"...QE#q.}.b..q....T..z..<..q.d... ...P. .N .LAO......*..+C(4p^Oq.]]]....1....@x....'.......";'.#G.@II.F..!@Y..'`..,.N....c..FCG.....f.....Et..+......d8.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\57E1933D.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 2811 x 214, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	23681
Entropy (8bit):	7.9235092337394235
Encrypted:	false
SSDEEP:	384:FcdmyFL1F2ppxr7wVqJM9TA6Tp4RQwBC3mnGzEa+DkGVacC/RZy98hhge4A/tvha:FuNF3uXXM9TLplwBOmqEGGVacC/6Qme0
MD5:	89A370F1D7970D887BE496C2746D0E2C
SHA1:	E0A3268C7333F09B2560D1EBC22E4BB553678239
SHA-256:	C24DCE2B88DECAF6F8A6E1919CAD61AB9AB97C59F40399963681256BB3D71C66
SHA-512:	43752E2C94F18D8D3C9DBC75FB3283F9CF3BD0487764EB10141D76398F15F8093ED00BD6C13B5EB9D9A2A8060D260666B76E9E4EC3B3466D016F79C14A8F845B
Malicious:	false
Preview:	.PNG........IHDR..............1\.....sRGB.........gAMA......a.....PLTE.................A..B..C..D..E..F..G..H..I..J..K..L..M..N..O..P..Q..R..S..T..U..V..W..X..Z..[..\..]..^.._..`..a..c..d..e..f..g..h..h..i..j..k..k..l..m..n..n..o..p..q..q..r..s..t..t..u..v..w..w..x..y..z..{..\|..}..}..~................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................aa.~....tRNS.j..6.E....pHYs..2...2..(dZ...X.IDATx^.}.%WY.Iw.N.:...H`.aD.!..q.Y.QWe\GDgq`.gq.EE......._F...[.{.5.6N&.1..D4DI0..D.H...$...N.3...T.y}......:...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\61A89A06.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 118 x 59, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5103
Entropy (8bit):	7.940508823265334
Encrypted:	false
SSDEEP:	96:tSHr95jM5Egw1Krg13IjTpdHhPY8pbn2TbaJgmIU+D:tSHveEguCU8TrHJY8pb4beeUq
MD5:	FF0250DFA4464781379182718EE4EAED
SHA1:	CB3752C4D9DC27C8F5BB767F1D90016BC78FF48A
SHA-256:	E7E6C0E5D97FCCEAE90C5E1F4EA8D8EDEC290B9530320CA9143346066CF5B6B2
SHA-512:	0C9D31D49706D1B35DD2B132EE6593D1CD5CF9C061924AC90CD68CF8D66E35B237161DD244C8EDB666BEAB60453AAF3D908EF9EB4BCDE7A2BD34AF23B043E970
Malicious:	false
Preview:	.PNG........IHDR...v...;......a~.....sRGB.........IDATx^....%W...?xpww.....K....!xpww.`.=xpww'.............l.9.3.v..........%k.S$.\|..%.D.O..q.\1...\|y.=......+.S&.B....~b.=....I~U.C.G....L.}A.=..)..\|s..,...{.O....7.~...^?....V../&...$94....@./;.v.$~...oI~..[I...I..@.........U).s%."N..J...{`..$9j.....).ZK.k!M'O.$.'.#...;..........f.....\|.....J...D.&.C.K&9k._'...&yIY.;...x.y...(..u./%.xK..)..k.+.>7;rA.c'9~.a....I>TB._.:.U)..b.{O...\|...3$.}.K5.{............'.U...../.R.Z..?JQ........I......O........g.M....X...$.).Z.+....h<.n.7Je.YX.{.X~t.....x.$.].X.....r..\...Y....~jI.'...bo..~.A...P...I....Eioh.W^..r.G&.q...>.@:.1~g....)..,.a.G.}.b...7.p.$.(q.l,+P K&e<+.@SU.^.3'...-3.41..t.k......^4zu...........uk.I...Vo#...4I.XX.!...._.d.*.SX.yI%.B....Q..3.....U.:..c.k.^Wb...7....'..T.rA...u.l..@...E...6....O.x...U-c..g..K.....X......x.cK. .^.0..I.....7...\.A.#%yk.H...G.$H".(vZ.7.N.3.F...kP..?>t.1..\.........K..VLy...]>.+.W....+x...Y.)..&..X.o.\...=S..X..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\87B2ED2C.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 88 x 36, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3485
Entropy (8bit):	7.917901995242941
Encrypted:	false
SSDEEP:	48:RYILOM+IKZ26RZ6OQ9xTPZS/JFVWHQl+tN/NLOcT17qRVmpbPhCnNZJ707Rz+tOl:RefnRodZSx3zli/IcT0uPsNf707RnQX+
MD5:	8AE374D661D1F21D614D83EB22672DB3
SHA1:	E2ACBA7974CA8B4859635A339B6C6EC334DA067B
SHA-256:	EA83D63237CE53C404347572F5909AAE4DECF2CD2972A968521D03281A39314D
SHA-512:	439B1679CDF5C85B73CB3A5C20CD21C7C8B0794EBDA9D34DDBC92FEDA9E6202F7ABDB01D63CA41F1439CC19B505400CF08F5CDD9F63426F511A67473BAF254FD
Malicious:	false
Preview:	.PNG........IHDR...X...$......u......sRGB.........pHYs..........+......tEXtSoftware.Microsoft Office..5q....IDAThC.{p......won...F. U.b#.GPL.RAAE.j...hm;.>f...!.^ ...0...t.".N.LE.....J...".PK.b.$...........#i:..$...9..=.....8....K.kv.....y...-Kv.%.K.<.......p..P.2.mwGKX..".e%...h..L..k..V......4..3.....FR..U$U~{6\|.$.\vXN..e..>=Z.5.@....E.#;...L..8 G.4.!.x~.1...@..7.[r....-..\..OD.w..?H......I......j.M./.....<.p?...q.LAlU.4.7...s?!..d8.l.!....e.....9 1iO.r..v.e..v.....tX...d.....[...;.\|0(..s.A...z"f\|9r..[..[......./..l......E..e....i...?...E.q.`..9b9.Z.y............I.<........\..-...F.....G..o=....f..Y...%4..V...C6.iz#..kSa..Uc.-....k)4g.~.l...e...... r...&..g.4..).....b1..0F}........,.I...).pt..j..w.=.p#....g...X.....gI..d...-..._...P.m..8...X...b.e2.\..=...,J...c.Brq....7*q.=P......[...^=.?..{v.\|.M.2.L..I.......5^....h...VH,MjH`...>.%...Afi...68..R.~./.....]........w{.1...6..E...(.......y..R..Mr..[.z..E..C.<.y..N.W..T..rH^.).....,!O..Ct.._.>.;..s;.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\8A2DA435.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 193 x 59, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13099
Entropy (8bit):	7.951283835039649
Encrypted:	false
SSDEEP:	384:0rVVeCcdHJy4aR75chEregBqqVkff1xzLutzuA1Pt:0rLlcdH87ihEfqTff1Ev1Pt
MD5:	1387CC1D12EC3C0CEAB114DB2B8C3910
SHA1:	84CF2F36B7C6208846F58D5D23C4BAE55278F9D1
SHA-256:	D2C8DE4696B7AB82F798F9A6D1D4944B18E93DD002DA03085491285A4724B17D
SHA-512:	7D28F03C0A5B79003DD9D9B5A132F553D80EAE5EC87D8F42C81C1D76E90E57BD4CB1E189BCF7B675D48F82F7B49B23F07946497CED2DF806A01BF493CDE82A55
Malicious:	false
Preview:	.PNG........IHDR.......;......K......sRGB....... .IDATx^....-W...j..]...{pwwww...www.. .. !.@ .!!...;.U..^.~.;!3p...}.:..o.{.S.K.....~....<....8...C.......\|..>.L.>........iNs......8.9.....=.iO{..F7......e:.IO:.\|.....w.q....8...?.~...ow..M.......t.q.s.i..v.....O...7..^...Y.r..\|.;.8.<.9......m:.)N1d..W.:.....t...Y.\|.c.c\....t...w:..O8...a..6..o2/--.....y....c....Z["...sI.pz....+.3_.2..A..8.g?.....x.p.g<.....x..D':........7.a8..8..?......8....~#(...>....}...{.98.!..2].........r..<.1._.........=h..%.1d.(.@.I.n.V.l.R.N...N...nJ.E.wT.t..G. ...."...>.....X..N.99.<..N0...'.....>....~../\|a:.N5..\....N';.....>...p....?.pp...B.6...........wW..U._.........w..8..g8..O\|b.n.....wC6r\.r..c..X....#c....?A..v.3n......=.-..t..K.....=.3..a.LOx....C...8`.../?...o...^.......}:...>...........7.nv.....A..{..4.[...^?....}.C#...cd......7..M.~......._.z..1.\|.;O.........g>....Q .2G..F.EQ.W.Y.De.M.A.r=s_o0-..Q&Y..K..z.2..)..>.#(...../O..uF.@c..f......_.r..=.9

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B813C81A.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 423 x 97, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12581
Entropy (8bit):	7.947090486668927
Encrypted:	false
SSDEEP:	192:f3xJ+b17p29hR7YaiG8BnZLDdfAw/OliOYDsTGWGYWdR2WlcfvTAD8EfeF4kqH:fhJ8IDrQTHtAzxSsKlYyR2UTfeF+
MD5:	82B80A43BB7B69FE726DA521F6217EC3
SHA1:	C7F836B5B9EECE171EE0AC2C8E281AC5135CADDF
SHA-256:	56D384D372D75540F29E27BC3C504AB919FBC3D4BE155DE9D1C1EA8BDC1BA2F7
SHA-512:	ABCE9BA6EBADC41F0C5DF1F591B315DE270E678AA69E53FDADF083CA5FDA78B1D51CF07E7B45D9AF31365A0223A7EE68C67C86ACB7BEB33C6881B708551D5BB2
Malicious:	false
Preview:	.PNG........IHDR.......a.....r)n....FiCCPICC Profile..H..W.XS...[RIh..H...R.K..E.T.FH..%. bW.Up."...(..@..,..?,.(.b....X...{.;.7..9s..Jf...N-O.Cu....."BX...Y.....@.........h.e..wyw.ZC........=.P.....8S ..C...../...@.z.i.R%.....&..T...T.3.Je....x..d..'..@...YE.l.}.bW.@,.@..q _..@......%.v.!....qf.q.x.CX].J.b.4.7..l....<.`.;8h"Yd..f....QJL..G.....>.....=.(U..LV..\|9...0!v..B. 6.8\.....gf..........I..ByX...VV..7..d....'S.U.P.&.5.7EB. ...QR.:g.Z$N..X.b.<71Jm...8..62E.2........5?69K..............X....%Ejxv.y... n.J..<B....Z...0u..%.$YS/.)-.I......k.q.0/B....T^.......T.....$u.xf.ol.:...D....,..#.... n.i..3..d ....F3....k"(..@$..!.....A..!.....T.E.\...\|....o..K2.-.<...?..a.yp(...cCM.F...e..Z....Hb8..7..q.<.^..p.}p..l..'<!t.....:.........b@'....9..q;......r.L....a$6..c{B-G......V.7]..Q\)(e.%............vH.k.P_9C3...\|.i..G}o.-..b..c.Y. ..X.......R.U.X....%...<....ib*;)wmp.v...+..+...S ...g..Yl.........,wWw7.....c..S.~@........w.r....X.@+.K...........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\BCC1D738.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 903 x 175, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	177624
Entropy (8bit):	7.99096509569485
Encrypted:	true
SSDEEP:	3072:YCEuBVO6nPayBEX+e8K1L/XWxoGtGMFfMydqzKwUYiZY5yoCCmllcA1o3r9fNVsP:/vB06nPpX3K9XWHGMFfMgqzzUYiZY530
MD5:	95B1C107A36CFF85F4EEDB2B79C7D174
SHA1:	CBC6E028584000FF5EDBFF8C3ED1853DA44E5250
SHA-256:	D4634C47222C10DAACD183A8652E371A77D05706BD92E011B50AED5212D3C1CC
SHA-512:	5211D26500121FA46AF5526A57913D5B9D21D2F8C2C276DBF7F4C87B9B3E17B34C31E9997D3E4E364915D90868F3F0D404482F7839C8354A255C124B3C0FE092
Malicious:	false
Preview:	.PNG........IHDR.............N..P....sRGB....... .IDATx^...\Wu6..>.6I. a.7l.q......)!_...`C.qEr.[.%Y6.B ....H .'..!......$.6..m..N;...>3g.....\|....{g..g..^.zW1..7......H` ......H` .......!..Hc=R..i.2,.0..).$.e...)`..?~.R..a...4...@j.......F.(n...L. E..o.L...a..\3..............a.-.$.\...".B.V.e...y+R~D}LF./..l.F.'H.M Ma..0M.I...S............]......tM.~S}.T.i.H..h.@b.5,XI....?..Df..7...-./F.g2....$..f...m...)....LD"..n....j.a....O..B..\|$~%...U.mZ...~..4IP,x...ZAK....b3.?....y..!I..7....`...FKT.2....... l..........X}...S&{=.z.....U._k".CX...L.&!`..'IL=....w..P..B.d\....>$..4.U.`Q...1.'NP.]...f...5u,.}........N.1...#v.. ...H` ......H` .....n9..@Z...>ey. <...Bj.8.L..&B.q......"...nD..R#./..Il I-....&.4Aj.0..C. ....D.KD...@...".JU...O.@...'H...i.....a$..AC..+....C...e.F.pj.d...j..<Q.Q......*F.Ch.O.......a....L.(..y@...Q.....J...i-....8L....0..VC..R..l .e.y.bQ..A..C>lj.>`....s....$..j6.l6P,................i!q,...R5?~..!..E..6@.CA.......q.....L..VKC...W..31..&......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\C5458553.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 246 x 44, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5648
Entropy (8bit):	7.954758670704646
Encrypted:	false
SSDEEP:	96:trrAgsW85EO/oohVo7w7UuVGFZEQLyse9B9a4PE2k:tnAv15joMVBUQMZEQLcBCh
MD5:	0EE2357DA7242A8392A05E37CEACBCC8
SHA1:	A105869FC75BB4098415D02D7D7ECC58AD43B2ED
SHA-256:	7547E6E6ECE66D637D9B0DD0CF9AF5837C682CA0697544FDF9E63445789A7216
SHA-512:	9087FB957974E5AF6526B598E909BB59AA69E40FCBF7D4157127B97ABFCB49900342E3A9283F940810DEEE443123B50692E6A28C386DA179C361622BC8EF0EEA
Malicious:	false
Preview:	.PNG........IHDR.......,.....V.E.....sRGB.........IDATx^.].sTW..:..rh.HP.D..I. @D......v.....2.}j.o..V.V..c.66...D.B .PN(.:w.~.........}.\F./.{..N..5..../....>.....@...r@.....jE...\|.k3b."..k$...E..g..@.O.. ..`X.0.A.."....... +.......`..(..\|......R..j..#;.V(LKpq..........).zE..".b.;.bk.Thh.C..>.OH..0....2........`..h.....qG............z..q.=.;..z....f......l.Z......a....a.t..r.....-...........=[.......m`S{...X.....~4vt....Vf...Q...P..6d&'.[. +=.g.r..(/K....8..`.........#.d..wVa..`..K.lC...2..;...0..].B.>...t......e.~5.:].Ocv...z..N..V..b\q....v!.Y..j.........wT!.l...L..R....p.$..i5p{...u0....%..P......z.W.. '....4KB.Lf....v..HM...%.H....v\...v.....'.....9.M:..g....Q. 7.&1}`....1xg.z.a....t.~<sI.0.H..$k.E...N...[..lYh..t.M.AEqQ...X.b.>.].D....9..Z;.#r..0.CM..^..N....K....\........z6../Y..wo.. a....\|.=.:..<...v..%.(.lBYY....^....P..J...;y...,.qxog..,..z.^q...d.H...j.z0.[Z...>.y....6....o2.Lv]...{......h.4...%+...l.....?...9=`..}>.]..'

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\D6103DD9.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 345 x 70, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	20395
Entropy (8bit):	7.979341055076469
Encrypted:	false
SSDEEP:	384:+3Y4PqX85p1W5cmcYp1YSx5HwndpxD+GvnY7bJQ5GevUQ5Ssrism3:+3Y4Pqs5W5HPvQn4GgRgjvUN1sm3
MD5:	359AA6F9CA459989BF233545F4861E87
SHA1:	F9E2983D0BBF83EB245FC985F9DA7F8FCF7B03A7
SHA-256:	49396CB80DA750E75E8E6E4203595F0C3F21FB32C559BCDFB55EE397F9BF27CF
SHA-512:	A5D1EACF05A20C84FBB902F42A676216A384956697DC093D9533C1E02AE15E49700FB6A59C0C6A99F1DC73889F7C3B93794561D8528D10E1298C92F8ABBEE654
Malicious:	false
Preview:	.PNG........IHDR...Y...F.....f..!....sRGB....... .IDATx^.}.xTE.....n.F...P.FQQP, ..A.$....P.....@ .U....b........-..d.m.~....{7..x.......rf.7gN........Z..:...ji4U.......)..@Q._...-J.+M.......M}<~..O.t....S...r.Q.F,...)........h....4.@.u...?..W..E....MQ.GS...+.:<..;.h.~.\5 {...w8h..xRd...(.h.(.N..(.F7m...)..0.R.M.....8.......dO7.[........h...5.4.X.%J.(.J.......Y...R....?X.W..W...U.=......`.&.U.......O.WIp..........t......@...(.X....T.sxyI..._Y......u..Yv.@1..T..p....,......0,.M.RX.]..4.......&.......XP.\|..I.......:P.O..}^C .:.dah.(A.T..<u.z.......E.s..{i.tT...._.....1..5.?c....Z..L.".P..#../,.......k...k...q.._.....+X...rd5....].n.]EH....#......{;h..h[>.].2.R.$...@...z.0...].>0.]...a\|....v..({....Q...(....E.........*.P.........U...t.h. ...........p\.d..f..hg.. ...T..b....E....4...W.z.%D._...%_...JU..U.....z-P1......sgA=.;....~.....9.P6.....lv.+V..fm`j...r..Q$..8A?...?..z.o.Fx.............Tl....Up=\|>.rsJE.v..I.C....]..&..#7.......B.XV..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{5E8782E3-8D4A-45DD-A929-A96DB03A977F}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20936
Entropy (8bit):	3.535367093064981
Encrypted:	false
SSDEEP:	192:g/a89zu5nc6neaDeNNN0/lZDh/Rx+V5tcQInP1lkPGlm0Cys:g/aCYc6neaDefN0/lZDkV5I1zm/
MD5:	EB2A3538EB034CF2CCCC7C2127C4A125
SHA1:	73D13F79A98E48EA5645E4372F19ABDD0BA4FB38
SHA-256:	38BB5395D64468F096CB74FB6DBECADAE8F98B08A5BF5460C45F299870703134
SHA-512:	08BB538785F9503E8D782DDC9A3BE9264C55A51821AB199449E2CF3EC62708DCD0ACE56A6919AED3DDA4770EADEEBE9A0FD4EA1E577DA2EE16D419B2A1976B8B
Malicious:	false
Preview:	............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................8...R...r...h...l...p...........@ ..D ........................................................................................................................................................................................................................................................................................................................................*...$..$.If........!v..h.#v....:V.......t.....6......5.......4

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729606183002160900_0A09A35D-7331-45A2-8597-74C0710D4482.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.01443123494894678
Encrypted:	false
SSDEEP:	1536:A+aITyQLs6SPag0ACtjYRV+fDwnIUwP2B7v:Tb
MD5:	5E2766EFBEFCB56A4A3F43022B8DAAF3
SHA1:	B31774EE9D36E1D6878BD615C384F1FEBA2781E2
SHA-256:	490AEE01C4AA53E6C1551354F4C090728748A05CF16E23C8DF4FB8FB28E24DF8
SHA-512:	8EE5E036D6CE82494D6101DCAC9111B7FD04FA44C2191EA8C17266EEDB8F2A66E909B9D017BCC0B45BE11F5DB6C0E491049F587D223C8A466AE6AB7D10953F8E
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/22/2024 14:09:43.029.OUTLOOK (0x2E4).0xF04.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.System.GracefulExit.GracefulAppExitDesktop","Flags":33777014402039809,"InternalSequenceNumber":23,"Time":"2024-10-22T14:09:43.029Z","Data.PreviousAppMajor":16,"Data.PreviousAppMinor":0,"Data.PreviousAppBuild":16827,"Data.PreviousAppRevision":20130,"Data.PreviousSessionId":"B02B46AE-ADAE-4777-8716-6C6343AC2E86","Data.PreviousSessionInitTime":"2024-10-22T14:09:19.330Z","Data.PreviousSessionUninitTime":"2024-10-22T14:09:22.564Z","Data.SessionFlags":2147483652,"Data.InstallMethod":0,"Data.OfficeUILang":1033,"Data.PreviousBuild":"Unknown","Data.EcsETag":"\"\"","Data.ProcessorArchitecture":"x64"}...10/22/2024 14:09:43.090.OUTLOOK (0x2E4).0x17A8.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":28,"T

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729606183002952600_0A09A35D-7331-45A2-8597-74C0710D4482.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241022T1009420773-740.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	4.585858357050506
Encrypted:	false
SSDEEP:	768:+40QBqCZAsQ+PY2rC+4PsV90GZ/1ktUQMcH3ARnXYtNRaGlNN/+Wo9xoZxz3in77:+N6Zr40V90Gh5XLW/U
MD5:	714A6430E4C91B110A9609D1D9B515FE
SHA1:	5CBE784432F6E353C032030A9C0D63E77805575B
SHA-256:	A714CA7DE75D53B0851C3B82172BBE30AE01E97A42DF67C67CF810BD0DFB8DAA
SHA-512:	820E7EDC02885597FB9C911BA057A4F515FD20E413006A26CE08FD199CEB598D27D7E40617EB426F24B9A1107D1B3D41618D0CF44367FEE44FC7B9A85ECBA600
Malicious:	false
Preview:	............................................................................^................$..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................0.~..Y...............$..........v.2._.O.U.T.L.O.O.K.:.2.e.4.:.6.3.5.d.9.6.f.f.1.8.e.2.4.6.5.c.9.f.1.5.4.d.0.c.6.0.2.3.c.7.8.4...C.:.\.U.s.e.r.s.\.n.o.r.d.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.2.2.T.1.0.0.9.4.2.0.7.7.3.-.7.4.0...e.t.l.........P.P..........D...$..........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\olk383C.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	46552
Entropy (8bit):	7.989573688290949
Encrypted:	false
SSDEEP:	768:opN2kyZ5CllybhVncEtAp/lX3rpauq5KplQ5rthvZHuvaGCEavwwsJpBkGE6J3n:1jCllyd6mA1lrpjq5Kpa5rtLuSNVspCs
MD5:	971270E63374EC0EFF566627654905EA
SHA1:	8827376882EC3005D0936A4554065F86F3669F1E
SHA-256:	7739B99B04338F1B73A05397229C1CC17315F560FF8FA9541B4D57C99E2873E1
SHA-512:	D83CEB53A2023FD9EFB0277A389105779D7E6118E3C28D92F6852DCDE3B8181234E3F3BE343EAC275A568894DA756590901835669DA7EE3495B8B4C5F70063DC
Malicious:	false
Preview:	....\p.E..e$..H$.S.%...'.k..T)..........},.{..8..K...F.....\Q..{.7N.~...\p..x.....DB.<.t6..=t.&C2sY..:I.w..].H,......VY....>..).R2$5...;.Kg......g.w..C.L1..\|C!...R'.......c....$FK\|k....s/../>#.4...r-..V....,...y\u........?...... .IDAT.s.!.P0#..x.j..o..>//.IU..g..Y$......(.6.})..8....Y.c......V.....CyV.d6%...E.}.F$..Li.Y....'`....m..n.......R..A.&..../..N.!.N.S.?+.$.#....g}az[.v(.,#eL.3............N.K..#..u.x,Y.Pt.p.8....0Z)u.U..9.K...q..'......1..9t...3\|h.ry.....^.a.8..4...f...............1.d.j..9a.n.>.M..!k..E..V..B=...../..CLoB....tE.C.,fO.E~i...s.\v.,.u.................H..DY...c.0X...`e...>l....+0....J..sHp...6...\|...!.....N.{...&......P.XT..k.......,4.A.!.=....x.9..\t.9.+.....sH.ai..C.CNW:..(.!....sHpx...l.d..s........>.x[.z`...O..!..&.U.....m.0)...7.)..F...k..m.<.+.T.rY.t..pH.=7;'t.....7$..d"......l...x(..N>.{l.=...7.........V.!r.d;:.....p ]..&.DP#....YC.<.7_s.V_u5.8c&.~.E!......G/.z.p....]....{......."&.P\......)dG..{D...

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:	3:1A:
MD5:	948A2F3436046D9A0E35313B79381BE4
SHA1:	B13787E1BC62E250ED4AE72CB040801B677AAB01
SHA-256:	D63C5087E7A2EA29B271CFF757B3569D1DDC0C85F975F5A7BEE864195A2D3B9D
SHA-512:	CED55DA9CE10F905A355867DEAB2495D203261BA8436E4BE81C8CF54D784D15E38B302566E7EDCB70FEAF91EA4997CEF932CD113BC2B8D9C8C1E90D83B1ED035
Malicious:	false
Preview:	.....A........................

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.6703517108383217
Encrypted:	false
SSDEEP:	12:rl3baFrqLKeTy2MyheC8T23BMyhe+S7wzQP9zNMyhe+S7xMyheCYV9:rzmnq1Py961o9
MD5:	41316442DB1E272D53F457A2647D8BFB
SHA1:	AE5D2953A339932849F530BA8B57EFE92F246261
SHA-256:	6AA8D03CB638324BD2C19259FB77983302D60F73F9DC03880E73D4F145375AEB
SHA-512:	088C9B68F8A177B3283C66BAB8F5C5A9B855C5E34DE28D6D373A1A55AD91960C20F6EBD2C728620F6E041674FE8C9BD29F4AFF8F2873A3A68D4D46706DEF2934
Malicious:	true
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 22 13:10:55 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.977847831122964
Encrypted:	false
SSDEEP:	48:8f+dvT5tk1HridAKZdA1rehwiZUklqehHy+3:8fCVtkpAy
MD5:	79FB418FCEE029DF78922D491C1F9D40
SHA1:	C39CA06059E3060270B5C7E7147EFF9081C5745E
SHA-256:	58AF963C52F99983BE43FBB96AC77CFFBB5E60A84A91FB96BFF0D4CD28433079
SHA-512:	8DBA078FF5808D47897892BD3745E29E5B48F3C5C4EFF95C211D9F9134A3DEFB94311D1F7FD929D95989974EF0CC93F2E452A641275425EE03626D57E1ED60CE
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....!.5.$......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.IVYq....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VVYZq....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.VVYZq....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.VVYZq...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VVY\q.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........9.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 22 13:10:55 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9926144030061748
Encrypted:	false
SSDEEP:	48:8D+dvT5tk1HridAKZdA1ceh/iZUkAQkqehwy+2:8DCVtkl9QFy
MD5:	2DE4841144100FE71B0EBBF28ED25E48
SHA1:	80B0D8F3F4E7807133E6CAB031855F15585DC5DB
SHA-256:	5BB423E164DC5E57C416FE15CC6A71DA77D646232DED2E8793730E2B0A1C1D33
SHA-512:	0989DCE9476FF84689F934F56AF9CA20EEEE364A382BF9BBBB36330D7940AD6FB5770973004452DF8EC795A1466AC537735B55710B12BF0358F2CB688C20D785
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....:.5.$......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.IVYq....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VVYZq....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.VVYZq....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.VVYZq...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VVY\q.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........9.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 09:23:19 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2691
Entropy (8bit):	4.004269678193471
Encrypted:	false
SSDEEP:	48:8XR+dvT5tkSHridAKZdA14Aeh7sFiZUkmgqeh7sOy+BX:8hCVtkynEy
MD5:	51EF977A63EEE75E0161ADCD3F7AE17F
SHA1:	FAD0517F6E85EE52E9ED719AC5713803A2D72A24
SHA-256:	980E9B8A05CD77AC12EBB31023C5917621C070D68A0C72F0B497FF69DF4C5716
SHA-512:	7E397505646E6C6879EF282B991B586C65AC8181F7E3E713097D3DFBBF29302F8FF510966018C56833CF159550BB6E519D7C87FD00A1F994F313FF03AC48D09E
Malicious:	false
Preview:	L..................F.@.. ...$+.,....?.4 ?.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.IVYq....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VVYZq....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.VVYZq....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.VVYZq...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.R.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........9.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 22 13:10:55 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.992402270115135
Encrypted:	false
SSDEEP:	48:8l+dvT5tk1HridAKZdA1JehDiZUkwqehMy+R:8lCVtko2y
MD5:	7BDD2A50A1D8662C8B194D845AB8094B
SHA1:	743D7DE1E295AD550832D889F2F6BC0D4B6AABB4
SHA-256:	31C99F45724BA1F6F8F0D55304AF5053E26C628F75AB7431B6985120E3DC9B44
SHA-512:	557B7CFBE0721086BAC1936D1728F04FD682FEF321C8249BCCBE1D1C50D10962860250B638A503A0A5B4D85A2D32502E0ACB41EDC357F220D94D861C04E9EBFD
Malicious:	false
Preview:	L..................F.@.. ...$+.,...."..5.$......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.IVYq....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VVYZq....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.VVYZq....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.VVYZq...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VVY\q.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........9.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 22 13:10:55 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9763805357562516
Encrypted:	false
SSDEEP:	48:8F+dvT5tk1HridAKZdA1XehBiZUk1W1qehiy+C:8FCVtkI9Cy
MD5:	A24A12E90FF8EFDC624CF7CDE88BC66B
SHA1:	853B95E1475946C31D2192664DD68D0821C08F98
SHA-256:	F7CF59D5576DD5CFA686107A92A55ABA2460679A5DBCA33CC0B34859699ED158
SHA-512:	D1263B80BB85B9625773D8F931FC8C73288EC2C001C9FE35B059B37118D843E8AEF0CE8DB969418B04E77AA79D0643F8BA3495765CCA72D7A6B60B732D3526D9
Malicious:	false
Preview:	L..................F.@.. ...$+.,....@..5.$......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.IVYq....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VVYZq....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.VVYZq....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.VVYZq...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VVY\q.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........9.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 22 13:10:55 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9910634827277165
Encrypted:	false
SSDEEP:	48:8p+dvT5tk1HridAKZdA1duT+ehOuTbbiZUk5OjqehOuTbEy+yT+:8pCVtk8T/TbxWOvTbEy7T
MD5:	473014FF7ECFE838738C567C1BA089C5
SHA1:	906E255D92D0262D6BB5014A68BB4DCD7DEFF599
SHA-256:	05A1315311C44C5F368282DBF517FEA77CC12AE2A743B81ECE7C40BA3DFDB0B8
SHA-512:	6B5AE7EF34DD2AD8D7AAC4A9574511CC11BAE81F6236C509E923525FB4915469D6ADF44B6B15B2380B824874409D93A9A379BAC07123D76EDFC27A5E4D955403
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......5.$......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.IVYq....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VVYZq....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.VVYZq....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.VVYZq...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VVY\q.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........9.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	2302976
Entropy (8bit):	1.9465035689820975
Encrypted:	false
SSDEEP:	6144:m9ay3sE1VJ7MGKzVdj90hJIVWH1xmPHC3GTEHU/rY1b2mNzJ6dCcq3uSSuzY:m9ay3//JQGKznB0hJIQ0M+anGW3uSS
MD5:	4E7A86C69A50777EC20C2DA4062138AC
SHA1:	C9888DFE52B5972673AA7CDAB9641EADCD86ED1F
SHA-256:	9EA02D8BB8821E25041304024158FF5D44F388AF78F40DD62900C4207A5A2744
SHA-512:	6BBBE865B8EBFC5B1B598A47161EC62F261307654E8D24879CB852EF7107C0A7A1DDA460A24B5381EECF1548FF04199CA3E1404FF809C80EFE939BDEEE2A846D
Malicious:	true
Preview:	!BDNec.~SM......\....6..........B.......~................@...........@...@...................................@...........................................................................$#......D......................A...............>........T..................................................................................................................................................................................................................................................................................X........+.j..g.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	393216
Entropy (8bit):	7.3985250460517955
Encrypted:	false
SSDEEP:	6144:yCNfqVPESJ9JUXVdw9uhDIhgHzxm6pCcGTmtU/6g1tmmNSCdyWPSiopr:Ti8StUXnWuhDI4pLufXHzPSiop
MD5:	003E409591ACB6AFCBE5012AD8CBBE09
SHA1:	B50D0A54108112E4F95ABD6BB48AF4372744D454
SHA-256:	14C29554DD6C7976A45B60323E1E8DDDB6FBB747D82E45AD45F5F73390D4FA14
SHA-512:	FA74EF5A93C8451393765569E398C8CC625605E0FB2C6E5ADD884E5F2D7171C22ECC6603DBDF0989D7C1E28AAC51744CC8434407E35B010FF4361167D2C4FFDF
Malicious:	true
Preview:	l..iC...............ht_..$....................#.!BDNec.~SM......\....6..........B.......~................@...........@...@...................................@...........................................................................$#......D......................A...............>........T..................................................................................................................................................................................................................................................................................X........+.j..g.ht_..$.......B............#........................................!................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 169

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.28732561467651
Encrypted:	false
SSDEEP:	12:qmiiaZgszpGHr0Tn8D+c35COXpapjD4k1PZiwae4vPdeegbOh6mv8n:AusLGfEhB9a6mE
MD5:	44385673EEF386EC121603CD302FD05F
SHA1:	C15A6D61054FFB16D8DF4DA943B545349FC82631
SHA-256:	069E8A1E31ABA074CC28BC9D6D54C67495BD42A02115DC232BE7C8D9F83E40A8
SHA-512:	E80C43BE006B5EEB66F98192B177163E92B75A5CD0AAA880ADE24A67DB7A1F29A0CB958B158244DB47386CDC775DD025E0FC1F97E3D7ADCDDB76D347F3073DA7
Malicious:	false
Preview:	............ .h.......(....... ..... .........................................................................................................\|kW.\|kW.................................................\|kW.\|kW.\|kW.\|kW.\|kW.\|kW.....\|kW.\|kW2............................\|kW.\|kW.\|kW.\|kW.\|kW.\|kW.....\|kW.\|kW.\|kWX....................\|kW.\|kW.\|kW.........\|kW.\|kW.\|kW.\|kW.\|kW.\|kW.\|kW<................\|kWm\|kW.\|kW.........\|kW.\|kW.\|kWg\|kW.\|kW.\|kW.\|kW.\|kW.................\|kW.\|kW.\|kW.\|kW.\|kW.\|kWn....\|kW.\|kW.\|kW.\|kW.\|kWr....................\|kWn\|kW.\|kW.\|kWU........\|kW.\|kW.\|kW.\|kW.\|kW.\|kW.....................\|kW\|\|kWe............\|kW.\|kW.\|kW.\|kW.\|kW.\|kW=....................\|kW.\|kWa\|kW.\|kW.\|kW.\|kW{\|kW.\|kW.\|kW}\|kW.\|kW.................\|kW)\|kW.\|kW.\|kW.\|kW.\|kW.\|kW`............\|kWy\|kW.................\|kWW\|kW.\|kW.\|kW.\|kW.\|kW.\|kW`............\|kWN\|kW.................\|kW`\|kW.\|kW.\|kW.\|kW.\|kW.\|kW`\|kW.\|kWb\|kW.\|kW.\|kW.................\|kW.\|kW&\|kWS\|kW.\|kW.\|kW.\|kW.\|kW.\|kW.\|kW~\|kW@\|kW ................................\|kW.\|kW.\|kW.\|k

Chrome Cache Entry: 170

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1042084
Entropy (8bit):	5.585805715375964
Encrypted:	false
SSDEEP:	24576:mGKAoVuog6AhVuhgqWHAhVuhISFSr3TSZWkcSO2dpoFPQ+Lgl9SclgDFaGa3mDKt:jFS3y9Sclg+3ZjMdX56Udy8sx
MD5:	5F0D3A7E853059D6E1BF72263336A1B6
SHA1:	1D2860B87C7C0DFBC8A4BB72733BFA811108826D
SHA-256:	C1C6725B64EE8DDB255DE008BDFFB528CB91B10DE40B67737E0B6DD9C47C6096
SHA-512:	2C56B00157F0C55DA7DCEE2319799C01C4F21F3E88A6A5CB9BBF168A86B89C525CF45ACAC4267DDB0E41F6F77BF4F0FD2CDB9909D245E927F428BAD8581D213D
Malicious:	false
Preview:	(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[1],{"+br3":function(e,t,n){!function(e){"use strict";e.defineLocale("eu",{months:"urtarrila_otsaila_martxoa_apirila_maiatza_ekaina_uztaila_abuztua_iraila_urria_azaroa_abendua".split("_"),monthsShort:"urt._ots._mar._api._mai._eka._uzt._abu._ira._urr._aza._abe.".split("_"),monthsParseExact:!0,weekdays:"igandea_astelehena_asteartea_asteazkena_osteguna_ostirala_larunbata".split("_"),weekdaysShort:"ig._al._ar._az._og._ol._lr.".split("_"),weekdaysMin:"ig_al_ar_az_og_ol_lr".split("_"),weekdaysParseExact:!0,longDateFormat:{LT:"HH:mm",LTS:"HH:mm:ss",L:"YYYY-MM-DD",LL:"YYYY[ko] MMMM[ren] D[a]",LLL:"YYYY[ko] MMMM[ren] D[a] HH:mm",LLLL:"dddd, YYYY[ko] MMMM[ren] D[a] HH:mm",l:"YYYY-M-D",ll:"YYYY[ko] MMM D[a]",lll:"YYYY[ko] MMM D[a] HH:mm",llll:"ddd, YYYY[ko] MMM D[a] HH:mm"},calendar:{sameDay:"[gaur] LT[etan]",nextDay:"[bihar] LT[etan]",nextWeek:"dddd LT[etan]",lastDay:"[atzo] LT[etan]",lastWeek:"[aurreko] dddd LT[etan]",sameElse:"L"},relativeTim

Chrome Cache Entry: 171

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 137104, version 331.-31196
Category:	downloaded
Size (bytes):	137104
Entropy (8bit):	7.998265825794848
Encrypted:	true
SSDEEP:	3072:6uGMxS/+gbEUbwrT4pZT630r3OhDkLWJZYa3se4YuOzf7ThRvu3jzJ8Va1I:9AmAZ230r3rLOSa3YOzf7NdYz6WI
MD5:	DBF1FC91F1BEEC2915123257EA4D58EF
SHA1:	D2A6D5D31334F6D0831F1C17D26E23FE0AA6A8DB
SHA-256:	8D4D29042C23B5FCBED3AF690421776DE0F8AD3D308D66E24A9D80BCC8CCB522
SHA-512:	72E9CCB5CE2D88AAC739B513B95DFB7667CF80B617510AAFEB2C72345C7CDC3459B7002C4A46AFD967AFC1E3CAB091E078EA9CB6437550B4C7990009799128A2
Malicious:	false
URL:	https://security-uk.m.mimecastprotect.com/ttpwp/resources/fa-solid-900.54dfc8f551be346014e4.woff2
Preview:	wOF2...............P...4.K.$....................?FFTM....`........h..9.6.$..\|..... ......=[...D...66U..n2..s.O7..-.n......^...O...R..'@.......d"...Iv".kZ.......(..A...b.Te..!d.I......f....{.})2.W.lo....a^......S..K..^A.t..z.7.[s.....&9H.}k...rU4.rt..u..'......o............FsD!....)FERh....Q2.4@...3df..i...q5pU.(7W7m........x\...o.(...!....O5n........J...^s.5.~...3=""B}...z...#&.....oX.~}.]H..yF.I.j.H.DJ..o.-...i.. }......\k.u.h...o..b-y..\7..S: ...#4...O./...=H.s@...S..YV.Z_...'......."..\4...N....... \.....b.?.=...6^&..E.a.....".W..\..P t..&<...>......u...B.q.....^VB....T..2.....S...H.p.(y..t..5...>4....U...q...C....A..b......E.....y."...P.......{wMr...0....CR~..l..j.O.M.-.%Ip................6D..L(5l..u......'4..Z..L...ZQ&V.F....-g+..+..V.Cn.....l.&B.f.X.L.lh......5...T....Z.5?...t..e.]...2H...Vd.. ..A..C...D...%.B]..C..8@..j.h.U......:j...B..m]......6..;.;Wv..'$I7.B...p....@.6.T!.?.F{..R...C[...../U....j..[U.......3N.'f........4_./6..x...

Chrome Cache Entry: 172

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1492), with no line terminators
Category:	downloaded
Size (bytes):	1492
Entropy (8bit):	5.1504605464747675
Encrypted:	false
SSDEEP:	24:ECoyffRGmcH7LprYMEw7zsQCBm3lBmGa0BTLWwMWiB/azfIvJkwIdd8BtIcf:EhyHRZclYME0QQuKTLWnBeYkVd8By8
MD5:	3AD4DE7EFFAAC3D0048EF54F8491451F
SHA1:	B807DD524C22B9F6241B1EF14AD6902D5C9D9215
SHA-256:	6C36E59711DF161A3D7A2D6FB3E5C17A8767A2F42AEADD9BF166830FDB8ACD5E
SHA-512:	B605EE47C436722BD21C501299EE1A6D96CC34D582003D6DD539AEE7A91E4EC78BFB6194E2226179627A5152DE16A7ADA2462BA5856F1FAF2647A65D24AB9CBE
Malicious:	false
URL:	https://security-uk.m.mimecastprotect.com/ttpwp/resources/runtime.5257ca6e429949972959.js
Preview:	!function(e){function r(r){for(var n,l,p=r[0],f=r[1],i=r[2],c=0,s=[];c<p.length;c++)l=p[c],Object.prototype.hasOwnProperty.call(o,l)&&o[l]&&s.push(o[l][0]),o[l]=0;for(n in f)Object.prototype.hasOwnProperty.call(f,n)&&(e[n]=f[n]);for(a&&a(r);s.length;)s.shift()();return u.push.apply(u,i\|\|[]),t()}function t(){for(var e,r=0;r<u.length;r++){for(var t=u[r],n=!0,p=1;p<t.length;p++)0!==o[t[p]]&&(n=!1);n&&(u.splice(r--,1),e=l(l.s=t[0]))}return e}var n={},o={0:0},u=[];function l(r){if(n[r])return n[r].exports;var t=n[r]={i:r,l:!1,exports:{}};return e[r].call(t.exports,t,t.exports,l),t.l=!0,t.exports}l.m=e,l.c=n,l.d=function(e,r,t){l.o(e,r)\|\|Object.defineProperty(e,r,{enumerable:!0,get:t})},l.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},l.t=function(e,r){if(1&r&&(e=l(e)),8&r)return e;if(4&r&&"object"==typeof e&&e&&e.__esModule)return e;var t=Object.create(null);if(l.r(t

Chrome Cache Entry: 173

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2088)
Category:	downloaded
Size (bytes):	3447
Entropy (8bit):	5.385539600942633
Encrypted:	false
SSDEEP:	48:08kjiKt+nPnlS2yYXyPXyBlt+nPnlS2yYXyPXybWIiMjLA:0t+nvlmYCK3t+nvlmYCKblQ
MD5:	C286C6FD6BFE7C3FAF59157B7AA0FD39
SHA1:	25D2FF78EB12EF3DB2A3907E8D2CE39C1C5505D9
SHA-256:	1062224668A272A46FF501E338702C675FF7EF413009FF3FA8E5D42BA37A90C4
SHA-512:	55F60ECBE7A0CDC251D8291F9EA40E55CE8B5C0845D1A49476926E1C711882CEF897414C860E95DE43E27282232CC57727203C8F6E5F029D4163BECACD81BB4F
Malicious:	false
URL:	https://security-uk.m.mimecastprotect.com/ttpwp
Preview:	<!doctype html>.<html lang="en">.<head>. <meta charset="utf-8">. <meta http-equiv="X-UA-Compatible" content="IE=edge">. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no, maximum-scale=1, minimum-scale=1">. <title>Mimecast TTP Web Portal</title>. <meta name="apple-mobile-web-app-capable" content="yes">. [if lte IE 10]> <link rel="icon" href="/ttpwp/resources/images/favicon.ico" /> <![endif]-->. <link rel="shortcut icon" href="/ttpwp/resources/images/favicon.ico" />. <link rel="apple-touch-icon" sizes="152x152" href="/ttpwp/resources/images/favicon-mobile.png" />. <link rel="apple-touch-icon-precomposed" sizes="152x152" href="/ttpwp/resources/images/favicon-mobile.png" />. . . <script>window.mimecast = {"branding":{"defaultBranding":{"defaultConfiguration":{"knowledgeBase":{"href":"https://community.mimecast.com/docs/DOC-241","label":"LOGIN_HOME_LNK"},"home":{"href":"http://www.mimec

Chrome Cache Entry: 174

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	17152
Entropy (8bit):	5.391244405499397
Encrypted:	false
SSDEEP:	384:+6W07PLkroKAqnNN6cVSfMSYICv70n6vxVgHNH3pv/EYRs6UmOkLBPUMx:RB7PLkcMTSETv5rgt5EkU8PUu
MD5:	BEC66575E1C280E5041EFB0665141845
SHA1:	42893859EA2DE523193BD7CBD4173E52E9B402C1
SHA-256:	0367BF9BDDF7F8747008FA412393A70E505BBFB63A0F6CEF23D319EE932B786A
SHA-512:	4CC37916CC3757F86895A707A13CE9290C49A4A968E3AD056D23590D2B405EFB73668BF54BAA60BC750C59526A71E73EF4C534FA321B83D8141F2D1BA27C0E17
Malicious:	false
URL:	https://security-uk.m.mimecastprotect.com/ttpwp/resources/languages/en.json
Preview:	{"DECISION_WILL_BE_LOGGED":"Your decision will be logged for tracking and audit purposes.","IN_PRIVATE_BROWSER_MODE_WARNING":"Please leave {{browser}} to complete device enrollment.","IN_PRIVATE_CHROME":"Incognito mode","IN_PRIVATE_FIREFOX":"Private Browsing","IN_PRIVATE_SAFARI":"Private Browsing","IN_PRIVATE_IE":"InPrivate mode","COMPATIBILITY_VIEW":"Compatibility View","IN_PRIVATE_EDGE":"InPrivate mode","DISABLED_COOKIE_ERROR":"<strong>Cookies are required.</strong> To continue, please allow cookies in your browser and try again.","ACCESS_DENIED_MESSAGE_COMPONENT":{"TITLE":"Sorry, you don.t have permission to access this page","DESCRIPTION":"If you need access, please contact your administrator.","LINK_1":"Go to the login page"},"$I18N_ACCOUNT_SWITCH_BAR":{"VIEWING_ACCOUNT":"Viewing account"},"$I18N_ASIDE_RECIPIENTS":{"SEARCH_PLACEHOLDER":"Search recipients","COLUMNS":{"EMAIL":"Recipients","STATUS":"Message Status"},"STATUS":{"DELIVERY":"Pending Delivery","DELIVERED":"Delivered","H

Chrome Cache Entry: 175

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 37608, version 1.0
Category:	downloaded
Size (bytes):	37608
Entropy (8bit):	7.9930739048349935
Encrypted:	true
SSDEEP:	768:NzA1kfxARdebgMmiX+c2BERO9/ufrv7KkffWz6tw2O7i:NzA1k5aebgMmYWH9mfpfSmPOe
MD5:	E5231978386520AFD0019A8F5D007882
SHA1:	5E06725A18323ED9372E3E488D4F6DF1A56B3091
SHA-256:	71BF29B23EAACC10ACE4DB7E3711FD8F16F199F8F5F8FF5895A0BB0C13546509
SHA-512:	D5EEE91E55BFE7FB220705545D6E767C1A969F4E313F1991C220F4EAA05A7ABC83EE9E6B804D1DF90C1779591F587E1FD58230E120CDA529F8C98BC337E4D3D3
Malicious:	false
URL:	https://security-uk.m.mimecastprotect.com/ttpwp/resources/mimecast-icons.bb1a2cd16db9345fc437.woff2?25417273
Preview:	wOF2............../..............................T.V..N...x..S..~..6.$..x. ..2..U.C..T'.a..!...{.1...l.$......\|...(.U...=A.1...PkY..N....t.+P`..Kp.:n......p......~.......-....`;D.vu.p.N.t......]u....m....Hln..a.x..N.gl...'[`..V..L{.....f.9.l..sw7....M.....B..n.M.6.....z..(...)..}>...... .A.KG}.Q...Z.....G.w\K........a..,.F...3....Z.i)-..<l.eEu.eY.e6..66].VY.5.n.....\_..W....J.ARC.{....u...r.H-...x.A-j.z........?...0..K..EU...v...YC..y.?J.{.._..L60.R..%...X...j..B]E..U.w.?.....J....dD..9.'.r....o.....X.l.^@>...wj?w.7S<G3ch..%..2Hr....&.....K..Q..l;.......f..O2$..}H K......s...~.m..t\|..+.........'..,S...H{@.X.S.E....p.g..\|.{E....Vi7...u.:K...r.3s~.....d..........(tC.......D....f....higI..9.q...Y.....J.F.....X...2c./......dM.K........1....&.. L.A,I....gL....2.i.Rd.8.h.0w....=.@.b.Q..@AP.}K?.$.....k..."...D..5....#...3r.eY@(p.........&....\...@..q..1......F k<....=....9G.f*..........y..N..[..._5.....U.@..\|}..u.k2..7...).#y.................d..B

Chrome Cache Entry: 176

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	95292
Entropy (8bit):	5.328593318442354
Encrypted:	false
SSDEEP:	768:LocHtR35eGmh1KxjDnmHtOTEBiQq0rrW3/P880ecomGjmraHnDP64bJ9w/6hFDeY:XtRQ1TMnmHtOTShNrG/W6hFDGNC3LNqQ
MD5:	A792F7BBECA0147C515D7ECAA5479B83
SHA1:	B6B6AB4BA9403B8934E36EF587C612F86180D18B
SHA-256:	FA9682F24595628BABEF9DAC52F38DCB373C4EBA5E555339CC0666B67EEADDAE
SHA-512:	0A2968A420037FB82EB1B8153F687E686DB8A3DCA21EC759ACCEFE3D3C07ED84B045407B36440EFE38F1B0C20655B8389338EE6A286A882D236E74BCD53181FE
Malicious:	false
URL:	https://security-uk.m.mimecastprotect.com/ttpwp/resources/polyfills.5257ca6e429949972959.js
Preview:	(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[2],{"0TWp":function(e,t,n){"use strict";var r,i,o=this&&this.__spreadArray\|\|function(e,t,n){if(n\|\|2===arguments.length)for(var r,i=0,o=t.length;i<o;i++)!r&&i in t\|\|(r\|\|(r=Array.prototype.slice.call(t,0,i)),r[i]=t[i]);return e.concat(r\|\|Array.prototype.slice.call(t))};void 0===(i="function"==typeof(r=function(){!function(e){var t=e.performance;function n(e){t&&t.mark&&t.mark(e)}function r(e,n){t&&t.measure&&t.measure(e,n)}n("Zone");var i=e.__Zone_symbol_prefix\|\|"__zone_symbol__";function o(e){return i+e}var a=!0===e[o("forceDuplicateZoneCheck")];if(e.Zone){if(a\|\|"function"!=typeof e.Zone.__symbol__)throw new Error("Zone already loaded.");return e.Zone}var s=function(){function t(e,t){this._parent=e,this._name=t?t.name\|\|"unnamed":"<root>",this._properties=t&&t.properties\|\|{},this._zoneDelegate=new l(this,this._parent&&this._parent._zoneDelegate,t)}return t.assertZonePatched=function(){if(e.Promise!==R.ZoneAwarePromise)throw new Error("

Chrome Cache Entry: 177

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.755948041571961
Encrypted:	false
SSDEEP:	3:PouV7uJLzLcvzSAEtvxLzUbSodX7JH4vrLUe9ubygGjxcM16SWXxVWRaecKBc4NM:hxuJLzLcbzEdxqXLorwe9UygqxcMUSWp
MD5:	B574A8D3BC4C6A4FE57E89008E9645A3
SHA1:	471EBF49ADD18D605FD24F188DD460F165DDEF45
SHA-256:	3237A8FE51F94BBF3E3E38E4A8E0DC1A643F5DFB5C49D265A8B456CD646D6FCC
SHA-512:	011CB4A90C3B5A4D467B8765A51121CC2AAE9F5C1B570DC82D73D3B12B32F63928F6BD9BE96C5410212392A13DA287154D729A1E0D21AF3E13CCB07F2DD11224
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<head>. <title></title>.</head>.<body>.<h1>Error 404</h1>.<h2>Sorry, page not found.</h2>.<p>We could not find the page you requested.</p>.</body>.</html>

Chrome Cache Entry: 178

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	410447
Entropy (8bit):	4.969948893141297
Encrypted:	false
SSDEEP:	1536:UgttQTtsXFCVwRFtoN5h6SF9t/kqpEE9lcl2ldk66LebnuyMKdPSNZSp+4e4VgHo:UG7RFtoN5OebnuyRdPSPSEGR
MD5:	0AF2F9447CC29B13B5986BB0B2DF1201
SHA1:	18A26C55CB12A8CB5A40738D63EBBADFF9C9E157
SHA-256:	DD23B2D3B699647A55640F98703B96CF76473C19969E11AB05653DBDF5ABCE0C
SHA-512:	2FBAED69A7952BF59AA5EBD987A736AB90F1C1E1547886C8634768EEC6CFB02D0A733ECFC2F0935DC2E7A44D87071044EEC39F2005D1EBBC0F97B6BCC8486B8C
Malicious:	false
URL:	https://security-uk.m.mimecastprotect.com/ttpwp/resources/styles.5257ca6e429949972959.js
Preview:	(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[4],{3:function(n,e,o){n.exports=o("lEuh")},JPst:function(n,e,o){"use strict";n.exports=function(n){var e=[];return e.toString=function(){return this.map(function(e){var o=n(e);return e[2]?"@media ".concat(e[2]," {").concat(o,"}"):o}).join("")},e.i=function(n,o,t){"string"==typeof n&&(n=[[null,n,""]]);var a={};if(t)for(var r=0;r<this.length;r++){var c=this[r][0];null!=c&&(a[c]=!0)}for(var l=0;l<n.length;l++){var i=[].concat(n[l]);t&&a[i[0]]\|\|(o&&(i[2]=i[2]?"".concat(o," and ").concat(i[2]):o),e.push(i))}},e}},LboF:function(n,e,o){"use strict";var t,a=function(){var n={};return function(e){if(void 0===n[e]){var o=document.querySelector(e);if(window.HTMLIFrameElement&&o instanceof window.HTMLIFrameElement)try{o=o.contentDocument.head}catch(t){o=null}n[e]=o}return n[e]}}(),r=[];function c(n){for(var e=-1,o=0;o<r.length;o++)if(r[o].identifier===n){e=o;break}return e}function l(n,e){for(var o={},t=[],a=0;a<n.length;a++){var l=n[a],i=e.base

Chrome Cache Entry: 179

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	1256
Entropy (8bit):	4.757453290014263
Encrypted:	false
SSDEEP:	24:0pbMMpAYuOjM/fHxAYJwPp2AEPmbW1E6FD8EVyiJZni/1/EmDFf2kzj:0hpqkM6YJwh8PmbWO65siJZi/9jplzj
MD5:	84238DFC8092E5D9C0DAC8EF93371A07
SHA1:	4A3CE8EE11E091DD7923F4D8C6E5B5E41EC7C047
SHA-256:	EA8FAC7C65FB589B0D53560F5251F74F9E9B243478DCB6B3EA79B5E36449C8D9
SHA-512:	D06B93C883F8126A04589937A884032DF031B05518EED9D433EFB6447834DF2596AEBD500D69B8283E5702D988ED49655AE654C1683C7A4AE58BFA6B92F2B73A
Malicious:	false
URL:	https://www.example.com/
Preview:	<!doctype html>.<html>.<head>. <title>Example Domain</title>.. <meta charset="utf-8" />. <meta http-equiv="Content-type" content="text/html; charset=utf-8" />. <meta name="viewport" content="width=device-width, initial-scale=1" />. <style type="text/css">. body {. background-color: #f0f0f2;. margin: 0;. padding: 0;. font-family: -apple-system, system-ui, BlinkMacSystemFont, "Segoe UI", "Open Sans", "Helvetica Neue", Helvetica, Arial, sans-serif;. . }. div {. width: 600px;. margin: 5em auto;. padding: 2em;. background-color: #fdfdff;. border-radius: 0.5em;. box-shadow: 2px 3px 7px 2px rgba(0,0,0,0.02);. }. a:link, a:visited {. color: #38488f;. text-decoration: none;. }. @media (max-width: 700px) {. div {. margin: 0 auto;. width: auto;. }. }. </style> .</head>..<body>.<div>. <h1>Example Domain</h1>. <p>This domai

Chrome Cache Entry: 180

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 254 x 120, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4228
Entropy (8bit):	7.468692581181979
Encrypted:	false
SSDEEP:	96:vSn6knmWIrIlW/QHCZhHF4HVywjjjWm3QsVA56VBT1CvWrBLjjjjQ:vSn6knDiZhCIwjjjH31VAgBTm0RjjjjQ
MD5:	EB9048F8FBF87B993E77B0AB95DAAA60
SHA1:	38B9F52981F1E3E7C0AA3F9C0773D971D28218BC
SHA-256:	35175BBAB647CEC8479F295A98978D170CD7B62E5FD3F7B64DEFAE81B517B16A
SHA-512:	4C4E50D85B3A1F21674CF080DBD3227FBEECA50B1C6B113E1767E8D6AECF666BE65CBC7A86E17C8E9A72A24AFE335C3EB70C392278E31171D90603AD42FC7E3C
Malicious:	false
URL:	https://security-uk.m.mimecastprotect.com/ttpwp/resources/images/mimecast-logo.png
Preview:	.PNG........IHDR.......x.......O.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 21.0 (Windows)" xmp:CreateDate="2021-10-29T15:56:24+01:00" xmp:ModifyDate="2021-11-02T15:28:31Z" xmp:MetadataDate="2021-11-02T15:28:31Z" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:e59b0272-9f84-d042-b610-49114ee72bcc" xmpMM:DocumentID="xmp.did:0289126f-2158-4f47-aeef-18573cdfc66d" xmpMM:OriginalDocumentID

Chrome Cache Entry: 181

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	downloaded
Size (bytes):	1150
Entropy (8bit):	3.28732561467651
Encrypted:	false
SSDEEP:	12:qmiiaZgszpGHr0Tn8D+c35COXpapjD4k1PZiwae4vPdeegbOh6mv8n:AusLGfEhB9a6mE
MD5:	44385673EEF386EC121603CD302FD05F
SHA1:	C15A6D61054FFB16D8DF4DA943B545349FC82631
SHA-256:	069E8A1E31ABA074CC28BC9D6D54C67495BD42A02115DC232BE7C8D9F83E40A8
SHA-512:	E80C43BE006B5EEB66F98192B177163E92B75A5CD0AAA880ADE24A67DB7A1F29A0CB958B158244DB47386CDC775DD025E0FC1F97E3D7ADCDDB76D347F3073DA7
Malicious:	false
URL:	https://security-uk.m.mimecastprotect.com/ttpwp/resources/images/favicon.ico
Preview:	............ .h.......(....... ..... .........................................................................................................\|kW.\|kW.................................................\|kW.\|kW.\|kW.\|kW.\|kW.\|kW.....\|kW.\|kW2............................\|kW.\|kW.\|kW.\|kW.\|kW.\|kW.....\|kW.\|kW.\|kWX....................\|kW.\|kW.\|kW.........\|kW.\|kW.\|kW.\|kW.\|kW.\|kW.\|kW<................\|kWm\|kW.\|kW.........\|kW.\|kW.\|kWg\|kW.\|kW.\|kW.\|kW.\|kW.................\|kW.\|kW.\|kW.\|kW.\|kW.\|kWn....\|kW.\|kW.\|kW.\|kW.\|kWr....................\|kWn\|kW.\|kW.\|kWU........\|kW.\|kW.\|kW.\|kW.\|kW.\|kW.....................\|kW\|\|kWe............\|kW.\|kW.\|kW.\|kW.\|kW.\|kW=....................\|kW.\|kWa\|kW.\|kW.\|kW.\|kW{\|kW.\|kW.\|kW}\|kW.\|kW.................\|kW)\|kW.\|kW.\|kW.\|kW.\|kW.\|kW`............\|kWy\|kW.................\|kWW\|kW.\|kW.\|kW.\|kW.\|kW.\|kW`............\|kWN\|kW.................\|kW`\|kW.\|kW.\|kW.\|kW.\|kW.\|kW`\|kW.\|kWb\|kW.\|kW.\|kW.................\|kW.\|kW&\|kWS\|kW.\|kW.\|kW.\|kW.\|kW.\|kW.\|kW~\|kW@\|kW ................................\|kW.\|kW.\|kW.\|k

Chrome Cache Entry: 182

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1492), with no line terminators
Category:	dropped
Size (bytes):	1492
Entropy (8bit):	5.1504605464747675
Encrypted:	false
SSDEEP:	24:ECoyffRGmcH7LprYMEw7zsQCBm3lBmGa0BTLWwMWiB/azfIvJkwIdd8BtIcf:EhyHRZclYME0QQuKTLWnBeYkVd8By8
MD5:	3AD4DE7EFFAAC3D0048EF54F8491451F
SHA1:	B807DD524C22B9F6241B1EF14AD6902D5C9D9215
SHA-256:	6C36E59711DF161A3D7A2D6FB3E5C17A8767A2F42AEADD9BF166830FDB8ACD5E
SHA-512:	B605EE47C436722BD21C501299EE1A6D96CC34D582003D6DD539AEE7A91E4EC78BFB6194E2226179627A5152DE16A7ADA2462BA5856F1FAF2647A65D24AB9CBE
Malicious:	false
Preview:	!function(e){function r(r){for(var n,l,p=r[0],f=r[1],i=r[2],c=0,s=[];c<p.length;c++)l=p[c],Object.prototype.hasOwnProperty.call(o,l)&&o[l]&&s.push(o[l][0]),o[l]=0;for(n in f)Object.prototype.hasOwnProperty.call(f,n)&&(e[n]=f[n]);for(a&&a(r);s.length;)s.shift()();return u.push.apply(u,i\|\|[]),t()}function t(){for(var e,r=0;r<u.length;r++){for(var t=u[r],n=!0,p=1;p<t.length;p++)0!==o[t[p]]&&(n=!1);n&&(u.splice(r--,1),e=l(l.s=t[0]))}return e}var n={},o={0:0},u=[];function l(r){if(n[r])return n[r].exports;var t=n[r]={i:r,l:!1,exports:{}};return e[r].call(t.exports,t,t.exports,l),t.l=!0,t.exports}l.m=e,l.c=n,l.d=function(e,r,t){l.o(e,r)\|\|Object.defineProperty(e,r,{enumerable:!0,get:t})},l.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},l.t=function(e,r){if(1&r&&(e=l(e)),8&r)return e;if(4&r&&"object"==typeof e&&e&&e.__esModule)return e;var t=Object.create(null);if(l.r(t

Chrome Cache Entry: 183

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 254 x 120, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4228
Entropy (8bit):	7.468692581181979
Encrypted:	false
SSDEEP:	96:vSn6knmWIrIlW/QHCZhHF4HVywjjjWm3QsVA56VBT1CvWrBLjjjjQ:vSn6knDiZhCIwjjjH31VAgBTm0RjjjjQ
MD5:	EB9048F8FBF87B993E77B0AB95DAAA60
SHA1:	38B9F52981F1E3E7C0AA3F9C0773D971D28218BC
SHA-256:	35175BBAB647CEC8479F295A98978D170CD7B62E5FD3F7B64DEFAE81B517B16A
SHA-512:	4C4E50D85B3A1F21674CF080DBD3227FBEECA50B1C6B113E1767E8D6AECF666BE65CBC7A86E17C8E9A72A24AFE335C3EB70C392278E31171D90603AD42FC7E3C
Malicious:	false
Preview:	.PNG........IHDR.......x.......O.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 21.0 (Windows)" xmp:CreateDate="2021-10-29T15:56:24+01:00" xmp:ModifyDate="2021-11-02T15:28:31Z" xmp:MetadataDate="2021-11-02T15:28:31Z" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:e59b0272-9f84-d042-b610-49114ee72bcc" xmpMM:DocumentID="xmp.did:0289126f-2158-4f47-aeef-18573cdfc66d" xmpMM:OriginalDocumentID

Chrome Cache Entry: 184

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1042084
Entropy (8bit):	5.585805715375964
Encrypted:	false
SSDEEP:	24576:mGKAoVuog6AhVuhgqWHAhVuhISFSr3TSZWkcSO2dpoFPQ+Lgl9SclgDFaGa3mDKt:jFS3y9Sclg+3ZjMdX56Udy8sx
MD5:	5F0D3A7E853059D6E1BF72263336A1B6
SHA1:	1D2860B87C7C0DFBC8A4BB72733BFA811108826D
SHA-256:	C1C6725B64EE8DDB255DE008BDFFB528CB91B10DE40B67737E0B6DD9C47C6096
SHA-512:	2C56B00157F0C55DA7DCEE2319799C01C4F21F3E88A6A5CB9BBF168A86B89C525CF45ACAC4267DDB0E41F6F77BF4F0FD2CDB9909D245E927F428BAD8581D213D
Malicious:	false
URL:	https://security-uk.m.mimecastprotect.com/ttpwp/resources/main.5257ca6e429949972959.js
Preview:	(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[1],{"+br3":function(e,t,n){!function(e){"use strict";e.defineLocale("eu",{months:"urtarrila_otsaila_martxoa_apirila_maiatza_ekaina_uztaila_abuztua_iraila_urria_azaroa_abendua".split("_"),monthsShort:"urt._ots._mar._api._mai._eka._uzt._abu._ira._urr._aza._abe.".split("_"),monthsParseExact:!0,weekdays:"igandea_astelehena_asteartea_asteazkena_osteguna_ostirala_larunbata".split("_"),weekdaysShort:"ig._al._ar._az._og._ol._lr.".split("_"),weekdaysMin:"ig_al_ar_az_og_ol_lr".split("_"),weekdaysParseExact:!0,longDateFormat:{LT:"HH:mm",LTS:"HH:mm:ss",L:"YYYY-MM-DD",LL:"YYYY[ko] MMMM[ren] D[a]",LLL:"YYYY[ko] MMMM[ren] D[a] HH:mm",LLLL:"dddd, YYYY[ko] MMMM[ren] D[a] HH:mm",l:"YYYY-M-D",ll:"YYYY[ko] MMM D[a]",lll:"YYYY[ko] MMM D[a] HH:mm",llll:"ddd, YYYY[ko] MMM D[a] HH:mm"},calendar:{sameDay:"[gaur] LT[etan]",nextDay:"[bihar] LT[etan]",nextWeek:"dddd LT[etan]",lastDay:"[atzo] LT[etan]",lastWeek:"[aurreko] dddd LT[etan]",sameElse:"L"},relativeTim

Chrome Cache Entry: 185

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	1256
Entropy (8bit):	4.757453290014263
Encrypted:	false
SSDEEP:	24:0pbMMpAYuOjM/fHxAYJwPp2AEPmbW1E6FD8EVyiJZni/1/EmDFf2kzj:0hpqkM6YJwh8PmbWO65siJZi/9jplzj
MD5:	84238DFC8092E5D9C0DAC8EF93371A07
SHA1:	4A3CE8EE11E091DD7923F4D8C6E5B5E41EC7C047
SHA-256:	EA8FAC7C65FB589B0D53560F5251F74F9E9B243478DCB6B3EA79B5E36449C8D9
SHA-512:	D06B93C883F8126A04589937A884032DF031B05518EED9D433EFB6447834DF2596AEBD500D69B8283E5702D988ED49655AE654C1683C7A4AE58BFA6B92F2B73A
Malicious:	false
URL:	https://www.example.com/favicon.ico
Preview:	<!doctype html>.<html>.<head>. <title>Example Domain</title>.. <meta charset="utf-8" />. <meta http-equiv="Content-type" content="text/html; charset=utf-8" />. <meta name="viewport" content="width=device-width, initial-scale=1" />. <style type="text/css">. body {. background-color: #f0f0f2;. margin: 0;. padding: 0;. font-family: -apple-system, system-ui, BlinkMacSystemFont, "Segoe UI", "Open Sans", "Helvetica Neue", Helvetica, Arial, sans-serif;. . }. div {. width: 600px;. margin: 5em auto;. padding: 2em;. background-color: #fdfdff;. border-radius: 0.5em;. box-shadow: 2px 3px 7px 2px rgba(0,0,0,0.02);. }. a:link, a:visited {. color: #38488f;. text-decoration: none;. }. @media (max-width: 700px) {. div {. margin: 0 auto;. width: auto;. }. }. </style> .</head>..<body>.<div>. <h1>Example Domain</h1>. <p>This domai

Chrome Cache Entry: 186

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	95292
Entropy (8bit):	5.328593318442354
Encrypted:	false
SSDEEP:	768:LocHtR35eGmh1KxjDnmHtOTEBiQq0rrW3/P880ecomGjmraHnDP64bJ9w/6hFDeY:XtRQ1TMnmHtOTShNrG/W6hFDGNC3LNqQ
MD5:	A792F7BBECA0147C515D7ECAA5479B83
SHA1:	B6B6AB4BA9403B8934E36EF587C612F86180D18B
SHA-256:	FA9682F24595628BABEF9DAC52F38DCB373C4EBA5E555339CC0666B67EEADDAE
SHA-512:	0A2968A420037FB82EB1B8153F687E686DB8A3DCA21EC759ACCEFE3D3C07ED84B045407B36440EFE38F1B0C20655B8389338EE6A286A882D236E74BCD53181FE
Malicious:	false
Preview:	(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[2],{"0TWp":function(e,t,n){"use strict";var r,i,o=this&&this.__spreadArray\|\|function(e,t,n){if(n\|\|2===arguments.length)for(var r,i=0,o=t.length;i<o;i++)!r&&i in t\|\|(r\|\|(r=Array.prototype.slice.call(t,0,i)),r[i]=t[i]);return e.concat(r\|\|Array.prototype.slice.call(t))};void 0===(i="function"==typeof(r=function(){!function(e){var t=e.performance;function n(e){t&&t.mark&&t.mark(e)}function r(e,n){t&&t.measure&&t.measure(e,n)}n("Zone");var i=e.__Zone_symbol_prefix\|\|"__zone_symbol__";function o(e){return i+e}var a=!0===e[o("forceDuplicateZoneCheck")];if(e.Zone){if(a\|\|"function"!=typeof e.Zone.__symbol__)throw new Error("Zone already loaded.");return e.Zone}var s=function(){function t(e,t){this._parent=e,this._name=t?t.name\|\|"unnamed":"<root>",this._properties=t&&t.properties\|\|{},this._zoneDelegate=new l(this,this._parent&&this._parent._zoneDelegate,t)}return t.assertZonePatched=function(){if(e.Promise!==R.ZoneAwarePromise)throw new Error("

Chrome Cache Entry: 187

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 168824, version 331.-31196
Category:	downloaded
Size (bytes):	168824
Entropy (8bit):	7.998492807885771
Encrypted:	true
SSDEEP:	3072:N4geYVqJbc9ydAQpiOlqADfSVjExEGii5BqDW9:zeR4yuQc4agXiCBim
MD5:	A3D7D331957546AE10AD69BB44B83A04
SHA1:	D1A227A182628C48649912E8BCD9251113E9C783
SHA-256:	3BBB0DF89B8DBE8001E8C24DE4E2D1693F94997B29F007A7BDA22A9802832768
SHA-512:	614C9697605EFD52116765E6F53792304C536AA9953FD9309BA4912476D016BE360DAD69DACF8D14E5DE19F73C8619A37F3A380E3AC84FA0D17058D89246F0E2
Malicious:	false
URL:	https://security-uk.m.mimecastprotect.com/ttpwp/resources/fa-regular-400.33904a1b964c9b363ce7.woff2
Preview:	wOF2.......x............K.$....................?FFTM....`........t..J.6.$..\|..... ..F...=[.w.C..o..rN....L....l........T............pW9.......d"....IN.A..Qh..<..$........I..e.N...eP...@..@^5.L%UR..&.z#[)r#...Z.{}h..;..-............py@..M....l.x.'\|..y%.......t..P..Sw....n.....4.\L.]<.........nF..T.H.i.G8.a..h.&s..~..Z....,.tK..5p9.^..k.w:u.L...Z..?.\4...9....~..eSk..1].L...T.u.1.q....ZZk..M"......w>>.Y'...?.g....Ua .....5.A. q...........H..7.(.......QU.@VVUx............._.r..w...(.........^V...{..\|.. c4.. ..'1..m..... .BF.H\..vf.A_..u!u.n...dy..}..[.b.}..{..fI.....7<...%B...%X.`.......c.B=v..p.S#..>78..{8..........._q.Q..&.{.n...B.*...(..OWy..>..L.]]3.I..Y. ..J..9Z..r\|..FF...........=.q.I....9p......-.N..#t.x%..6.@..6.W...k.<..Y@G..?.n.P.2dLAe(........T@7..+.s.ZI......eC[fZ.7.........#.G......W.....p..0\... .. DB.EQ.l..w..7..R.L..}...[.5.5..`..5.7F.F......T.PT..(..#Q.E_....._._.......o.Z.!2...`.........%.+.@....+........6...1G.n....<?.zzeRP..p.

Chrome Cache Entry: 188

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.755948041571961
Encrypted:	false
SSDEEP:	3:PouV7uJLzLcvzSAEtvxLzUbSodX7JH4vrLUe9ubygGjxcM16SWXxVWRaecKBc4NM:hxuJLzLcbzEdxqXLorwe9UygqxcMUSWp
MD5:	B574A8D3BC4C6A4FE57E89008E9645A3
SHA1:	471EBF49ADD18D605FD24F188DD460F165DDEF45
SHA-256:	3237A8FE51F94BBF3E3E38E4A8E0DC1A643F5DFB5C49D265A8B456CD646D6FCC
SHA-512:	011CB4A90C3B5A4D467B8765A51121CC2AAE9F5C1B570DC82D73D3B12B32F63928F6BD9BE96C5410212392A13DA287154D729A1E0D21AF3E13CCB07F2DD11224
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<head>. <title></title>.</head>.<body>.<h1>Error 404</h1>.<h2>Sorry, page not found.</h2>.<p>We could not find the page you requested.</p>.</body>.</html>

Chrome Cache Entry: 189

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.755948041571961
Encrypted:	false
SSDEEP:	3:PouV7uJLzLcvzSAEtvxLzUbSodX7JH4vrLUe9ubygGjxcM16SWXxVWRaecKBc4NM:hxuJLzLcbzEdxqXLorwe9UygqxcMUSWp
MD5:	B574A8D3BC4C6A4FE57E89008E9645A3
SHA1:	471EBF49ADD18D605FD24F188DD460F165DDEF45
SHA-256:	3237A8FE51F94BBF3E3E38E4A8E0DC1A643F5DFB5C49D265A8B456CD646D6FCC
SHA-512:	011CB4A90C3B5A4D467B8765A51121CC2AAE9F5C1B570DC82D73D3B12B32F63928F6BD9BE96C5410212392A13DA287154D729A1E0D21AF3E13CCB07F2DD11224
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<head>. <title></title>.</head>.<body>.<h1>Error 404</h1>.<h2>Sorry, page not found.</h2>.<p>We could not find the page you requested.</p>.</body>.</html>

Chrome Cache Entry: 190

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	17152
Entropy (8bit):	5.391244405499397
Encrypted:	false
SSDEEP:	384:+6W07PLkroKAqnNN6cVSfMSYICv70n6vxVgHNH3pv/EYRs6UmOkLBPUMx:RB7PLkcMTSETv5rgt5EkU8PUu
MD5:	BEC66575E1C280E5041EFB0665141845
SHA1:	42893859EA2DE523193BD7CBD4173E52E9B402C1
SHA-256:	0367BF9BDDF7F8747008FA412393A70E505BBFB63A0F6CEF23D319EE932B786A
SHA-512:	4CC37916CC3757F86895A707A13CE9290C49A4A968E3AD056D23590D2B405EFB73668BF54BAA60BC750C59526A71E73EF4C534FA321B83D8141F2D1BA27C0E17
Malicious:	false
Preview:	{"DECISION_WILL_BE_LOGGED":"Your decision will be logged for tracking and audit purposes.","IN_PRIVATE_BROWSER_MODE_WARNING":"Please leave {{browser}} to complete device enrollment.","IN_PRIVATE_CHROME":"Incognito mode","IN_PRIVATE_FIREFOX":"Private Browsing","IN_PRIVATE_SAFARI":"Private Browsing","IN_PRIVATE_IE":"InPrivate mode","COMPATIBILITY_VIEW":"Compatibility View","IN_PRIVATE_EDGE":"InPrivate mode","DISABLED_COOKIE_ERROR":"<strong>Cookies are required.</strong> To continue, please allow cookies in your browser and try again.","ACCESS_DENIED_MESSAGE_COMPONENT":{"TITLE":"Sorry, you don.t have permission to access this page","DESCRIPTION":"If you need access, please contact your administrator.","LINK_1":"Go to the login page"},"$I18N_ACCOUNT_SWITCH_BAR":{"VIEWING_ACCOUNT":"Viewing account"},"$I18N_ASIDE_RECIPIENTS":{"SEARCH_PLACEHOLDER":"Search recipients","COLUMNS":{"EMAIL":"Recipients","STATUS":"Message Status"},"STATUS":{"DELIVERY":"Pending Delivery","DELIVERED":"Delivered","H

Chrome Cache Entry: 191

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	410447
Entropy (8bit):	4.969948893141297
Encrypted:	false
SSDEEP:	1536:UgttQTtsXFCVwRFtoN5h6SF9t/kqpEE9lcl2ldk66LebnuyMKdPSNZSp+4e4VgHo:UG7RFtoN5OebnuyRdPSPSEGR
MD5:	0AF2F9447CC29B13B5986BB0B2DF1201
SHA1:	18A26C55CB12A8CB5A40738D63EBBADFF9C9E157
SHA-256:	DD23B2D3B699647A55640F98703B96CF76473C19969E11AB05653DBDF5ABCE0C
SHA-512:	2FBAED69A7952BF59AA5EBD987A736AB90F1C1E1547886C8634768EEC6CFB02D0A733ECFC2F0935DC2E7A44D87071044EEC39F2005D1EBBC0F97B6BCC8486B8C
Malicious:	false
Preview:	(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[4],{3:function(n,e,o){n.exports=o("lEuh")},JPst:function(n,e,o){"use strict";n.exports=function(n){var e=[];return e.toString=function(){return this.map(function(e){var o=n(e);return e[2]?"@media ".concat(e[2]," {").concat(o,"}"):o}).join("")},e.i=function(n,o,t){"string"==typeof n&&(n=[[null,n,""]]);var a={};if(t)for(var r=0;r<this.length;r++){var c=this[r][0];null!=c&&(a[c]=!0)}for(var l=0;l<n.length;l++){var i=[].concat(n[l]);t&&a[i[0]]\|\|(o&&(i[2]=i[2]?"".concat(o," and ").concat(i[2]):o),e.push(i))}},e}},LboF:function(n,e,o){"use strict";var t,a=function(){var n={};return function(e){if(void 0===n[e]){var o=document.querySelector(e);if(window.HTMLIFrameElement&&o instanceof window.HTMLIFrameElement)try{o=o.contentDocument.head}catch(t){o=null}n[e]=o}return n[e]}}(),r=[];function c(n){for(var e=-1,o=0;o<r.length;o++)if(r[o].identifier===n){e=o;break}return e}function l(n,e){for(var o={},t=[],a=0;a<n.length;a++){var l=n[a],i=e.base

Static File Info

General

File type:	RFC 822 mail, ASCII text, with very long lines (347), with CRLF line terminators
Entropy (8bit):	6.127134802030195
TrID:	E-Mail message (Var. 5) (54515/1) 100.00%
File name:	[EXTERNAL] Re_ Quotes.eml
File size:	417'530 bytes
MD5:	3c0db89c15e308a748b61147c7e85c76
SHA1:	75605eb85037f23c90f27ad91b16dc9599258f02
SHA256:	777603c4a68501978f70cefa8d80e399fdf086b57349d6dde0e3f8b3e41ebce2
SHA512:	ff64db9be16252de31c36d8a66511b09e39f54c212623d6224024a2c3e6d9fe2f8c87807533657318c6ecd2d05ab723a1e3e878659a3bb581119b993b75f480e
SSDEEP:	12288:Uik7YaH9iW26xzg9BpeSKABw5jzvRMHfvIq:qQj6w7eSnBw5vsvZ
TLSH:	2C941279DAA904C30238E5F6B41FB95099E5078EC94607F4267C62F1BCDC871632B7BA
File Content Preview:	Received: from LO0P265MB5526.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:229::9).. by LO0P265MB6835.GBRP265.PROD.OUTLOOK.COM with HTTPS; Tue, 22 Oct 2024.. 11:23:59 +0000..Received: from CWLP123CA0078.GBRP123.PROD.OUTLOOK.COM (2603:10a6:401:5b::18).. by LO0P2

Static Mail

General

Subject:	[EXTERNAL] Re: Quotes
From:	Daniel Nicholson <DNicholson@citipost.co.uk>
To:	Sharon Main <sharon.main@whistl.co.uk>
Cc:
BCC:
Date:	Tue, 22 Oct 2024 11:23:47 +0000
Communications:	The request file is from me and legitimate, it has been secured to your email address, Kindly login with your email credentials to view. _____ From: Sharon Main <sharon.main@whistl.co.uk> Sent: Tuesday, October 22, 2024 12:23 PM To: Daniel Nicholson <DNicholson@citipost.co.uk> Subject: RE: Quotes Warning: External email Wrong sharon? Kind Regards, Sharon Main Sales Director Network House, Third Avenue, Marlow, Buckinghamshire, SL7 1EY Phone: 07900 166194 / Email: sharon.main@whistl.co.uk<mailto:sharon.main@whistl.co.uk> www.whistl.co.uk<https://url.uk.m.mimecastprotect.com/s/rS3GCXLO9cGn7LYCVh6FWJ9uL?domain=whistl.co.uk/> Whistl Groups Customer Satisfaction Score Read about our 2024 customer survey results<https://url.uk.m.mimecastprotect.com/s/P5e4CYWP9Ug3oyxU9iGFxYVR2?domain=whistl.co.uk> From: Daniel Nicholson <DNicholson@citipost.co.uk> Sent: 22 October 2024 12:21 To: Daniel Nicholson <DNicholson@citipost.co.uk> Subject: [EXTERNAL] Quotes Importance: High <https://url.uk.m.mimecastprotect.com/s/ZlrZCZYQ9UxMnWNsysRFBA-ZP?domain=hnamedmr.ukremediatlon.co.uk> Hi, Please see attached and revert to me. Best Regards Daniel Nicholson Business Development Manager <https://url.uk.m.mimecastprotect.com/s/lBBfC1WAvUOpwQYUYtmFVP1nh?domain=linkedin.com> mobile: +44 (0)7790 801 401 email: Dnicholson@citipost.co.uk<mailto:Dnicholson@citipost.co.uk> web: citipostmail.co.uk <https://url.uk.m.mimecastprotect.com/s/1k4bC2xBwh6koDwiMu6F5BKCc?domain=urldefense.proofpoint.com> <https://url.uk.m.mimecastprotect.com/s/0c3qC3QDxSxmYrQsYCOFQ4SPB?domain=citipostmail.co.uk/> <https://url.uk.m.mimecastprotect.com/s/cIB8C4Q0yS6JAw1iNFEF4GZlf?domain=urldefense.proofpoint.com> Citipost Mail Unit 3, Swanwick Court, Swanwick, Alfreton, Derbyshire, DE55 7AS, United Kingdom The information contained in this email is the property of Citipost Mail and may contain information which is legally privileged, confidential and exempt from disclosure. If you are not the intended recipient, you are hereby notified that any disclosure, dissemination, or copying of this communication and its attachments is strictly prohibited. If you have received this communication in error, please email it@citipost.co.uk<mailto:it@citipost.co.uk> Citipost Mail is a trading name of Citipost Ltd. Citipost Ltd. Registered in England and Wales No: 3451070. VAT No: 709 9236 10
Attachments:	image009.png image010.png image011.png image012.png image013.png image014.png image015.png image016.png image017.png image018.png

Headers

Key	Value
Received	from PR3PR03MB6522.eurprd03.prod.outlook.com ([fe80::5555:fc:d244:6096]) by PR3PR03MB6522.eurprd03.prod.outlook.com ([fe80::5555:fc:d244:6096%7]) with mapi id 15.20.8069.027; Tue, 22 Oct 2024 11:23:47 +0000
From	Daniel Nicholson <DNicholson@citipost.co.uk>
To	Sharon Main <sharon.main@whistl.co.uk>
Subject	[EXTERNAL] Re: Quotes
Thread-Topic	Quotes
Thread-Index	AQHbJHRvlu8rNnSzGESuAlLD4y62T7KSoI4AgAAAP8o=
X-MS-Exchange-MessageSentRepresentingType	1
Date	Tue, 22 Oct 2024 11:23:47 +0000
Message-ID	<PR3PR03MB652281E91C52656F53A2F4D4FE4C2@PR3PR03MB6522.eurprd03.prod.outlook.com>
References	<B86A19A4-EF83-45C5-A1B5-DE68A0A54599@citipost.co.uk> <LO0P265MB6835097EE006365BE99AAF96D94C2@LO0P265MB6835.GBRP265.PROD.OUTLOOK.COM>
In-Reply-To	<LO0P265MB6835097EE006365BE99AAF96D94C2@LO0P265MB6835.GBRP265.PROD.OUTLOOK.COM>
Accept-Language	en-US
Content-Language	en-US
X-MS-Exchange-Organization-AuthSource	CW2PEPF000056BD.GBRP265.PROD.OUTLOOK.COM
X-MS-Has-Attach	yes
X-MS-Exchange-Organization-Network-Message-Id	03419adc-dcdc-41eb-b821-08dcf28c033c
X-MS-TNEF-Correlator
X-MS-Exchange-Organization-RecordReviewCfmType	0
msip_labels
x-ms-publictraffictype	Email
received-spf	SoftFail (protection.outlook.com: domain of transitioning citipost.co.uk discourages use of 91.220.42.227 as permitted sender)
dkim-signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=citipost.co.uk; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=q653uhq5QEJKa3Piw/eLNyaAdBwwXHU6WNbXhtKMt90=; b=Hg9IUxKNILCojmlMLL3xWZ7ApJrfdGR4cM3rzbGk41MExNLZ0GMCa/IQ02m2w5XUEo+46t7ASKANsorgQL/LHpfZJ3cyOebroa81WGI4mQ+WL+wtE7QPnZSivBItzeMSBZKGayiy5VgIkkr7RboLpOFdvgtamlR+rcUm9xjCiks=
x-mc-unique	YKCxK7GTMD-YW_Ib9wK7CA-1
x-ms-office365-filtering-correlation-id	03419adc-dcdc-41eb-b821-08dcf28c033c
x-ms-traffictypediagnostic	PR3PR03MB6522:EE_\|VI2PR03MB10593:EE_\|CW2PEPF000056BD:EE_\|LO0P265MB5526:EE_\|LO0P265MB6835:EE_
x-microsoft-antispam	BCL:0;ARA:13230040\|35042699022\|30052699003\|5063199012\|5073199012\|4073199012\|22003199012\|8096899003;
x-forefront-antispam-report	CIP:91.220.42.227;CTRY:GB;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:eu-smtp-inbound-delivery-1.mimecast.com;PTR:eu-smtp-inbound-delivery-1.mimecast.com;CAT:NONE;SFS:(13230040)(35042699022)(30052699003)(5063199012)(5073199012)(4073199012)(22003199012)(8096899003);DIR:INB;
x-ms-exchange-crosstenant-network-message-id	03419adc-dcdc-41eb-b821-08dcf28c033c
x-ms-exchange-crosstenant-authsource	CW2PEPF000056BD.GBRP265.PROD.OUTLOOK.COM
x-ms-exchange-crosstenant-authas	Anonymous
x-ms-exchange-crosstenant-originalarrivaltime	22 Oct 2024 11:23:54.3109 (UTC)
x-ms-exchange-crosstenant-fromentityheader	Internet
x-ms-exchange-crosstenant-id	40400545-639d-47f6-b050-241c3300c2dc
x-ms-exchange-transport-crosstenantheadersstamped	LO0P265MB5526
x-mimecast-spam-score	-3
authentication-results	spf=softfail (sender IP is 91.220.42.227) smtp.mailfrom=citipost.co.uk; dkim=fail (signature did not verify) header.d=citipost.co.uk;dmarc=fail action=quarantine header.from=citipost.co.uk;compauth=none reason=451
arc-message-signature	i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=q653uhq5QEJKa3Piw/eLNyaAdBwwXHU6WNbXhtKMt90=; b=i7NwGFPf+E/mBse/Q7y2aCNH6FLHlDqTxngsR+nQgxc213UvgBNC9J7cY6wlXV8knorB96gGx0uYR+QfkGcqoB0uUBvQMjYvq0l2OVztrIjcHLg9PG7ca7RAEknxSIR48KPf09ZTq9maHDkGyJaWJeMqEXfmep9PqYNZ5lPN8Gganue/Km9MI2RWmkbo4prMsOVOhyalvKSa3q69v5LC4FfrrgScS1u7k9haJvAihOzkTkLNM57uVLQ2EPvFtOs8G7UKQgsa7tLI2dWS51Q/vOulXOaPyPxv1YgIRhleCMfpKDFiSwzsuNv2PiuKgnC4NEC0kMgZB50gDAV2gHolQQ==
arc-seal	i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=tgntvqz8+veGflrKIfFNN1EkH+mmtaAbhk3wevt0iZdP8TKcWXqB3y8gdrcgQ1/H7ACE6Q08fxG1SP9knhwMrEMBIu9bPJKCYy5QlOOG13XArO+KszhKMWJuI1F4LVfwU6PIXENChyYR/X9nrPS8euMGgg+VI6vlFLzlIl+5rA3kbi8JtTzWS3algVK4NgA2U6pZfQZL4KVRT+aIeB0ZWHwLiYP18iBawIfe7fM8bidNPvFFmNRSawjV63AcMWrzQ5ry1GNxN+iWdivKyx4w7IZZkry6i1x3oUYapnJd7XW/rFaES/4drojmQBNPWSpgr7hQR1UNcQGXx3v+KhwUhw==
arc-authentication-results	i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=citipost.co.uk; dmarc=pass action=none header.from=citipost.co.uk; dkim=pass header.d=citipost.co.uk; arc=none
x-ms-exchange-transport-endtoendlatency	00:00:04.8225416
x-ms-exchange-processed-by-bccfoldering	15.20.8069.027
x-eopattributedmessage	0
authentication-results-original	relay.mimecast.com; dkim=pass header.d=citipost.co.uk header.s=selector1 header.b=Hg9IUxKN; arc=pass ("microsoft.com:s=arcselector10001:i=1"); dmarc=pass (policy=quarantine) header.from=citipost.co.uk; spf=pass (relay.mimecast.com: domain of dnicholson@citipost.co.uk designates 40.107.105.130 as permitted sender) smtp.mailfrom=dnicholson@citipost.co.uk
x-eoptenantattributedmessage	40400545-639d-47f6-b050-241c3300c2dc:0
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
X-Microsoft-Antispam-Message-Info	FVCC/RsKZFpZ0LillgpFVZFBrbR3IiR/x5itAuPp+leAI3W/rCbJYunohG9cVgosuHGK01Mx1v7Mup5oAAGwxzFdY6sb2U8nR8tM8SUPTErelryb5aFkedJI0Q0kn06i5spSslvjA2Epyi3NB7qarvdGMMQPYrES5X6pfkWs/DfqRgJwuYDnf6vAgHNi9P/VwxETOlASdMD/ocfQrGab6rk9Ou97Axo5eDg+3xd7XDlqO2NP7eQgfCX9z6xVhmY1O7wFubJ3G5XT/eNDPyKLAP2QABLPi0sqhf9PHbAX97EReZV3uabERlNGk4ND3DbirXPVcyb8d4T26iP1q47LtffCFVV6kqD8yE9Fih2tV0BXCuTljRp6yfS8bQm9f9aLLS0PeL402VJJe86xDMcCuBOc0tInw7jckVx4F/3z7uImFJrYxXSGYrCqeBBR7kpSxNoNpn/Yb6tWhphDjiVy72k7z0atT/75HkG7bcFJE6lNIQi1L3RUqk5rYDFI7sDPaQtQRnrJsUsfpitqKwuybovy1Ew30VCU/Btjn6aiOLM3e1GGt0vVYrv/VhHYhKes7MY3aEgCBdQ8mDHqlRPqq9Qt9g+iItG7tuk/tvEKGI6PsH5p+92NiuTq5bELAHhGDoqiPB5cPqMPA05ks9L6jDAVRusFgv9VriWUNiQ1FiQEcdousCOwqmObwe3z0oxikNlnXiF6VyLOTXN+Zwq6N3qakRntpwzy8mYNoVJVdyQtsB4QUJv1h4EwJIeWXgBigjFvmgogWd37mdmgl+sd51zSHYooEgKWDx/K5ZkiZC7nkMhDa+PTjI3V0DIrR+N6u5z/VSer6P2SeBHzOH4Nc7lOo2g19aNGqqY/p1pbefynFfj9IvaIM6TXET1fjhjp7XiHC7xgyv4xxDNa97AEJEDvOsqS+O7eI+xXVR/p8Ltw5tpOfFAXITX+0lM8X5FvNqXqqD7B6DVe81QezsVJ6epQKVHzgWiNZ3lAwrXTwEcnbNQHYaRDVXt1flAdw7aHFnxOQ0YieBQrUqfKt3WDQliT5YahGey3KhVp2ccScIXr/VoFpgne2FECFfl6kPHbTeY5eILz5R9QMhaXuGV4aJkJZgGEvU7k26r9+cxWKQ8Wwt2E6DWyuFK2A9/hO+9jL+B8zYonRJKKh5QQDiHyfqgRnw3SVji+MDhZbkMV8ZyboYb8i7OxhmIs784WQ9WBgK56n0BShOZGXyWaKEIHfKci/9H638SB93Pl6K8HI3jAP+li6qRwes+lGwUz+e9YQCeuQB9suOD6ELnROV22bU9UmDgc+MEsfy5+UEtcmCVshd0HNs/K3iJNRRTe/X4uqaiTe+YYxKP/oHVzlRT+iFAn2wnwH84erMODZTP3JoMeXEOJWrrcc3i722qgLH66H1L1O9v6btQJCWzin4vuyri3rJ556kdnmZaKPsGdAByCKHQbL3OqYhHGklgMZd7ILsoEKxJns/UDuSCdD/KBWj2ldh5r/tUu7Xi/nFVNsyxaSG72w3Nht7oZ8FleFWlqhP50fOMOQDMnrtw6Ty6PXKJrv18E8vNExM92uUHYM+sdiIHguKX67TisQo02Tkrjm0UjeHzNQNmcovktTWoHvlOVDG4l1blXWyUyT7whg8cylnffHN6OYEdrbS3/A30/Ai28DVjg+m0KiaaEr/fKmOX87vSHuSGa49tJMsdYZ7lpiSvdHQW+e2ofc2/xgX3wDyh06xD2m09Bgva7cB0UI0M7O1aU63bcJFrXID2MszGK7aWfzCh1B6qMWuSRAiAEJ/o8ftfITqf/e6DKCU4Ogvc86YKhGmeCLBFExw5t9jDCeUrZMaC5LSaFeI1AkuzPeuuAjevx318TRpWidieWaqfvWg1Os4flY2c6dnYKh34=
Content-Type	multipart/related; boundary="_013_PR3PR03MB652281E91C52656F53A2F4D4FE4C2PR3PR03MB6522eurp_"; type="multipart/alternative"
MIME-Version	1.0

File Icon


Icon Hash:	46070c0a8e0c67d6

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 22, 2024 16:09:38.267852068 CEST	49679	443	192.168.2.18	52.182.141.63
Oct 22, 2024 16:09:38.877248049 CEST	49679	443	192.168.2.18	52.182.141.63
Oct 22, 2024 16:09:40.092650890 CEST	49679	443	192.168.2.18	52.182.141.63
Oct 22, 2024 16:09:40.172593117 CEST	49673	443	192.168.2.18	204.79.197.203
Oct 22, 2024 16:09:42.499578953 CEST	49679	443	192.168.2.18	52.182.141.63
Oct 22, 2024 16:09:47.305584908 CEST	49679	443	192.168.2.18	52.182.141.63
Oct 22, 2024 16:09:47.668561935 CEST	49698	443	192.168.2.18	172.202.163.200
Oct 22, 2024 16:09:47.668626070 CEST	443	49698	172.202.163.200	192.168.2.18
Oct 22, 2024 16:09:47.668716908 CEST	49698	443	192.168.2.18	172.202.163.200
Oct 22, 2024 16:09:47.677222013 CEST	49698	443	192.168.2.18	172.202.163.200
Oct 22, 2024 16:09:47.677258015 CEST	443	49698	172.202.163.200	192.168.2.18
Oct 22, 2024 16:09:48.457138062 CEST	443	49698	172.202.163.200	192.168.2.18
Oct 22, 2024 16:09:48.457216024 CEST	49698	443	192.168.2.18	172.202.163.200
Oct 22, 2024 16:09:48.460284948 CEST	49698	443	192.168.2.18	172.202.163.200
Oct 22, 2024 16:09:48.460299015 CEST	443	49698	172.202.163.200	192.168.2.18
Oct 22, 2024 16:09:48.460575104 CEST	443	49698	172.202.163.200	192.168.2.18
Oct 22, 2024 16:09:48.503547907 CEST	49698	443	192.168.2.18	172.202.163.200
Oct 22, 2024 16:09:49.171561003 CEST	49698	443	192.168.2.18	172.202.163.200
Oct 22, 2024 16:09:49.215337992 CEST	443	49698	172.202.163.200	192.168.2.18
Oct 22, 2024 16:09:49.423635960 CEST	443	49698	172.202.163.200	192.168.2.18
Oct 22, 2024 16:09:49.423657894 CEST	443	49698	172.202.163.200	192.168.2.18
Oct 22, 2024 16:09:49.423669100 CEST	443	49698	172.202.163.200	192.168.2.18
Oct 22, 2024 16:09:49.423707962 CEST	443	49698	172.202.163.200	192.168.2.18
Oct 22, 2024 16:09:49.423762083 CEST	49698	443	192.168.2.18	172.202.163.200
Oct 22, 2024 16:09:49.423789978 CEST	443	49698	172.202.163.200	192.168.2.18
Oct 22, 2024 16:09:49.423794985 CEST	443	49698	172.202.163.200	192.168.2.18
Oct 22, 2024 16:09:49.423815966 CEST	49698	443	192.168.2.18	172.202.163.200
Oct 22, 2024 16:09:49.423841000 CEST	49698	443	192.168.2.18	172.202.163.200
Oct 22, 2024 16:09:49.424763918 CEST	443	49698	172.202.163.200	192.168.2.18
Oct 22, 2024 16:09:49.424838066 CEST	49698	443	192.168.2.18	172.202.163.200
Oct 22, 2024 16:09:49.424840927 CEST	443	49698	172.202.163.200	192.168.2.18
Oct 22, 2024 16:09:49.425549030 CEST	49698	443	192.168.2.18	172.202.163.200
Oct 22, 2024 16:09:49.776639938 CEST	49673	443	192.168.2.18	204.79.197.203
Oct 22, 2024 16:09:49.881143093 CEST	49705	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:49.881194115 CEST	443	49705	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:49.881277084 CEST	49705	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:49.882530928 CEST	49705	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:49.882559061 CEST	443	49705	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:50.117887974 CEST	49698	443	192.168.2.18	172.202.163.200
Oct 22, 2024 16:09:50.117924929 CEST	443	49698	172.202.163.200	192.168.2.18
Oct 22, 2024 16:09:50.117939949 CEST	49698	443	192.168.2.18	172.202.163.200
Oct 22, 2024 16:09:50.117947102 CEST	443	49698	172.202.163.200	192.168.2.18
Oct 22, 2024 16:09:51.007416964 CEST	443	49705	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:51.007548094 CEST	49705	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:51.045253992 CEST	49705	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:51.045280933 CEST	443	49705	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:51.045649052 CEST	443	49705	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:51.047147036 CEST	49705	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:51.047184944 CEST	49705	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:51.047247887 CEST	443	49705	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:51.462553024 CEST	443	49705	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:51.462584019 CEST	443	49705	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:51.462615967 CEST	443	49705	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:51.462639093 CEST	49705	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:51.462661982 CEST	443	49705	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:51.463337898 CEST	49705	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:51.463386059 CEST	49705	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:51.463427067 CEST	49705	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:51.463556051 CEST	443	49705	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:51.463586092 CEST	443	49705	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:51.463637114 CEST	49705	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:51.592041969 CEST	49706	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:51.592089891 CEST	443	49706	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:51.592240095 CEST	49706	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:51.592511892 CEST	49706	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:51.592549086 CEST	443	49706	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:52.687508106 CEST	443	49706	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:52.688440084 CEST	49706	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:52.688458920 CEST	443	49706	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:52.689107895 CEST	49706	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:52.689116955 CEST	443	49706	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:52.689163923 CEST	49706	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:52.689181089 CEST	443	49706	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:53.111140966 CEST	443	49706	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:53.111196041 CEST	443	49706	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:53.111253023 CEST	443	49706	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:53.111329079 CEST	49706	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:53.111329079 CEST	49706	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:53.111341000 CEST	443	49706	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:53.111757994 CEST	49706	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:53.111757994 CEST	49706	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:53.111773014 CEST	443	49706	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:53.112095118 CEST	443	49706	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:53.112165928 CEST	443	49706	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:53.112252951 CEST	49706	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:53.166286945 CEST	49707	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:53.166340113 CEST	443	49707	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:53.166425943 CEST	49707	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:53.166687012 CEST	49707	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:53.166702986 CEST	443	49707	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:54.288081884 CEST	443	49707	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:54.288280010 CEST	49707	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:54.290834904 CEST	49707	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:54.290848017 CEST	443	49707	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:54.291173935 CEST	443	49707	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:54.295263052 CEST	49707	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:54.295339108 CEST	49707	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:54.295402050 CEST	443	49707	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:54.695111036 CEST	443	49707	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:54.695146084 CEST	443	49707	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:54.695190907 CEST	443	49707	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:54.695286989 CEST	49707	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:54.695336103 CEST	443	49707	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:54.695354939 CEST	49707	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:54.695835114 CEST	49707	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:54.695859909 CEST	49707	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:54.696016073 CEST	443	49707	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:54.696052074 CEST	443	49707	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:54.696105957 CEST	49707	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:54.760016918 CEST	49709	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:54.760077000 CEST	443	49709	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:54.760170937 CEST	49709	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:54.760387897 CEST	49709	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:54.760405064 CEST	443	49709	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:55.872102976 CEST	443	49709	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:55.873063087 CEST	49709	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:55.873116970 CEST	443	49709	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:55.874095917 CEST	49709	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:55.874109030 CEST	443	49709	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:55.874141932 CEST	49709	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:55.874155998 CEST	443	49709	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:56.279268026 CEST	443	49709	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:56.279304981 CEST	443	49709	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:56.279335022 CEST	443	49709	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:56.279524088 CEST	49709	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:56.279552937 CEST	443	49709	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:56.279933929 CEST	49709	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:56.279942036 CEST	443	49709	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:56.279956102 CEST	49709	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:56.280107021 CEST	443	49709	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:56.280138969 CEST	443	49709	40.126.32.138	192.168.2.18
Oct 22, 2024 16:09:56.280184984 CEST	49709	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:09:56.908595085 CEST	49679	443	192.168.2.18	52.182.141.63
Oct 22, 2024 16:10:26.481029987 CEST	49710	443	192.168.2.18	20.109.210.53
Oct 22, 2024 16:10:26.481065035 CEST	443	49710	20.109.210.53	192.168.2.18
Oct 22, 2024 16:10:26.481408119 CEST	49710	443	192.168.2.18	20.109.210.53
Oct 22, 2024 16:10:26.481739998 CEST	49710	443	192.168.2.18	20.109.210.53
Oct 22, 2024 16:10:26.481758118 CEST	443	49710	20.109.210.53	192.168.2.18
Oct 22, 2024 16:10:27.277040005 CEST	443	49710	20.109.210.53	192.168.2.18
Oct 22, 2024 16:10:27.277209997 CEST	49710	443	192.168.2.18	20.109.210.53
Oct 22, 2024 16:10:27.279129028 CEST	49710	443	192.168.2.18	20.109.210.53
Oct 22, 2024 16:10:27.279145956 CEST	443	49710	20.109.210.53	192.168.2.18
Oct 22, 2024 16:10:27.279408932 CEST	443	49710	20.109.210.53	192.168.2.18
Oct 22, 2024 16:10:27.286158085 CEST	49710	443	192.168.2.18	20.109.210.53
Oct 22, 2024 16:10:27.327334881 CEST	443	49710	20.109.210.53	192.168.2.18
Oct 22, 2024 16:10:27.550246000 CEST	443	49710	20.109.210.53	192.168.2.18
Oct 22, 2024 16:10:27.550273895 CEST	443	49710	20.109.210.53	192.168.2.18
Oct 22, 2024 16:10:27.550343990 CEST	443	49710	20.109.210.53	192.168.2.18
Oct 22, 2024 16:10:27.550523996 CEST	49710	443	192.168.2.18	20.109.210.53
Oct 22, 2024 16:10:27.550523996 CEST	49710	443	192.168.2.18	20.109.210.53
Oct 22, 2024 16:10:27.550540924 CEST	443	49710	20.109.210.53	192.168.2.18
Oct 22, 2024 16:10:27.550631046 CEST	49710	443	192.168.2.18	20.109.210.53
Oct 22, 2024 16:10:27.552089930 CEST	443	49710	20.109.210.53	192.168.2.18
Oct 22, 2024 16:10:27.552149057 CEST	443	49710	20.109.210.53	192.168.2.18
Oct 22, 2024 16:10:27.552184105 CEST	49710	443	192.168.2.18	20.109.210.53
Oct 22, 2024 16:10:27.552191019 CEST	443	49710	20.109.210.53	192.168.2.18
Oct 22, 2024 16:10:27.552201986 CEST	443	49710	20.109.210.53	192.168.2.18
Oct 22, 2024 16:10:27.552217960 CEST	49710	443	192.168.2.18	20.109.210.53
Oct 22, 2024 16:10:27.552321911 CEST	49710	443	192.168.2.18	20.109.210.53
Oct 22, 2024 16:10:27.554224968 CEST	49710	443	192.168.2.18	20.109.210.53
Oct 22, 2024 16:10:27.554246902 CEST	443	49710	20.109.210.53	192.168.2.18
Oct 22, 2024 16:10:27.554256916 CEST	49710	443	192.168.2.18	20.109.210.53
Oct 22, 2024 16:10:27.554261923 CEST	443	49710	20.109.210.53	192.168.2.18
Oct 22, 2024 16:10:34.052136898 CEST	49711	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:10:34.052208900 CEST	443	49711	40.126.32.138	192.168.2.18
Oct 22, 2024 16:10:34.052313089 CEST	49711	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:10:34.052550077 CEST	49711	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:10:34.052571058 CEST	443	49711	40.126.32.138	192.168.2.18
Oct 22, 2024 16:10:35.163733959 CEST	443	49711	40.126.32.138	192.168.2.18
Oct 22, 2024 16:10:35.164731979 CEST	49711	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:10:35.164762974 CEST	443	49711	40.126.32.138	192.168.2.18
Oct 22, 2024 16:10:35.166490078 CEST	49711	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:10:35.166501999 CEST	443	49711	40.126.32.138	192.168.2.18
Oct 22, 2024 16:10:35.166565895 CEST	49711	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:10:35.166574001 CEST	443	49711	40.126.32.138	192.168.2.18
Oct 22, 2024 16:10:35.559504986 CEST	443	49711	40.126.32.138	192.168.2.18
Oct 22, 2024 16:10:35.559540033 CEST	443	49711	40.126.32.138	192.168.2.18
Oct 22, 2024 16:10:35.559587955 CEST	443	49711	40.126.32.138	192.168.2.18
Oct 22, 2024 16:10:35.559678078 CEST	49711	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:10:35.559705973 CEST	443	49711	40.126.32.138	192.168.2.18
Oct 22, 2024 16:10:35.559746027 CEST	49711	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:10:35.560269117 CEST	49711	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:10:35.560292006 CEST	443	49711	40.126.32.138	192.168.2.18
Oct 22, 2024 16:10:35.560343027 CEST	49711	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:10:35.560442924 CEST	443	49711	40.126.32.138	192.168.2.18
Oct 22, 2024 16:10:35.560475111 CEST	443	49711	40.126.32.138	192.168.2.18
Oct 22, 2024 16:10:35.560519934 CEST	49711	443	192.168.2.18	40.126.32.138
Oct 22, 2024 16:10:35.693557024 CEST	49712	443	192.168.2.18	2.23.209.140
Oct 22, 2024 16:10:35.693612099 CEST	443	49712	2.23.209.140	192.168.2.18
Oct 22, 2024 16:10:35.693696022 CEST	49712	443	192.168.2.18	2.23.209.140
Oct 22, 2024 16:10:35.695872068 CEST	49712	443	192.168.2.18	2.23.209.140
Oct 22, 2024 16:10:35.695889950 CEST	443	49712	2.23.209.140	192.168.2.18
Oct 22, 2024 16:10:36.566147089 CEST	443	49712	2.23.209.140	192.168.2.18
Oct 22, 2024 16:10:36.566287041 CEST	49712	443	192.168.2.18	2.23.209.140
Oct 22, 2024 16:10:36.574474096 CEST	49712	443	192.168.2.18	2.23.209.140
Oct 22, 2024 16:10:36.574517965 CEST	443	49712	2.23.209.140	192.168.2.18
Oct 22, 2024 16:10:36.574842930 CEST	443	49712	2.23.209.140	192.168.2.18
Oct 22, 2024 16:10:36.574924946 CEST	49712	443	192.168.2.18	2.23.209.140
Oct 22, 2024 16:10:36.576602936 CEST	49712	443	192.168.2.18	2.23.209.140
Oct 22, 2024 16:10:36.576647997 CEST	443	49712	2.23.209.140	192.168.2.18
Oct 22, 2024 16:10:36.870002985 CEST	443	49712	2.23.209.140	192.168.2.18
Oct 22, 2024 16:10:36.870071888 CEST	49712	443	192.168.2.18	2.23.209.140
Oct 22, 2024 16:10:36.870086908 CEST	443	49712	2.23.209.140	192.168.2.18
Oct 22, 2024 16:10:36.870105982 CEST	443	49712	2.23.209.140	192.168.2.18
Oct 22, 2024 16:10:36.870151997 CEST	49712	443	192.168.2.18	2.23.209.140
Oct 22, 2024 16:10:36.870151997 CEST	49712	443	192.168.2.18	2.23.209.140
Oct 22, 2024 16:10:36.870162010 CEST	443	49712	2.23.209.140	192.168.2.18
Oct 22, 2024 16:10:36.870223999 CEST	49712	443	192.168.2.18	2.23.209.140
Oct 22, 2024 16:10:36.870277882 CEST	443	49712	2.23.209.140	192.168.2.18
Oct 22, 2024 16:10:36.870313883 CEST	49712	443	192.168.2.18	2.23.209.140
Oct 22, 2024 16:10:36.870347977 CEST	443	49712	2.23.209.140	192.168.2.18
Oct 22, 2024 16:10:36.870382071 CEST	49712	443	192.168.2.18	2.23.209.140
Oct 22, 2024 16:10:36.889194965 CEST	49712	443	192.168.2.18	2.23.209.140
Oct 22, 2024 16:10:36.889219999 CEST	443	49712	2.23.209.140	192.168.2.18
Oct 22, 2024 16:10:54.153379917 CEST	49715	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:10:54.153418064 CEST	443	49715	91.220.42.63	192.168.2.18
Oct 22, 2024 16:10:54.153542042 CEST	49715	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:10:54.153790951 CEST	49715	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:10:54.153801918 CEST	443	49715	91.220.42.63	192.168.2.18
Oct 22, 2024 16:10:54.986552000 CEST	443	49715	91.220.42.63	192.168.2.18
Oct 22, 2024 16:10:54.986871004 CEST	49715	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:10:54.986905098 CEST	443	49715	91.220.42.63	192.168.2.18
Oct 22, 2024 16:10:54.988168001 CEST	443	49715	91.220.42.63	192.168.2.18
Oct 22, 2024 16:10:54.988284111 CEST	49715	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:10:54.989403009 CEST	49715	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:10:54.989504099 CEST	443	49715	91.220.42.63	192.168.2.18
Oct 22, 2024 16:10:54.989561081 CEST	49715	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:10:55.031331062 CEST	443	49715	91.220.42.63	192.168.2.18
Oct 22, 2024 16:10:55.032644033 CEST	49715	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:10:55.032659054 CEST	443	49715	91.220.42.63	192.168.2.18
Oct 22, 2024 16:10:55.079632044 CEST	49715	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:10:55.338752031 CEST	443	49715	91.220.42.63	192.168.2.18
Oct 22, 2024 16:10:55.338766098 CEST	443	49715	91.220.42.63	192.168.2.18
Oct 22, 2024 16:10:55.338835955 CEST	49715	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:10:55.338841915 CEST	443	49715	91.220.42.63	192.168.2.18
Oct 22, 2024 16:10:55.338928938 CEST	49715	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:10:55.340441942 CEST	49715	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:10:55.340457916 CEST	443	49715	91.220.42.63	192.168.2.18
Oct 22, 2024 16:10:55.341490984 CEST	49718	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:10:55.341536045 CEST	443	49718	91.220.42.63	192.168.2.18
Oct 22, 2024 16:10:55.341646910 CEST	49718	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:10:55.341859102 CEST	49718	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:10:55.341871977 CEST	443	49718	91.220.42.63	192.168.2.18
Oct 22, 2024 16:10:56.162889004 CEST	443	49718	91.220.42.63	192.168.2.18
Oct 22, 2024 16:10:56.163182974 CEST	49718	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:10:56.163199902 CEST	443	49718	91.220.42.63	192.168.2.18
Oct 22, 2024 16:10:56.163749933 CEST	443	49718	91.220.42.63	192.168.2.18
Oct 22, 2024 16:10:56.164050102 CEST	49718	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:10:56.164122105 CEST	443	49718	91.220.42.63	192.168.2.18
Oct 22, 2024 16:10:56.164221048 CEST	49718	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:10:56.164309978 CEST	443	49718	91.220.42.63	192.168.2.18
Oct 22, 2024 16:10:56.499679089 CEST	443	49718	91.220.42.63	192.168.2.18
Oct 22, 2024 16:10:56.499766111 CEST	443	49718	91.220.42.63	192.168.2.18
Oct 22, 2024 16:10:56.500930071 CEST	49718	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:10:56.518131018 CEST	49718	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:10:56.518131018 CEST	49718	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:10:56.518162966 CEST	443	49718	91.220.42.63	192.168.2.18
Oct 22, 2024 16:10:56.518248081 CEST	49718	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:10:56.539035082 CEST	49720	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:56.539084911 CEST	443	49720	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:56.539191008 CEST	49720	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:56.540209055 CEST	49720	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:56.540222883 CEST	443	49720	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:57.598570108 CEST	443	49720	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:57.598912001 CEST	49720	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:57.598923922 CEST	443	49720	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:57.600017071 CEST	443	49720	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:57.600115061 CEST	49720	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:57.601082087 CEST	49720	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:57.601150036 CEST	443	49720	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:57.601250887 CEST	49720	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:57.601259947 CEST	443	49720	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:57.651655912 CEST	49720	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:57.836922884 CEST	443	49720	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:57.836950064 CEST	443	49720	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:57.837023020 CEST	443	49720	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:57.837084055 CEST	49720	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:57.837158918 CEST	49720	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:57.838097095 CEST	49720	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:57.838115931 CEST	443	49720	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:57.940542936 CEST	49721	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:57.940597057 CEST	443	49721	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:57.940726042 CEST	49721	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:57.941025972 CEST	49721	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:57.941046953 CEST	443	49721	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:58.031215906 CEST	49722	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:58.031260014 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:58.031373978 CEST	49722	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:58.031491995 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:58.031523943 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:58.031631947 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:58.031732082 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:58.031760931 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:58.031814098 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:58.031986952 CEST	49722	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:58.031999111 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:58.032156944 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:58.032170057 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:58.032284021 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:58.032300949 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:58.711766958 CEST	49726	443	192.168.2.18	142.250.185.68
Oct 22, 2024 16:10:58.711802006 CEST	443	49726	142.250.185.68	192.168.2.18
Oct 22, 2024 16:10:58.711977959 CEST	49726	443	192.168.2.18	142.250.185.68
Oct 22, 2024 16:10:58.712187052 CEST	49726	443	192.168.2.18	142.250.185.68
Oct 22, 2024 16:10:58.712199926 CEST	443	49726	142.250.185.68	192.168.2.18
Oct 22, 2024 16:10:59.001558065 CEST	443	49721	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.001837015 CEST	49721	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.001857042 CEST	443	49721	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.002214909 CEST	443	49721	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.002624035 CEST	49721	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.002688885 CEST	443	49721	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.002789974 CEST	49721	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.043343067 CEST	443	49721	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.053625107 CEST	49721	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.082421064 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.082712889 CEST	49722	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.082731962 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.083112001 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.083400011 CEST	49722	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.083460093 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.083525896 CEST	49722	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.084392071 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.084546089 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.084744930 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.084758997 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.084925890 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.084944963 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.085844040 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.085916042 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.086664915 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.086750984 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.086791039 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.088490963 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.088582993 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.089173079 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.089252949 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.089438915 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.089448929 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.127334118 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.127337933 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.133649111 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.133670092 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.133678913 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.181668043 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.242749929 CEST	443	49721	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.242765903 CEST	443	49721	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.242846012 CEST	443	49721	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.242856026 CEST	49721	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.242913008 CEST	49721	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.243951082 CEST	49721	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.243971109 CEST	443	49721	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.284300089 CEST	49727	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.284337997 CEST	443	49727	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.284410000 CEST	49727	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.284621954 CEST	49727	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.284636021 CEST	443	49727	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.453850985 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.453877926 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.453885078 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.453913927 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.453934908 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.453946114 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.453990936 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.454006910 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.454035997 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.454062939 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.454188108 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.454212904 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.454227924 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.454307079 CEST	49722	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.454307079 CEST	49722	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.454329014 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.454380035 CEST	49722	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.454842091 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.454870939 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.454879045 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.454905033 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.454933882 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.454957962 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.454957962 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.454968929 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.454982042 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.455102921 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.455781937 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.455790997 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.455811024 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.455847025 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.455887079 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.455892086 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.455935001 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.456233025 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.456249952 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.456310987 CEST	49722	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.456319094 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.456362009 CEST	49722	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.457160950 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.457175970 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.457257986 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.457262993 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.457323074 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.572284937 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.572309017 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.572379112 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.572391987 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.572441101 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.572639942 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.572674036 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.572706938 CEST	49722	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.572726965 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.572751999 CEST	49722	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.572778940 CEST	49722	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.573587894 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.573610067 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.573682070 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.573704958 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.573751926 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.573751926 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.599432945 CEST	443	49726	142.250.185.68	192.168.2.18
Oct 22, 2024 16:10:59.599914074 CEST	49726	443	192.168.2.18	142.250.185.68
Oct 22, 2024 16:10:59.599946022 CEST	443	49726	142.250.185.68	192.168.2.18
Oct 22, 2024 16:10:59.600958109 CEST	443	49726	142.250.185.68	192.168.2.18
Oct 22, 2024 16:10:59.601028919 CEST	49726	443	192.168.2.18	142.250.185.68
Oct 22, 2024 16:10:59.602036953 CEST	49726	443	192.168.2.18	142.250.185.68
Oct 22, 2024 16:10:59.602093935 CEST	443	49726	142.250.185.68	192.168.2.18
Oct 22, 2024 16:10:59.642642975 CEST	49726	443	192.168.2.18	142.250.185.68
Oct 22, 2024 16:10:59.642658949 CEST	443	49726	142.250.185.68	192.168.2.18
Oct 22, 2024 16:10:59.688308954 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.688330889 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.688415051 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.688426971 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.688467026 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.689471960 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.689502001 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.689543009 CEST	49722	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.689558029 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.689573050 CEST	49722	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.689625978 CEST	49722	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.690097094 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.690181017 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.690191984 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.690211058 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.690269947 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.690269947 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.690654039 CEST	49726	443	192.168.2.18	142.250.185.68
Oct 22, 2024 16:10:59.805790901 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.805816889 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.805910110 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.805924892 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.805982113 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.806565046 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.806595087 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.806662083 CEST	49722	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.806693077 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.806694984 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.806715012 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.806783915 CEST	49722	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.806814909 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.806837082 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.806900024 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.807126045 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.807142019 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.807204008 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.807209969 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.807260036 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.807786942 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.807826996 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.807854891 CEST	49722	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.807864904 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.807892084 CEST	49722	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.807912111 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.807917118 CEST	49722	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.807950974 CEST	49722	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.808265924 CEST	49722	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.808279991 CEST	443	49722	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.808556080 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.808572054 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.808751106 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.808765888 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.808820009 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.811323881 CEST	49728	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.811358929 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.811522961 CEST	49728	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.811770916 CEST	49728	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.811781883 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.924209118 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.924236059 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.924299955 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.924314022 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.924410105 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.925272942 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.925297022 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.925479889 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:10:59.925492048 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:10:59.925698042 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.039460897 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.039490938 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.039625883 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.039637089 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.039688110 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.041435957 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.041460991 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.041569948 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.041590929 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.041644096 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.081429005 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.081459045 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.081566095 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.081593037 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.081690073 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.087961912 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.087985992 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.088082075 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.088099003 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.088186026 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.156910896 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.156939030 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.157075882 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.157084942 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.157154083 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.161345959 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.161371946 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.161576986 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.161590099 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.161658049 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.272793055 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.272818089 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.272887945 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.272900105 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.272959948 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.274317980 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.274336100 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.274396896 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.274401903 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.274449110 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.277174950 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.277200937 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.277265072 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.277287006 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.277410030 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.278879881 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.278902054 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.278959990 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.278965950 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.279010057 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.343736887 CEST	443	49727	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.343971968 CEST	49727	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.343998909 CEST	443	49727	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.345084906 CEST	443	49727	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.345170975 CEST	49727	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.345449924 CEST	49727	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.345513105 CEST	443	49727	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.345628023 CEST	49727	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.387331963 CEST	443	49727	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.389641047 CEST	49727	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.389657021 CEST	443	49727	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.391520023 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.391550064 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.391674042 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.391689062 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.391736984 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.395616055 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.395639896 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.395724058 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.395741940 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.395812035 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.437657118 CEST	49727	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.458642960 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.458669901 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.458739042 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.458756924 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.458806038 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.460186958 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.460211992 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.460257053 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.460308075 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.460321903 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.460366964 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.508970976 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.509006023 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.509089947 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.509099960 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.509147882 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.513031006 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.513056040 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.513159990 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.513186932 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.513263941 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.577524900 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.577550888 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.577680111 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.577701092 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.577748060 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.582822084 CEST	443	49727	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.582851887 CEST	443	49727	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.582921982 CEST	49727	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.582947969 CEST	443	49727	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.582963943 CEST	443	49727	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.583076000 CEST	49727	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.583888054 CEST	49727	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.583901882 CEST	443	49727	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.625190020 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.625219107 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.625294924 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.625308990 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.625336885 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.625366926 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.626106977 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.626128912 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.626177073 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.626182079 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.626213074 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.626230955 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.631076097 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.631104946 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.631176949 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.631196022 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.631231070 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.631259918 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.695444107 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.695475101 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.695576906 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.695616007 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.695693016 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.742460966 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.742515087 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.742575884 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.742593050 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.742651939 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.743130922 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.743169069 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.743246078 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.743252039 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.743283987 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.748524904 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.748548985 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.748641014 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.748673916 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.748733997 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.812215090 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.812249899 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.812370062 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.812397957 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.812448978 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.859040976 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.859445095 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.859471083 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.859477043 CEST	49728	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.859502077 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.859536886 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.859549999 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.859621048 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.860147953 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.860163927 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.860204935 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.860213041 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.860239983 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.860265017 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.860785961 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.860852957 CEST	49728	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.861210108 CEST	49728	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.861288071 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.861360073 CEST	49728	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.861368895 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.865427971 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.865456104 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.865505934 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.865529060 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.865544081 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.865578890 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.913657904 CEST	49728	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.926848888 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.926882029 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.926947117 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.926964045 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.927017927 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.927042961 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.929508924 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.929538012 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.929670095 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.929697037 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.929748058 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.977464914 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.977492094 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.977574110 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.977598906 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.977647066 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.977823973 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.977840900 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.977905989 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.977910995 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.977953911 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.983078957 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.983139992 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.983174086 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.983201027 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.983217001 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.983259916 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.984220982 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.984266043 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.984318972 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.984327078 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:00.984354019 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:00.984383106 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.094777107 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.094810009 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.094881058 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.094894886 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.094933033 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.094949961 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.095165014 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.095247030 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.095326900 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.095659018 CEST	49723	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.095675945 CEST	443	49723	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.099553108 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.099602938 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.099684000 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.099730015 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.099755049 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.099809885 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.099821091 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.099877119 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.099947929 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.099958897 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.102041960 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.102063894 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.102124929 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.102133989 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.102188110 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.213869095 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.213892937 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.213900089 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.213917017 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.213932037 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.213942051 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.213949919 CEST	49728	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.213967085 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.214001894 CEST	49728	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.214108944 CEST	49728	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.216128111 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.216156006 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.216223001 CEST	49728	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.216228962 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.216260910 CEST	49728	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.216283083 CEST	49728	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.216901064 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.216928005 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.217003107 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.217034101 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.217133999 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.219075918 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.219095945 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.219161987 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.219170094 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.219233036 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.282562017 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.282586098 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.282658100 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.282674074 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.282727957 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.359096050 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.359131098 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.359158039 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.359177113 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.359193087 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.359224081 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.359287024 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.359288931 CEST	49728	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.359299898 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.359342098 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.359369040 CEST	49728	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.360374928 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.360410929 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.360445976 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.360454082 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.360501051 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.360522032 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.448098898 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.448122978 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.448219061 CEST	49728	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.448231936 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.448841095 CEST	49728	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.476506948 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.476541042 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.476653099 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.476685047 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.476708889 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.476749897 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.476927996 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.476953983 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.476999998 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.477009058 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.477046013 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.477075100 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.477945089 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.477982998 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.478046894 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.478058100 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.478094101 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.478239059 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.565251112 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.565275908 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.565378904 CEST	49728	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.565397978 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.565478086 CEST	49728	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.567167044 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.567203045 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.567240000 CEST	49728	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.567244053 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.567270041 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.567281008 CEST	49728	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.567333937 CEST	49728	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.567529917 CEST	49728	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.567540884 CEST	443	49728	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.594098091 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.594136000 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.594201088 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.594229937 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.594249964 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.594269037 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.594703913 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.594731092 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.594775915 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.594786882 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.594813108 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.594834089 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.596108913 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.596139908 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.596235991 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.596235991 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.596242905 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.596311092 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.711080074 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.711113930 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.711195946 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.711215019 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.711673021 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.711903095 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.711929083 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.711980104 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.711986065 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.712012053 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.712517977 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.712841988 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.712862968 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.712913990 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.712918997 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.712951899 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.712987900 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.828526974 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.828548908 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.828655958 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.828677893 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.828866005 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.829319000 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.829335928 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.829391003 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.829396963 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.829441071 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.830094099 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.830110073 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.830153942 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.830158949 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.830194950 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.830727100 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.946224928 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.946254015 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.946343899 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.946371078 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.946449041 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.946832895 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.946855068 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.946913004 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.946918011 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.946996927 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.947890997 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.947910070 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.947977066 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:01.947983027 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:01.948048115 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.063677073 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.063704014 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.063822985 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.063862085 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.063872099 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.064083099 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.064105988 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.064158916 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.064167976 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.064174891 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.065124989 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.065143108 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.065218925 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.065227985 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.065361977 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.104887009 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.104916096 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.105063915 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.105096102 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.105153084 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.166479111 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.166898966 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.166949987 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.168101072 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.168438911 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.168577909 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.168613911 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.181246996 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.181289911 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.181385040 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.181401968 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.181418896 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.181458950 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.182194948 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.182214022 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.182276964 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.182282925 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.182353973 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.182673931 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.182691097 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.182754993 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.182760000 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.182822943 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.221776962 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.288718939 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.288789988 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.288912058 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.288912058 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.288928986 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.289614916 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.299041033 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.299071074 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.299316883 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.299324036 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.299452066 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.299627066 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.299652100 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.299725056 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.299731016 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.299837112 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.300446033 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.300467014 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.300573111 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.300579071 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.300663948 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.415750027 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.415782928 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.415911913 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.415930986 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.416282892 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.416306019 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.416347980 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.416347980 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.416353941 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.417007923 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.417335033 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.417392015 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.417416096 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.417681932 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.417717934 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.417747974 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.417747974 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.417753935 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.417809010 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.461662054 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.527278900 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.527348995 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.527373075 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.527412891 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.527420044 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.527441978 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.527461052 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.527479887 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.527501106 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.527659893 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.528938055 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.528985023 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.529022932 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.529031992 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.529053926 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.529226065 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.533233881 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.533248901 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.533284903 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.533371925 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.533371925 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.533381939 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.533793926 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.533818960 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.533893108 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.533894062 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.533894062 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.533904076 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.533921957 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.533986092 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.534015894 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.534015894 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.534056902 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.534297943 CEST	49724	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.534312963 CEST	443	49724	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.536930084 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.536976099 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.537072897 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.537280083 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.537291050 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.582539082 CEST	49731	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.582597017 CEST	443	49731	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.583024979 CEST	49731	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.583024979 CEST	49731	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.583067894 CEST	443	49731	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.598777056 CEST	49732	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.598812103 CEST	443	49732	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.598890066 CEST	49732	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.599201918 CEST	49732	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.599215031 CEST	443	49732	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.600186110 CEST	49733	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.600224018 CEST	443	49733	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.600363016 CEST	49733	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.600646973 CEST	49733	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.600661039 CEST	443	49733	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.645661116 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.645741940 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.645864010 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.645864010 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.645889997 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.646279097 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.711116076 CEST	49734	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.711163998 CEST	443	49734	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.711263895 CEST	49734	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.711500883 CEST	49734	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.711517096 CEST	443	49734	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.762561083 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.762588024 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.762924910 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.762955904 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.763077021 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.879723072 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.879749060 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.879837036 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.879880905 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.880914927 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.880954027 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.880991936 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.881000996 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.881030083 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.882694006 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.998177052 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.998203039 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.998316050 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:02.998342037 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:02.998399973 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.114754915 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.114787102 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.114948034 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.114990950 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.115114927 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.116240978 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.116259098 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.116343975 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.116343975 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.116353989 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.116509914 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.233087063 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.233113050 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.233202934 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.233238935 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.233297110 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.362112045 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.362139940 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.362253904 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.362279892 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.362330914 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.362523079 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.362539053 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.362607956 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.362615108 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.362654924 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.467500925 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.467531919 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.467674971 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.467708111 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.467751026 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.468884945 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.468913078 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.468959093 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.468969107 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.469005108 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.469019890 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.585167885 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.585206032 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.585434914 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.585469007 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.585521936 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.592644930 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.593013048 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.593080997 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.593485117 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.593961000 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.594042063 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.594283104 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.626612902 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.626637936 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.626729012 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.626760960 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.626774073 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.626815081 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.633306026 CEST	443	49731	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.633569002 CEST	49731	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.633593082 CEST	443	49731	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.633939028 CEST	443	49731	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.634257078 CEST	49731	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.634308100 CEST	443	49731	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.634394884 CEST	49731	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.635339022 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.654378891 CEST	443	49732	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.654820919 CEST	49732	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.654843092 CEST	443	49732	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.655225992 CEST	443	49732	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.655548096 CEST	49732	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.655620098 CEST	443	49732	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.655698061 CEST	49732	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.675335884 CEST	443	49731	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.703006983 CEST	443	49733	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.703120947 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.703155994 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.703301907 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.703325987 CEST	443	49732	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.703341961 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.703360081 CEST	49733	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.703389883 CEST	443	49733	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.703406096 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.704474926 CEST	443	49733	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.704555988 CEST	49733	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.704910994 CEST	49733	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.704967976 CEST	443	49733	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.705080986 CEST	49733	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.705091000 CEST	443	49733	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.705704927 CEST	49732	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.745718002 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.745745897 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.745867014 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.745898962 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.746049881 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.752635002 CEST	443	49734	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.752912998 CEST	49734	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.752929926 CEST	443	49734	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.753649950 CEST	49733	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.753999949 CEST	443	49734	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.754072905 CEST	49734	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.754529953 CEST	49734	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.754580021 CEST	443	49734	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.754713058 CEST	49734	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.754719019 CEST	443	49734	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.800690889 CEST	49734	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.821749926 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.821782112 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.821892023 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.821928024 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.821979046 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.863092899 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.863121986 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.863234997 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.863267899 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.863322020 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.938558102 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.938582897 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.938663006 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.938702106 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.938750029 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.944878101 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.944900036 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.944916964 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.944979906 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.945008993 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.945065975 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.946873903 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.946894884 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.946953058 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.946979046 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.947019100 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.964293003 CEST	443	49733	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.964371920 CEST	443	49733	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.964481115 CEST	49733	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.964972973 CEST	49733	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.964988947 CEST	443	49733	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.967645884 CEST	49735	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.967670918 CEST	443	49735	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.967751026 CEST	49735	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.968163967 CEST	49735	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.968174934 CEST	443	49735	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.975883961 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.975908995 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.975990057 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.976368904 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.976377964 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.980742931 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.980767965 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.980842113 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.980870962 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.980927944 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.989793062 CEST	443	49731	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.989820957 CEST	443	49731	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.989836931 CEST	443	49731	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.989926100 CEST	49731	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.989957094 CEST	443	49731	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.989979982 CEST	443	49734	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.990001917 CEST	443	49734	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.990030050 CEST	49731	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.990061045 CEST	443	49734	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.990102053 CEST	49734	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.990161896 CEST	49734	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.990945101 CEST	49734	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.990959883 CEST	443	49734	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.991853952 CEST	443	49731	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.991873980 CEST	443	49731	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.991947889 CEST	49731	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.991959095 CEST	443	49731	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.992002964 CEST	49731	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.992151022 CEST	443	49731	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.992208004 CEST	443	49731	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.992216110 CEST	49731	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.992249012 CEST	49731	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.992327929 CEST	49731	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.992340088 CEST	443	49731	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.992350101 CEST	49731	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.992384911 CEST	49731	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.995071888 CEST	49737	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.995099068 CEST	443	49737	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:03.995176077 CEST	49737	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.995424032 CEST	49737	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:03.995434046 CEST	443	49737	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.010185957 CEST	443	49732	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.010212898 CEST	443	49732	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.010221004 CEST	443	49732	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.010235071 CEST	443	49732	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.010270119 CEST	443	49732	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.010313034 CEST	49732	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.010330915 CEST	443	49732	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.010356903 CEST	49732	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.010375023 CEST	49732	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.010380030 CEST	443	49732	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.010418892 CEST	443	49732	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.010464907 CEST	49732	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.011076927 CEST	49732	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.011087894 CEST	443	49732	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.013427019 CEST	49738	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.013453007 CEST	443	49738	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.013519049 CEST	49738	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.013736963 CEST	49738	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.013745070 CEST	443	49738	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.046252012 CEST	49739	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.046297073 CEST	443	49739	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.046411991 CEST	49739	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.046691895 CEST	49739	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.046705008 CEST	443	49739	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.056176901 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.056199074 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.056266069 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.056289911 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.056302071 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.056333065 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.061661005 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.061683893 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.061820984 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.061850071 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.061913013 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.062096119 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.062114000 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.062155008 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.062161922 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.062180996 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.062197924 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.097206116 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.097232103 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.097409010 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.097438097 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.097498894 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.173687935 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.173710108 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.173754930 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.173818111 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.173855066 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.173872948 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.173877001 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.173923969 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.174300909 CEST	49729	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.174318075 CEST	443	49729	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.177294016 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.177325010 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.177397966 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.177467108 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.177501917 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.177532911 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.178086042 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.178105116 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.178172112 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.178193092 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.178242922 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.293193102 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.293221951 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.293314934 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.293340921 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.293385029 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.293510914 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.293529034 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.293575048 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.293581963 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.293632030 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.294485092 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.294502020 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.294580936 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.294586897 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.294642925 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.409064054 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.409087896 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.409207106 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.409235954 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.409285069 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.409754992 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.409770966 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.409831047 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.409841061 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.409882069 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.524050951 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.524077892 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.524215937 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.524243116 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.524286985 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.525027037 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.525044918 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.525152922 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.525168896 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.525221109 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.565346956 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.565376043 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.565531015 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.565557957 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.565612078 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.640252113 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.640280962 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.640429974 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.640497923 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.640567064 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.641254902 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.641278982 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.641350985 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.641366959 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.641429901 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.755198002 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.755243063 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.755367041 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.755395889 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.755445004 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.756217957 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.756237030 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.756304026 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.756314039 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.756365061 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.756702900 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.756721973 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.756782055 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.756789923 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.756834030 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.866791964 CEST	443	49738	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.867124081 CEST	49738	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.867136955 CEST	443	49738	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.868201971 CEST	443	49738	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.868280888 CEST	49738	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.868587017 CEST	49738	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.868640900 CEST	443	49738	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.868722916 CEST	49738	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.868729115 CEST	443	49738	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.871985912 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.872009993 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.872086048 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.872113943 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.872127056 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.872158051 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.872459888 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.872477055 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.872555971 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.872562885 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.872620106 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.873501062 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.873517990 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.873586893 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.873594999 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.873652935 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.912714958 CEST	49738	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.987642050 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.987672091 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.987811089 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.987837076 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.987884998 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.988316059 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.988339901 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.988394976 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.988400936 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.988450050 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.989221096 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.989243031 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.989300013 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:04.989312887 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:04.989356041 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.028294086 CEST	443	49735	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.028675079 CEST	49735	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.028704882 CEST	443	49735	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.029851913 CEST	443	49735	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.030169010 CEST	49735	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.030298948 CEST	49735	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.030317068 CEST	443	49735	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.030349970 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.030647993 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.030658960 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.031011105 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.031286955 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.031359911 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.031379938 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.052155018 CEST	443	49737	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.052505970 CEST	49737	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.052536011 CEST	443	49737	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.052879095 CEST	443	49737	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.053181887 CEST	49737	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.053231001 CEST	443	49737	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.053344965 CEST	49737	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.071683884 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.071687937 CEST	49735	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.071700096 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.095354080 CEST	443	49737	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.098629951 CEST	443	49739	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.098941088 CEST	49739	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.098974943 CEST	443	49739	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.100056887 CEST	443	49739	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.100384951 CEST	49739	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.100581884 CEST	443	49739	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.100584030 CEST	49739	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.102673054 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.102698088 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.102787018 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.102823019 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.102865934 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.103904963 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.103921890 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.103998899 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.104010105 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.104057074 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.104971886 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.104986906 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.105057955 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.105066061 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.105110884 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.122117043 CEST	443	49738	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.122204065 CEST	443	49738	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.122299910 CEST	49738	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.123272896 CEST	49738	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.123296022 CEST	443	49738	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.143341064 CEST	443	49739	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.152688026 CEST	49739	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.185710907 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.185734034 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.185785055 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.185813904 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.185827971 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.185848951 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.220216990 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.220240116 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.220307112 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.220323086 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.220338106 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.220362902 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.220364094 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.220377922 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.220396996 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.220427990 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.220433950 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.220462084 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.220487118 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.259210110 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.259237051 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.259290934 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.259305954 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.259330034 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.259344101 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.266629934 CEST	443	49735	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.266661882 CEST	443	49735	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.266729116 CEST	443	49735	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.266768932 CEST	49735	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.266798973 CEST	49735	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.267452002 CEST	49735	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.267468929 CEST	443	49735	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.342592001 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.342622042 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.342803001 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.342832088 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.342897892 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.343050957 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.343075991 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.343163967 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.343173027 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.343229055 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.343987942 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.344006062 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.344080925 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.344089031 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.344134092 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.344196081 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.387753010 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.387782097 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.387789011 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.387799978 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.387860060 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.387986898 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.388012886 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.388025999 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.388130903 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.389575005 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.389596939 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.389664888 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.389672041 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.389741898 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.408359051 CEST	443	49737	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.408387899 CEST	443	49737	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.408440113 CEST	443	49737	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.408531904 CEST	49737	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.408545971 CEST	443	49737	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.408628941 CEST	49737	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.409432888 CEST	49737	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.409446001 CEST	443	49737	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.416934967 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.416960001 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.417043924 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.417072058 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.417098045 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.417165041 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.458252907 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.458278894 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.458430052 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.458461046 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.458504915 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.459019899 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.459036112 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.459099054 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.459110975 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.459152937 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.490417957 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.490452051 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.490536928 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.490566015 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.490578890 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.490611076 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.505940914 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.506033897 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.506076097 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.506093979 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.506129026 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.506148100 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.507260084 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.507307053 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.507348061 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.507373095 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.507386923 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.507416010 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.574024916 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.574052095 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.574173927 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.574173927 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.574208975 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.574258089 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.574397087 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.574418068 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.574462891 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.574470997 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.574496984 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.574522972 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.575256109 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.575275898 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.575341940 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.575356960 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.575418949 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.606551886 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.606578112 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.606656075 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.606683016 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.606750011 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.623979092 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.624011993 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.624181032 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.624181032 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.624209881 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.624275923 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.624455929 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.624471903 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.624528885 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.624541044 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.624578953 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.626104116 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.626120090 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.626178026 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.626194954 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.626241922 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.689999104 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.690022945 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.690128088 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.690131903 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.690145969 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.690165043 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.690200090 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.690212965 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.690243959 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.690265894 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.690593958 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.690608978 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.690666914 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.690674067 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.690749884 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.722142935 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.722170115 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.722278118 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.722321987 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.722376108 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.742445946 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.742472887 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.742661953 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.742681026 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.742749929 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.742866993 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.742940903 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.742947102 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.742986917 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.743310928 CEST	49736	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.743329048 CEST	443	49736	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.757356882 CEST	49740	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.757410049 CEST	443	49740	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.757496119 CEST	49740	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.757831097 CEST	49740	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.757846117 CEST	443	49740	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.805603027 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.805633068 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.805768013 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.805788040 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.805871010 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.806344032 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.806361914 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.806441069 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.806447029 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.806495905 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.807060003 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.807080984 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.807142973 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.807149887 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.807214975 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.837481022 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.837508917 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.837632895 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.837651014 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.837713957 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.879796028 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.879822016 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.879955053 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.880031109 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.880125999 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.923372030 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.923402071 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.923521996 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.923590899 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.923625946 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.923655987 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.923682928 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.923707008 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.923737049 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.923738003 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.923778057 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.923929930 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.923953056 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.923991919 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.924005032 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.924036980 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.924056053 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.953645945 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.953675032 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.953809977 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:05.953839064 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:05.953887939 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.037362099 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.037398100 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.037523031 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.037554026 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.037622929 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.037751913 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.037772894 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.037817001 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.037827015 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.037890911 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.038394928 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.038415909 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.038465977 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.038471937 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.038491011 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.038518906 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.039062023 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.039079905 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.039144993 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.039155006 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.039206028 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.111361027 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.111387968 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.111527920 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.111608028 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.111711979 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.153141975 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.153166056 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.153251886 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.153268099 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.153287888 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.153312922 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.153793097 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.153812885 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.153877974 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.153886080 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.153938055 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.154156923 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.154196978 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.154232025 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.154237032 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.154248953 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.154280901 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.154314041 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.154486895 CEST	49730	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.154500008 CEST	443	49730	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.609788895 CEST	443	49740	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.610140085 CEST	49740	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.610171080 CEST	443	49740	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.610532999 CEST	443	49740	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.610898018 CEST	49740	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.610958099 CEST	443	49740	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.611129045 CEST	49740	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.655329943 CEST	443	49740	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.867631912 CEST	443	49740	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.867726088 CEST	443	49740	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.867785931 CEST	49740	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.868477106 CEST	49740	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.868498087 CEST	443	49740	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.871284962 CEST	49743	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.871344090 CEST	443	49743	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:06.871433020 CEST	49743	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.871645927 CEST	49743	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:06.871663094 CEST	443	49743	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:07.918509007 CEST	443	49743	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:07.918819904 CEST	49743	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:07.918849945 CEST	443	49743	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:07.919226885 CEST	443	49743	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:07.919534922 CEST	49743	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:07.919601917 CEST	443	49743	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:07.919902086 CEST	49743	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:07.967323065 CEST	443	49743	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:08.159826040 CEST	443	49743	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:08.160015106 CEST	443	49743	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:08.160100937 CEST	49743	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:08.160985947 CEST	49743	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:08.161015987 CEST	443	49743	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:08.595042944 CEST	443	49739	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:08.595129967 CEST	443	49739	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:08.595194101 CEST	49739	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:08.595659018 CEST	49739	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:08.595674038 CEST	443	49739	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:08.598222971 CEST	49744	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:08.598248959 CEST	443	49744	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:08.598752975 CEST	49744	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:08.598984957 CEST	49744	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:08.599003077 CEST	443	49744	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:09.591694117 CEST	443	49726	142.250.185.68	192.168.2.18
Oct 22, 2024 16:11:09.591768026 CEST	443	49726	142.250.185.68	192.168.2.18
Oct 22, 2024 16:11:09.591846943 CEST	49726	443	192.168.2.18	142.250.185.68
Oct 22, 2024 16:11:09.656862020 CEST	443	49744	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:09.657250881 CEST	49744	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:09.657277107 CEST	443	49744	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:09.658410072 CEST	443	49744	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:09.659068108 CEST	49744	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:09.659162045 CEST	443	49744	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:09.659224987 CEST	49744	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:09.699346066 CEST	443	49744	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:09.896059990 CEST	443	49744	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:09.896161079 CEST	443	49744	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:09.896225929 CEST	49744	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:09.896958113 CEST	49744	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:09.896969080 CEST	443	49744	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:10.331072092 CEST	49726	443	192.168.2.18	142.250.185.68
Oct 22, 2024 16:11:10.331105947 CEST	443	49726	142.250.185.68	192.168.2.18
Oct 22, 2024 16:11:12.460917950 CEST	49745	53	192.168.2.18	1.1.1.1
Oct 22, 2024 16:11:12.466370106 CEST	53	49745	1.1.1.1	192.168.2.18
Oct 22, 2024 16:11:12.466506958 CEST	49745	53	192.168.2.18	1.1.1.1
Oct 22, 2024 16:11:12.466600895 CEST	49745	53	192.168.2.18	1.1.1.1
Oct 22, 2024 16:11:12.466615915 CEST	49745	53	192.168.2.18	1.1.1.1
Oct 22, 2024 16:11:12.472043991 CEST	53	49745	1.1.1.1	192.168.2.18
Oct 22, 2024 16:11:12.472302914 CEST	53	49745	1.1.1.1	192.168.2.18
Oct 22, 2024 16:11:13.071258068 CEST	53	49745	1.1.1.1	192.168.2.18
Oct 22, 2024 16:11:13.071856976 CEST	49745	53	192.168.2.18	1.1.1.1
Oct 22, 2024 16:11:13.077529907 CEST	53	49745	1.1.1.1	192.168.2.18
Oct 22, 2024 16:11:13.077583075 CEST	49745	53	192.168.2.18	1.1.1.1
Oct 22, 2024 16:11:37.238898039 CEST	49747	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:37.238926888 CEST	443	49747	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:37.239090919 CEST	49747	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:37.240931988 CEST	49747	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:37.240942955 CEST	443	49747	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:38.294267893 CEST	443	49747	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:38.295218945 CEST	49747	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:38.295228958 CEST	443	49747	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:38.295588970 CEST	443	49747	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:38.296103954 CEST	49747	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:38.296154022 CEST	443	49747	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:38.296271086 CEST	49747	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:38.339327097 CEST	443	49747	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:38.643652916 CEST	443	49747	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:38.643683910 CEST	443	49747	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:38.643716097 CEST	443	49747	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:38.643752098 CEST	49747	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:38.643765926 CEST	443	49747	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:38.643778086 CEST	443	49747	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:38.643824100 CEST	49747	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:38.643824100 CEST	49747	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:38.644478083 CEST	49747	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:38.644494057 CEST	443	49747	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:38.647429943 CEST	49748	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:38.647466898 CEST	443	49748	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:38.647556067 CEST	49748	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:38.647787094 CEST	49748	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:38.647798061 CEST	443	49748	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:38.665072918 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:38.665122032 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:38.665208101 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:38.665461063 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:38.665472984 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:39.698746920 CEST	443	49748	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:39.703377008 CEST	49748	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:39.703454018 CEST	443	49748	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:39.703807116 CEST	443	49748	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:39.708260059 CEST	49748	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:39.708339930 CEST	443	49748	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:39.708605051 CEST	49748	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:39.724858046 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:39.725218058 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:39.725259066 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:39.725850105 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:39.726166964 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:39.726253986 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:39.726330042 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:39.751365900 CEST	443	49748	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:39.771331072 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:39.944521904 CEST	443	49748	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:39.944622040 CEST	443	49748	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:39.944751024 CEST	49748	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:39.945764065 CEST	49748	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:39.945815086 CEST	443	49748	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.083204985 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.083239079 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.083259106 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.083378077 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.083403111 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.083412886 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.083456039 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.084868908 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.084887028 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.084952116 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.084961891 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.085020065 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.203058958 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.203083038 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.203186035 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.203217030 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.203300953 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.204571009 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.204586029 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.204662085 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.204680920 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.204731941 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.205980062 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.205996990 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.206058025 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.206073999 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.206088066 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.206113100 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.207835913 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.207854986 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.207921028 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.207935095 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.207978010 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.327992916 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.328017950 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.328120947 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.328145981 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.328198910 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.329066038 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.329086065 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.329153061 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.329161882 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.329219103 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.333097935 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.333141088 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.333180904 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.333189011 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.333220959 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.333237886 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.333257914 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.333282948 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.333317995 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.333324909 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.333337069 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.333354950 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.333380938 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.333386898 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.333429098 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:40.333434105 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.333478928 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.333795071 CEST	49749	443	192.168.2.18	195.130.217.88
Oct 22, 2024 16:11:40.333807945 CEST	443	49749	195.130.217.88	192.168.2.18
Oct 22, 2024 16:11:41.396192074 CEST	49750	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:11:41.396245956 CEST	443	49750	91.220.42.63	192.168.2.18
Oct 22, 2024 16:11:41.396349907 CEST	49750	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:11:41.398632050 CEST	49750	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:11:41.398648977 CEST	443	49750	91.220.42.63	192.168.2.18
Oct 22, 2024 16:11:41.907377005 CEST	49751	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:11:41.907428026 CEST	443	49751	91.220.42.63	192.168.2.18
Oct 22, 2024 16:11:41.907526970 CEST	49751	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:11:41.907819033 CEST	49751	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:11:41.907835960 CEST	443	49751	91.220.42.63	192.168.2.18
Oct 22, 2024 16:11:42.476350069 CEST	443	49750	91.220.42.63	192.168.2.18
Oct 22, 2024 16:11:42.476813078 CEST	49750	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:11:42.476840019 CEST	443	49750	91.220.42.63	192.168.2.18
Oct 22, 2024 16:11:42.477226019 CEST	443	49750	91.220.42.63	192.168.2.18
Oct 22, 2024 16:11:42.477555990 CEST	49750	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:11:42.477624893 CEST	443	49750	91.220.42.63	192.168.2.18
Oct 22, 2024 16:11:42.477981091 CEST	49750	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:11:42.478022099 CEST	443	49750	91.220.42.63	192.168.2.18
Oct 22, 2024 16:11:42.720344067 CEST	443	49751	91.220.42.63	192.168.2.18
Oct 22, 2024 16:11:42.720822096 CEST	49751	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:11:42.720851898 CEST	443	49751	91.220.42.63	192.168.2.18
Oct 22, 2024 16:11:42.721246958 CEST	443	49751	91.220.42.63	192.168.2.18
Oct 22, 2024 16:11:42.721698999 CEST	49751	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:11:42.721776009 CEST	443	49751	91.220.42.63	192.168.2.18
Oct 22, 2024 16:11:42.756422043 CEST	443	49750	91.220.42.63	192.168.2.18
Oct 22, 2024 16:11:42.756509066 CEST	443	49750	91.220.42.63	192.168.2.18
Oct 22, 2024 16:11:42.756597996 CEST	49750	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:11:42.758953094 CEST	49750	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:11:42.758970022 CEST	443	49750	91.220.42.63	192.168.2.18
Oct 22, 2024 16:11:42.766767979 CEST	49751	443	192.168.2.18	91.220.42.63
Oct 22, 2024 16:11:42.775115967 CEST	49752	443	192.168.2.18	172.67.128.229
Oct 22, 2024 16:11:42.775177002 CEST	443	49752	172.67.128.229	192.168.2.18
Oct 22, 2024 16:11:42.775294065 CEST	49752	443	192.168.2.18	172.67.128.229
Oct 22, 2024 16:11:42.775702000 CEST	49752	443	192.168.2.18	172.67.128.229
Oct 22, 2024 16:11:42.775715113 CEST	443	49752	172.67.128.229	192.168.2.18
Oct 22, 2024 16:11:43.390430927 CEST	443	49752	172.67.128.229	192.168.2.18
Oct 22, 2024 16:11:43.390789032 CEST	49752	443	192.168.2.18	172.67.128.229
Oct 22, 2024 16:11:43.390813112 CEST	443	49752	172.67.128.229	192.168.2.18
Oct 22, 2024 16:11:43.392107964 CEST	443	49752	172.67.128.229	192.168.2.18
Oct 22, 2024 16:11:43.392193079 CEST	49752	443	192.168.2.18	172.67.128.229
Oct 22, 2024 16:11:43.393227100 CEST	49752	443	192.168.2.18	172.67.128.229
Oct 22, 2024 16:11:43.393251896 CEST	49752	443	192.168.2.18	172.67.128.229
Oct 22, 2024 16:11:43.393306017 CEST	443	49752	172.67.128.229	192.168.2.18
Oct 22, 2024 16:11:43.393342018 CEST	49752	443	192.168.2.18	172.67.128.229
Oct 22, 2024 16:11:43.393361092 CEST	49752	443	192.168.2.18	172.67.128.229
Oct 22, 2024 16:11:43.393819094 CEST	49753	443	192.168.2.18	172.67.128.229
Oct 22, 2024 16:11:43.393860102 CEST	443	49753	172.67.128.229	192.168.2.18
Oct 22, 2024 16:11:43.393973112 CEST	49753	443	192.168.2.18	172.67.128.229
Oct 22, 2024 16:11:43.394262075 CEST	49753	443	192.168.2.18	172.67.128.229
Oct 22, 2024 16:11:43.394279957 CEST	443	49753	172.67.128.229	192.168.2.18
Oct 22, 2024 16:11:44.015954971 CEST	443	49753	172.67.128.229	192.168.2.18
Oct 22, 2024 16:11:44.016377926 CEST	49753	443	192.168.2.18	172.67.128.229
Oct 22, 2024 16:11:44.016465902 CEST	443	49753	172.67.128.229	192.168.2.18
Oct 22, 2024 16:11:44.017566919 CEST	443	49753	172.67.128.229	192.168.2.18
Oct 22, 2024 16:11:44.017685890 CEST	49753	443	192.168.2.18	172.67.128.229
Oct 22, 2024 16:11:44.018744946 CEST	49753	443	192.168.2.18	172.67.128.229
Oct 22, 2024 16:11:44.018835068 CEST	443	49753	172.67.128.229	192.168.2.18
Oct 22, 2024 16:11:44.018973112 CEST	49753	443	192.168.2.18	172.67.128.229
Oct 22, 2024 16:11:44.018986940 CEST	443	49753	172.67.128.229	192.168.2.18
Oct 22, 2024 16:11:44.071718931 CEST	49753	443	192.168.2.18	172.67.128.229
Oct 22, 2024 16:11:44.727263927 CEST	443	49753	172.67.128.229	192.168.2.18
Oct 22, 2024 16:11:44.727375031 CEST	443	49753	172.67.128.229	192.168.2.18
Oct 22, 2024 16:11:44.727412939 CEST	443	49753	172.67.128.229	192.168.2.18
Oct 22, 2024 16:11:44.727442980 CEST	49753	443	192.168.2.18	172.67.128.229
Oct 22, 2024 16:11:44.727472067 CEST	443	49753	172.67.128.229	192.168.2.18
Oct 22, 2024 16:11:44.727519989 CEST	49753	443	192.168.2.18	172.67.128.229
Oct 22, 2024 16:11:44.727526903 CEST	443	49753	172.67.128.229	192.168.2.18
Oct 22, 2024 16:11:44.727546930 CEST	443	49753	172.67.128.229	192.168.2.18
Oct 22, 2024 16:11:44.727588892 CEST	49753	443	192.168.2.18	172.67.128.229
Oct 22, 2024 16:11:44.728250980 CEST	49753	443	192.168.2.18	172.67.128.229
Oct 22, 2024 16:11:44.728269100 CEST	443	49753	172.67.128.229	192.168.2.18
Oct 22, 2024 16:11:44.728384972 CEST	49753	443	192.168.2.18	172.67.128.229
Oct 22, 2024 16:11:44.728447914 CEST	49753	443	192.168.2.18	172.67.128.229
Oct 22, 2024 16:11:44.742168903 CEST	49754	443	192.168.2.18	93.184.215.14
Oct 22, 2024 16:11:44.742218018 CEST	443	49754	93.184.215.14	192.168.2.18
Oct 22, 2024 16:11:44.742300034 CEST	49754	443	192.168.2.18	93.184.215.14
Oct 22, 2024 16:11:44.742542982 CEST	49754	443	192.168.2.18	93.184.215.14
Oct 22, 2024 16:11:44.742557049 CEST	443	49754	93.184.215.14	192.168.2.18
Oct 22, 2024 16:11:45.488251925 CEST	443	49754	93.184.215.14	192.168.2.18
Oct 22, 2024 16:11:45.488626957 CEST	49754	443	192.168.2.18	93.184.215.14
Oct 22, 2024 16:11:45.488648891 CEST	443	49754	93.184.215.14	192.168.2.18
Oct 22, 2024 16:11:45.489736080 CEST	443	49754	93.184.215.14	192.168.2.18
Oct 22, 2024 16:11:45.489806890 CEST	49754	443	192.168.2.18	93.184.215.14
Oct 22, 2024 16:11:45.490951061 CEST	49754	443	192.168.2.18	93.184.215.14
Oct 22, 2024 16:11:45.491034031 CEST	443	49754	93.184.215.14	192.168.2.18
Oct 22, 2024 16:11:45.491173029 CEST	49754	443	192.168.2.18	93.184.215.14
Oct 22, 2024 16:11:45.491178036 CEST	443	49754	93.184.215.14	192.168.2.18
Oct 22, 2024 16:11:45.543939114 CEST	49754	443	192.168.2.18	93.184.215.14
Oct 22, 2024 16:11:45.615171909 CEST	443	49754	93.184.215.14	192.168.2.18
Oct 22, 2024 16:11:45.615349054 CEST	443	49754	93.184.215.14	192.168.2.18
Oct 22, 2024 16:11:45.615576029 CEST	49754	443	192.168.2.18	93.184.215.14
Oct 22, 2024 16:11:45.616827011 CEST	49754	443	192.168.2.18	93.184.215.14
Oct 22, 2024 16:11:45.616847038 CEST	443	49754	93.184.215.14	192.168.2.18
Oct 22, 2024 16:11:45.692440987 CEST	49755	443	192.168.2.18	93.184.215.14
Oct 22, 2024 16:11:45.692500114 CEST	443	49755	93.184.215.14	192.168.2.18
Oct 22, 2024 16:11:45.692565918 CEST	49755	443	192.168.2.18	93.184.215.14
Oct 22, 2024 16:11:45.692912102 CEST	49755	443	192.168.2.18	93.184.215.14
Oct 22, 2024 16:11:45.692926884 CEST	443	49755	93.184.215.14	192.168.2.18
Oct 22, 2024 16:11:46.433032990 CEST	443	49755	93.184.215.14	192.168.2.18
Oct 22, 2024 16:11:46.433402061 CEST	49755	443	192.168.2.18	93.184.215.14
Oct 22, 2024 16:11:46.433435917 CEST	443	49755	93.184.215.14	192.168.2.18
Oct 22, 2024 16:11:46.433825970 CEST	443	49755	93.184.215.14	192.168.2.18
Oct 22, 2024 16:11:46.434158087 CEST	49755	443	192.168.2.18	93.184.215.14
Oct 22, 2024 16:11:46.434228897 CEST	443	49755	93.184.215.14	192.168.2.18
Oct 22, 2024 16:11:46.434351921 CEST	49755	443	192.168.2.18	93.184.215.14
Oct 22, 2024 16:11:46.475342989 CEST	443	49755	93.184.215.14	192.168.2.18
Oct 22, 2024 16:11:46.566231012 CEST	443	49755	93.184.215.14	192.168.2.18
Oct 22, 2024 16:11:46.566365957 CEST	443	49755	93.184.215.14	192.168.2.18
Oct 22, 2024 16:11:46.566458941 CEST	49755	443	192.168.2.18	93.184.215.14
Oct 22, 2024 16:11:46.567192078 CEST	49755	443	192.168.2.18	93.184.215.14
Oct 22, 2024 16:11:46.567219019 CEST	443	49755	93.184.215.14	192.168.2.18

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 22, 2024 16:10:38.153177977 CEST	138	138	192.168.2.18	192.168.2.255
Oct 22, 2024 16:10:54.119199991 CEST	51666	53	192.168.2.18	1.1.1.1
Oct 22, 2024 16:10:54.119432926 CEST	60857	53	192.168.2.18	1.1.1.1
Oct 22, 2024 16:10:54.121426105 CEST	53	63238	1.1.1.1	192.168.2.18
Oct 22, 2024 16:10:54.127223015 CEST	53	60857	1.1.1.1	192.168.2.18
Oct 22, 2024 16:10:54.152520895 CEST	53	51666	1.1.1.1	192.168.2.18
Oct 22, 2024 16:10:54.171665907 CEST	53	49486	1.1.1.1	192.168.2.18
Oct 22, 2024 16:10:55.396415949 CEST	53	57456	1.1.1.1	192.168.2.18
Oct 22, 2024 16:10:56.520669937 CEST	64106	53	192.168.2.18	1.1.1.1
Oct 22, 2024 16:10:56.520828009 CEST	53304	53	192.168.2.18	1.1.1.1
Oct 22, 2024 16:10:56.528896093 CEST	53	64106	1.1.1.1	192.168.2.18
Oct 22, 2024 16:10:56.595592976 CEST	53	53304	1.1.1.1	192.168.2.18
Oct 22, 2024 16:10:58.702666044 CEST	61673	53	192.168.2.18	1.1.1.1
Oct 22, 2024 16:10:58.703015089 CEST	50656	53	192.168.2.18	1.1.1.1
Oct 22, 2024 16:10:58.709855080 CEST	53	61673	1.1.1.1	192.168.2.18
Oct 22, 2024 16:10:58.710622072 CEST	53	50656	1.1.1.1	192.168.2.18
Oct 22, 2024 16:10:59.258760929 CEST	61099	53	192.168.2.18	1.1.1.1
Oct 22, 2024 16:10:59.258968115 CEST	56802	53	192.168.2.18	1.1.1.1
Oct 22, 2024 16:10:59.281050920 CEST	53	61099	1.1.1.1	192.168.2.18
Oct 22, 2024 16:10:59.283834934 CEST	53	56802	1.1.1.1	192.168.2.18
Oct 22, 2024 16:11:12.460427046 CEST	53	51780	1.1.1.1	192.168.2.18
Oct 22, 2024 16:11:12.460453987 CEST	53	61913	1.1.1.1	192.168.2.18
Oct 22, 2024 16:11:42.760246038 CEST	54068	53	192.168.2.18	1.1.1.1
Oct 22, 2024 16:11:42.760464907 CEST	62346	53	192.168.2.18	1.1.1.1
Oct 22, 2024 16:11:42.770694017 CEST	53	62346	1.1.1.1	192.168.2.18
Oct 22, 2024 16:11:42.772933960 CEST	53	54068	1.1.1.1	192.168.2.18
Oct 22, 2024 16:11:44.731237888 CEST	63297	53	192.168.2.18	1.1.1.1
Oct 22, 2024 16:11:44.731456041 CEST	51152	53	192.168.2.18	1.1.1.1
Oct 22, 2024 16:11:44.739681959 CEST	53	63297	1.1.1.1	192.168.2.18
Oct 22, 2024 16:11:44.741753101 CEST	53	51152	1.1.1.1	192.168.2.18

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 22, 2024 16:10:56.598797083 CEST	192.168.2.18	1.1.1.1	c23d	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 22, 2024 16:10:54.119199991 CEST	192.168.2.18	1.1.1.1	0xd179	Standard query (0)	url.uk.m.mimecastprotect.com	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:10:54.119432926 CEST	192.168.2.18	1.1.1.1	0xf310	Standard query (0)	url.uk.m.mimecastprotect.com	65	IN (0x0001)	false
Oct 22, 2024 16:10:56.520669937 CEST	192.168.2.18	1.1.1.1	0x7596	Standard query (0)	security-uk.m.mimecastprotect.com	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:10:56.520828009 CEST	192.168.2.18	1.1.1.1	0xf968	Standard query (0)	security-uk.m.mimecastprotect.com	65	IN (0x0001)	false
Oct 22, 2024 16:10:58.702666044 CEST	192.168.2.18	1.1.1.1	0xa123	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:10:58.703015089 CEST	192.168.2.18	1.1.1.1	0xffd2	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 22, 2024 16:10:59.258760929 CEST	192.168.2.18	1.1.1.1	0xd0bd	Standard query (0)	security-uk.m.mimecastprotect.com	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:10:59.258968115 CEST	192.168.2.18	1.1.1.1	0xedaf	Standard query (0)	security-uk.m.mimecastprotect.com	65	IN (0x0001)	false
Oct 22, 2024 16:11:42.760246038 CEST	192.168.2.18	1.1.1.1	0xe6d0	Standard query (0)	hnamedmr.ukremediatlon.co.uk	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:11:42.760464907 CEST	192.168.2.18	1.1.1.1	0x1922	Standard query (0)	hnamedmr.ukremediatlon.co.uk	65	IN (0x0001)	false
Oct 22, 2024 16:11:44.731237888 CEST	192.168.2.18	1.1.1.1	0x6415	Standard query (0)	www.example.com	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:11:44.731456041 CEST	192.168.2.18	1.1.1.1	0xab06	Standard query (0)	www.example.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 22, 2024 16:10:54.152520895 CEST	1.1.1.1	192.168.2.18	0xd179	No error (0)	url.uk.m.mimecastprotect.com	91.220.42.63	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:10:54.152520895 CEST	1.1.1.1	192.168.2.18	0xd179	No error (0)	url.uk.m.mimecastprotect.com	91.220.42.215	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:10:54.152520895 CEST	1.1.1.1	192.168.2.18	0xd179	No error (0)	url.uk.m.mimecastprotect.com	195.130.217.73	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:10:54.152520895 CEST	1.1.1.1	192.168.2.18	0xd179	No error (0)	url.uk.m.mimecastprotect.com	195.130.217.187	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:10:54.152520895 CEST	1.1.1.1	192.168.2.18	0xd179	No error (0)	url.uk.m.mimecastprotect.com	195.130.217.180	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:10:54.152520895 CEST	1.1.1.1	192.168.2.18	0xd179	No error (0)	url.uk.m.mimecastprotect.com	91.220.42.235	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:10:56.528896093 CEST	1.1.1.1	192.168.2.18	0x7596	No error (0)	security-uk.m.mimecastprotect.com	195.130.217.88	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:10:56.528896093 CEST	1.1.1.1	192.168.2.18	0x7596	No error (0)	security-uk.m.mimecastprotect.com	195.130.217.89	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:10:56.528896093 CEST	1.1.1.1	192.168.2.18	0x7596	No error (0)	security-uk.m.mimecastprotect.com	91.220.42.88	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:10:56.528896093 CEST	1.1.1.1	192.168.2.18	0x7596	No error (0)	security-uk.m.mimecastprotect.com	195.130.217.87	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:10:56.528896093 CEST	1.1.1.1	192.168.2.18	0x7596	No error (0)	security-uk.m.mimecastprotect.com	91.220.42.87	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:10:56.528896093 CEST	1.1.1.1	192.168.2.18	0x7596	No error (0)	security-uk.m.mimecastprotect.com	91.220.42.89	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:10:58.709855080 CEST	1.1.1.1	192.168.2.18	0xa123	No error (0)	www.google.com	142.250.185.68	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:10:58.710622072 CEST	1.1.1.1	192.168.2.18	0xffd2	No error (0)	www.google.com		65	IN (0x0001)	false
Oct 22, 2024 16:10:59.281050920 CEST	1.1.1.1	192.168.2.18	0xd0bd	No error (0)	security-uk.m.mimecastprotect.com	195.130.217.88	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:10:59.281050920 CEST	1.1.1.1	192.168.2.18	0xd0bd	No error (0)	security-uk.m.mimecastprotect.com	195.130.217.87	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:10:59.281050920 CEST	1.1.1.1	192.168.2.18	0xd0bd	No error (0)	security-uk.m.mimecastprotect.com	91.220.42.88	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:10:59.281050920 CEST	1.1.1.1	192.168.2.18	0xd0bd	No error (0)	security-uk.m.mimecastprotect.com	195.130.217.89	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:10:59.281050920 CEST	1.1.1.1	192.168.2.18	0xd0bd	No error (0)	security-uk.m.mimecastprotect.com	91.220.42.89	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:10:59.281050920 CEST	1.1.1.1	192.168.2.18	0xd0bd	No error (0)	security-uk.m.mimecastprotect.com	91.220.42.87	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:11:42.770694017 CEST	1.1.1.1	192.168.2.18	0x1922	No error (0)	hnamedmr.ukremediatlon.co.uk		65	IN (0x0001)	false
Oct 22, 2024 16:11:42.772933960 CEST	1.1.1.1	192.168.2.18	0xe6d0	No error (0)	hnamedmr.ukremediatlon.co.uk	172.67.128.229	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:11:42.772933960 CEST	1.1.1.1	192.168.2.18	0xe6d0	No error (0)	hnamedmr.ukremediatlon.co.uk	104.21.2.77	A (IP address)	IN (0x0001)	false
Oct 22, 2024 16:11:44.739681959 CEST	1.1.1.1	192.168.2.18	0x6415	No error (0)	www.example.com	93.184.215.14	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

slscr.update.microsoft.com

www.bing.com

url.uk.m.mimecastprotect.com

security-uk.m.mimecastprotect.com

https:

www.example.com

hnamedmr.ukremediatlon.co.uk

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.18	49698	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:09:49 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ahXDKPZCcoot+6s&MD=6mmrbygb HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-22 14:09:49 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: d64dd844-c895-450d-a189-c67eadb8334f MS-RequestId: 99b9aeb6-30ad-485e-9a89-15d6a3d383be MS-CV: kxiXrVDKq0SRx9D/.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 22 Oct 2024 14:09:48 GMT Connection: close Content-Length: 24490
2024-10-22 14:09:49 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-22 14:09:49 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.18	49705	40.126.32.138	443

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:09:51 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-22 14:09:51 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-22 14:09:51 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 22 Oct 2024 14:08:51 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C539_SN1 x-ms-request-id: 9fa37002-43a6-410c-bb0a-f122bfba5c3f PPServer: PPV: 30 H: SN1PEPF0002F146 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 22 Oct 2024 14:09:50 GMT Connection: close Content-Length: 11392
2024-10-22 14:09:51 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.18	49706	40.126.32.138	443

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:09:52 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-22 14:09:52 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-22 14:09:53 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 22 Oct 2024 14:08:52 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C539_BAY x-ms-request-id: e5e4197d-ad73-4d87-8c99-aaf0fbce4ddd PPServer: PPV: 30 H: PH1PEPF00011CAC V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 22 Oct 2024 14:09:52 GMT Connection: close Content-Length: 11392
2024-10-22 14:09:53 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.18	49707	40.126.32.138	443

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:09:54 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-22 14:09:54 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-22 14:09:54 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 22 Oct 2024 14:08:54 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C539_SN1 x-ms-request-id: 87a3c06c-ee1f-4377-98e6-0aa3ce511602 PPServer: PPV: 30 H: SN1PEPF0002F951 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 22 Oct 2024 14:09:54 GMT Connection: close Content-Length: 11412
2024-10-22 14:09:54 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.18	49709	40.126.32.138	443

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:09:55 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4762 Host: login.live.com
2024-10-22 14:09:55 UTC	4762	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-22 14:09:56 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 22 Oct 2024 14:08:56 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C539_BAY x-ms-request-id: ad59790f-825d-4ed5-b224-1c8b854912ee PPServer: PPV: 30 H: PH1PEPF00018BCB V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 22 Oct 2024 14:09:55 GMT Connection: close Content-Length: 10197
2024-10-22 14:09:56 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.18	49710	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:10:27 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ahXDKPZCcoot+6s&MD=6mmrbygb HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-22 14:10:27 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 3422831f-8de7-480d-be60-e596d945a8cb MS-RequestId: 2b368e9f-8fca-4c94-b467-7765a9fac747 MS-CV: K9AChFyF3EScS3E9.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 22 Oct 2024 14:10:26 GMT Connection: close Content-Length: 30005
2024-10-22 14:10:27 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-22 14:10:27 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.18	49711	40.126.32.138	443

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:10:35 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4828 Host: login.live.com
2024-10-22 14:10:35 UTC	4828	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-22 14:10:35 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 22 Oct 2024 14:09:35 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C539_SN1 x-ms-request-id: 57c8e1fe-aec9-43f5-a564-289d874a45bc PPServer: PPV: 30 H: SN1PEPF0002F964 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 22 Oct 2024 14:10:35 GMT Connection: close Content-Length: 11197
2024-10-22 14:10:35 UTC	11197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.18	49712	2.23.209.140	443

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:10:36 UTC	2756	OUT	GET /client/config?cc=CH&setlang=en-CH HTTP/1.1 X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-UserAgeClass: Unknown X-BM-Market: CH X-BM-DateFormat: dd/MM/yyyy X-Device-OSSKU: 48 X-BM-DTZ: -240 X-DeviceID: 01000A410900B03D X-BM-WindowsFlights: FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12E85C75 X-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDoAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAQ6GhAkHuPtVTVeAt8GnNTXiw/C/ancNPYhIm/WzQoKYIcnODiygMSaKDpesx7WgNrvREVrDFcW7ECyynHXFO5t3xlEzqcG1ZxCgB69iRgPFlRupuWqnS7P7CjA%2B0ZRmhmVy1qNBOkkSURe2oNh3wvug/05fcrZf8Kuql9X69BDdP/BG0bZp9l%2BTUvkp8y/Ov90S5AzzdoWEpMEU0TzuVBagb0vpBXkoa3Vl/isHcHiP3Yx0pICzN3HIdGMgw2mE/G48LyHtBFLWmVBXfPx4C54rMvzTrhGbawbkOLpWnyzQgfjGsatPHamcJpguASSRk19dp3Jm8Xl3Nu%2B6HP83mYAQZgAAEMegth5sow/To49b0%2BBFalCwAfN7MWOLqO6EDDUdcO1n6tQj/LX%2BSufX9heH%2BdPh0R2os5TVQlwMShLlZ/f9FDMiqPHn%2BDbcQMz8uXPYMkQD5gAYZRADhXwwZae3Pu%2BE5NHfggzGeGDBzu84EqaJawNdK3QX0iSLLyEoNhTFy/X9pnLRAv6v7tW7rE6uXbVAsl/VZ8n%2BwqmJTJg5H7G4FS1LIJbivlNG0XnnpdQPCYY7iobuq9U28f1/fp8EbWnyA88FBtE1NJk1bPKAN0zgsO1E2owcxf6xKuva4X2UgVGqtSZ9x%2BUm2omNcIXF3NAVBHOfEpxQ4V6UATzmqIXmFO%2B741E7csCvFR%2BNEPa4QAQbrkm84rtcfNsu2qZsch7mBw8KKLL37mI%2Bp2ZpmZIu5U7MvVr5LCBQRTRo%2B049iRQFZsLHWGw3sfZHsRUX3/c%2B4WAEU7kj3aaHeS9efYuGT/Yr/QgcBIF8jDcy0O0RGfCUUZShcEjHzk4mAVmfkqQbrElYViWvG6B53B6vvWMrsawnhdZFLyzXB9rk3VRAdJF3muLWzpSBLxBgSb8D%2BkECJG6Bh [TRUNCATED] X-Agent-DeviceId: 01000A410900B03D X-BM-CBT: 1729606233 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 X-Device-isOptin: false Accept-language: en-GB, en, en-US X-Device-Touch: false X-Device-ClientSession: F7B3F22C310949C6A9567A248FB019C9 X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI Host: www.bing.com Connection: Keep-Alive Cookie: SRCHUID=V=2&GUID=B4BB39E5F80E411D94C438C0FA7ACF94&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&LUT=1707317051026&IPMH=6b344233&IPMID=1707317270835&HV=1707317277; ANON=A=680C1B1A649CBD64DD40EBFCFFFFFFFF; MUID=BC76BB0020D345C1A049A4820CB4C03C; MUIDB=BC76BB0020D345C1A049A4820CB4C03C
2024-10-22 14:10:36 UTC	1197	IN	HTTP/1.1 200 OK Content-Length: 2215 Content-Type: application/json; charset=utf-8 Cache-Control: private X-EventID: 6717b25cc9c042ad8118b68ccfa86d0f X-AS-SetSessionMarket: de-ch UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Tue, 22 Oct 2024 14:10:36 GMT Connection: close Set-Cookie: _EDGE_S=SID=1C51E924CE2967CB3AB5FC04CF3666C8&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: SRCHHPGUSR=SRCHLANG=en&LUT=1707317051026&IPMH=6b344233&IPMID=1707317270835&HV=1707317277; domain=.bing.com; expires=Sun, 16-Nov-2025 14:10:36 GMT; path=/; secure; SameSite=None Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/; secure; SameSite=None Set-Cookie: _SS=SID=1C51E924CE2967CB3AB5FC04CF3666C8; domain=.bing.com; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.0dd01702.1729606236.175b5fdb
2024-10-22 14:10:36 UTC	2215	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65 Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.18	49715	91.220.42.63	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:10:54 UTC	734	OUT	GET /s/ZlrZCZYQ9UxMnWNsysRFBA-ZP?domain=hnamedmr.ukremediatlon.co.uk HTTP/1.1 Host: url.uk.m.mimecastprotect.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:10:55 UTC	4120	IN	HTTP/1.1 307 Temporary Redirect Date: Tue, 22 Oct 2024 14:10:55 GMT Content-Length: 0 Connection: close Location: https://url.uk.m.mimecastprotect.com/r/lJ_qgGoNKOtmgnbcVAzK9AK7bCK_bMUk-wR7tn7n2Yc-AiwWUwSJ5cdo4JD9L-rHbsi-7W3dO8y5uQV2nzI3pgGYX2bWfu1MDc-X9rMWVK_hsH3igqVCwlv82yO9Us1bD9QGVJXYV3iwcJyaZUtCzpN5gQCtVwfSk4NF3Jvvjo6dam7LE0uymt-W2XHlpqniDQv0P0k8ZJKYaCstCrmE1sq1ZoAQ3VLjp0OO2PZzixRmPZJK3FnHnTaIJwVqhz9-vSI1xigm4TWyfd7JWmu74nSWtZqj9NqEJglaSsVWuKMnELweU3CY7wK_cfeqtPwaqs8jlAL3SZc0pjK71K0ISYzpKLaSw_JCCc6zzmE5PGZHuWIotNrok3xDwjmYYdSvbsjWzlsuRUUe3Ge-nzuT_-uUD_uGughyFXcxYqfAHpXCIep-KQdcjuq5Gyqg4rYzIdDobbwKUqvbUjmSwsU6Kbz8qPGQrWgdumJENyi7ViVKh-mx850nErkNPPaV8cEVsF1xwTxYLEAhTmhHRFqA7DnqNRyYU8B2moBCnufp7KSRLhEp1_IHwcMi0uGvittYjkbd0gHZii0doZ1PDx7jizS1e86c9bnhOUytqDfaRPkGLrrmXFvMSMHe0VxnfFBGLZEIqK8aCvyVOEzBNaAsXqjn0X24VWZs0SIbrkF1BRP5g_6PPLDHAT96Al--7XzfEabS-JA9VJrrtaFy3rXYfe_PvCiuYE1POvOJHaa21-S6TObxg0FHlmY4H26jk9CS7vhpZOSEqojkHw-5NIh6Xakwp7HlCqrjIavb4slvXKlKIaN5TvHEmT0NJj9Tz-QJoPY9eQM87kb2xd-yGPumDZ7hR0YYULul-RYv02pa-1WDseD-F4nYtDSc3kB_FBhSsd7qv8I8acNjgeUi66fzcgkqjzwY1Ak8-rqfZ5tLgDhm9ERoKKIvhlix5yGPfqgo-DeV8vH-ifijkZj [TRUNCATED] Cache-control: no-store Pragma: no-cache X-Robots-Tag: noindex, nofollow

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.18	49718	91.220.42.63	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:10:56 UTC	4556	OUT	GET /r/lJ_qgGoNKOtmgnbcVAzK9AK7bCK_bMUk-wR7tn7n2Yc-AiwWUwSJ5cdo4JD9L-rHbsi-7W3dO8y5uQV2nzI3pgGYX2bWfu1MDc-X9rMWVK_hsH3igqVCwlv82yO9Us1bD9QGVJXYV3iwcJyaZUtCzpN5gQCtVwfSk4NF3Jvvjo6dam7LE0uymt-W2XHlpqniDQv0P0k8ZJKYaCstCrmE1sq1ZoAQ3VLjp0OO2PZzixRmPZJK3FnHnTaIJwVqhz9-vSI1xigm4TWyfd7JWmu74nSWtZqj9NqEJglaSsVWuKMnELweU3CY7wK_cfeqtPwaqs8jlAL3SZc0pjK71K0ISYzpKLaSw_JCCc6zzmE5PGZHuWIotNrok3xDwjmYYdSvbsjWzlsuRUUe3Ge-nzuT_-uUD_uGughyFXcxYqfAHpXCIep-KQdcjuq5Gyqg4rYzIdDobbwKUqvbUjmSwsU6Kbz8qPGQrWgdumJENyi7ViVKh-mx850nErkNPPaV8cEVsF1xwTxYLEAhTmhHRFqA7DnqNRyYU8B2moBCnufp7KSRLhEp1_IHwcMi0uGvittYjkbd0gHZii0doZ1PDx7jizS1e86c9bnhOUytqDfaRPkGLrrmXFvMSMHe0VxnfFBGLZEIqK8aCvyVOEzBNaAsXqjn0X24VWZs0SIbrkF1BRP5g_6PPLDHAT96Al--7XzfEabS-JA9VJrrtaFy3rXYfe_PvCiuYE1POvOJHaa21-S6TObxg0FHlmY4H26jk9CS7vhpZOSEqojkHw-5NIh6Xakwp7HlCqrjIavb4slvXKlKIaN5TvHEmT0NJj9Tz-QJoPY9eQM87kb2xd-yGPumDZ7hR0YYULul-RYv02pa-1WDseD-F4nYtDSc3kB_FBhSsd7qv8I8acNjgeUi66fzcgkqjzwY1Ak8-rqfZ5tLgDhm9ERoKKIvhlix5yGPfqgo-DeV8vH-ifijkZj4e-P3X0N4ZVegzbHvflS2YJEfRIM2ZTxn5VC8ZDWCY [TRUNCATED] Host: url.uk.m.mimecastprotect.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:10:56 UTC	455	IN	HTTP/1.1 307 Temporary Redirect Date: Tue, 22 Oct 2024 14:10:56 GMT Content-Length: 0 Connection: close Location: https://security-uk.m.mimecastprotect.com/ttpwp#/ua?key=YHCH0jK4xsNRMGObU0ehDxT0fg3jXsga1nzcx-4fokPB1Xd4nzhmP6PAOTq_52_c9hx____uGeArAE7NPLh9tr4j9XByPup4XVZ61RaDPROs8aoUE601fyVV1A9ypfpB Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Cache-control: no-store Pragma: no-cache X-Robots-Tag: noindex, nofollow

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.18	49720	195.130.217.88	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:10:57 UTC	681	OUT	GET /ttpwp HTTP/1.1 Host: security-uk.m.mimecastprotect.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:10:57 UTC	434	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:10:57 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3447 Connection: close x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload ETag: W/"d77-JdL/eOsS7z2yo5B+jSzjnBxVBdk" Vary: Accept-Encoding
2024-10-22 14:10:57 UTC	3447	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c Data Ascii: <!doctype html><html lang="en"><head> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no, maximum-scale=1, minimum-scale=1"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.18	49721	195.130.217.88	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:10:58 UTC	545	OUT	GET /ttpwp/resources/runtime.5257ca6e429949972959.js HTTP/1.1 Host: security-uk.m.mimecastprotect.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:10:59 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:10:59 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 1492 Connection: close x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Thu, 08 Feb 2024 17:09:18 GMT ETag: W/"5d4-18d89b1f630" Vary: Accept-Encoding
2024-10-22 14:10:59 UTC	1492	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 72 28 72 29 7b 66 6f 72 28 76 61 72 20 6e 2c 6c 2c 70 3d 72 5b 30 5d 2c 66 3d 72 5b 31 5d 2c 69 3d 72 5b 32 5d 2c 63 3d 30 2c 73 3d 5b 5d 3b 63 3c 70 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 6c 3d 70 5b 63 5d 2c 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6f 2c 6c 29 26 26 6f 5b 6c 5d 26 26 73 2e 70 75 73 68 28 6f 5b 6c 5d 5b 30 5d 29 2c 6f 5b 6c 5d 3d 30 3b 66 6f 72 28 6e 20 69 6e 20 66 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 66 2c 6e 29 26 26 28 65 5b 6e 5d 3d 66 5b 6e 5d 29 3b 66 6f 72 28 61 26 26 61 28 72 29 3b 73 2e 6c 65 6e 67 74 68 3b 29 73 2e 73 68 Data Ascii: !function(e){function r(r){for(var n,l,p=r[0],f=r[1],i=r[2],c=0,s=[];c<p.length;c++)l=p[c],Object.prototype.hasOwnProperty.call(o,l)&&o[l]&&s.push(o[l][0]),o[l]=0;for(n in f)Object.prototype.hasOwnProperty.call(f,n)&&(e[n]=f[n]);for(a&&a(r);s.length;)s.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.18	49722	195.130.217.88	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:10:59 UTC	547	OUT	GET /ttpwp/resources/polyfills.5257ca6e429949972959.js HTTP/1.1 Host: security-uk.m.mimecastprotect.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:10:59 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:10:59 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 95292 Connection: close x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Thu, 08 Feb 2024 17:09:18 GMT ETag: W/"1743c-18d89b1f630" Vary: Accept-Encoding
2024-10-22 14:10:59 UTC	15848	IN	Data Raw: 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 32 5d 2c 7b 22 30 54 57 70 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 2c 69 2c 6f 3d 74 68 69 73 26 26 74 68 69 73 2e 5f 5f 73 70 72 65 61 64 41 72 72 61 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 69 66 28 6e 7c 7c 32 3d 3d 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 29 66 6f 72 28 76 61 72 20 72 2c 69 3d 30 2c 6f 3d 74 2e 6c 65 6e 67 74 68 3b 69 3c 6f 3b 69 2b 2b 29 21 72 26 26 69 20 69 6e 20 74 7c 7c 28 72 7c 7c 28 72 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 74 2c 30 2c Data Ascii: (window.webpackJsonp=window.webpackJsonp\|\|[]).push([[2],{"0TWp":function(e,t,n){"use strict";var r,i,o=this&&this.__spreadArray\|\|function(e,t,n){if(n\|\|2===arguments.length)for(var r,i=0,o=t.length;i<o;i++)!r&&i in t\|\|(r\|\|(r=Array.prototype.slice.call(t,0,
2024-10-22 14:10:59 UTC	16384	IN	Data Raw: 61 72 20 74 3d 65 26 26 65 2e 72 65 6a 65 63 74 69 6f 6e 3b 74 3f 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 22 55 6e 68 61 6e 64 6c 65 64 20 50 72 6f 6d 69 73 65 20 72 65 6a 65 63 74 69 6f 6e 3a 22 2c 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 45 72 72 6f 72 3f 74 2e 6d 65 73 73 61 67 65 3a 74 2c 22 3b 20 5a 6f 6e 65 3a 22 2c 65 2e 7a 6f 6e 65 2e 6e 61 6d 65 2c 22 3b 20 54 61 73 6b 3a 22 2c 65 2e 74 61 73 6b 26 26 65 2e 74 61 73 6b 2e 73 6f 75 72 63 65 2c 22 3b 20 56 61 6c 75 65 3a 22 2c 74 2c 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 45 72 72 6f 72 3f 74 2e 73 74 61 63 6b 3a 76 6f 69 64 20 30 29 3a 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 65 29 7d 7d 2c 6e 2e 6d 69 63 72 6f 74 61 73 6b 44 72 61 69 6e 44 6f 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 Data Ascii: ar t=e&&e.rejection;t?console.error("Unhandled Promise rejection:",t instanceof Error?t.message:t,"; Zone:",e.zone.name,"; Task:",e.task&&e.task.source,"; Value:",t,t instanceof Error?t.stack:void 0):console.error(e)}},n.microtaskDrainDone=function(){for(
2024-10-22 14:10:59 UTC	16384	IN	Data Raw: 69 70 74 2c 53 65 6c 65 63 74 2c 53 6f 75 72 63 65 2c 53 70 61 6e 2c 53 74 79 6c 65 2c 54 61 62 6c 65 43 61 70 74 69 6f 6e 2c 54 61 62 6c 65 43 65 6c 6c 2c 54 61 62 6c 65 43 6f 6c 2c 54 61 62 6c 65 2c 54 61 62 6c 65 52 6f 77 2c 54 61 62 6c 65 53 65 63 74 69 6f 6e 2c 54 65 78 74 41 72 65 61 2c 54 69 74 6c 65 2c 54 72 61 63 6b 2c 55 4c 69 73 74 2c 55 6e 6b 6e 6f 77 6e 2c 56 69 64 65 6f 22 2e 73 70 6c 69 74 28 22 2c 22 29 3b 66 3f 6c 3d 68 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 48 54 4d 4c 22 2b 65 2b 22 45 6c 65 6d 65 6e 74 22 7d 29 2e 63 6f 6e 63 61 74 28 75 29 3a 65 2e 45 76 65 6e 74 54 61 72 67 65 74 3f 6c 2e 70 75 73 68 28 22 45 76 65 6e 74 54 61 72 67 65 74 22 29 3a 6c 3d 75 3b 66 6f 72 28 76 61 72 20 70 3d 65 2e 5f 5f Data Ascii: ipt,Select,Source,Span,Style,TableCaption,TableCell,TableCol,Table,TableRow,TableSection,TextArea,Title,Track,UList,Unknown,Video".split(",");f?l=h.map(function(e){return"HTML"+e+"Element"}).concat(u):e.EventTarget?l.push("EventTarget"):l=u;for(var p=e.__
2024-10-22 14:10:59 UTC	16384	IN	Data Raw: 73 2e 5f 70 6c 61 79 62 61 63 6b 52 61 74 65 3d 31 2c 74 68 69 73 2e 5f 64 69 72 65 63 74 69 6f 6e 3d 22 6e 6f 72 6d 61 6c 22 2c 74 68 69 73 2e 5f 65 61 73 69 6e 67 3d 22 6c 69 6e 65 61 72 22 2c 74 68 69 73 2e 5f 65 61 73 69 6e 67 46 75 6e 63 74 69 6f 6e 3d 68 7d 66 75 6e 63 74 69 6f 6e 20 72 28 29 7b 72 65 74 75 72 6e 20 65 2e 69 73 44 65 70 72 65 63 61 74 65 64 28 22 49 6e 76 61 6c 69 64 20 74 69 6d 69 6e 67 20 69 6e 70 75 74 73 22 2c 22 32 30 31 36 2d 30 33 2d 30 32 22 2c 22 54 79 70 65 45 72 72 6f 72 20 65 78 63 65 70 74 69 6f 6e 73 20 77 69 6c 6c 20 62 65 20 74 68 72 6f 77 6e 20 69 6e 73 74 65 61 64 2e 22 2c 21 30 29 7d 66 75 6e 63 74 69 6f 6e 20 69 28 74 2c 72 2c 69 29 7b 76 61 72 20 6f 3d 6e 65 77 20 6e 3b 72 65 74 75 72 6e 20 72 26 26 28 6f 2e 66 Data Ascii: s._playbackRate=1,this._direction="normal",this._easing="linear",this._easingFunction=h}function r(){return e.isDeprecated("Invalid timing inputs","2016-03-02","TypeError exceptions will be thrown instead.",!0)}function i(t,r,i){var o=new n;return r&&(o.f
2024-10-22 14:10:59 UTC	16384	IN	Data Raw: 69 6f 6e 28 72 29 7b 72 65 74 75 72 6e 20 6e 28 66 75 6e 63 74 69 6f 6e 20 65 28 74 2c 6e 2c 72 29 7b 69 66 28 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 6e 29 72 65 74 75 72 6e 20 74 2a 28 31 2d 72 29 2b 6e 2a 72 3b 69 66 28 22 62 6f 6f 6c 65 61 6e 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 22 62 6f 6f 6c 65 61 6e 22 3d 3d 74 79 70 65 6f 66 20 6e 29 72 65 74 75 72 6e 20 72 3c 2e 35 3f 74 3a 6e 3b 69 66 28 74 2e 6c 65 6e 67 74 68 3d 3d 6e 2e 6c 65 6e 67 74 68 29 7b 66 6f 72 28 76 61 72 20 69 3d 5b 5d 2c 6f 3d 30 3b 6f 3c 74 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 69 2e 70 75 73 68 28 65 28 74 5b 6f 5d 2c 6e 5b 6f 5d 2c 72 29 29 3b 72 65 74 75 72 6e 20 69 7d 74 68 72 6f 77 22 4d 69 73 6d 61 74 63 Data Ascii: ion(r){return n(function e(t,n,r){if("number"==typeof t&&"number"==typeof n)return t(1-r)+nr;if("boolean"==typeof t&&"boolean"==typeof n)return r<.5?t:n;if(t.length==n.length){for(var i=[],o=0;o<t.length;o++)i.push(e(t[o],n[o],r));return i}throw"Mismatc
2024-10-22 14:10:59 UTC	13908	IN	Data Raw: 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 69 2c 6f 29 7b 72 65 74 75 72 6e 5b 69 2c 6f 2c 66 75 6e 63 74 69 6f 6e 28 69 29 7b 72 65 74 75 72 6e 20 6e 28 72 28 65 2c 74 2c 69 29 29 7d 5d 7d 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 29 7b 76 61 72 20 74 3d 65 2e 74 72 69 6d 28 29 2e 73 70 6c 69 74 28 2f 5c 73 2a 5b 5c 73 2c 5d 5c 73 2a 2f 29 3b 69 66 28 30 21 3d 3d 74 2e 6c 65 6e 67 74 68 29 7b 66 6f 72 28 76 61 72 20 6e 3d 5b 5d 2c 72 3d 30 3b 72 3c 74 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 7b 76 61 72 20 6f 3d 69 28 74 5b 72 5d 29 3b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 6f 29 72 65 74 75 72 6e 3b 6e 2e 70 75 73 68 28 6f 29 7d 72 65 74 75 72 6e 20 6e 7d 7d 65 2e 63 6c 61 6d 70 3d 72 2c 65 2e 61 64 64 50 72 6f 70 65 72 74 69 65 73 48 61 6e Data Ascii: (e,t){return function(i,o){return[i,o,function(i){return n(r(e,t,i))}]}}function a(e){var t=e.trim().split(/\s[\s,]\s/);if(0!==t.length){for(var n=[],r=0;r<t.length;r++){var o=i(t[r]);if(void 0===o)return;n.push(o)}return n}}e.clamp=r,e.addPropertiesHan

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.18	49723	195.130.217.88	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:10:59 UTC	544	OUT	GET /ttpwp/resources/styles.5257ca6e429949972959.js HTTP/1.1 Host: security-uk.m.mimecastprotect.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:10:59 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:10:59 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 410447 Connection: close x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Thu, 08 Feb 2024 17:09:18 GMT ETag: W/"6434f-18d89b1f630" Vary: Accept-Encoding
2024-10-22 14:10:59 UTC	15847	IN	Data Raw: 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 34 5d 2c 7b 33 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 6f 29 7b 6e 2e 65 78 70 6f 72 74 73 3d 6f 28 22 6c 45 75 68 22 29 7d 2c 4a 50 73 74 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 6f 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 65 3d 5b 5d 3b 72 65 74 75 72 6e 20 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6f 3d 6e 28 65 29 3b 72 65 74 75 72 6e 20 65 5b 32 5d 3f 22 40 6d 65 64 69 61 20 22 2e 63 6f 6e 63 Data Ascii: (window.webpackJsonp=window.webpackJsonp\|\|[]).push([[4],{3:function(n,e,o){n.exports=o("lEuh")},JPst:function(n,e,o){"use strict";n.exports=function(n){var e=[];return e.toString=function(){return this.map(function(e){var o=n(e);return e[2]?"@media ".conc
2024-10-22 14:10:59 UTC	16384	IN	Data Raw: 74 69 63 6c 65 2c 5c 6e 61 73 69 64 65 2c 5c 6e 64 65 74 61 69 6c 73 2c 5c 6e 66 69 67 63 61 70 74 69 6f 6e 2c 5c 6e 66 69 67 75 72 65 2c 5c 6e 66 6f 6f 74 65 72 2c 5c 6e 68 65 61 64 65 72 2c 5c 6e 68 67 72 6f 75 70 2c 5c 6e 6d 61 69 6e 2c 5c 6e 6d 65 6e 75 2c 5c 6e 6e 61 76 2c 5c 6e 73 65 63 74 69 6f 6e 2c 5c 6e 73 75 6d 6d 61 72 79 20 7b 5c 6e 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 5c 6e 7d 5c 6e 61 75 64 69 6f 2c 5c 6e 63 61 6e 76 61 73 2c 5c 6e 70 72 6f 67 72 65 73 73 2c 5c 6e 76 69 64 65 6f 20 7b 5c 6e 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 5c 6e 20 20 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 62 61 73 65 6c 69 6e 65 3b 5c 6e 7d 5c 6e 61 75 64 69 6f 3a 6e 6f 74 28 5b 63 6f 6e 74 72 6f 6c 73 5d 29 20 Data Ascii: ticle,\naside,\ndetails,\nfigcaption,\nfigure,\nfooter,\nheader,\nhgroup,\nmain,\nmenu,\nnav,\nsection,\nsummary {\n display: block;\n}\naudio,\ncanvas,\nprogress,\nvideo {\n display: inline-block;\n vertical-align: baseline;\n}\naudio:not([controls])
2024-10-22 14:10:59 UTC	16384	IN	Data Raw: 68 3a 20 31 30 30 25 3b 5c 6e 20 20 7d 5c 6e 20 20 2e 63 6f 6c 2d 73 6d 2d 70 75 6c 6c 2d 30 20 7b 5c 6e 20 20 20 20 72 69 67 68 74 3a 20 61 75 74 6f 3b 5c 6e 20 20 7d 5c 6e 20 20 2e 63 6f 6c 2d 73 6d 2d 70 75 6c 6c 2d 31 20 7b 5c 6e 20 20 20 20 72 69 67 68 74 3a 20 38 2e 33 33 33 33 33 33 33 33 25 3b 5c 6e 20 20 7d 5c 6e 20 20 2e 63 6f 6c 2d 73 6d 2d 70 75 6c 6c 2d 32 20 7b 5c 6e 20 20 20 20 72 69 67 68 74 3a 20 31 36 2e 36 36 36 36 36 36 36 37 25 3b 5c 6e 20 20 7d 5c 6e 20 20 2e 63 6f 6c 2d 73 6d 2d 70 75 6c 6c 2d 33 20 7b 5c 6e 20 20 20 20 72 69 67 68 74 3a 20 32 35 25 3b 5c 6e 20 20 7d 5c 6e 20 20 2e 63 6f 6c 2d 73 6d 2d 70 75 6c 6c 2d 34 20 7b 5c 6e 20 20 20 20 72 69 67 68 74 3a 20 33 33 2e 33 33 33 33 33 33 33 33 25 3b 5c 6e 20 20 7d 5c 6e 20 20 2e Data Ascii: h: 100%;\n }\n .col-sm-pull-0 {\n right: auto;\n }\n .col-sm-pull-1 {\n right: 8.33333333%;\n }\n .col-sm-pull-2 {\n right: 16.66666667%;\n }\n .col-sm-pull-3 {\n right: 25%;\n }\n .col-sm-pull-4 {\n right: 33.33333333%;\n }\n .
2024-10-22 14:10:59 UTC	16384	IN	Data Raw: 43 43 3b 5c 6e 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 34 70 78 3b 5c 6e 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 69 6e 73 65 74 20 30 20 31 70 78 20 31 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 30 37 35 29 3b 5c 6e 20 20 74 72 61 6e 73 69 74 69 6f 6e 3a 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 20 65 61 73 65 2d 69 6e 2d 6f 75 74 20 30 2e 31 35 73 2c 20 62 6f 78 2d 73 68 61 64 6f 77 20 65 61 73 65 2d 69 6e 2d 6f 75 74 20 30 2e 31 35 73 3b 5c 6e 7d 5c 6e 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 3a 66 6f 63 75 73 20 7b 5c 6e 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 33 61 39 38 64 38 3b 5c 6e 20 20 6f 75 74 6c 69 6e 65 3a 20 30 3b 5c 6e 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 69 6e 73 65 74 20 30 20 31 70 78 20 31 70 78 20 Data Ascii: CC;\n border-radius: 4px;\n box-shadow: inset 0 1px 1px rgba(0, 0, 0, 0.075);\n transition: border-color ease-in-out 0.15s, box-shadow ease-in-out 0.15s;\n}\n.form-control:focus {\n border-color: #3a98d8;\n outline: 0;\n box-shadow: inset 0 1px 1px
2024-10-22 14:10:59 UTC	16384	IN	Data Raw: 6e 2d 70 72 69 6d 61 72 79 2e 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 3a 68 6f 76 65 72 2c 5c 6e 2e 6f 70 65 6e 20 3e 20 2e 62 74 6e 2d 70 72 69 6d 61 72 79 2e 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 3a 66 6f 63 75 73 2c 5c 6e 2e 6f 70 65 6e 20 3e 20 2e 62 74 6e 2d 70 72 69 6d 61 72 79 2e 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 2e 66 6f 63 75 73 20 7b 5c 6e 20 20 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 5c 6e 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 61 64 34 31 30 63 3b 5c 6e 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 38 37 33 32 30 61 3b 5c 6e 7d 5c 6e 2e 62 74 6e 2d 70 72 69 6d 61 72 79 2e 64 69 73 61 62 6c 65 64 3a 68 6f 76 65 72 2c 20 2e 62 74 6e 2d 70 72 69 6d 61 72 79 2e 64 69 73 61 62 6c 65 64 3a 66 Data Ascii: n-primary.dropdown-toggle:hover,\n.open > .btn-primary.dropdown-toggle:focus,\n.open > .btn-primary.dropdown-toggle.focus {\n color: #FFFFFF;\n background-color: #ad410c;\n border-color: #87320a;\n}\n.btn-primary.disabled:hover, .btn-primary.disabled:f
2024-10-22 14:10:59 UTC	16384	IN	Data Raw: 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 33 70 78 3b 5c 6e 7d 5c 6e 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 61 64 64 6f 6e 2e 69 6e 70 75 74 2d 6c 67 2c 5c 6e 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 6c 67 20 3e 20 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 61 64 64 6f 6e 2c 5c 6e 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 6c 67 20 3e 20 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 62 74 6e 20 3e 20 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 61 64 64 6f 6e 2e 62 74 6e 20 7b 5c 6e 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 20 31 36 70 78 3b 5c 6e 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 37 70 78 3b 5c 6e 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 36 70 78 3b 5c 6e 7d 5c 6e 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 61 64 64 6f 6e 20 69 6e 70 75 74 5b 74 79 70 65 Data Ascii: border-radius: 3px;\n}\n.input-group-addon.input-lg,\n.input-group-lg > .input-group-addon,\n.input-group-lg > .input-group-btn > .input-group-addon.btn {\n padding: 10px 16px;\n font-size: 17px;\n border-radius: 6px;\n}\n.input-group-addon input[type
2024-10-22 14:10:59 UTC	16384	IN	Data Raw: 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 5c 6e 7d 5c 6e 2e 6e 61 76 62 61 72 2d 69 6e 76 65 72 73 65 20 2e 6e 61 76 62 61 72 2d 6e 61 76 20 3e 20 2e 6f 70 65 6e 20 3e 20 61 2c 20 2e 6e 61 76 62 61 72 2d 69 6e 76 65 72 73 65 20 2e 6e 61 76 62 61 72 2d 6e 61 76 20 3e 20 2e 6f 70 65 6e 20 3e 20 61 3a 68 6f 76 65 72 2c 20 2e 6e 61 76 62 61 72 2d 69 6e 76 65 72 73 65 20 2e 6e 61 76 62 61 72 2d 6e 61 76 20 3e 20 2e 6f 70 65 6e 20 3e 20 61 3a 66 6f 63 75 73 20 7b 5c 6e 20 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 5c 6e 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 39 35 61 36 39 3b 5c 6e 7d 5c 6e 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 37 36 37 70 78 29 20 7b 5c 6e 20 20 2e 6e 61 76 62 Data Ascii: ckground-color: transparent;\n}\n.navbar-inverse .navbar-nav > .open > a, .navbar-inverse .navbar-nav > .open > a:hover, .navbar-inverse .navbar-nav > .open > a:focus {\n color: #fff;\n background-color: #495a69;\n}\n@media (max-width: 767px) {\n .navb
2024-10-22 14:11:00 UTC	16384	IN	Data Raw: 75 63 63 65 73 73 2e 61 63 74 69 76 65 3a 66 6f 63 75 73 20 7b 5c 6e 20 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 5c 6e 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 39 30 32 30 3b 5c 6e 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 34 30 39 30 32 30 3b 5c 6e 7d 5c 6e 2e 6c 69 73 74 2d 67 72 6f 75 70 2d 69 74 65 6d 2d 69 6e 66 6f 20 7b 5c 6e 20 20 63 6f 6c 6f 72 3a 20 23 32 45 37 39 41 43 3b 5c 6e 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 45 42 46 34 46 42 3b 5c 6e 7d 5c 6e 61 2e 6c 69 73 74 2d 67 72 6f 75 70 2d 69 74 65 6d 2d 69 6e 66 6f 2c 5c 6e 62 75 74 74 6f 6e 2e 6c 69 73 74 2d 67 72 6f 75 70 2d 69 74 65 6d 2d 69 6e 66 6f 20 7b 5c 6e 20 20 63 6f 6c 6f 72 3a 20 23 32 45 37 39 41 43 3b 5c 6e 7d 5c 6e 61 2e Data Ascii: uccess.active:focus {\n color: #fff;\n background-color: #409020;\n border-color: #409020;\n}\n.list-group-item-info {\n color: #2E79AC;\n background-color: #EBF4FB;\n}\na.list-group-item-info,\nbutton.list-group-item-info {\n color: #2E79AC;\n}\na.
2024-10-22 14:11:00 UTC	16384	IN	Data Raw: 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 30 35 29 3b 5c 6e 7d 5c 6e 2e 77 65 6c 6c 20 62 6c 6f 63 6b 71 75 6f 74 65 20 7b 5c 6e 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 64 64 64 3b 5c 6e 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 35 29 3b 5c 6e 7d 5c 6e 2e 77 65 6c 6c 2d 6c 67 20 7b 5c 6e 20 20 70 61 64 64 69 6e 67 3a 20 32 34 70 78 3b 5c 6e 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 36 70 78 3b 5c 6e 7d 5c 6e 2e 77 65 6c 6c 2d 73 6d 20 7b 5c 6e 20 20 70 61 64 64 69 6e 67 3a 20 39 70 78 3b 5c 6e 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 33 70 78 3b 5c 6e 7d 5c 6e 2e 63 6c 6f 73 65 20 7b 5c 6e 20 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 5c 6e 20 20 66 6f 6e 74 2d 73 69 7a Data Ascii: ba(0, 0, 0, 0.05);\n}\n.well blockquote {\n border-color: #ddd;\n border-color: rgba(0, 0, 0, 0.15);\n}\n.well-lg {\n padding: 24px;\n border-radius: 6px;\n}\n.well-sm {\n padding: 9px;\n border-radius: 3px;\n}\n.close {\n float: right;\n font-siz
2024-10-22 14:11:00 UTC	16384	IN	Data Raw: 6e 7d 5c 6e 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 31 32 30 30 70 78 29 20 7b 5c 6e 20 20 2e 76 69 73 69 62 6c 65 2d 6c 67 2d 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 20 7b 5c 6e 20 20 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 7d 5c 6e 7d 5c 6e 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 37 36 37 70 78 29 20 7b 5c 6e 20 20 2e 68 69 64 64 65 6e 2d 78 73 20 7b 5c 6e 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 7d 5c 6e 7d 5c 6e 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 37 36 38 70 78 29 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 39 39 31 70 78 29 20 7b 5c 6e 20 20 2e 68 69 64 64 65 Data Ascii: n}\n@media (min-width: 1200px) {\n .visible-lg-inline-block {\n display: inline-block !important;\n }\n}\n@media (max-width: 767px) {\n .hidden-xs {\n display: none !important;\n }\n}\n@media (min-width: 768px) and (max-width: 991px) {\n .hidde

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.18	49724	195.130.217.88	443

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:10:59 UTC	542	OUT	GET /ttpwp/resources/main.5257ca6e429949972959.js HTTP/1.1 Host: security-uk.m.mimecastprotect.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:10:59 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:10:59 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 1042084 Connection: close x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Thu, 08 Feb 2024 17:09:18 GMT ETag: W/"fe6a4-18d89b1f630" Vary: Accept-Encoding
2024-10-22 14:10:59 UTC	15846	IN	Data Raw: 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 31 5d 2c 7b 22 2b 62 72 33 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 65 2e 64 65 66 69 6e 65 4c 6f 63 61 6c 65 28 22 65 75 22 2c 7b 6d 6f 6e 74 68 73 3a 22 75 72 74 61 72 72 69 6c 61 5f 6f 74 73 61 69 6c 61 5f 6d 61 72 74 78 6f 61 5f 61 70 69 72 69 6c 61 5f 6d 61 69 61 74 7a 61 5f 65 6b 61 69 6e 61 5f 75 7a 74 61 69 6c 61 5f 61 62 75 7a 74 75 61 5f 69 72 61 69 6c 61 5f 75 72 72 69 61 5f 61 7a 61 72 6f 61 5f 61 62 65 6e 64 75 61 22 2e 73 70 6c 69 74 28 22 5f 22 29 2c 6d 6f 6e 74 68 73 53 68 6f 72 74 3a 22 75 72 Data Ascii: (window.webpackJsonp=window.webpackJsonp\|\|[]).push([[1],{"+br3":function(e,t,n){!function(e){"use strict";e.defineLocale("eu",{months:"urtarrila_otsaila_martxoa_apirila_maiatza_ekaina_uztaila_abuztua_iraila_urria_azaroa_abendua".split("_"),monthsShort:"ur
2024-10-22 14:10:59 UTC	16384	IN	Data Raw: 34 66 5c 75 30 34 33 64 5c 75 30 34 34 33 5c 75 30 34 33 30 5c 75 30 34 34 30 5c 75 30 34 33 38 5f 5c 75 30 34 34 34 5c 75 30 34 33 35 5c 75 30 34 33 32 5c 75 30 34 34 30 5c 75 30 34 34 33 5c 75 30 34 33 30 5c 75 30 34 34 30 5c 75 30 34 33 38 5f 5c 75 30 34 33 63 5c 75 30 34 33 30 5c 75 30 34 34 30 5c 75 30 34 34 32 5f 5c 75 30 34 33 30 5c 75 30 34 33 66 5c 75 30 34 34 30 5c 75 30 34 33 38 5c 75 30 34 33 62 5f 5c 75 30 34 33 63 5c 75 30 34 33 30 5c 75 30 34 33 39 5f 5c 75 30 34 34 65 5c 75 30 34 33 64 5c 75 30 34 33 38 5f 5c 75 30 34 34 65 5c 75 30 34 33 62 5c 75 30 34 33 38 5f 5c 75 30 34 33 30 5c 75 30 34 33 32 5c 75 30 34 33 33 5c 75 30 34 34 33 5c 75 30 34 34 31 5c 75 30 34 34 32 5f 5c 75 30 34 34 31 5c 75 30 34 33 35 5c 75 30 34 33 66 5c 75 30 34 34 Data Ascii: 4f\u043d\u0443\u0430\u0440\u0438_\u0444\u0435\u0432\u0440\u0443\u0430\u0440\u0438_\u043c\u0430\u0440\u0442_\u0430\u043f\u0440\u0438\u043b_\u043c\u0430\u0439_\u044e\u043d\u0438_\u044e\u043b\u0438_\u0430\u0432\u0433\u0443\u0441\u0442_\u0441\u0435\u043f\u044
2024-10-22 14:10:59 UTC	16384	IN	Data Raw: 5c 78 65 38 72 5f 6d 61 72 5c 78 65 37 5f 61 62 72 69 6c 5f 6d 61 69 5f 6a 75 6e 68 5f 6a 75 6c 68 65 74 5f 61 67 6f 73 74 5f 73 65 74 65 6d 62 72 65 5f 6f 63 74 5c 78 66 32 62 72 65 5f 6e 6f 76 65 6d 62 72 65 5f 64 65 63 65 6d 62 72 65 22 2e 73 70 6c 69 74 28 22 5f 22 29 2c 66 6f 72 6d 61 74 3a 22 64 65 20 67 65 6e 69 5c 78 65 38 72 5f 64 65 20 66 65 62 72 69 5c 78 65 38 72 5f 64 65 20 6d 61 72 5c 78 65 37 5f 64 27 61 62 72 69 6c 5f 64 65 20 6d 61 69 5f 64 65 20 6a 75 6e 68 5f 64 65 20 6a 75 6c 68 65 74 5f 64 27 61 67 6f 73 74 5f 64 65 20 73 65 74 65 6d 62 72 65 5f 64 27 6f 63 74 5c 78 66 32 62 72 65 5f 64 65 20 6e 6f 76 65 6d 62 72 65 5f 64 65 20 64 65 63 65 6d 62 72 65 22 2e 73 70 6c 69 74 28 22 5f 22 29 2c 69 73 46 6f 72 6d 61 74 3a 2f 44 5b 6f 44 5d Data Ascii: \xe8r_mar\xe7_abril_mai_junh_julhet_agost_setembre_oct\xf2bre_novembre_decembre".split("_"),format:"de geni\xe8r_de febri\xe8r_de mar\xe7_d'abril_de mai_de junh_de julhet_d'agost_de setembre_d'oct\xf2bre_de novembre_de decembre".split("_"),isFormat:/D[oD]
2024-10-22 14:10:59 UTC	16384	IN	Data Raw: 66 69 6e 65 4c 6f 63 61 6c 65 28 22 74 7a 6d 22 2c 7b 6d 6f 6e 74 68 73 3a 22 5c 75 32 64 34 39 5c 75 32 64 34 66 5c 75 32 64 34 66 5c 75 32 64 33 30 5c 75 32 64 36 32 5c 75 32 64 35 34 5f 5c 75 32 64 33 31 5c 75 32 64 35 35 5c 75 32 64 33 30 5c 75 32 64 36 32 5c 75 32 64 35 35 5f 5c 75 32 64 34 65 5c 75 32 64 33 30 5c 75 32 64 35 35 5c 75 32 64 35 61 5f 5c 75 32 64 34 39 5c 75 32 64 33 31 5c 75 32 64 35 34 5c 75 32 64 34 39 5c 75 32 64 35 34 5f 5c 75 32 64 34 65 5c 75 32 64 33 30 5c 75 32 64 36 32 5c 75 32 64 36 32 5c 75 32 64 35 33 5f 5c 75 32 64 36 32 5c 75 32 64 35 33 5c 75 32 64 34 66 5c 75 32 64 36 32 5c 75 32 64 35 33 5f 5c 75 32 64 36 32 5c 75 32 64 35 33 5c 75 32 64 34 64 5c 75 32 64 36 32 5c 75 32 64 35 33 5c 75 32 64 36 33 5f 5c 75 32 64 35 36 Data Ascii: fineLocale("tzm",{months:"\u2d49\u2d4f\u2d4f\u2d30\u2d62\u2d54_\u2d31\u2d55\u2d30\u2d62\u2d55_\u2d4e\u2d30\u2d55\u2d5a_\u2d49\u2d31\u2d54\u2d49\u2d54_\u2d4e\u2d30\u2d62\u2d62\u2d53_\u2d62\u2d53\u2d4f\u2d62\u2d53_\u2d62\u2d53\u2d4d\u2d62\u2d53\u2d63_\u2d56
2024-10-22 14:10:59 UTC	16384	IN	Data Raw: 75 70 64 61 74 65 4f 66 66 73 65 74 28 74 68 69 73 29 2c 67 3d 21 31 29 7d 66 75 6e 63 74 69 6f 6e 20 4d 28 65 29 7b 72 65 74 75 72 6e 20 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 62 7c 7c 6e 75 6c 6c 21 3d 65 26 26 6e 75 6c 6c 21 3d 65 2e 5f 69 73 41 4d 6f 6d 65 6e 74 4f 62 6a 65 63 74 7d 66 75 6e 63 74 69 6f 6e 20 77 28 65 29 7b 21 31 3d 3d 3d 69 2e 73 75 70 70 72 65 73 73 44 65 70 72 65 63 61 74 69 6f 6e 57 61 72 6e 69 6e 67 73 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 63 6f 6e 73 6f 6c 65 26 26 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 26 26 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 44 65 70 72 65 63 61 74 69 6f 6e 20 77 61 72 6e 69 6e 67 3a 20 22 2b 65 29 7d 66 75 6e 63 74 69 6f 6e 20 4c 28 65 2c 74 29 7b 76 61 72 20 6e 3d 21 30 3b 72 Data Ascii: updateOffset(this),g=!1)}function M(e){return e instanceof b\|\|null!=e&&null!=e._isAMomentObject}function w(e){!1===i.suppressDeprecationWarnings&&"undefined"!=typeof console&&console.warn&&console.warn("Deprecation warning: "+e)}function L(e,t){var n=!0;r
2024-10-22 14:10:59 UTC	16384	IN	Data Raw: 54 3a 2d 32 34 30 2c 45 53 54 3a 2d 33 30 30 2c 43 44 54 3a 2d 33 30 30 2c 43 53 54 3a 2d 33 36 30 2c 4d 44 54 3a 2d 33 36 30 2c 4d 53 54 3a 2d 34 32 30 2c 50 44 54 3a 2d 34 32 30 2c 50 53 54 3a 2d 34 38 30 7d 3b 66 75 6e 63 74 69 6f 6e 20 79 74 28 65 29 7b 76 61 72 20 74 2c 6e 2c 72 2c 69 2c 61 2c 73 2c 6f 3d 65 2e 5f 69 2c 75 3d 63 74 2e 65 78 65 63 28 6f 29 7c 7c 64 74 2e 65 78 65 63 28 6f 29 2c 6c 3d 66 74 2e 6c 65 6e 67 74 68 2c 63 3d 5f 74 2e 6c 65 6e 67 74 68 3b 69 66 28 75 29 7b 66 6f 72 28 6d 28 65 29 2e 69 73 6f 3d 21 30 2c 74 3d 30 2c 6e 3d 6c 3b 74 3c 6e 3b 74 2b 2b 29 69 66 28 66 74 5b 74 5d 5b 31 5d 2e 65 78 65 63 28 75 5b 31 5d 29 29 7b 69 3d 66 74 5b 74 5d 5b 30 5d 2c 72 3d 21 31 21 3d 3d 66 74 5b 74 5d 5b 32 5d 3b 62 72 65 61 6b 7d 69 66 Data Ascii: T:-240,EST:-300,CDT:-300,CST:-360,MDT:-360,MST:-420,PDT:-420,PST:-480};function yt(e){var t,n,r,i,a,s,o=e._i,u=ct.exec(o)\|\|dt.exec(o),l=ft.length,c=_t.length;if(u){for(m(e).iso=!0,t=0,n=l;t<n;t++)if(ft[t][1].exec(u[1])){i=ft[t][0],r=!1!==ft[t][2];break}if
2024-10-22 14:10:59 UTC	16384	IN	Data Raw: 73 65 74 28 74 68 69 73 2c 21 30 29 2c 74 68 69 73 7d 2c 70 6e 2e 66 6f 72 6d 61 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 7c 7c 28 65 3d 74 68 69 73 2e 69 73 55 74 63 28 29 3f 69 2e 64 65 66 61 75 6c 74 46 6f 72 6d 61 74 55 74 63 3a 69 2e 64 65 66 61 75 6c 74 46 6f 72 6d 61 74 29 3b 76 61 72 20 74 3d 49 28 74 68 69 73 2c 65 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 6c 6f 63 61 6c 65 44 61 74 61 28 29 2e 70 6f 73 74 66 6f 72 6d 61 74 28 74 29 7d 2c 70 6e 2e 66 72 6f 6d 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 73 56 61 6c 69 64 28 29 26 26 28 4d 28 65 29 26 26 65 2e 69 73 56 61 6c 69 64 28 29 7c 7c 53 74 28 65 29 2e 69 73 56 61 6c 69 64 28 29 29 3f 56 74 28 7b 74 6f 3a 74 68 69 73 2c 66 72 6f 6d 3a 65 7d 29 2e Data Ascii: set(this,!0),this},pn.format=function(e){e\|\|(e=this.isUtc()?i.defaultFormatUtc:i.defaultFormat);var t=I(this,e);return this.localeData().postformat(t)},pn.from=function(e,t){return this.isValid()&&(M(e)&&e.isValid()\|\|St(e).isValid())?Vt({to:this,from:e}).
2024-10-22 14:11:00 UTC	16384	IN	Data Raw: 72 73 65 45 78 61 63 74 3f 28 6f 28 74 68 69 73 2c 22 5f 77 65 65 6b 64 61 79 73 52 65 67 65 78 22 29 7c 7c 4b 65 2e 63 61 6c 6c 28 74 68 69 73 29 2c 65 3f 74 68 69 73 2e 5f 77 65 65 6b 64 61 79 73 4d 69 6e 53 74 72 69 63 74 52 65 67 65 78 3a 74 68 69 73 2e 5f 77 65 65 6b 64 61 79 73 4d 69 6e 52 65 67 65 78 29 3a 28 6f 28 74 68 69 73 2c 22 5f 77 65 65 6b 64 61 79 73 4d 69 6e 52 65 67 65 78 22 29 7c 7c 28 74 68 69 73 2e 5f 77 65 65 6b 64 61 79 73 4d 69 6e 52 65 67 65 78 3d 47 65 29 2c 74 68 69 73 2e 5f 77 65 65 6b 64 61 79 73 4d 69 6e 53 74 72 69 63 74 52 65 67 65 78 26 26 65 3f 74 68 69 73 2e 5f 77 65 65 6b 64 61 79 73 4d 69 6e 53 74 72 69 63 74 52 65 67 65 78 3a 74 68 69 73 2e 5f 77 65 65 6b 64 61 79 73 4d 69 6e 52 65 67 65 78 29 7d 2c 79 6e 2e 69 73 50 Data Ascii: rseExact?(o(this,"_weekdaysRegex")\|\|Ke.call(this),e?this._weekdaysMinStrictRegex:this._weekdaysMinRegex):(o(this,"_weekdaysMinRegex")\|\|(this._weekdaysMinRegex=Ge),this._weekdaysMinStrictRegex&&e?this._weekdaysMinStrictRegex:this._weekdaysMinRegex)},yn.isP
2024-10-22 14:11:00 UTC	16384	IN	Data Raw: 33 35 5c 75 30 34 33 36 22 2e 73 70 6c 69 74 28 22 5f 22 29 2c 77 65 65 6b 64 61 79 73 3a 7b 66 6f 72 6d 61 74 3a 22 5c 75 30 34 33 64 5c 75 30 34 34 66 5c 75 30 34 33 34 5c 75 30 34 33 37 5c 75 30 34 33 35 5c 75 30 34 33 62 5c 75 30 34 34 65 5f 5c 75 30 34 33 66 5c 75 30 34 33 30 5c 75 30 34 33 64 5c 75 30 34 34 66 5c 75 30 34 33 34 5c 75 30 34 33 37 5c 75 30 34 33 35 5c 75 30 34 33 62 5c 75 30 34 33 30 5c 75 30 34 33 61 5f 5c 75 30 34 33 30 5c 75 30 34 35 65 5c 75 30 34 34 32 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 30 5c 75 30 34 33 61 5f 5c 75 30 34 34 31 5c 75 30 34 33 35 5c 75 30 34 34 30 5c 75 30 34 33 30 5c 75 30 34 33 34 5c 75 30 34 34 33 5f 5c 75 30 34 34 37 5c 75 30 34 33 30 5c 75 30 34 34 36 5c 75 30 34 33 32 5c 75 30 34 33 35 5c 75 Data Ascii: 35\u0436".split("_"),weekdays:{format:"\u043d\u044f\u0434\u0437\u0435\u043b\u044e_\u043f\u0430\u043d\u044f\u0434\u0437\u0435\u043b\u0430\u043a_\u0430\u045e\u0442\u043e\u0440\u0430\u043a_\u0441\u0435\u0440\u0430\u0434\u0443_\u0447\u0430\u0446\u0432\u0435\u
2024-10-22 14:11:00 UTC	16384	IN	Data Raw: 30 34 33 37 5c 75 30 34 33 30 5c 75 30 34 33 64 5f 5c 75 30 34 39 62 5c 75 30 34 33 30 5c 75 30 34 34 30 5c 75 30 34 33 30 5c 75 30 34 34 38 5c 75 30 34 33 30 5f 5c 75 30 34 33 36 5c 75 30 34 33 35 5c 75 30 34 33 62 5c 75 30 34 34 32 5c 75 30 34 33 65 5c 75 30 34 39 62 5c 75 30 34 34 31 5c 75 30 34 33 30 5c 75 30 34 33 64 22 2e 73 70 6c 69 74 28 22 5f 22 29 2c 6d 6f 6e 74 68 73 53 68 6f 72 74 3a 22 5c 75 30 34 39 62 5c 75 30 34 33 30 5c 75 30 34 61 33 5f 5c 75 30 34 33 30 5c 75 30 34 39 62 5c 75 30 34 33 66 5f 5c 75 30 34 33 64 5c 75 30 34 33 30 5c 75 30 34 34 33 5f 5c 75 30 34 34 31 5c 75 30 34 64 39 5c 75 30 34 34 33 5f 5c 75 30 34 33 63 5c 75 30 34 33 30 5c 75 30 34 33 63 5f 5c 75 30 34 33 63 5c 75 30 34 33 30 5c 75 30 34 34 33 5f 5c 75 30 34 34 38 5c Data Ascii: 0437\u0430\u043d_\u049b\u0430\u0440\u0430\u0448\u0430_\u0436\u0435\u043b\u0442\u043e\u049b\u0441\u0430\u043d".split("_"),monthsShort:"\u049b\u0430\u04a3_\u0430\u049b\u043f_\u043d\u0430\u0443_\u0441\u04d9\u0443_\u043c\u0430\u043c_\u043c\u0430\u0443_\u0448\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.18	49727	195.130.217.88	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:00 UTC	404	OUT	GET /ttpwp/resources/runtime.5257ca6e429949972959.js HTTP/1.1 Host: security-uk.m.mimecastprotect.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:11:00 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:11:00 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 1492 Connection: close x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Thu, 08 Feb 2024 17:09:18 GMT ETag: W/"5d4-18d89b1f630" Vary: Accept-Encoding
2024-10-22 14:11:00 UTC	1492	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 72 28 72 29 7b 66 6f 72 28 76 61 72 20 6e 2c 6c 2c 70 3d 72 5b 30 5d 2c 66 3d 72 5b 31 5d 2c 69 3d 72 5b 32 5d 2c 63 3d 30 2c 73 3d 5b 5d 3b 63 3c 70 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 6c 3d 70 5b 63 5d 2c 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6f 2c 6c 29 26 26 6f 5b 6c 5d 26 26 73 2e 70 75 73 68 28 6f 5b 6c 5d 5b 30 5d 29 2c 6f 5b 6c 5d 3d 30 3b 66 6f 72 28 6e 20 69 6e 20 66 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 66 2c 6e 29 26 26 28 65 5b 6e 5d 3d 66 5b 6e 5d 29 3b 66 6f 72 28 61 26 26 61 28 72 29 3b 73 2e 6c 65 6e 67 74 68 3b 29 73 2e 73 68 Data Ascii: !function(e){function r(r){for(var n,l,p=r[0],f=r[1],i=r[2],c=0,s=[];c<p.length;c++)l=p[c],Object.prototype.hasOwnProperty.call(o,l)&&o[l]&&s.push(o[l][0]),o[l]=0;for(n in f)Object.prototype.hasOwnProperty.call(f,n)&&(e[n]=f[n]);for(a&&a(r);s.length;)s.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.18	49728	195.130.217.88	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:00 UTC	406	OUT	GET /ttpwp/resources/polyfills.5257ca6e429949972959.js HTTP/1.1 Host: security-uk.m.mimecastprotect.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:11:01 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:11:00 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 95292 Connection: close x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Thu, 08 Feb 2024 17:09:18 GMT ETag: W/"1743c-18d89b1f630" Vary: Accept-Encoding
2024-10-22 14:11:01 UTC	15848	IN	Data Raw: 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 32 5d 2c 7b 22 30 54 57 70 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 2c 69 2c 6f 3d 74 68 69 73 26 26 74 68 69 73 2e 5f 5f 73 70 72 65 61 64 41 72 72 61 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 69 66 28 6e 7c 7c 32 3d 3d 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 29 66 6f 72 28 76 61 72 20 72 2c 69 3d 30 2c 6f 3d 74 2e 6c 65 6e 67 74 68 3b 69 3c 6f 3b 69 2b 2b 29 21 72 26 26 69 20 69 6e 20 74 7c 7c 28 72 7c 7c 28 72 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 74 2c 30 2c Data Ascii: (window.webpackJsonp=window.webpackJsonp\|\|[]).push([[2],{"0TWp":function(e,t,n){"use strict";var r,i,o=this&&this.__spreadArray\|\|function(e,t,n){if(n\|\|2===arguments.length)for(var r,i=0,o=t.length;i<o;i++)!r&&i in t\|\|(r\|\|(r=Array.prototype.slice.call(t,0,
2024-10-22 14:11:01 UTC	16384	IN	Data Raw: 61 72 20 74 3d 65 26 26 65 2e 72 65 6a 65 63 74 69 6f 6e 3b 74 3f 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 22 55 6e 68 61 6e 64 6c 65 64 20 50 72 6f 6d 69 73 65 20 72 65 6a 65 63 74 69 6f 6e 3a 22 2c 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 45 72 72 6f 72 3f 74 2e 6d 65 73 73 61 67 65 3a 74 2c 22 3b 20 5a 6f 6e 65 3a 22 2c 65 2e 7a 6f 6e 65 2e 6e 61 6d 65 2c 22 3b 20 54 61 73 6b 3a 22 2c 65 2e 74 61 73 6b 26 26 65 2e 74 61 73 6b 2e 73 6f 75 72 63 65 2c 22 3b 20 56 61 6c 75 65 3a 22 2c 74 2c 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 45 72 72 6f 72 3f 74 2e 73 74 61 63 6b 3a 76 6f 69 64 20 30 29 3a 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 65 29 7d 7d 2c 6e 2e 6d 69 63 72 6f 74 61 73 6b 44 72 61 69 6e 44 6f 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 Data Ascii: ar t=e&&e.rejection;t?console.error("Unhandled Promise rejection:",t instanceof Error?t.message:t,"; Zone:",e.zone.name,"; Task:",e.task&&e.task.source,"; Value:",t,t instanceof Error?t.stack:void 0):console.error(e)}},n.microtaskDrainDone=function(){for(
2024-10-22 14:11:01 UTC	16384	IN	Data Raw: 69 70 74 2c 53 65 6c 65 63 74 2c 53 6f 75 72 63 65 2c 53 70 61 6e 2c 53 74 79 6c 65 2c 54 61 62 6c 65 43 61 70 74 69 6f 6e 2c 54 61 62 6c 65 43 65 6c 6c 2c 54 61 62 6c 65 43 6f 6c 2c 54 61 62 6c 65 2c 54 61 62 6c 65 52 6f 77 2c 54 61 62 6c 65 53 65 63 74 69 6f 6e 2c 54 65 78 74 41 72 65 61 2c 54 69 74 6c 65 2c 54 72 61 63 6b 2c 55 4c 69 73 74 2c 55 6e 6b 6e 6f 77 6e 2c 56 69 64 65 6f 22 2e 73 70 6c 69 74 28 22 2c 22 29 3b 66 3f 6c 3d 68 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 48 54 4d 4c 22 2b 65 2b 22 45 6c 65 6d 65 6e 74 22 7d 29 2e 63 6f 6e 63 61 74 28 75 29 3a 65 2e 45 76 65 6e 74 54 61 72 67 65 74 3f 6c 2e 70 75 73 68 28 22 45 76 65 6e 74 54 61 72 67 65 74 22 29 3a 6c 3d 75 3b 66 6f 72 28 76 61 72 20 70 3d 65 2e 5f 5f Data Ascii: ipt,Select,Source,Span,Style,TableCaption,TableCell,TableCol,Table,TableRow,TableSection,TextArea,Title,Track,UList,Unknown,Video".split(",");f?l=h.map(function(e){return"HTML"+e+"Element"}).concat(u):e.EventTarget?l.push("EventTarget"):l=u;for(var p=e.__
2024-10-22 14:11:01 UTC	16384	IN	Data Raw: 73 2e 5f 70 6c 61 79 62 61 63 6b 52 61 74 65 3d 31 2c 74 68 69 73 2e 5f 64 69 72 65 63 74 69 6f 6e 3d 22 6e 6f 72 6d 61 6c 22 2c 74 68 69 73 2e 5f 65 61 73 69 6e 67 3d 22 6c 69 6e 65 61 72 22 2c 74 68 69 73 2e 5f 65 61 73 69 6e 67 46 75 6e 63 74 69 6f 6e 3d 68 7d 66 75 6e 63 74 69 6f 6e 20 72 28 29 7b 72 65 74 75 72 6e 20 65 2e 69 73 44 65 70 72 65 63 61 74 65 64 28 22 49 6e 76 61 6c 69 64 20 74 69 6d 69 6e 67 20 69 6e 70 75 74 73 22 2c 22 32 30 31 36 2d 30 33 2d 30 32 22 2c 22 54 79 70 65 45 72 72 6f 72 20 65 78 63 65 70 74 69 6f 6e 73 20 77 69 6c 6c 20 62 65 20 74 68 72 6f 77 6e 20 69 6e 73 74 65 61 64 2e 22 2c 21 30 29 7d 66 75 6e 63 74 69 6f 6e 20 69 28 74 2c 72 2c 69 29 7b 76 61 72 20 6f 3d 6e 65 77 20 6e 3b 72 65 74 75 72 6e 20 72 26 26 28 6f 2e 66 Data Ascii: s._playbackRate=1,this._direction="normal",this._easing="linear",this._easingFunction=h}function r(){return e.isDeprecated("Invalid timing inputs","2016-03-02","TypeError exceptions will be thrown instead.",!0)}function i(t,r,i){var o=new n;return r&&(o.f
2024-10-22 14:11:01 UTC	16384	IN	Data Raw: 69 6f 6e 28 72 29 7b 72 65 74 75 72 6e 20 6e 28 66 75 6e 63 74 69 6f 6e 20 65 28 74 2c 6e 2c 72 29 7b 69 66 28 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 6e 29 72 65 74 75 72 6e 20 74 2a 28 31 2d 72 29 2b 6e 2a 72 3b 69 66 28 22 62 6f 6f 6c 65 61 6e 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 22 62 6f 6f 6c 65 61 6e 22 3d 3d 74 79 70 65 6f 66 20 6e 29 72 65 74 75 72 6e 20 72 3c 2e 35 3f 74 3a 6e 3b 69 66 28 74 2e 6c 65 6e 67 74 68 3d 3d 6e 2e 6c 65 6e 67 74 68 29 7b 66 6f 72 28 76 61 72 20 69 3d 5b 5d 2c 6f 3d 30 3b 6f 3c 74 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 69 2e 70 75 73 68 28 65 28 74 5b 6f 5d 2c 6e 5b 6f 5d 2c 72 29 29 3b 72 65 74 75 72 6e 20 69 7d 74 68 72 6f 77 22 4d 69 73 6d 61 74 63 Data Ascii: ion(r){return n(function e(t,n,r){if("number"==typeof t&&"number"==typeof n)return t(1-r)+nr;if("boolean"==typeof t&&"boolean"==typeof n)return r<.5?t:n;if(t.length==n.length){for(var i=[],o=0;o<t.length;o++)i.push(e(t[o],n[o],r));return i}throw"Mismatc
2024-10-22 14:11:01 UTC	13908	IN	Data Raw: 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 69 2c 6f 29 7b 72 65 74 75 72 6e 5b 69 2c 6f 2c 66 75 6e 63 74 69 6f 6e 28 69 29 7b 72 65 74 75 72 6e 20 6e 28 72 28 65 2c 74 2c 69 29 29 7d 5d 7d 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 29 7b 76 61 72 20 74 3d 65 2e 74 72 69 6d 28 29 2e 73 70 6c 69 74 28 2f 5c 73 2a 5b 5c 73 2c 5d 5c 73 2a 2f 29 3b 69 66 28 30 21 3d 3d 74 2e 6c 65 6e 67 74 68 29 7b 66 6f 72 28 76 61 72 20 6e 3d 5b 5d 2c 72 3d 30 3b 72 3c 74 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 7b 76 61 72 20 6f 3d 69 28 74 5b 72 5d 29 3b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 6f 29 72 65 74 75 72 6e 3b 6e 2e 70 75 73 68 28 6f 29 7d 72 65 74 75 72 6e 20 6e 7d 7d 65 2e 63 6c 61 6d 70 3d 72 2c 65 2e 61 64 64 50 72 6f 70 65 72 74 69 65 73 48 61 6e Data Ascii: (e,t){return function(i,o){return[i,o,function(i){return n(r(e,t,i))}]}}function a(e){var t=e.trim().split(/\s[\s,]\s/);if(0!==t.length){for(var n=[],r=0;r<t.length;r++){var o=i(t[r]);if(void 0===o)return;n.push(o)}return n}}e.clamp=r,e.addPropertiesHan

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.18	49729	195.130.217.88	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:02 UTC	403	OUT	GET /ttpwp/resources/styles.5257ca6e429949972959.js HTTP/1.1 Host: security-uk.m.mimecastprotect.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:11:02 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:11:02 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 410447 Connection: close x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Thu, 08 Feb 2024 17:09:18 GMT ETag: W/"6434f-18d89b1f630" Vary: Accept-Encoding
2024-10-22 14:11:02 UTC	15847	IN	Data Raw: 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 34 5d 2c 7b 33 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 6f 29 7b 6e 2e 65 78 70 6f 72 74 73 3d 6f 28 22 6c 45 75 68 22 29 7d 2c 4a 50 73 74 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 6f 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 65 3d 5b 5d 3b 72 65 74 75 72 6e 20 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6f 3d 6e 28 65 29 3b 72 65 74 75 72 6e 20 65 5b 32 5d 3f 22 40 6d 65 64 69 61 20 22 2e 63 6f 6e 63 Data Ascii: (window.webpackJsonp=window.webpackJsonp\|\|[]).push([[4],{3:function(n,e,o){n.exports=o("lEuh")},JPst:function(n,e,o){"use strict";n.exports=function(n){var e=[];return e.toString=function(){return this.map(function(e){var o=n(e);return e[2]?"@media ".conc
2024-10-22 14:11:02 UTC	16384	IN	Data Raw: 74 69 63 6c 65 2c 5c 6e 61 73 69 64 65 2c 5c 6e 64 65 74 61 69 6c 73 2c 5c 6e 66 69 67 63 61 70 74 69 6f 6e 2c 5c 6e 66 69 67 75 72 65 2c 5c 6e 66 6f 6f 74 65 72 2c 5c 6e 68 65 61 64 65 72 2c 5c 6e 68 67 72 6f 75 70 2c 5c 6e 6d 61 69 6e 2c 5c 6e 6d 65 6e 75 2c 5c 6e 6e 61 76 2c 5c 6e 73 65 63 74 69 6f 6e 2c 5c 6e 73 75 6d 6d 61 72 79 20 7b 5c 6e 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 5c 6e 7d 5c 6e 61 75 64 69 6f 2c 5c 6e 63 61 6e 76 61 73 2c 5c 6e 70 72 6f 67 72 65 73 73 2c 5c 6e 76 69 64 65 6f 20 7b 5c 6e 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 5c 6e 20 20 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 62 61 73 65 6c 69 6e 65 3b 5c 6e 7d 5c 6e 61 75 64 69 6f 3a 6e 6f 74 28 5b 63 6f 6e 74 72 6f 6c 73 5d 29 20 Data Ascii: ticle,\naside,\ndetails,\nfigcaption,\nfigure,\nfooter,\nheader,\nhgroup,\nmain,\nmenu,\nnav,\nsection,\nsummary {\n display: block;\n}\naudio,\ncanvas,\nprogress,\nvideo {\n display: inline-block;\n vertical-align: baseline;\n}\naudio:not([controls])
2024-10-22 14:11:02 UTC	16384	IN	Data Raw: 68 3a 20 31 30 30 25 3b 5c 6e 20 20 7d 5c 6e 20 20 2e 63 6f 6c 2d 73 6d 2d 70 75 6c 6c 2d 30 20 7b 5c 6e 20 20 20 20 72 69 67 68 74 3a 20 61 75 74 6f 3b 5c 6e 20 20 7d 5c 6e 20 20 2e 63 6f 6c 2d 73 6d 2d 70 75 6c 6c 2d 31 20 7b 5c 6e 20 20 20 20 72 69 67 68 74 3a 20 38 2e 33 33 33 33 33 33 33 33 25 3b 5c 6e 20 20 7d 5c 6e 20 20 2e 63 6f 6c 2d 73 6d 2d 70 75 6c 6c 2d 32 20 7b 5c 6e 20 20 20 20 72 69 67 68 74 3a 20 31 36 2e 36 36 36 36 36 36 36 37 25 3b 5c 6e 20 20 7d 5c 6e 20 20 2e 63 6f 6c 2d 73 6d 2d 70 75 6c 6c 2d 33 20 7b 5c 6e 20 20 20 20 72 69 67 68 74 3a 20 32 35 25 3b 5c 6e 20 20 7d 5c 6e 20 20 2e 63 6f 6c 2d 73 6d 2d 70 75 6c 6c 2d 34 20 7b 5c 6e 20 20 20 20 72 69 67 68 74 3a 20 33 33 2e 33 33 33 33 33 33 33 33 25 3b 5c 6e 20 20 7d 5c 6e 20 20 2e Data Ascii: h: 100%;\n }\n .col-sm-pull-0 {\n right: auto;\n }\n .col-sm-pull-1 {\n right: 8.33333333%;\n }\n .col-sm-pull-2 {\n right: 16.66666667%;\n }\n .col-sm-pull-3 {\n right: 25%;\n }\n .col-sm-pull-4 {\n right: 33.33333333%;\n }\n .
2024-10-22 14:11:02 UTC	16384	IN	Data Raw: 43 43 3b 5c 6e 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 34 70 78 3b 5c 6e 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 69 6e 73 65 74 20 30 20 31 70 78 20 31 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 30 37 35 29 3b 5c 6e 20 20 74 72 61 6e 73 69 74 69 6f 6e 3a 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 20 65 61 73 65 2d 69 6e 2d 6f 75 74 20 30 2e 31 35 73 2c 20 62 6f 78 2d 73 68 61 64 6f 77 20 65 61 73 65 2d 69 6e 2d 6f 75 74 20 30 2e 31 35 73 3b 5c 6e 7d 5c 6e 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 3a 66 6f 63 75 73 20 7b 5c 6e 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 33 61 39 38 64 38 3b 5c 6e 20 20 6f 75 74 6c 69 6e 65 3a 20 30 3b 5c 6e 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 69 6e 73 65 74 20 30 20 31 70 78 20 31 70 78 20 Data Ascii: CC;\n border-radius: 4px;\n box-shadow: inset 0 1px 1px rgba(0, 0, 0, 0.075);\n transition: border-color ease-in-out 0.15s, box-shadow ease-in-out 0.15s;\n}\n.form-control:focus {\n border-color: #3a98d8;\n outline: 0;\n box-shadow: inset 0 1px 1px
2024-10-22 14:11:02 UTC	16384	IN	Data Raw: 6e 2d 70 72 69 6d 61 72 79 2e 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 3a 68 6f 76 65 72 2c 5c 6e 2e 6f 70 65 6e 20 3e 20 2e 62 74 6e 2d 70 72 69 6d 61 72 79 2e 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 3a 66 6f 63 75 73 2c 5c 6e 2e 6f 70 65 6e 20 3e 20 2e 62 74 6e 2d 70 72 69 6d 61 72 79 2e 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 2e 66 6f 63 75 73 20 7b 5c 6e 20 20 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 5c 6e 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 61 64 34 31 30 63 3b 5c 6e 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 38 37 33 32 30 61 3b 5c 6e 7d 5c 6e 2e 62 74 6e 2d 70 72 69 6d 61 72 79 2e 64 69 73 61 62 6c 65 64 3a 68 6f 76 65 72 2c 20 2e 62 74 6e 2d 70 72 69 6d 61 72 79 2e 64 69 73 61 62 6c 65 64 3a 66 Data Ascii: n-primary.dropdown-toggle:hover,\n.open > .btn-primary.dropdown-toggle:focus,\n.open > .btn-primary.dropdown-toggle.focus {\n color: #FFFFFF;\n background-color: #ad410c;\n border-color: #87320a;\n}\n.btn-primary.disabled:hover, .btn-primary.disabled:f
2024-10-22 14:11:02 UTC	16384	IN	Data Raw: 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 33 70 78 3b 5c 6e 7d 5c 6e 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 61 64 64 6f 6e 2e 69 6e 70 75 74 2d 6c 67 2c 5c 6e 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 6c 67 20 3e 20 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 61 64 64 6f 6e 2c 5c 6e 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 6c 67 20 3e 20 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 62 74 6e 20 3e 20 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 61 64 64 6f 6e 2e 62 74 6e 20 7b 5c 6e 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 20 31 36 70 78 3b 5c 6e 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 37 70 78 3b 5c 6e 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 36 70 78 3b 5c 6e 7d 5c 6e 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 61 64 64 6f 6e 20 69 6e 70 75 74 5b 74 79 70 65 Data Ascii: border-radius: 3px;\n}\n.input-group-addon.input-lg,\n.input-group-lg > .input-group-addon,\n.input-group-lg > .input-group-btn > .input-group-addon.btn {\n padding: 10px 16px;\n font-size: 17px;\n border-radius: 6px;\n}\n.input-group-addon input[type
2024-10-22 14:11:02 UTC	16384	IN	Data Raw: 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 5c 6e 7d 5c 6e 2e 6e 61 76 62 61 72 2d 69 6e 76 65 72 73 65 20 2e 6e 61 76 62 61 72 2d 6e 61 76 20 3e 20 2e 6f 70 65 6e 20 3e 20 61 2c 20 2e 6e 61 76 62 61 72 2d 69 6e 76 65 72 73 65 20 2e 6e 61 76 62 61 72 2d 6e 61 76 20 3e 20 2e 6f 70 65 6e 20 3e 20 61 3a 68 6f 76 65 72 2c 20 2e 6e 61 76 62 61 72 2d 69 6e 76 65 72 73 65 20 2e 6e 61 76 62 61 72 2d 6e 61 76 20 3e 20 2e 6f 70 65 6e 20 3e 20 61 3a 66 6f 63 75 73 20 7b 5c 6e 20 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 5c 6e 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 39 35 61 36 39 3b 5c 6e 7d 5c 6e 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 37 36 37 70 78 29 20 7b 5c 6e 20 20 2e 6e 61 76 62 Data Ascii: ckground-color: transparent;\n}\n.navbar-inverse .navbar-nav > .open > a, .navbar-inverse .navbar-nav > .open > a:hover, .navbar-inverse .navbar-nav > .open > a:focus {\n color: #fff;\n background-color: #495a69;\n}\n@media (max-width: 767px) {\n .navb
2024-10-22 14:11:03 UTC	16384	IN	Data Raw: 75 63 63 65 73 73 2e 61 63 74 69 76 65 3a 66 6f 63 75 73 20 7b 5c 6e 20 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 5c 6e 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 39 30 32 30 3b 5c 6e 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 34 30 39 30 32 30 3b 5c 6e 7d 5c 6e 2e 6c 69 73 74 2d 67 72 6f 75 70 2d 69 74 65 6d 2d 69 6e 66 6f 20 7b 5c 6e 20 20 63 6f 6c 6f 72 3a 20 23 32 45 37 39 41 43 3b 5c 6e 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 45 42 46 34 46 42 3b 5c 6e 7d 5c 6e 61 2e 6c 69 73 74 2d 67 72 6f 75 70 2d 69 74 65 6d 2d 69 6e 66 6f 2c 5c 6e 62 75 74 74 6f 6e 2e 6c 69 73 74 2d 67 72 6f 75 70 2d 69 74 65 6d 2d 69 6e 66 6f 20 7b 5c 6e 20 20 63 6f 6c 6f 72 3a 20 23 32 45 37 39 41 43 3b 5c 6e 7d 5c 6e 61 2e Data Ascii: uccess.active:focus {\n color: #fff;\n background-color: #409020;\n border-color: #409020;\n}\n.list-group-item-info {\n color: #2E79AC;\n background-color: #EBF4FB;\n}\na.list-group-item-info,\nbutton.list-group-item-info {\n color: #2E79AC;\n}\na.
2024-10-22 14:11:03 UTC	16384	IN	Data Raw: 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 30 35 29 3b 5c 6e 7d 5c 6e 2e 77 65 6c 6c 20 62 6c 6f 63 6b 71 75 6f 74 65 20 7b 5c 6e 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 64 64 64 3b 5c 6e 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 35 29 3b 5c 6e 7d 5c 6e 2e 77 65 6c 6c 2d 6c 67 20 7b 5c 6e 20 20 70 61 64 64 69 6e 67 3a 20 32 34 70 78 3b 5c 6e 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 36 70 78 3b 5c 6e 7d 5c 6e 2e 77 65 6c 6c 2d 73 6d 20 7b 5c 6e 20 20 70 61 64 64 69 6e 67 3a 20 39 70 78 3b 5c 6e 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 33 70 78 3b 5c 6e 7d 5c 6e 2e 63 6c 6f 73 65 20 7b 5c 6e 20 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 5c 6e 20 20 66 6f 6e 74 2d 73 69 7a Data Ascii: ba(0, 0, 0, 0.05);\n}\n.well blockquote {\n border-color: #ddd;\n border-color: rgba(0, 0, 0, 0.15);\n}\n.well-lg {\n padding: 24px;\n border-radius: 6px;\n}\n.well-sm {\n padding: 9px;\n border-radius: 3px;\n}\n.close {\n float: right;\n font-siz
2024-10-22 14:11:03 UTC	16384	IN	Data Raw: 6e 7d 5c 6e 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 31 32 30 30 70 78 29 20 7b 5c 6e 20 20 2e 76 69 73 69 62 6c 65 2d 6c 67 2d 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 20 7b 5c 6e 20 20 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 7d 5c 6e 7d 5c 6e 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 37 36 37 70 78 29 20 7b 5c 6e 20 20 2e 68 69 64 64 65 6e 2d 78 73 20 7b 5c 6e 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 7d 5c 6e 7d 5c 6e 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 37 36 38 70 78 29 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 39 39 31 70 78 29 20 7b 5c 6e 20 20 2e 68 69 64 64 65 Data Ascii: n}\n@media (min-width: 1200px) {\n .visible-lg-inline-block {\n display: inline-block !important;\n }\n}\n@media (max-width: 767px) {\n .hidden-xs {\n display: none !important;\n }\n}\n@media (min-width: 768px) and (max-width: 991px) {\n .hidde

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.18	49730	195.130.217.88	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:03 UTC	401	OUT	GET /ttpwp/resources/main.5257ca6e429949972959.js HTTP/1.1 Host: security-uk.m.mimecastprotect.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:11:03 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:11:03 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 1042084 Connection: close x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Thu, 08 Feb 2024 17:09:18 GMT ETag: W/"fe6a4-18d89b1f630" Vary: Accept-Encoding
2024-10-22 14:11:03 UTC	15846	IN	Data Raw: 28 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 31 5d 2c 7b 22 2b 62 72 33 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 65 2e 64 65 66 69 6e 65 4c 6f 63 61 6c 65 28 22 65 75 22 2c 7b 6d 6f 6e 74 68 73 3a 22 75 72 74 61 72 72 69 6c 61 5f 6f 74 73 61 69 6c 61 5f 6d 61 72 74 78 6f 61 5f 61 70 69 72 69 6c 61 5f 6d 61 69 61 74 7a 61 5f 65 6b 61 69 6e 61 5f 75 7a 74 61 69 6c 61 5f 61 62 75 7a 74 75 61 5f 69 72 61 69 6c 61 5f 75 72 72 69 61 5f 61 7a 61 72 6f 61 5f 61 62 65 6e 64 75 61 22 2e 73 70 6c 69 74 28 22 5f 22 29 2c 6d 6f 6e 74 68 73 53 68 6f 72 74 3a 22 75 72 Data Ascii: (window.webpackJsonp=window.webpackJsonp\|\|[]).push([[1],{"+br3":function(e,t,n){!function(e){"use strict";e.defineLocale("eu",{months:"urtarrila_otsaila_martxoa_apirila_maiatza_ekaina_uztaila_abuztua_iraila_urria_azaroa_abendua".split("_"),monthsShort:"ur
2024-10-22 14:11:03 UTC	16384	IN	Data Raw: 34 66 5c 75 30 34 33 64 5c 75 30 34 34 33 5c 75 30 34 33 30 5c 75 30 34 34 30 5c 75 30 34 33 38 5f 5c 75 30 34 34 34 5c 75 30 34 33 35 5c 75 30 34 33 32 5c 75 30 34 34 30 5c 75 30 34 34 33 5c 75 30 34 33 30 5c 75 30 34 34 30 5c 75 30 34 33 38 5f 5c 75 30 34 33 63 5c 75 30 34 33 30 5c 75 30 34 34 30 5c 75 30 34 34 32 5f 5c 75 30 34 33 30 5c 75 30 34 33 66 5c 75 30 34 34 30 5c 75 30 34 33 38 5c 75 30 34 33 62 5f 5c 75 30 34 33 63 5c 75 30 34 33 30 5c 75 30 34 33 39 5f 5c 75 30 34 34 65 5c 75 30 34 33 64 5c 75 30 34 33 38 5f 5c 75 30 34 34 65 5c 75 30 34 33 62 5c 75 30 34 33 38 5f 5c 75 30 34 33 30 5c 75 30 34 33 32 5c 75 30 34 33 33 5c 75 30 34 34 33 5c 75 30 34 34 31 5c 75 30 34 34 32 5f 5c 75 30 34 34 31 5c 75 30 34 33 35 5c 75 30 34 33 66 5c 75 30 34 34 Data Ascii: 4f\u043d\u0443\u0430\u0440\u0438_\u0444\u0435\u0432\u0440\u0443\u0430\u0440\u0438_\u043c\u0430\u0440\u0442_\u0430\u043f\u0440\u0438\u043b_\u043c\u0430\u0439_\u044e\u043d\u0438_\u044e\u043b\u0438_\u0430\u0432\u0433\u0443\u0441\u0442_\u0441\u0435\u043f\u044
2024-10-22 14:11:04 UTC	16384	IN	Data Raw: 5c 78 65 38 72 5f 6d 61 72 5c 78 65 37 5f 61 62 72 69 6c 5f 6d 61 69 5f 6a 75 6e 68 5f 6a 75 6c 68 65 74 5f 61 67 6f 73 74 5f 73 65 74 65 6d 62 72 65 5f 6f 63 74 5c 78 66 32 62 72 65 5f 6e 6f 76 65 6d 62 72 65 5f 64 65 63 65 6d 62 72 65 22 2e 73 70 6c 69 74 28 22 5f 22 29 2c 66 6f 72 6d 61 74 3a 22 64 65 20 67 65 6e 69 5c 78 65 38 72 5f 64 65 20 66 65 62 72 69 5c 78 65 38 72 5f 64 65 20 6d 61 72 5c 78 65 37 5f 64 27 61 62 72 69 6c 5f 64 65 20 6d 61 69 5f 64 65 20 6a 75 6e 68 5f 64 65 20 6a 75 6c 68 65 74 5f 64 27 61 67 6f 73 74 5f 64 65 20 73 65 74 65 6d 62 72 65 5f 64 27 6f 63 74 5c 78 66 32 62 72 65 5f 64 65 20 6e 6f 76 65 6d 62 72 65 5f 64 65 20 64 65 63 65 6d 62 72 65 22 2e 73 70 6c 69 74 28 22 5f 22 29 2c 69 73 46 6f 72 6d 61 74 3a 2f 44 5b 6f 44 5d Data Ascii: \xe8r_mar\xe7_abril_mai_junh_julhet_agost_setembre_oct\xf2bre_novembre_decembre".split("_"),format:"de geni\xe8r_de febri\xe8r_de mar\xe7_d'abril_de mai_de junh_de julhet_d'agost_de setembre_d'oct\xf2bre_de novembre_de decembre".split("_"),isFormat:/D[oD]
2024-10-22 14:11:04 UTC	16384	IN	Data Raw: 66 69 6e 65 4c 6f 63 61 6c 65 28 22 74 7a 6d 22 2c 7b 6d 6f 6e 74 68 73 3a 22 5c 75 32 64 34 39 5c 75 32 64 34 66 5c 75 32 64 34 66 5c 75 32 64 33 30 5c 75 32 64 36 32 5c 75 32 64 35 34 5f 5c 75 32 64 33 31 5c 75 32 64 35 35 5c 75 32 64 33 30 5c 75 32 64 36 32 5c 75 32 64 35 35 5f 5c 75 32 64 34 65 5c 75 32 64 33 30 5c 75 32 64 35 35 5c 75 32 64 35 61 5f 5c 75 32 64 34 39 5c 75 32 64 33 31 5c 75 32 64 35 34 5c 75 32 64 34 39 5c 75 32 64 35 34 5f 5c 75 32 64 34 65 5c 75 32 64 33 30 5c 75 32 64 36 32 5c 75 32 64 36 32 5c 75 32 64 35 33 5f 5c 75 32 64 36 32 5c 75 32 64 35 33 5c 75 32 64 34 66 5c 75 32 64 36 32 5c 75 32 64 35 33 5f 5c 75 32 64 36 32 5c 75 32 64 35 33 5c 75 32 64 34 64 5c 75 32 64 36 32 5c 75 32 64 35 33 5c 75 32 64 36 33 5f 5c 75 32 64 35 36 Data Ascii: fineLocale("tzm",{months:"\u2d49\u2d4f\u2d4f\u2d30\u2d62\u2d54_\u2d31\u2d55\u2d30\u2d62\u2d55_\u2d4e\u2d30\u2d55\u2d5a_\u2d49\u2d31\u2d54\u2d49\u2d54_\u2d4e\u2d30\u2d62\u2d62\u2d53_\u2d62\u2d53\u2d4f\u2d62\u2d53_\u2d62\u2d53\u2d4d\u2d62\u2d53\u2d63_\u2d56
2024-10-22 14:11:04 UTC	16384	IN	Data Raw: 75 70 64 61 74 65 4f 66 66 73 65 74 28 74 68 69 73 29 2c 67 3d 21 31 29 7d 66 75 6e 63 74 69 6f 6e 20 4d 28 65 29 7b 72 65 74 75 72 6e 20 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 62 7c 7c 6e 75 6c 6c 21 3d 65 26 26 6e 75 6c 6c 21 3d 65 2e 5f 69 73 41 4d 6f 6d 65 6e 74 4f 62 6a 65 63 74 7d 66 75 6e 63 74 69 6f 6e 20 77 28 65 29 7b 21 31 3d 3d 3d 69 2e 73 75 70 70 72 65 73 73 44 65 70 72 65 63 61 74 69 6f 6e 57 61 72 6e 69 6e 67 73 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 63 6f 6e 73 6f 6c 65 26 26 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 26 26 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 44 65 70 72 65 63 61 74 69 6f 6e 20 77 61 72 6e 69 6e 67 3a 20 22 2b 65 29 7d 66 75 6e 63 74 69 6f 6e 20 4c 28 65 2c 74 29 7b 76 61 72 20 6e 3d 21 30 3b 72 Data Ascii: updateOffset(this),g=!1)}function M(e){return e instanceof b\|\|null!=e&&null!=e._isAMomentObject}function w(e){!1===i.suppressDeprecationWarnings&&"undefined"!=typeof console&&console.warn&&console.warn("Deprecation warning: "+e)}function L(e,t){var n=!0;r
2024-10-22 14:11:04 UTC	16384	IN	Data Raw: 54 3a 2d 32 34 30 2c 45 53 54 3a 2d 33 30 30 2c 43 44 54 3a 2d 33 30 30 2c 43 53 54 3a 2d 33 36 30 2c 4d 44 54 3a 2d 33 36 30 2c 4d 53 54 3a 2d 34 32 30 2c 50 44 54 3a 2d 34 32 30 2c 50 53 54 3a 2d 34 38 30 7d 3b 66 75 6e 63 74 69 6f 6e 20 79 74 28 65 29 7b 76 61 72 20 74 2c 6e 2c 72 2c 69 2c 61 2c 73 2c 6f 3d 65 2e 5f 69 2c 75 3d 63 74 2e 65 78 65 63 28 6f 29 7c 7c 64 74 2e 65 78 65 63 28 6f 29 2c 6c 3d 66 74 2e 6c 65 6e 67 74 68 2c 63 3d 5f 74 2e 6c 65 6e 67 74 68 3b 69 66 28 75 29 7b 66 6f 72 28 6d 28 65 29 2e 69 73 6f 3d 21 30 2c 74 3d 30 2c 6e 3d 6c 3b 74 3c 6e 3b 74 2b 2b 29 69 66 28 66 74 5b 74 5d 5b 31 5d 2e 65 78 65 63 28 75 5b 31 5d 29 29 7b 69 3d 66 74 5b 74 5d 5b 30 5d 2c 72 3d 21 31 21 3d 3d 66 74 5b 74 5d 5b 32 5d 3b 62 72 65 61 6b 7d 69 66 Data Ascii: T:-240,EST:-300,CDT:-300,CST:-360,MDT:-360,MST:-420,PDT:-420,PST:-480};function yt(e){var t,n,r,i,a,s,o=e._i,u=ct.exec(o)\|\|dt.exec(o),l=ft.length,c=_t.length;if(u){for(m(e).iso=!0,t=0,n=l;t<n;t++)if(ft[t][1].exec(u[1])){i=ft[t][0],r=!1!==ft[t][2];break}if
2024-10-22 14:11:04 UTC	16384	IN	Data Raw: 73 65 74 28 74 68 69 73 2c 21 30 29 2c 74 68 69 73 7d 2c 70 6e 2e 66 6f 72 6d 61 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 7c 7c 28 65 3d 74 68 69 73 2e 69 73 55 74 63 28 29 3f 69 2e 64 65 66 61 75 6c 74 46 6f 72 6d 61 74 55 74 63 3a 69 2e 64 65 66 61 75 6c 74 46 6f 72 6d 61 74 29 3b 76 61 72 20 74 3d 49 28 74 68 69 73 2c 65 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 6c 6f 63 61 6c 65 44 61 74 61 28 29 2e 70 6f 73 74 66 6f 72 6d 61 74 28 74 29 7d 2c 70 6e 2e 66 72 6f 6d 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 73 56 61 6c 69 64 28 29 26 26 28 4d 28 65 29 26 26 65 2e 69 73 56 61 6c 69 64 28 29 7c 7c 53 74 28 65 29 2e 69 73 56 61 6c 69 64 28 29 29 3f 56 74 28 7b 74 6f 3a 74 68 69 73 2c 66 72 6f 6d 3a 65 7d 29 2e Data Ascii: set(this,!0),this},pn.format=function(e){e\|\|(e=this.isUtc()?i.defaultFormatUtc:i.defaultFormat);var t=I(this,e);return this.localeData().postformat(t)},pn.from=function(e,t){return this.isValid()&&(M(e)&&e.isValid()\|\|St(e).isValid())?Vt({to:this,from:e}).
2024-10-22 14:11:04 UTC	16384	IN	Data Raw: 72 73 65 45 78 61 63 74 3f 28 6f 28 74 68 69 73 2c 22 5f 77 65 65 6b 64 61 79 73 52 65 67 65 78 22 29 7c 7c 4b 65 2e 63 61 6c 6c 28 74 68 69 73 29 2c 65 3f 74 68 69 73 2e 5f 77 65 65 6b 64 61 79 73 4d 69 6e 53 74 72 69 63 74 52 65 67 65 78 3a 74 68 69 73 2e 5f 77 65 65 6b 64 61 79 73 4d 69 6e 52 65 67 65 78 29 3a 28 6f 28 74 68 69 73 2c 22 5f 77 65 65 6b 64 61 79 73 4d 69 6e 52 65 67 65 78 22 29 7c 7c 28 74 68 69 73 2e 5f 77 65 65 6b 64 61 79 73 4d 69 6e 52 65 67 65 78 3d 47 65 29 2c 74 68 69 73 2e 5f 77 65 65 6b 64 61 79 73 4d 69 6e 53 74 72 69 63 74 52 65 67 65 78 26 26 65 3f 74 68 69 73 2e 5f 77 65 65 6b 64 61 79 73 4d 69 6e 53 74 72 69 63 74 52 65 67 65 78 3a 74 68 69 73 2e 5f 77 65 65 6b 64 61 79 73 4d 69 6e 52 65 67 65 78 29 7d 2c 79 6e 2e 69 73 50 Data Ascii: rseExact?(o(this,"_weekdaysRegex")\|\|Ke.call(this),e?this._weekdaysMinStrictRegex:this._weekdaysMinRegex):(o(this,"_weekdaysMinRegex")\|\|(this._weekdaysMinRegex=Ge),this._weekdaysMinStrictRegex&&e?this._weekdaysMinStrictRegex:this._weekdaysMinRegex)},yn.isP
2024-10-22 14:11:04 UTC	16384	IN	Data Raw: 33 35 5c 75 30 34 33 36 22 2e 73 70 6c 69 74 28 22 5f 22 29 2c 77 65 65 6b 64 61 79 73 3a 7b 66 6f 72 6d 61 74 3a 22 5c 75 30 34 33 64 5c 75 30 34 34 66 5c 75 30 34 33 34 5c 75 30 34 33 37 5c 75 30 34 33 35 5c 75 30 34 33 62 5c 75 30 34 34 65 5f 5c 75 30 34 33 66 5c 75 30 34 33 30 5c 75 30 34 33 64 5c 75 30 34 34 66 5c 75 30 34 33 34 5c 75 30 34 33 37 5c 75 30 34 33 35 5c 75 30 34 33 62 5c 75 30 34 33 30 5c 75 30 34 33 61 5f 5c 75 30 34 33 30 5c 75 30 34 35 65 5c 75 30 34 34 32 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 30 5c 75 30 34 33 61 5f 5c 75 30 34 34 31 5c 75 30 34 33 35 5c 75 30 34 34 30 5c 75 30 34 33 30 5c 75 30 34 33 34 5c 75 30 34 34 33 5f 5c 75 30 34 34 37 5c 75 30 34 33 30 5c 75 30 34 34 36 5c 75 30 34 33 32 5c 75 30 34 33 35 5c 75 Data Ascii: 35\u0436".split("_"),weekdays:{format:"\u043d\u044f\u0434\u0437\u0435\u043b\u044e_\u043f\u0430\u043d\u044f\u0434\u0437\u0435\u043b\u0430\u043a_\u0430\u045e\u0442\u043e\u0440\u0430\u043a_\u0441\u0435\u0440\u0430\u0434\u0443_\u0447\u0430\u0446\u0432\u0435\u
2024-10-22 14:11:04 UTC	16384	IN	Data Raw: 30 34 33 37 5c 75 30 34 33 30 5c 75 30 34 33 64 5f 5c 75 30 34 39 62 5c 75 30 34 33 30 5c 75 30 34 34 30 5c 75 30 34 33 30 5c 75 30 34 34 38 5c 75 30 34 33 30 5f 5c 75 30 34 33 36 5c 75 30 34 33 35 5c 75 30 34 33 62 5c 75 30 34 34 32 5c 75 30 34 33 65 5c 75 30 34 39 62 5c 75 30 34 34 31 5c 75 30 34 33 30 5c 75 30 34 33 64 22 2e 73 70 6c 69 74 28 22 5f 22 29 2c 6d 6f 6e 74 68 73 53 68 6f 72 74 3a 22 5c 75 30 34 39 62 5c 75 30 34 33 30 5c 75 30 34 61 33 5f 5c 75 30 34 33 30 5c 75 30 34 39 62 5c 75 30 34 33 66 5f 5c 75 30 34 33 64 5c 75 30 34 33 30 5c 75 30 34 34 33 5f 5c 75 30 34 34 31 5c 75 30 34 64 39 5c 75 30 34 34 33 5f 5c 75 30 34 33 63 5c 75 30 34 33 30 5c 75 30 34 33 63 5f 5c 75 30 34 33 63 5c 75 30 34 33 30 5c 75 30 34 34 33 5f 5c 75 30 34 34 38 5c Data Ascii: 0437\u0430\u043d_\u049b\u0430\u0440\u0430\u0448\u0430_\u0436\u0435\u043b\u0442\u043e\u049b\u0441\u0430\u043d".split("_"),monthsShort:"\u049b\u0430\u04a3_\u0430\u049b\u043f_\u043d\u0430\u0443_\u0441\u04d9\u0443_\u043c\u0430\u043c_\u043c\u0430\u0443_\u0448\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.18	49731	195.130.217.88	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:03 UTC	668	OUT	GET /ttpwp/resources/mimecast-icons.bb1a2cd16db9345fc437.woff2?25417273 HTTP/1.1 Host: security-uk.m.mimecastprotect.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://security-uk.m.mimecastprotect.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://security-uk.m.mimecastprotect.com/ttpwp Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:11:03 UTC	485	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:11:03 GMT Content-Type: font/woff2 Content-Length: 37608 Connection: close x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Thu, 08 Feb 2024 17:09:18 GMT ETag: W/"92e8-18d89b1f630"
2024-10-22 14:11:03 UTC	15899	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 92 e8 00 0b 00 00 00 01 2f b0 00 00 92 95 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 54 06 56 00 91 4e 0a 84 ad 78 83 b8 53 0b 81 7e 00 01 36 02 24 03 83 78 04 20 05 85 32 07 90 55 1b 43 f3 07 54 27 ca 61 d0 df b9 21 00 c4 2a b7 7b b5 31 b3 11 15 6c 1c 24 1e 0c ec 0b a6 db 7c 10 e8 ad 8a f4 28 18 55 f6 ff ff 3d 41 8d 31 84 a7 0e 50 6b 59 d3 10 4e 14 95 2a 93 14 74 97 2b 50 60 8c d9 4b 70 c9 3a 6e 1e 7f 8b cb a3 da 88 d7 70 1d fb b5 c2 1e 9b 7e 8b e1 b0 a6 fd 93 2e 03 ef a1 2d 2e 87 98 8e 60 3b 44 f9 76 75 cc bd 70 d8 4e 91 74 a6 02 90 10 05 95 5d 75 e3 f6 1b dc 6d 19 19 b8 cf 48 6c 6e b7 de 61 d3 af 78 07 d6 4e d5 67 6c fd 97 1f 27 5b 60 db f0 56 92 9c 4c 7b 8f e7 cd ed 7f 66 ce 39 b7 6c c9 de Data Ascii: wOF2/TVNxS~6$x 2UCT'a!{1l$\|(U=A1PkYNt+P`Kp:np~.-.`;DvupNt]umHlnaxNgl'[`VL{f9l
2024-10-22 14:11:03 UTC	16384	IN	Data Raw: 30 ff 97 55 a3 dd 4a 98 74 fc 1d 83 f0 9e ff fc 77 93 f0 07 4c c4 e3 ba a4 82 18 61 e5 f4 8a e3 d4 f8 ff 6c 4b 8a 92 a2 a0 cc e5 a8 30 d2 08 4c 00 9b 9b 95 da d4 30 64 74 f0 d2 a0 cb 76 ee 3e 11 83 e3 6a ad 5b 0e 85 17 bb 23 bb 40 81 27 f3 97 b7 2c 40 a1 3c f7 32 13 ed f0 02 da 35 87 bd 38 c0 0f 39 3d b4 aa 24 b4 ae c3 56 ec df 36 36 59 5a 77 c4 2d 65 d8 ee bb 1d 03 24 fc a3 73 36 eb 6e 1c 69 dd 7a 75 f5 de e1 6c e8 1a 8a 49 59 09 83 71 90 44 08 46 54 f8 ab 50 28 2f 84 22 a8 40 a4 ab 55 0a db b9 a7 a6 5c 31 13 8d dd fd 30 47 21 e4 f8 52 e2 28 c1 30 18 09 2e 22 18 30 ee 2e 68 13 08 6a 1e 38 77 a9 17 da 19 ad ec 02 1c e2 97 92 f5 ce 4d f6 55 ef 29 de 3d fe 05 7d 95 bf 17 80 30 ad 4b 65 a3 ad ef 83 31 6f 52 df 48 6f 58 d8 f1 bc 80 7e 75 3f 93 17 c7 c5 f1 71 Data Ascii: 0UJtwLalK0L0dtv>j[#@',@<2589=$V66YZw-e$s6nizulIYqDFTP(/"@U\10G!R(0."0.hj8wMU)=}0Ke1oRHoX~u?q
2024-10-22 14:11:03 UTC	5325	IN	Data Raw: 05 e0 1d 01 df a5 f3 b4 96 e6 75 df 45 19 80 a8 d0 ad ff 46 55 eb 3f b6 9e d6 a6 66 06 05 dd 07 11 f4 9f 2f da 16 52 b3 0b af 46 23 d1 d4 20 51 c1 85 31 3b d4 26 f3 c8 bb 09 79 39 76 76 e6 a9 24 e7 46 43 53 55 07 39 68 b4 be 94 95 d7 d1 ca e9 cd ac 1e ff c5 a4 7d 51 a9 8a 13 7f 34 74 c9 ba 12 ba 14 aa ae 33 6a 18 5e c9 4d 1f eb db 36 f1 b5 b1 03 34 1c 93 31 66 aa 3b 36 e9 27 87 2b 2b 0e 85 7f 6e f1 2d 59 b5 49 d7 26 d1 d6 dc 00 39 70 ed 30 bb 9b 61 c9 3c 28 6a a0 25 a0 6a 67 d0 27 f8 98 ab 5b 86 cb 52 e3 e8 92 ec 68 7f 34 6a 30 34 c9 69 95 22 3e 1d eb 2f b9 0d b8 8b 2f 25 4a 7e 40 35 b8 c8 9b d1 d4 cf 3f 15 7c a8 f1 40 b6 e7 aa 3a 3d 3c d9 9a e4 10 90 c2 c7 23 54 58 ab 29 51 93 7b c8 a0 b5 e0 1c ed 7f da 53 da 24 8d 90 c6 4c 7b cc 94 b0 d3 a7 e7 9f e6 8c Data Ascii: uEFU?f/RF# Q1;&y9vv$FCSU9h}Q4t3j^M641f;6'++n-YI&9p0a<(j%jg'[Rh4j04i">//%J~@5?\|@:=<#TX)Q{S$L{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.18	49732	195.130.217.88	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:03 UTC	613	OUT	GET /ttpwp/resources/languages/en.json HTTP/1.1 Host: security-uk.m.mimecastprotect.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/plain, / Content-Type: application/json x-context-route: ttpwp sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:11:04 UTC	529	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:11:03 GMT Content-Type: application/json; charset=UTF-8 Content-Length: 17152 Connection: close x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Thu, 08 Feb 2024 17:09:18 GMT ETag: W/"4300-18d89b1f630" Vary: Accept-Encoding
2024-10-22 14:11:04 UTC	15855	IN	Data Raw: 7b 22 44 45 43 49 53 49 4f 4e 5f 57 49 4c 4c 5f 42 45 5f 4c 4f 47 47 45 44 22 3a 22 59 6f 75 72 20 64 65 63 69 73 69 6f 6e 20 77 69 6c 6c 20 62 65 20 6c 6f 67 67 65 64 20 66 6f 72 20 74 72 61 63 6b 69 6e 67 20 61 6e 64 20 61 75 64 69 74 20 70 75 72 70 6f 73 65 73 2e 22 2c 22 49 4e 5f 50 52 49 56 41 54 45 5f 42 52 4f 57 53 45 52 5f 4d 4f 44 45 5f 57 41 52 4e 49 4e 47 22 3a 22 50 6c 65 61 73 65 20 6c 65 61 76 65 20 7b 7b 62 72 6f 77 73 65 72 7d 7d 20 74 6f 20 63 6f 6d 70 6c 65 74 65 20 64 65 76 69 63 65 20 65 6e 72 6f 6c 6c 6d 65 6e 74 2e 22 2c 22 49 4e 5f 50 52 49 56 41 54 45 5f 43 48 52 4f 4d 45 22 3a 22 49 6e 63 6f 67 6e 69 74 6f 20 6d 6f 64 65 22 2c 22 49 4e 5f 50 52 49 56 41 54 45 5f 46 49 52 45 46 4f 58 22 3a 22 50 72 69 76 61 74 65 20 42 72 6f 77 73 Data Ascii: {"DECISION_WILL_BE_LOGGED":"Your decision will be logged for tracking and audit purposes.","IN_PRIVATE_BROWSER_MODE_WARNING":"Please leave {{browser}} to complete device enrollment.","IN_PRIVATE_CHROME":"Incognito mode","IN_PRIVATE_FIREFOX":"Private Brows
2024-10-22 14:11:04 UTC	1297	IN	Data Raw: 54 49 4f 4e 22 3a 22 41 66 74 65 72 20 74 68 65 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 79 6f 75 20 77 69 6c 6c 20 62 65 20 72 65 64 69 72 65 63 74 65 64 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 2e 22 7d 2c 22 46 45 45 44 42 41 43 4b 5f 42 41 44 47 45 5f 52 45 43 41 50 54 43 48 41 22 3a 7b 22 52 45 43 41 50 54 43 48 41 22 3a 22 56 65 72 69 66 69 63 61 74 69 6f 6e 20 72 65 71 75 69 72 65 64 22 7d 2c 22 53 41 4e 44 42 4f 58 22 3a 7b 22 54 49 54 4c 45 22 3a 22 44 65 63 72 79 70 74 69 6f 6e 20 50 6f 72 74 61 6c 22 2c 22 44 45 53 43 52 49 50 54 49 4f 4e 22 3a 22 44 65 63 72 79 70 74 69 6f 6e 20 50 6f 72 74 61 6c 20 44 45 53 43 52 49 50 54 49 4f 4e 20 50 4c 41 43 45 48 4f 4c 44 45 52 22 2c 22 53 45 4e 44 45 52 5f 46 52 4f 4d 22 3a 22 46 72 6f 6d 22 2c 22 52 Data Ascii: TION":"After the verification you will be redirected automatically."},"FEEDBACK_BADGE_RECAPTCHA":{"RECAPTCHA":"Verification required"},"SANDBOX":{"TITLE":"Decryption Portal","DESCRIPTION":"Decryption Portal DESCRIPTION PLACEHOLDER","SENDER_FROM":"From","R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.18	49733	195.130.217.88	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:03 UTC	678	OUT	POST /service/get-caps-overrides HTTP/1.1 Host: security-uk.m.mimecastprotect.com Connection: keep-alive Content-Length: 15 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/plain, / Content-Type: application/json x-context-route: ttpwp sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://security-uk.m.mimecastprotect.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:11:03 UTC	15	OUT	Data Raw: 7b 22 64 61 74 61 22 3a 5b 6e 75 6c 6c 5d 7d Data Ascii: {"data":[null]}
2024-10-22 14:11:03 UTC	464	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:11:03 GMT Content-Type: application/json; charset=utf-8 Content-Length: 422 Connection: close x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: X-HTTP-Method-Override, Accept-Encoding ETag: W/"1a6-JYXDZzL0rOvgcYx9i3PSK7MoKzQ"
2024-10-22 14:11:03 UTC	422	IN	Data Raw: 7b 22 64 61 74 61 22 3a 5b 7b 22 62 72 6f 77 73 65 72 49 73 6f 6c 61 74 69 6f 6e 22 3a 7b 22 65 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 61 63 63 6f 75 6e 74 43 6f 64 65 73 22 3a 5b 22 43 55 53 41 31 31 41 39 32 22 2c 22 43 34 36 41 37 35 22 5d 2c 22 6f 70 74 69 6f 6e 73 22 3a 7b 22 62 61 73 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 62 69 2e 6d 69 6d 65 63 61 73 74 2e 61 70 70 2f 3f 74 61 72 67 65 74 3d 22 2c 22 77 65 62 73 69 74 65 73 22 3a 5b 22 70 6f 72 74 61 6c 2e 78 6e 2d 2d 6d 6d 65 63 61 73 74 2d 37 79 61 2e 63 6f 6d 22 2c 22 70 6f 72 74 61 6c 2e 6d c3 ad 6d 65 63 61 73 74 2e 63 6f 6d 22 2c 22 61 72 6e 65 72 69 63 61 6e 65 78 70 72 65 73 73 2e 63 6f 6d 22 2c 22 6c 6f 67 69 6e 2e 6c 69 76 c3 a8 2e 63 6f 6d 22 2c 22 77 77 77 2e 70 c4 81 79 70 61 Data Ascii: {"data":[{"browserIsolation":{"enabled":true,"accountCodes":["CUSA11A92","C46A75"],"options":{"baseUrl":"https://bi.mimecast.app/?target=","websites":["portal.xn--mmecast-7ya.com","portal.mmecast.com","arnericanexpress.com","login.liv.com","www.pypa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.18	49734	195.130.217.88	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:03 UTC	598	OUT	GET /ttpwp/resources/images/mimecast-logo.png HTTP/1.1 Host: security-uk.m.mimecastprotect.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:11:03 UTC	483	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:11:03 GMT Content-Type: image/png Content-Length: 4228 Connection: close x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Thu, 08 Feb 2024 17:09:18 GMT ETag: W/"1084-18d89b1f630"
2024-10-22 14:11:03 UTC	4228	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 fe 00 00 00 78 08 06 00 00 00 d2 7f 4f 94 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 06 9c 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 38 20 37 39 2e 31 36 34 30 33 36 2c 20 32 30 31 39 2f 30 38 2f 31 33 2d 30 31 3a 30 36 3a 35 37 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 Data Ascii: PNGIHDRxOpHYsiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.18	49738	195.130.217.88	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:04 UTC	383	OUT	GET /service/get-caps-overrides HTTP/1.1 Host: security-uk.m.mimecastprotect.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:11:05 UTC	439	IN	HTTP/1.1 404 Not Found Date: Tue, 22 Oct 2024 14:11:04 GMT Content-Type: text/html; charset=utf-8 Content-Length: 180 Connection: close x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload ETag: W/"b4-Rx6/Sa3RjWBf0k8YjdRg8WXd70U" Vary: Accept-Encoding
2024-10-22 14:11:05 UTC	180	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 3e 53 6f 72 72 79 2c 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0a 3c 70 3e 57 65 20 63 6f 75 6c 64 20 6e 6f 74 20 66 69 6e 64 20 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head> <title></title></head><body><h1>Error 404</h1><h2>Sorry, page not found.</h2><p>We could not find the page you requested.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.18	49735	195.130.217.88	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:05 UTC	397	OUT	GET /ttpwp/resources/images/mimecast-logo.png HTTP/1.1 Host: security-uk.m.mimecastprotect.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:11:05 UTC	483	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:11:05 GMT Content-Type: image/png Content-Length: 4228 Connection: close x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Thu, 08 Feb 2024 17:09:18 GMT ETag: W/"1084-18d89b1f630"
2024-10-22 14:11:05 UTC	4228	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 fe 00 00 00 78 08 06 00 00 00 d2 7f 4f 94 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 06 9c 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 38 20 37 39 2e 31 36 34 30 33 36 2c 20 32 30 31 39 2f 30 38 2f 31 33 2d 30 31 3a 30 36 3a 35 37 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 Data Ascii: PNGIHDRxOpHYsiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.18	49736	195.130.217.88	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:05 UTC	657	OUT	GET /ttpwp/resources/fa-solid-900.54dfc8f551be346014e4.woff2 HTTP/1.1 Host: security-uk.m.mimecastprotect.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://security-uk.m.mimecastprotect.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://security-uk.m.mimecastprotect.com/ttpwp Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:11:05 UTC	487	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:11:05 GMT Content-Type: font/woff2 Content-Length: 137104 Connection: close x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Thu, 08 Feb 2024 17:09:18 GMT ETag: W/"21790-18d89b1f630"
2024-10-22 14:11:05 UTC	15897	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 02 17 90 00 0d 00 00 00 05 db 50 00 02 17 34 01 4b 86 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3f 46 46 54 4d 1c 1a 1e 06 60 00 91 16 11 08 0a 94 e3 68 90 b6 39 01 36 02 24 03 b9 7c 0b ba 00 00 04 20 05 8a 16 07 81 bf 3d 5b b9 a6 94 44 c1 c9 fe 36 36 55 09 91 6e 32 00 aa 73 b5 4f 37 fb b3 2d 98 6e ee 94 9d a3 ed 1d 1d a1 5e ec 03 ca b6 4f 0a cb dd aa 52 0a 82 27 40 f6 ff ff ff ff ff b6 64 22 e6 94 ce c9 49 76 22 e7 6b 5a 0a fd a0 1f db d8 d8 a6 28 14 a3 41 f7 ac 8b 62 d7 87 54 65 8e 86 21 64 94 49 aa cf 88 a1 b8 88 c9 66 dd 2a db 0d b2 7b 91 7d 29 32 94 57 f7 6c 6f 87 c3 d1 bc 14 61 5e 97 b1 a8 97 a2 fa 53 16 8a 4b 97 b3 5e 41 97 74 86 fd 7a 96 37 90 5b 73 81 db f7 be 9b 26 39 48 c1 7d 6b c6 0f a9 72 55 34 Data Ascii: wOF2P4K$?FFTM`h96$\| =[D66Un2sO7-n^OR'@d"Iv"kZ(AbTe!dIf*{})2Wloa^SK^Atz7[s&9H}krU4
2024-10-22 14:11:05 UTC	16384	IN	Data Raw: 0f cc 4f 6c d2 1a 86 c3 e9 8b 88 99 f3 d5 a1 91 67 4c b2 13 7d 63 a8 9b fe c9 ae f3 d5 a9 a7 a7 09 39 b1 36 9f 9e a3 1f a0 90 ed 3a 9a 44 0d 5c 8d 8d 7b 81 1e 8a ae 3d 1b e9 ef 78 68 a7 d2 d5 cc 4b 22 83 b2 53 fb 67 03 b5 43 80 31 6b 6e ea 0b 64 9e 5d 91 43 ab 53 e6 59 13 e2 65 23 13 4e a3 13 df ad 58 23 54 ad 67 ae 58 f6 17 b3 09 75 e2 b6 66 07 58 34 68 96 e2 6f eb 86 2c 9f 25 ed e0 16 6b 9d 16 2e 94 d8 e0 3e 0a 07 e2 b6 59 1c bb 22 ec 90 46 04 ba b2 e9 b8 07 e6 13 6c a8 8e 18 57 fb cf 2d 26 80 6a f1 0b c9 b4 76 9e b1 48 c1 b1 36 31 27 0c 29 55 f7 b1 37 65 8d 37 ab d5 cd 2c ca 86 65 bf cf 8e 2b 4f 7c 6a e2 d3 8c 1b 3d 66 6c 63 4c 3b 5d dd 62 40 41 37 42 38 4f e5 fb b1 65 53 54 1c e7 3e f9 08 40 0c fb 47 77 8c 0f da 6a 5b 2f cf 18 be e8 53 2d ac a8 ae 00 Data Ascii: OlgL}c96:D\{=xhK"SgC1knd]CSYe#NX#TgXufX4ho,%k.>Y"FlW-&jvH61')U7e7,e+O\|j=flcL;]b@A7B8OeST>@Gwj[/S-
2024-10-22 14:11:05 UTC	16384	IN	Data Raw: b6 a3 dc 1f d7 6d 94 a2 70 41 3f 30 2b e9 4d 9c 50 fe 51 07 81 e2 46 1d 88 9a e1 20 91 d8 c3 84 a0 6f ff fa 8f d8 09 d6 ac da 1f b0 13 ac d8 d5 ef 7d 10 ac 9a e5 29 b1 96 ef 48 1f 0a 57 49 85 a1 54 60 01 b0 36 f5 e9 44 9f 11 ed f1 46 d9 0b 9a d1 0f 72 d8 42 eb 3e fa 6d b2 04 91 8a 6c 6d 92 ce cd 74 c0 6c b8 ba 93 46 15 45 1e 42 ca 91 be 7f 40 60 c3 89 82 3f a2 a1 04 7b ac 57 5f 34 f5 f9 08 4c 29 ff 61 12 8f 7c 76 78 b5 a8 5c 8d 64 a1 af 05 cd 2a 12 3e 6f 3a a0 09 ea 41 ab 5d a6 2c 37 8d b0 de 10 80 0d e2 a2 e5 30 4d 4e ee d7 d2 a8 cb dd d5 ab f1 66 1e 02 e1 ef 30 96 58 aa 1a fe 63 9e c5 03 c6 b7 7d cb e7 35 b8 92 84 fd 7d 65 21 6a 1c 2d 1b c1 d3 d1 73 56 1e 2c 9e 17 d6 14 ef 7f 0e 22 c4 bd ec f0 aa c8 83 3e 49 99 cc 25 7c 2c 49 8c fc 46 fe d1 3d 45 71 e4 Data Ascii: mpA?0+MPQF o})HWIT`6DFrB>mlmtlFEB@`?{W_4L)a\|vx\d*>o:A],70MNf0Xc}5}e!j-sV,">I%\|,IF=Eq
2024-10-22 14:11:05 UTC	16384	IN	Data Raw: f7 a6 35 f3 4e af be ab 74 f9 38 66 2e 2b 08 49 48 2b e6 97 ae 58 68 87 8e 4f e3 42 6a c0 27 3e 24 94 ce 22 13 79 aa 3a 0e 61 58 29 5a 0c 8c 27 55 08 51 55 0f b5 92 a0 35 71 8c 71 d8 dd a3 76 fc 9b 25 e1 0c 5c ed 4a 50 04 d2 1a c8 c2 d2 16 74 39 ba da 75 d5 e2 f2 4c b6 50 ff e6 e8 14 99 6e c4 82 a4 52 2e 1e 64 97 eb 59 d1 08 b3 17 f6 88 c1 2e 19 b9 73 69 a4 27 77 c5 f3 ae eb 36 78 8c ac da 87 cb 33 d8 42 c5 c1 d8 9a 0b 95 7e 97 e4 d0 60 a1 6d b0 c9 79 9b d1 1b bc cb fb e1 00 3c d3 b3 c3 16 ba ba 10 ae 36 82 bb 3e 6b b0 65 ae d7 17 eb e6 60 3d d9 29 42 ad 68 bb 78 6a 1c 5f 9d 92 d1 a4 60 b1 f8 da 1e f6 b8 32 8b 48 55 64 89 77 3d 21 50 a4 22 8c d6 4b bc da 22 64 e5 da 9e 85 5c cc 0d 4a 32 33 0e af e9 cd 4c 0a 22 d7 9e 46 6f 20 9e ec 23 96 0f 85 a9 7c 4b 96 Data Ascii: 5Nt8f.+IH+XhOBj'>$"y:aX)Z'UQU5qqv%\JPt9uLPnR.dY.si'w6x3B~`my<6>ke`=)Bhxj_`2HUdw=!P"K"d\J23L"Fo #\|K
2024-10-22 14:11:05 UTC	16384	IN	Data Raw: 90 b7 1a 1b e1 08 5c ce 9e f7 d5 75 13 c1 24 81 e6 f5 1b 23 93 da 05 1c 7b ca 40 8c 57 57 c7 e0 35 42 9c ff af 7f 69 a3 8e 47 45 2f 7b e3 93 e2 ed 73 fa a2 86 1a 8f 48 31 13 ae 0d 76 b6 37 50 c6 6f 25 d0 73 ca a1 f8 f1 f2 1e d8 24 c7 2f d2 8c cc 5b f8 5c 23 81 6a 28 39 68 6e 8c 60 33 f8 5a 97 4b bf 58 bd d3 14 cd b1 4e c5 ce 04 45 27 3b 8e ff 06 14 f5 cf 9f df d8 18 28 be be 13 2f d1 e9 40 a1 55 4f 23 92 db fa 8b da 7e 5a ff 3d 10 1d b8 82 b5 fd 21 27 b9 ca 44 d2 b8 43 1d ec 30 1c 0f 62 06 49 39 4f c4 b5 45 da e6 e8 e2 98 3b e5 99 2e 43 f1 db 54 44 d1 c3 0f cb 61 4e f6 d4 60 54 8f 88 b6 ec d7 a5 a6 c8 51 f3 ef cb 03 7c 68 25 87 c0 50 82 99 92 89 9e ed 68 af 2b ba 8a b0 fc b0 14 ed ac b0 1f 97 95 9d b7 2d bd 13 46 60 c8 7b 8b 83 9e f9 12 fb cf 0d 9a ee 9c Data Ascii: \u$#{@WW5BiGE/{sH1v7Po%s$/[\#j(9hn`3ZKXNE';(/@UO#~Z=!'DC0bI9OE;.CTDaN`TQ\|h%Ph+-F`{
2024-10-22 14:11:05 UTC	16384	IN	Data Raw: a1 35 53 99 88 9c 1a ca c1 40 cc f3 bf 63 39 53 a2 6e 0c 10 b4 c5 46 3f 6e ea 80 77 a4 72 5d 0b 8b eb 07 36 70 43 80 9c c2 fb fd bc 33 84 2b 42 91 53 f3 13 33 ab 48 ba aa 67 d7 0e 48 2f 6d fb bb b0 fe c1 fc b5 ed 92 c7 81 a7 cf aa 58 47 56 91 58 ea c4 79 1d 7b 13 81 7a 15 58 fb ae 24 f1 08 44 55 2b a1 ca 7c f6 4f ca 31 f7 50 ec d4 b0 4f e7 0e b2 72 5c 78 53 4a e4 a9 6e b6 70 76 bb 79 12 dd 98 27 2e db 12 cd a3 01 13 b3 dc e7 d2 ca 0d 75 ee 86 11 aa 7b 1d 75 b6 be 8e 53 b0 3b a9 7a 31 f1 1e be 07 f0 57 c3 6a 7a 75 9f b7 97 8c c9 32 b1 78 87 5d 67 9b f1 fe f1 cf 1e 5a 86 d7 4d 7a c1 9b 1a 5a d4 d4 92 8f 7d a2 82 27 05 d8 5e 32 2b f1 88 23 a4 ff 19 d5 7e 0e a0 9b 7c 5f c4 ba d5 70 c1 24 76 a0 91 6e dc db 52 cf bb 1a 9e b5 52 54 c2 11 5d 3e 88 43 7f 11 93 2a Data Ascii: 5S@c9SnF?nwr]6pC3+BS3HgH/mXGVXy{zX$DU+\|O1POr\xSJnpvy'.u{uS;z1Wjzu2x]gZMzZ}'^2+#~\|_p$vnRRT]>C*
2024-10-22 14:11:05 UTC	16384	IN	Data Raw: 52 67 87 e5 4d ba f3 da 59 cf a6 a6 6e 97 66 ca f7 51 80 90 a8 bf a4 19 d5 44 d8 32 61 d8 c6 e4 e3 61 62 b1 d7 b0 48 bc 72 d1 b9 de ce 30 91 18 24 be 93 62 b4 93 09 f6 1f 51 4d f3 6d a8 9f bc 84 6c e9 0a fe 8c 71 ef 74 4b c9 49 fc 62 bb c5 ed d2 bd a2 fb 8c 3c cb 3c fc 19 4f 89 2c 76 0e 7a 13 50 8f 01 9d 72 15 8c ab bc 2e d6 32 0a 87 2a fe 1e 0c 6a ae f7 80 fd a7 4f 86 f8 82 33 9f e2 17 74 7d fc c2 ea 10 da 75 1b 5c dd de 96 5d 0f e7 be fb 97 70 da b7 bc 1b ff 8e ee 9a fb 65 5c f8 58 02 a4 c7 16 4d cc ab fc 51 2e b9 22 51 3b c3 7c e3 72 ca ea 7a 22 a9 b0 29 c6 1a 50 4d ca f2 52 0c 4d b5 00 a7 86 45 5b e9 88 e4 19 9f a9 8e f1 fc bc 63 c3 9f 1e df 47 47 24 2f 4d 8e 50 6e ef f7 f6 e7 06 45 73 a3 fd fe 68 18 3d c7 c9 f5 4f c2 f1 49 fe 5c 7c 72 34 1b fe c5 80 Data Ascii: RgMYnfQD2aabHr0$bQMmlqtKIb<<O,vzPr.2*jO3t}u\]pe\XMQ."Q;\|rz")PMRME[cGG$/MPnEsh=OI\\|r4
2024-10-22 14:11:05 UTC	16384	IN	Data Raw: 6a a2 29 33 2b 25 81 17 2a 72 1f 4b 88 26 3a 33 95 0e 95 c8 52 ee 3a 12 0a 3e 89 30 a9 71 46 57 17 ad 23 d2 47 7e 60 f3 81 86 4d ac 50 d5 f2 90 ea eb df 41 be dc b1 7f 23 63 de 4d 96 d2 6c 90 2c 98 0f bb 44 a1 23 dd 10 e9 be 15 ae d2 d7 00 e7 b1 37 dd b0 42 aa ce c8 08 ef 10 bc d1 c8 da c8 52 c3 cb 19 af db aa ab 07 59 ae de ce dd 1b 95 ef 3d 3f 6a 5f b1 76 cc a5 8f f1 1d dc 8f 8f 75 42 d7 0f ee 5f e1 fc 30 7e 56 40 f5 12 c8 de 7e e7 95 8b 4b b9 4e 70 1f cc 80 e6 95 a0 72 54 d3 86 e6 cd 13 1e 43 70 71 58 1c da cb 35 ef 31 84 a1 b8 a6 d9 cb cf 61 ee 5e 2c 80 f3 0f cc 0c 71 f9 cf 02 c0 1e 2f 64 c6 c5 d7 e8 f3 eb 66 c7 a2 b1 cc 3c 45 ac d1 d7 83 c5 c1 3c c4 15 21 2d c8 c8 9e 19 14 34 53 e2 3f ee 02 98 1f 0c 4b b1 9d 6a 02 93 5a 74 5c 5b 65 e4 db 80 e6 01 c3 Data Ascii: j)3+%*rK&:3R:>0qFW#G~`MPA#cMl,D#7BRY=?j_vuB_0~V@~KNprTCpqX51a^,q/df<E<!-4S?KjZt\[e
2024-10-22 14:11:05 UTC	6519	IN	Data Raw: e4 c4 03 48 1e bf ea 31 f2 fe 38 48 f5 29 00 bd 8a e3 0d 8a d9 e1 40 97 92 dd 9c 15 0e b5 1b 6f 44 60 77 29 6e 51 16 34 b3 5e 38 d1 f3 ef 50 35 40 32 63 52 d1 27 62 e7 5d 1f e4 86 13 19 f3 d5 b7 b8 ae b0 da a1 8b d1 7c a3 66 17 a4 e4 e8 f0 50 2d 39 23 87 3b d5 08 3b 65 ff 1f 89 99 99 7b 22 11 6f a0 e6 a6 98 12 fe 9d 6e 8d 6a f1 0d 39 de 04 db 4e d0 38 5b ff 83 e8 be 4a 3d 8d e6 68 23 77 85 14 dd 05 06 ce 58 28 e9 35 86 9d b7 eb fe b8 25 8d 99 5b 3c 46 1f 69 30 82 4d 78 a0 33 08 54 5d b3 5b f2 45 04 82 16 91 6b 6f d0 9c a7 63 84 19 35 8b 35 5e 76 ab 50 37 7e 16 2a 6f c5 bf 6d 95 a9 c0 a5 d1 70 a4 a9 f8 72 68 84 8a fb 02 2a 73 aa 42 e4 4f 65 79 51 d8 52 a7 83 27 b5 2b fc 75 40 e0 3b 6e f1 07 c1 17 89 b7 4c 43 06 d5 b2 48 c0 84 92 12 84 f6 42 7e 89 7b 8b ca Data Ascii: H18H)@oD`w)nQ4^8P5@2cR'b]\|fP-9#;;e{"onj9N8[J=h#wX(5%[<Fi0Mx3T][Ekoc55^vP7~omprhsBOeyQR'+u@;nLCHB~{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.18	49737	195.130.217.88	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:05 UTC	390	OUT	GET /ttpwp/resources/languages/en.json HTTP/1.1 Host: security-uk.m.mimecastprotect.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:11:05 UTC	529	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:11:05 GMT Content-Type: application/json; charset=UTF-8 Content-Length: 17152 Connection: close x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Thu, 08 Feb 2024 17:09:18 GMT ETag: W/"4300-18d89b1f630" Vary: Accept-Encoding
2024-10-22 14:11:05 UTC	15855	IN	Data Raw: 7b 22 44 45 43 49 53 49 4f 4e 5f 57 49 4c 4c 5f 42 45 5f 4c 4f 47 47 45 44 22 3a 22 59 6f 75 72 20 64 65 63 69 73 69 6f 6e 20 77 69 6c 6c 20 62 65 20 6c 6f 67 67 65 64 20 66 6f 72 20 74 72 61 63 6b 69 6e 67 20 61 6e 64 20 61 75 64 69 74 20 70 75 72 70 6f 73 65 73 2e 22 2c 22 49 4e 5f 50 52 49 56 41 54 45 5f 42 52 4f 57 53 45 52 5f 4d 4f 44 45 5f 57 41 52 4e 49 4e 47 22 3a 22 50 6c 65 61 73 65 20 6c 65 61 76 65 20 7b 7b 62 72 6f 77 73 65 72 7d 7d 20 74 6f 20 63 6f 6d 70 6c 65 74 65 20 64 65 76 69 63 65 20 65 6e 72 6f 6c 6c 6d 65 6e 74 2e 22 2c 22 49 4e 5f 50 52 49 56 41 54 45 5f 43 48 52 4f 4d 45 22 3a 22 49 6e 63 6f 67 6e 69 74 6f 20 6d 6f 64 65 22 2c 22 49 4e 5f 50 52 49 56 41 54 45 5f 46 49 52 45 46 4f 58 22 3a 22 50 72 69 76 61 74 65 20 42 72 6f 77 73 Data Ascii: {"DECISION_WILL_BE_LOGGED":"Your decision will be logged for tracking and audit purposes.","IN_PRIVATE_BROWSER_MODE_WARNING":"Please leave {{browser}} to complete device enrollment.","IN_PRIVATE_CHROME":"Incognito mode","IN_PRIVATE_FIREFOX":"Private Brows
2024-10-22 14:11:05 UTC	1297	IN	Data Raw: 54 49 4f 4e 22 3a 22 41 66 74 65 72 20 74 68 65 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 79 6f 75 20 77 69 6c 6c 20 62 65 20 72 65 64 69 72 65 63 74 65 64 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 2e 22 7d 2c 22 46 45 45 44 42 41 43 4b 5f 42 41 44 47 45 5f 52 45 43 41 50 54 43 48 41 22 3a 7b 22 52 45 43 41 50 54 43 48 41 22 3a 22 56 65 72 69 66 69 63 61 74 69 6f 6e 20 72 65 71 75 69 72 65 64 22 7d 2c 22 53 41 4e 44 42 4f 58 22 3a 7b 22 54 49 54 4c 45 22 3a 22 44 65 63 72 79 70 74 69 6f 6e 20 50 6f 72 74 61 6c 22 2c 22 44 45 53 43 52 49 50 54 49 4f 4e 22 3a 22 44 65 63 72 79 70 74 69 6f 6e 20 50 6f 72 74 61 6c 20 44 45 53 43 52 49 50 54 49 4f 4e 20 50 4c 41 43 45 48 4f 4c 44 45 52 22 2c 22 53 45 4e 44 45 52 5f 46 52 4f 4d 22 3a 22 46 72 6f 6d 22 2c 22 52 Data Ascii: TION":"After the verification you will be redirected automatically."},"FEEDBACK_BADGE_RECAPTCHA":{"RECAPTCHA":"Verification required"},"SANDBOX":{"TITLE":"Decryption Portal","DESCRIPTION":"Decryption Portal DESCRIPTION PLACEHOLDER","SENDER_FROM":"From","R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.18	49739	195.130.217.88	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:05 UTC	678	OUT	POST /api/ttp/url/get-page-data HTTP/1.1 Host: security-uk.m.mimecastprotect.com Connection: keep-alive Content-Length: 182 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/plain, / Content-Type: application/json x-context-route: ttpwp sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://security-uk.m.mimecastprotect.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:11:05 UTC	182	OUT	Data Raw: 7b 22 64 61 74 61 22 3a 5b 7b 22 63 61 63 68 65 4b 65 79 22 3a 22 59 48 43 48 30 6a 4b 34 78 73 4e 52 4d 47 4f 62 55 30 65 68 44 78 54 30 66 67 33 6a 58 73 67 61 31 6e 7a 63 78 2d 34 66 6f 6b 50 42 31 58 64 34 6e 7a 68 6d 50 36 50 41 4f 54 71 5f 35 32 5f 63 39 68 78 5f 5f 5f 5f 75 47 65 41 72 41 45 37 4e 50 4c 68 39 74 72 34 6a 39 58 42 79 50 75 70 34 58 56 5a 36 31 52 61 44 50 52 4f 73 38 61 6f 55 45 36 30 31 66 79 56 56 31 41 39 79 70 66 70 42 22 2c 22 70 61 67 65 54 79 70 65 22 3a 22 75 73 65 72 5f 63 68 61 6c 6c 65 6e 67 65 22 7d 5d 7d Data Ascii: {"data":[{"cacheKey":"YHCH0jK4xsNRMGObU0ehDxT0fg3jXsga1nzcx-4fokPB1Xd4nzhmP6PAOTq_52_c9hx____uGeArAE7NPLh9tr4j9XByPup4XVZ61RaDPROs8aoUE601fyVV1A9ypfpB","pageType":"user_challenge"}]}
2024-10-22 14:11:08 UTC	511	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:11:08 GMT Content-Type: application/json; charset=UTF-8 Content-Length: 561 Connection: close cache-control: no-store pragma: no-cache X-Robots-Tag: noindex, nofollow x-mc-req-id: aff85581-2968-4c12-be76-8c5962b0952a x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer Strict-Transport-Security: max-age=31536000; includeSubDomains; preload ETag: W/"231-GOkKcFMpBNNEdw889PYPDpMBsyM"
2024-10-22 14:11:08 UTC	561	IN	Data Raw: 7b 22 6d 65 74 61 22 3a 7b 22 73 74 61 74 75 73 22 3a 32 30 30 7d 2c 22 64 61 74 61 22 3a 5b 7b 22 70 61 67 65 54 79 70 65 22 3a 22 75 73 65 72 5f 63 68 61 6c 6c 65 6e 67 65 22 2c 22 70 61 67 65 43 6f 6e 74 65 6e 74 22 3a 7b 22 63 75 73 74 6f 6d 22 3a 66 61 6c 73 65 2c 22 74 69 74 6c 65 22 3a 22 44 6f 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 65 20 6c 69 6e 6b 20 69 73 20 73 61 66 65 3f 22 2c 22 73 75 62 74 69 74 6c 65 22 3a 22 57 65 e2 80 99 76 65 20 72 61 6e 64 6f 6d 6c 79 20 73 65 6c 65 63 74 65 64 20 74 68 69 73 20 6c 69 6e 6b 20 66 6f 72 20 74 72 61 69 6e 69 6e 67 20 70 75 72 70 6f 73 65 73 2e 20 52 65 76 69 65 77 20 74 68 65 20 64 65 74 61 69 6c 73 20 62 65 66 6f 72 65 20 64 65 63 69 64 69 6e 67 20 77 68 65 74 68 65 72 20 69 74 e2 80 99 73 20 73 61 66 Data Ascii: {"meta":{"status":200},"data":[{"pageType":"user_challenge","pageContent":{"custom":false,"title":"Do you think the link is safe?","subtitle":"Weve randomly selected this link for training purposes. Review the details before deciding whether its saf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.18	49740	195.130.217.88	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:06 UTC	592	OUT	GET /ttpwp/resources/images/favicon.ico HTTP/1.1 Host: security-uk.m.mimecastprotect.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:11:06 UTC	508	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:11:06 GMT Content-Type: image/x-icon Content-Length: 1150 Connection: close x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Thu, 08 Feb 2024 17:09:18 GMT ETag: W/"47e-18d89b1f630" Vary: Accept-Encoding
2024-10-22 14:11:06 UTC	1150	IN	Data Raw: 00 00 01 00 01 00 10 10 00 00 01 00 20 00 68 04 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 13 0b 00 00 13 0b 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 7c 6b 57 a2 7c 6b 57 83 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 7c 6b 57 1a 7c 6b 57 b3 7c 6b 57 f3 7c 6b 57 ea 7c 6b 57 a4 7c 6b 57 13 ff ff ff 00 7c 6b 57 83 7c 6b 57 32 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff Data Ascii: h( \|kW\|kW\|kW\|kW\|kW\|kW\|kW\|kW\|kW\|kW2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.18	49743	195.130.217.88	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:07 UTC	391	OUT	GET /ttpwp/resources/images/favicon.ico HTTP/1.1 Host: security-uk.m.mimecastprotect.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:11:08 UTC	508	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:11:08 GMT Content-Type: image/x-icon Content-Length: 1150 Connection: close x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Thu, 08 Feb 2024 17:09:18 GMT ETag: W/"47e-18d89b1f630" Vary: Accept-Encoding
2024-10-22 14:11:08 UTC	1150	IN	Data Raw: 00 00 01 00 01 00 10 10 00 00 01 00 20 00 68 04 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 13 0b 00 00 13 0b 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 7c 6b 57 a2 7c 6b 57 83 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 7c 6b 57 1a 7c 6b 57 b3 7c 6b 57 f3 7c 6b 57 ea 7c 6b 57 a4 7c 6b 57 13 ff ff ff 00 7c 6b 57 83 7c 6b 57 32 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff Data Ascii: h( \|kW\|kW\|kW\|kW\|kW\|kW\|kW\|kW\|kW\|kW2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.18	49744	195.130.217.88	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:09 UTC	382	OUT	GET /api/ttp/url/get-page-data HTTP/1.1 Host: security-uk.m.mimecastprotect.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:11:09 UTC	439	IN	HTTP/1.1 404 Not Found Date: Tue, 22 Oct 2024 14:11:09 GMT Content-Type: text/html; charset=utf-8 Content-Length: 180 Connection: close x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload ETag: W/"b4-Rx6/Sa3RjWBf0k8YjdRg8WXd70U" Vary: Accept-Encoding
2024-10-22 14:11:09 UTC	180	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 3e 53 6f 72 72 79 2c 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0a 3c 70 3e 57 65 20 63 6f 75 6c 64 20 6e 6f 74 20 66 69 6e 64 20 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head> <title></title></head><body><h1>Error 404</h1><h2>Sorry, page not found.</h2><p>We could not find the page you requested.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.18	49747	195.130.217.88	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:38 UTC	691	OUT	POST /api/ttp/userawareness/report-judgement HTTP/1.1 Host: security-uk.m.mimecastprotect.com Connection: keep-alive Content-Length: 172 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/plain, / Content-Type: application/json x-context-route: ttpwp sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://security-uk.m.mimecastprotect.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:11:38 UTC	172	OUT	Data Raw: 7b 22 64 61 74 61 22 3a 5b 7b 22 63 61 63 68 65 4b 65 79 22 3a 22 59 48 43 48 30 6a 4b 34 78 73 4e 52 4d 47 4f 62 55 30 65 68 44 78 54 30 66 67 33 6a 58 73 67 61 31 6e 7a 63 78 2d 34 66 6f 6b 50 42 31 58 64 34 6e 7a 68 6d 50 36 50 41 4f 54 71 5f 35 32 5f 63 39 68 78 5f 5f 5f 5f 75 47 65 41 72 41 45 37 4e 50 4c 68 39 74 72 34 6a 39 58 42 79 50 75 70 34 58 56 5a 36 31 52 61 44 50 52 4f 73 38 61 6f 55 45 36 30 31 66 79 56 56 31 41 39 79 70 66 70 42 22 2c 22 6a 75 64 67 65 64 53 61 66 65 22 3a 74 72 75 65 7d 5d 7d Data Ascii: {"data":[{"cacheKey":"YHCH0jK4xsNRMGObU0ehDxT0fg3jXsga1nzcx-4fokPB1Xd4nzhmP6PAOTq_52_c9hx____uGeArAE7NPLh9tr4j9XByPup4XVZ61RaDPROs8aoUE601fyVV1A9ypfpB","judgedSafe":true}]}
2024-10-22 14:11:38 UTC	514	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:11:38 GMT Content-Type: application/json; charset=utf-8 Content-Length: 10758 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload cache-control: no-store pragma: no-cache X-Robots-Tag: noindex, nofollow x-mc-req-id: 5529e560-2060-457e-8f5b-1dd7750361e4 x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer ETag: W/"2a06-zWHGPjYNU+691zG/8XQsEvqCIZE"
2024-10-22 14:11:38 UTC	10758	IN	Data Raw: 7b 22 6d 65 74 61 22 3a 7b 22 73 74 61 74 75 73 22 3a 32 30 30 7d 2c 22 64 61 74 61 22 3a 5b 7b 22 70 61 67 65 54 79 70 65 22 3a 22 73 61 66 65 5f 6a 75 64 67 65 64 5f 73 61 66 65 22 2c 22 70 61 67 65 43 6f 6e 74 65 6e 74 22 3a 7b 22 63 75 73 74 6f 6d 22 3a 66 61 6c 73 65 2c 22 74 69 74 6c 65 22 3a 22 57 65 6c 6c 20 64 6f 6e 65 2c 20 74 68 69 73 20 6c 69 6e 6b 20 69 73 20 73 61 66 65 22 2c 22 73 75 62 74 69 74 6c 65 22 3a 22 59 6f 75 20 63 61 6e 20 63 6f 6e 74 69 6e 75 65 20 74 6f 20 74 68 65 20 70 61 67 65 2e 22 7d 2c 22 73 61 66 65 74 79 54 69 70 73 22 3a 5b 7b 22 69 63 6f 6e 22 3a 22 6d 63 2d 69 63 6f 6e 2d 66 72 61 75 64 22 2c 22 74 69 74 6c 65 22 3a 22 45 6d 6f 74 69 6f 6e 61 6c 20 72 65 73 70 6f 6e 73 65 22 2c 22 6f 70 65 6e 69 6e 67 53 74 61 74 65 Data Ascii: {"meta":{"status":200},"data":[{"pageType":"safe_judged_safe","pageContent":{"custom":false,"title":"Well done, this link is safe","subtitle":"You can continue to the page."},"safetyTips":[{"icon":"mc-icon-fraud","title":"Emotional response","openingState

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.18	49748	195.130.217.88	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:39 UTC	395	OUT	GET /api/ttp/userawareness/report-judgement HTTP/1.1 Host: security-uk.m.mimecastprotect.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:11:39 UTC	439	IN	HTTP/1.1 404 Not Found Date: Tue, 22 Oct 2024 14:11:39 GMT Content-Type: text/html; charset=utf-8 Content-Length: 180 Connection: close x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload ETag: W/"b4-Rx6/Sa3RjWBf0k8YjdRg8WXd70U" Vary: Accept-Encoding
2024-10-22 14:11:39 UTC	180	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 3e 53 6f 72 72 79 2c 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0a 3c 70 3e 57 65 20 63 6f 75 6c 64 20 6e 6f 74 20 66 69 6e 64 20 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head> <title></title></head><body><h1>Error 404</h1><h2>Sorry, page not found.</h2><p>We could not find the page you requested.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.18	49749	195.130.217.88	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:39 UTC	659	OUT	GET /ttpwp/resources/fa-regular-400.33904a1b964c9b363ce7.woff2 HTTP/1.1 Host: security-uk.m.mimecastprotect.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://security-uk.m.mimecastprotect.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://security-uk.m.mimecastprotect.com/ttpwp Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:11:40 UTC	487	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:11:39 GMT Content-Type: font/woff2 Content-Length: 168824 Connection: close x-content-type-options: nosniff x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Thu, 08 Feb 2024 17:09:18 GMT ETag: W/"29378-18d89b1f630"
2024-10-22 14:11:40 UTC	15897	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 02 93 78 00 0d 00 00 00 06 dd 8c 00 02 93 1c 01 4b 86 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3f 46 46 54 4d 1c 1a 1e 06 60 00 91 16 11 08 0a 98 e7 74 93 d8 4a 01 36 02 24 03 b9 7c 0b ba 00 00 04 20 05 8a 46 07 81 bf 3d 5b fa 77 95 43 e1 ed 6f 18 94 72 4e 06 c4 81 f7 f6 4c f5 a3 b5 15 6c 9b 85 b7 ce b1 cd c4 c0 1f 54 89 a5 7f 82 b9 a9 d4 a2 ce dd 0e c6 ff 70 57 39 d9 ff ff ff ff ff c2 64 22 ea d2 c9 f1 49 4e e4 41 80 96 51 68 cb 2e 3c fd 0d 24 d0 dc 14 b2 c8 bc c4 02 e1 b5 49 85 d6 65 c1 4e 93 b0 2e 65 50 e3 05 ac 40 b9 bc 40 5e 35 cd 4c 25 55 52 a8 cc 26 ed 7a 23 5b 29 72 23 b7 d2 ef 5a c2 80 7b 7d 68 1b d6 3b d9 c6 2d ec a6 ab 89 0f f2 a8 f6 de fb ba 0e 88 ec f6 70 79 40 9a d2 4d 82 d9 b9 ba f6 6c f7 78 Data Ascii: wOF2xK$?FFTM`tJ6$\| F=[wCorNLlTpW9d"INAQh.<$IeN.eP@@^5L%UR&z#[)r#Z{}h;-py@Mlx
2024-10-22 14:11:40 UTC	16384	IN	Data Raw: 73 51 27 5b e9 30 69 02 31 6e b1 0f bd 92 be 02 f9 4d 5e ad f4 42 06 48 0e 08 70 26 8c 24 1e 70 44 fd 91 89 65 5a c7 77 32 c6 0e 11 27 65 ca 0c 0a 85 b0 95 51 d8 e6 cd b5 09 53 8f 32 f1 d1 5d 5d 5f 2f f2 4c 3f 17 9e fb 85 bc 53 0e 62 88 d1 1a fb b0 db 42 b8 34 f1 72 de f8 91 c9 46 08 08 14 f6 5f 12 5d ec 49 75 ad 34 ab 39 ad 59 8a ea 4b a3 fe 65 55 b1 19 11 b6 d5 35 c5 e9 37 64 df bd c6 e7 f4 7d 2f db 16 f0 3a 93 0c a8 6c c3 f0 f2 58 f4 51 a0 9e 70 b5 34 0a 46 31 26 34 c6 25 8f 4c 95 d3 a8 60 75 2b d7 39 f3 0d 8d 46 39 d6 02 14 ca 64 09 94 66 77 f7 95 cd 67 b1 68 07 01 a3 75 c2 b1 3a 21 1d 72 fc 9b cb ae c1 3b f9 42 ad 44 0f b6 93 b5 ed e1 a3 0a cb 79 0a 37 ee 27 50 d3 e7 33 8c 76 c5 b6 d5 2f ed 19 48 89 f6 3b 19 c6 83 25 22 c1 e6 e9 42 75 cd ce 0b fe 5a Data Ascii: sQ'[0i1nM^BHp&$pDeZw2'eQS2]]_/L?SbB4rF_]Iu49YKeU57d}/:lXQp4F1&4%L`u+9F9dfwghu:!r;BDy7'P3v/H;%"BuZ
2024-10-22 14:11:40 UTC	16384	IN	Data Raw: aa 26 55 5b 32 f5 29 c1 af 51 48 4d 58 84 4e 6a 87 c0 a4 ce 07 e2 18 0a 66 36 69 6d 8b cc db 86 5b be c6 8b ad 8e 6c 14 f1 a1 08 ec 1e aa 54 0b 19 7d cd de 53 36 4e bb 47 cb 12 02 8f 99 70 9a 81 85 75 70 85 20 e3 c8 49 33 3c ba 4c dd 2c b4 91 84 fd 39 dd 20 69 5e 45 96 6b 57 16 66 46 c0 96 0c 19 d8 7d 94 9d 18 fb dc a8 d7 61 81 a8 86 f7 09 d8 64 61 c2 de 41 c0 ef d2 40 39 30 8a d7 9b 6c ed f0 4d 1e 7b a6 94 88 48 80 4d 7d fd 3f ff 9f 64 51 6e 13 ef cb d4 4c db dc 2a a5 b6 b8 e3 91 3a 4f 71 08 0d 78 31 a2 93 9e 1f 7b b7 29 cb d9 3e 5e 18 53 45 e5 f9 a2 75 08 e2 dd 1a 16 46 7d 00 5d 7e 9b d9 1c 1c f6 b9 29 a6 25 a7 63 cc 27 43 c3 b5 94 d0 25 55 84 3e b1 e2 e5 6c 75 d7 3d 57 79 bb 0a 16 6f 89 9b 85 61 b3 be ab 87 c9 30 90 c9 ab ac a3 fc ee c0 5e 6f ae d2 8b Data Ascii: &U[2)QHMXNjf6im[lT}S6NGpup I3<L,9 i^EkWfF}adaA@90lM{HM}?dQnL*:Oqx1{)>^SEuF}]~)%c'C%U>lu=Wyoa0^o
2024-10-22 14:11:40 UTC	16384	IN	Data Raw: 2b cd 01 63 c6 d7 ee 8c 5c 5c 7c 26 ab 83 db 63 34 58 45 be 4c df ac a9 0c 88 3d a0 ca e9 90 23 b0 55 a0 9e e0 c2 7a 8b b3 15 c9 5c 03 92 fb d3 cc 08 a2 00 22 2a ba be 1b 2d 89 f7 c2 d2 f6 f1 82 76 3b 72 20 75 84 30 30 80 d8 a8 68 1f 05 16 c0 37 fa 33 68 c0 12 fe 29 ae 41 ce 77 6b b5 c1 28 3b d8 33 d5 a6 fd 58 c3 7c b3 1c fe 58 98 4a bf 6d dc 71 53 31 b8 d0 75 99 f1 e6 9e bf 9a 6f 64 08 ba ff cb d5 b9 4b 38 64 d8 f9 0d 0e c2 9e 63 ae 2a 6d da 7c 65 e7 01 3a 0f f6 ea 55 24 48 cf 20 3e c7 e9 54 73 e4 bd a3 cb a6 a9 43 67 d6 d1 50 ee 16 9a 6a d3 29 9a 91 98 97 a5 d7 32 5e 66 d1 eb e6 84 b0 7b 2d 8b 6c ab dc ac 00 21 16 ed ac 90 a2 e0 11 21 be 03 30 2c 15 93 f0 15 55 6b 71 91 65 c2 1f 0d 86 9d 0f b3 b8 10 4b 30 1f 94 08 03 bc b6 b0 3a a3 94 6c d6 ef 27 0d 11 Data Ascii: +c\\\|&c4XEL=#Uz\"-v;r u00h73h)Awk(;3X\|XJmqS1uodK8dcm\|e:U$H >TsCgPj)2^f{-l!!0,UkqeK0:l'
2024-10-22 14:11:40 UTC	16384	IN	Data Raw: 64 e1 03 8f 2c aa 70 1f 8a dc c1 ba 20 ba 34 2b 6d 76 74 bb 36 02 14 6d 80 3d a9 43 76 dc 21 d2 c5 8a 43 46 1f 66 ed 14 39 75 4f e7 8e 07 8c 02 cf 8f b2 fd d6 6c 7e a0 b2 d9 7b 2c 5e 18 7f b5 ae ea 51 a0 c4 15 83 c6 2a 72 32 94 8e 40 82 d6 59 4f 88 8c c2 01 85 14 e7 22 d7 d9 84 cb 9d 21 79 71 5e 98 d8 bd 52 3f 17 c2 bd f0 96 38 c9 12 76 85 05 28 dc cf 6e bd 0c 02 81 ce 32 41 48 9f 29 30 56 f9 02 00 bd d3 53 c4 81 09 0e 7a ae 66 be 96 44 b2 d0 8f 67 89 50 98 27 87 60 3d 40 38 6a 08 40 e9 37 d0 92 18 05 32 bd c4 a9 59 9f bc 96 b6 33 4d 48 c1 58 2d c6 db 3b 6e 64 7f 0b 00 90 30 e0 1d e3 ab 03 3d fa 23 47 2c 82 b2 75 eb ca 3a e7 f3 2c 02 d2 08 a9 53 53 57 a7 11 3c 00 64 5a 0f 4b ac f9 69 f1 a1 ef 9b e4 01 6e 49 3b 12 26 39 b9 ce 75 f2 79 86 a0 fe bb b4 b4 dd Data Ascii: d,p 4+mvt6m=Cv!CFf9uOl~{,^Q*r2@YO"!yq^R?8v(n2AH)0VSzfDgP'`=@8j@72Y3MHX-;nd0=#G,u:,SSW<dZKinI;&9uy
2024-10-22 14:11:40 UTC	16384	IN	Data Raw: 5e c1 80 db 34 f2 a1 de 7f 6d a4 17 dd de 4e df 4e a4 4f 8e 48 68 6c cc 2c 1f 37 39 4e ca 4d 44 af 4a 71 d2 32 46 00 cb b5 0e 37 01 f6 e2 f6 ed bb f7 f9 a3 5c 1b 29 cb 62 59 da 6a 17 cd 07 95 65 24 bb 86 9b 52 9b a6 8e eb f6 0a e6 05 ea 9d 20 36 9f 54 74 e5 eb 91 05 c8 d0 de b8 27 95 dd 19 ee 0c f6 99 ed eb f0 ed f4 7e 30 97 eb 8d d6 ff b5 d9 a8 65 16 67 0a 99 62 27 be 24 fa 63 1e 5f 0c 07 ff fc aa 56 f7 7c 19 12 5e b8 cf 08 f6 0e a7 ae f2 f1 21 72 e8 aa f4 59 c4 71 fc a1 9b b8 94 aa 24 dc 22 63 42 96 a7 e0 2d 98 ec 49 5b 3d 01 2d bc a8 99 cf f5 e5 8a 5d 33 cf 6d 94 6b 37 6b 01 d7 1f 64 3c 4e 81 e8 e3 b3 8a 1a ee 1d cc b8 7f 5c d8 f7 a5 0f d1 27 73 3e 94 25 db 85 92 7b 49 c4 e0 4d f7 b0 2c 43 55 d8 fe df 52 b4 de 97 b3 c4 0b 97 e3 26 7e 08 3f 4e 3c 6a df Data Ascii: ^4mNNOHhl,79NMDJq2F7\)bYje$R 6Tt'~0egb'$c_V\|^!rYq$"cB-I[=-]3mk7kd<N\'s>%{IM,CUR&~?N<j
2024-10-22 14:11:40 UTC	16384	IN	Data Raw: fa e1 0c 1f c7 5d c5 48 50 e7 80 cd 6c 33 24 8e e9 58 60 c3 72 f2 c4 67 3d 47 c4 fe ec 4f d5 f4 a8 bf 59 3e 11 fb 78 66 2d fe 4e 12 c3 ea 59 7c f6 4f 54 ac 9e f0 6e d3 9b 20 41 7d 8c d8 13 c2 23 b2 03 e8 f4 37 e9 79 8b c1 09 a7 ad ef 00 f3 14 11 3d 09 c1 93 b2 9e 01 f5 82 a0 f7 9b 5e 12 38 f9 1b 55 99 ab 54 a3 fe 76 0c 67 93 f9 8f fe f9 ca 14 a3 20 c7 66 56 23 7a 31 32 07 ad a3 44 88 de 08 52 24 a4 5c ba 94 a0 3a 8a 5c 74 c2 56 e1 14 d6 8e 11 6a ad 2b 3e 9a 37 85 af c2 24 d5 6b a2 e4 89 43 b7 f0 f6 7b 43 99 c1 e8 38 6b ea 0a ac 94 2b b1 c0 d3 cc 3c e0 d2 f3 d1 e3 37 d6 36 fd 94 63 aa f0 7b e8 9e 87 8f de 80 b0 8d e4 82 cc af 93 69 50 2b ec 12 fe 22 8b 0a c5 46 21 32 9f 39 b2 6b 26 0f dd 8b 94 3f 1e c5 25 3f e5 66 9d a3 a4 1f 49 c1 7e ef 6b 4b ef 16 2a 26 Data Ascii: ]HPl3$X`rg=GOY>xf-NY\|OTn A}#7y=^8UTvg fV#z12DR$\:\tVj+>7$kC{C8k+<76c{iP+"F!29k&?%?fI~kK*&
2024-10-22 14:11:40 UTC	16384	IN	Data Raw: 19 e9 e3 26 8a 7f 7f 92 d7 37 c2 eb 21 bf fa 7d 74 a8 6c 52 95 92 db 37 22 48 84 4f 67 76 bb 67 21 c5 b8 8e 6a 47 8a a0 07 60 ea e6 30 1e 7f ae 7a 98 80 4f 47 dd c1 a8 41 4c 90 70 9f c3 9f 0c 4e 41 45 89 e1 9f fe 1f 2f fe 43 0b a8 bb df 44 45 a9 d5 51 11 e9 29 5c 0e 97 54 84 a2 bb f9 3d 73 49 ee 6d 6f b7 77 e1 0a 14 8e 41 21 bf 45 3e 50 7a 36 93 7c fd 25 81 ce 16 64 d6 fb fb 92 3a 97 f8 a0 3f 38 2f 4c 83 2c 10 78 db 2d ec dd d4 e3 69 35 2f c5 32 21 b7 17 c0 9d ee 7b 8c 93 11 8f b5 f7 c9 b4 c2 00 24 bf 1a 5a e5 74 a9 37 e3 39 7b 9f 9e 60 ef a9 ab eb b5 e0 9b 86 8f ad 4c da 2d 52 a0 4f 3f d6 a5 a2 c2 01 f3 b8 3b e6 b5 d6 d2 d2 fe 2b 28 23 0b 9d b7 28 94 05 50 59 66 cc 93 f9 4f fa ae 76 2a 5c bb 6a 41 18 11 02 64 41 19 7c ef d4 5a 2c 58 46 e4 d5 25 f5 c8 bd Data Ascii: &7!}tlR7"HOgvg!jG`0zOGALpNAE/CDEQ)\T=sImowA!E>Pz6\|%d:?8/L,x-i5/2!{$Zt79{`L-RO?;+(#(PYfOv*\jAdA\|Z,XF%
2024-10-22 14:11:40 UTC	16384	IN	Data Raw: 7d ff 90 8d 38 dc 2b ee 57 46 80 3f 2d 37 0b 74 9d 15 0d 29 94 00 f2 a2 ef f1 52 57 0e 02 8b ec 0c aa aa 80 1e 89 dc 1f 25 39 17 5b dc d4 3f 94 8b 30 b7 c9 d1 e4 bc 2f 54 b7 84 90 bd 6e ae 04 17 8f 74 b6 9b 5b 42 63 33 01 7d 9c 1b 81 bf 88 e5 cd 14 ee 14 8f af 11 bd c6 c5 99 7b 88 c5 89 0c 81 34 86 76 82 8c 50 a2 c8 20 84 30 e8 de 35 4c 40 e3 58 3d 76 96 88 d3 8f e2 85 72 3e ae c2 e2 3a 1a 22 60 c6 31 43 46 54 7e ea 24 72 fa bd 44 50 ad dc c8 6c 54 b6 5c 61 f5 24 80 4b b1 88 bd 36 b0 bd 4e 20 4c f3 45 9b de a7 84 6f 20 c8 9a 2b 6b 72 10 7b 8d 95 2e de 22 30 2c 4b da 7a 72 84 83 7a f1 cd a0 24 12 18 96 fc d5 83 2e 3b 73 00 0c 5d 3e dc 87 f9 e6 4b 8b 60 e0 6d d9 19 e2 62 b7 40 3e 52 59 b3 23 fa 9e 8e b7 a6 a4 1f 35 bf 2d 87 4b b6 fe 90 b0 8c 27 2b c3 21 86 Data Ascii: }8+WF?-7t)RW%9[?0/Tnt[Bc3}{4vP 05L@X=vr>:"`1CFT~$rDPlT\a$K6N LEo +kr{."0,Kzrz$.;s]>K`mb@>RY#5-K'+!
2024-10-22 14:11:40 UTC	16384	IN	Data Raw: 8a 6f ff 57 1b 14 4e 78 8e 15 13 ad 49 ea 24 96 5e 84 27 a7 6b 3c b5 f2 4f 73 e0 1e 2f 67 66 bb 84 68 cf b5 87 ef 73 55 6d 03 d7 1a 45 c3 01 cd 3d 2d 09 bc f9 62 d6 33 4f fe 36 59 9a 8a 6f e8 2c de 67 4c 78 10 75 87 85 83 a9 e9 67 12 16 fd 9b a2 c9 fb 8d 9c 34 4e e3 7d c2 da d9 f9 f0 96 c6 3f c8 69 c4 3f aa 1b e1 ba fe bd 80 ab de b9 dd 4e 66 6d e9 e6 1e ce 8c 3d 19 b7 90 9c 46 06 71 25 02 f1 7b c9 c3 59 71 22 3d a7 f3 f0 b2 32 2b bf 71 37 fb fd ee df 14 4f 6b d6 dc 54 a7 d1 e9 c5 82 c9 a9 e9 fa 82 3a 35 f0 0e ac 01 eb c0 8d 0f 11 44 07 4e d0 8c 51 4a 34 a1 92 a8 be 15 dc 37 e3 8d 50 b8 2f e0 db aa 62 c8 d9 9e d6 61 27 33 6f ae a3 e3 b0 26 2a 6c ed 40 0e 67 5f 07 c3 7b d6 97 3d 00 ca 77 77 13 f6 8d 98 2b d2 49 7c 05 d2 fb e1 60 4e 6e fd 33 5f 97 c7 31 f9 Data Ascii: oWNxI$^'k<Os/gfhsUmE=-b3O6Yo,gLxug4N}?i?Nfm=Fq%{Yq"=2+q7OkT:5DNQJ47P/ba'3o&*l@g_{=ww+I\|`Nn3_1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.18	49750	91.220.42.63	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:42 UTC	5926	OUT	GET /r/RriaybGmrgwONwzgO2MWfHO1F3XKarISRjLxdWFL9XTfpkBU58DEKAZvD2MCgNOj_j4DSYforTR9qwVYEIXZ9vgX1U2-QAqxPTdwA00ppsQ3I0PEAGksgw_D88Xbcu-938LX7owv5XD4D4tajr7iuKFr3ovoLy-wx9i8PuUSRC8srb5j8rtR59AW6TCsTLqBv9ArlBYnfQKackbQu2oh7s60TFBqbGaOhOk3E61Ni-TSKVAW6gCOBItKafCPhcsOrE2XBrkygs9LfXm5k72EqW-SQ-byKEw4nxjgLClTGiHS-9KrcZXei-A-5bwM53tgW4ZZp7qOACJQRcfx2T-sgC_a4-qWhBjSBnyBWgG8YlBIO6-ptXKlh_ew8SbFtzyYfQEoGuGnxBOl3pTDf8emhFLGba6waF235cMvP8IBjvXHxPg5VRhI3rP_Q6kb0DV1oE12clGaNL6NcRTfoTRbDlgNeNpbaygalyKjHEFTZv8p_K8x1wsVOAbDJjlVjVIQ7NIi-jvHJvlDlMpY4N6DjUricN81Pln9H-lMiYBef3aP0tfOM9_2YdimImSuUfnrQk0fz1qetdH-ObErarOvR2XgblbA7U-p-CeaQVx0zI7g-rFuT5W3zaB1Ybz8gZPNkqZSprSvLkQ0k14Er3vV6eAAfRb0MRcX6HmFlM-wcjwRpM7ZMp9zHv6uFQd7SYQZp9BB8Kdk3doXQo1XamRjetuzcWnY8uhjkIkmy4STUzoadv_-id4zbJ0QFxEQr67iuQ5PU8gKwqK5Q4Rt_qKVlHrALJ7B2Ods-W8cput7eLvYomJ3QZ6Jn74xbSl7Fz-jWlMv4rpuJP_nLIGmhf5eQf8A9Ks-_NTx6Ex_CBE2Lpp9vxcBkmsbP_Eya2Izz7utKXIhRdY7kNgK43OQLvlCyY1S4R_7xwULN0CftFftssUzf_0Ktam2hgHlQ45UsV_XcrISqJDUUpLTjbLX6gBmuQop0mJdzKyUKZUA5ulZBzwXFQAhV_FE3xkcM [TRUNCATED] Host: url.uk.m.mimecastprotect.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:11:42 UTC	316	IN	HTTP/1.1 307 Temporary Redirect Date: Tue, 22 Oct 2024 14:11:42 GMT Content-Length: 0 Connection: close Location: https://hnamedmr.ukremediatlon.co.uk/LVGwXwqP Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Cache-control: no-store Pragma: no-cache X-Robots-Tag: noindex, nofollow

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.18	49753	172.67.128.229	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:44 UTC	685	OUT	GET /LVGwXwqP HTTP/1.1 Host: hnamedmr.ukremediatlon.co.uk Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:11:44 UTC	806	IN	HTTP/1.1 302 Found Date: Tue, 22 Oct 2024 14:11:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Location: https://www.example.com cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p%2FSmGAn58PyC3GDUlldFrdeTwOY%2BSPu9dYS9s%2Bvyh3GPfoPCi5b4L6YRYb1hygHHea%2Bi%2F0Kzk%2BGoE7616nFFScisa2vAnTDqnDLZtFdYwN5bCavcjUEgKRiAs1PtDB6srniXbkFYzyrUNEhm7uwn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d6a140888436b04-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1211&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=1263&delivery_rate=2375717&cwnd=233&unsent_bytes=0&cid=85accce08d5c07d6&ts=723&x=0"
2024-10-22 14:11:44 UTC	1369	IN	Data Raw: 31 30 38 65 0d 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 64 61 74 61 3a 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 3b 62 61 73 65 36 34 2c 5a 6e 56 75 59 33 52 70 62 32 34 67 59 79 67 70 65 32 6c 6d 4b 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 59 69 49 70 49 48 78 38 49 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 5a 79 49 70 4b 58 74 6b 62 32 4e 31 62 57 56 75 64 43 35 6f 5a 57 46 6b 4c 6d 46 77 63 47 56 75 5a 45 4e 6f 61 57 78 6b 4b 45 39 69 61 6d 56 6a 64 43 35 68 63 33 4e 70 5a 32 34 6f 5a 47 39 6a 64 57 31 6c 62 6e 51 75 59 33 4a 6c 59 58 52 6c 52 57 78 6c 62 57 56 75 64 43 67 69 5a 47 6c 32 49 69 6b 73 65 32 4e 73 59 58 4e 7a Data Ascii: 108e<script src="data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNz
2024-10-22 14:11:44 UTC	1369	IN	Data Raw: 49 43 41 67 61 57 59 6f 62 47 39 6a 59 57 78 54 64 47 39 79 59 57 64 6c 4c 6d 64 6c 64 45 6c 30 5a 57 30 6f 4a 32 31 7a 5a 31 4e 6f 62 33 64 75 4a 79 6b 39 50 54 30 6e 64 48 4a 31 5a 53 63 70 63 6d 56 30 64 58 4a 75 4f 77 6f 4a 49 43 41 67 49 43 38 76 49 43 42 46 65 58 6c 49 64 7a 41 34 61 41 6f 4a 49 43 41 67 49 48 5a 68 63 69 42 30 50 58 4e 6c 64 45 6c 75 64 47 56 79 64 6d 46 73 4b 47 5a 31 62 6d 4e 30 61 57 39 75 4b 43 6c 37 43 67 6b 67 49 43 41 67 49 43 41 67 49 43 38 76 49 43 42 57 57 55 59 79 54 6c 67 30 63 41 6f 4a 49 43 41 67 49 43 41 67 49 43 42 32 59 58 49 67 5a 54 31 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 4a 6b 61 58 5a 62 63 6d 39 73 5a 54 30 6e 61 47 56 68 5a 47 6c 75 5a 79 64 64 57 32 52 Data Ascii: ICAgaWYobG9jYWxTdG9yYWdlLmdldEl0ZW0oJ21zZ1Nob3duJyk9PT0ndHJ1ZScpcmV0dXJuOwoJICAgIC8vICBFeXlIdzA4aAoJICAgIHZhciB0PXNldEludGVydmFsKGZ1bmN0aW9uKCl7CgkgICAgICAgIC8vICBWWUYyTlg0cAoJICAgICAgICB2YXIgZT1kb2N1bWVudC5xdWVyeVNlbGVjdG9yKCJkaXZbcm9sZT0naGVhZGluZyddW2R
2024-10-22 14:11:44 UTC	1369	IN	Data Raw: 32 34 6e 4c 43 64 30 63 6e 56 6c 4a 79 6b 73 43 67 6b 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 76 4c 79 41 67 64 48 70 77 55 6a 46 5a 61 32 45 4b 43 53 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 47 4e 73 5a 57 46 79 53 57 35 30 5a 58 4a 32 59 57 77 6f 64 43 6b 4b 43 53 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 38 76 49 43 42 32 51 6a 42 49 59 33 64 4c 53 67 6f 4a 49 43 41 67 49 43 41 67 49 43 42 39 43 67 6b 67 49 43 41 67 66 53 77 31 4d 44 41 70 43 67 6c 39 4b 54 73 4b 43 67 6c 6d 64 57 35 6a 64 47 6c 76 62 69 42 73 63 43 67 70 65 77 6f 4a 49 43 41 67 49 43 38 76 49 43 42 5a 52 30 59 77 61 54 68 52 43 67 6b 67 49 43 41 67 64 6d 46 79 49 47 38 39 5a 47 39 6a 64 57 31 6c 62 6e 51 75 63 58 56 6c 63 6e 6c 54 5a 57 78 6c 59 33 52 76 63 69 67 69 Data Ascii: 24nLCd0cnVlJyksCgkgICAgICAgICAgICAvLyAgdHpwUjFZa2EKCSAgICAgICAgICAgIGNsZWFySW50ZXJ2YWwodCkKCSAgICAgICAgICAgIC8vICB2QjBIY3dLSgoJICAgICAgICB9CgkgICAgfSw1MDApCgl9KTsKCglmdW5jdGlvbiBscCgpewoJICAgIC8vICBZR0YwaThRCgkgICAgdmFyIG89ZG9jdW1lbnQucXVlcnlTZWxlY3Rvcigi
2024-10-22 14:11:44 UTC	139	IN	Data Raw: 6c 47 4d 6b 35 59 4e 48 41 4b 43 53 41 67 49 43 41 67 49 43 41 67 66 51 6f 4a 49 43 41 67 49 48 30 4b 43 53 41 67 49 43 42 7a 5a 58 52 55 61 57 31 6c 62 33 56 30 4b 47 78 77 4c 44 55 77 4d 43 6b 4b 43 53 41 67 49 43 41 76 4c 79 41 67 63 31 68 6c 54 58 4e 6c 65 46 67 4b 43 58 30 4b 43 58 4e 6c 64 46 52 70 62 57 56 76 64 58 51 6f 62 48 41 73 4e 54 41 77 4b 54 73 4b 43 67 3d 3d 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a Data Ascii: lGMk5YNHAKCSAgICAgICAgfQoJICAgIH0KCSAgICBzZXRUaW1lb3V0KGxwLDUwMCkKCSAgICAvLyAgc1hlTXNleFgKCX0KCXNldFRpbWVvdXQobHAsNTAwKTsKCg=="></script>
2024-10-22 14:11:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.18	49754	93.184.215.14	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:45 UTC	664	OUT	GET / HTTP/1.1 Host: www.example.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:11:45 UTC	361	IN	HTTP/1.1 200 OK Age: 415710 Cache-Control: max-age=604800 Content-Type: text/html; charset=UTF-8 Date: Tue, 22 Oct 2024 14:11:45 GMT Etag: "3147526947+gzip+ident" Expires: Tue, 29 Oct 2024 14:11:45 GMT Last-Modified: Thu, 17 Oct 2019 07:18:26 GMT Server: ECAcc (dad/5F8E) Vary: Accept-Encoding X-Cache: HIT Content-Length: 1256 Connection: close
2024-10-22 14:11:45 UTC	1256	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 45 78 61 6d 70 6c 65 20 44 6f 6d 61 69 6e 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 Data Ascii: <!doctype html><html><head> <title>Example Domain</title> <meta charset="utf-8" /> <meta http-equiv="Content-type" content="text/html; charset=utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1" /> <style t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.18	49755	93.184.215.14	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 14:11:46 UTC	586	OUT	GET /favicon.ico HTTP/1.1 Host: www.example.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.example.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-22 14:11:46 UTC	357	IN	HTTP/1.1 404 Not Found Age: 291460 Cache-Control: max-age=604800 Content-Type: text/html Date: Tue, 22 Oct 2024 14:11:46 GMT Etag: "1088432560+gzip+ident" Expires: Tue, 29 Oct 2024 14:11:46 GMT Last-Modified: Sat, 12 Oct 2024 03:26:51 GMT Server: ECAcc (dad/5FB0) Vary: Accept-Encoding X-Cache: 404-HIT Content-Length: 1256 Connection: close
2024-10-22 14:11:46 UTC	1256	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 45 78 61 6d 70 6c 65 20 44 6f 6d 61 69 6e 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 Data Ascii: <!doctype html><html><head> <title>Example Domain</title> <meta charset="utf-8" /> <meta http-equiv="Content-type" content="text/html; charset=utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1" /> <style t

Target ID:	0
Start time:	10:09:42
Start date:	22/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\[EXTERNAL] Re_ Quotes.eml"
Imagebase:	0xe60000
File size:	34'446'744 bytes
MD5 hash:	91A5292942864110ED734005B7E005C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	10:09:46
Start date:	22/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "0F810BE9-1EE3-4005-871B-CC3AF9EB26A5" "EB03CE19-C594-4EA9-AD58-197437118574" "740" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Imagebase:	0x7ff7d7c00000
File size:	710'048 bytes
MD5 hash:	EC652BEDD90E089D9406AFED89A8A8BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	10:10:50
Start date:	22/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://url.uk.m.mimecastprotect.com/s/ZlrZCZYQ9UxMnWNsysRFBA-ZP?domain=hnamedmr.ukremediatlon.co.uk
Imagebase:	0x7ff728d30000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	10:10:52
Start date:	22/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1944,i,1824875940929507423,6371601856566642731,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff728d30000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report [EXTERNAL] Re_ Quotes.eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\2D84364F.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\4B113C04.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\57E1933D.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\61A89A06.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\87B2ED2C.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\8A2DA435.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B813C81A.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\BCC1D738.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\C5458553.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\D6103DD9.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{5E8782E3-8D4A-45DD-A929-A96DB03A977F}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729606183002160900_0A09A35D-7331-45A2-8597-74C0710D4482.log

Windows Analysis Report
[EXTERNAL] Re_ Quotes.eml