Edit tour

Windows Analysis Report
http://3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com

Overview

General Information

Sample URL:	http://3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com
Analysis ID:	1541327
Infos:

Detection

Score:	23
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Performs DNS queries with encoded ASCII data (may be used to data exfiltration)

Detected hidden input values containing email addresses (often used in phishing pages)

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

HTTP GET or POST without a user agent

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6908 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 7096 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=2040,i,5767944486962329334,844409809218667319,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 5188 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZFPTNNgGMb7raNuOGVyIvFiGk_Ebm2_rv26BE3dGDg29g8HaKTpvrasuK5l7cYc4WJCQjyReDCBk4YTJ-LBmBkTEz3hhTMnjoSDGk8cPLjpxaNP3jx5kvfyvr9nkuRiXPI2-1c8M3SGNU2OwcYw_aPW-Gj0eefgNbyR78_Vii_uTWR-7YGw2rA6Rgw79nsATgA4B-AwIIkQiQmIWJnjJR7xCKIYErFgIE5iJIQgIyAoMzVWMhhNGCykmmYIMjwNjBWUtl_nh-a0rJ7xMxA2nZatuo7n75Er6WX__rSjrKbzlbm1POOWMh0X1bsbhdkOy6haaSmdzZazlfQDdpUrzwtVtVp7yOJSRvEWM6pfn8HwkcJrqXRVXZpnn-UE22_PuM21ImqKPVU5JP8LxFuSGrxrO81jknJco2npJ0FwFgQXwQhLJkOh0SgxQdwiLoPgzciA2e7Xu1--r-zPvFTlg_3tm8TxSBxne_W0hvPlRS-fW89uVFqLPTallIqKmKik4pKfg9MLprIMbTwlJbldCuxSVJ8Kh8goQZOpIndOgR8U2LlC9MOpuu-7XjIeh9qQtI7EwdRwQmdFQRM5KAoJWYYJHcVMN2YbmtduGTHHNC38p7W4s6HFT66Cowg4jQijFG5olu2NT27Slq76zlOjSSc36a7tqRgPU0drtA2PTj6mB2fQT7a2tj5dIy6vf_i8_e7Vzsdvsxdjd1rVgmtl-DW97In2AuTlRsa0utW2WODKXdSbLc0rentBqq1LpamjKHEWJX4D0&estsfed=1&uaid=a1a476821133ba4d4b62508a3f1846fc&cobrandid=deb3f74a-ed5b-4ef1-8d3c-92b85dd47352&fci=00000002-0000-0ff1-ce00-000000000000&username=test%40test.com&login_hint=test%40test.com

HTTP Parser: test@test.com

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A&sso_reload=true	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/login	HTTP Parser: Number of links: 1

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A&sso_reload=true	HTTP Parser: Title: Sign in to Outlook does not match URL
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZFPTNNgGMb7raNuOGVyIvFiGk_Ebm2_rv26BE3dGDg29g8HaKTpvrasuK5l7cYc4WJCQjyReDCBk4YTJ-LBmBkTEz3hhTMnjoSDGk8cPLjpxaNP3jx5kvfyvr9nkuRiXPI2-1c8M3SGNU2OwcYw_aPW-Gj0eefgNbyR78_Vii_uTWR-7YGw2rA6Rgw79nsATgA4B-AwIIkQiQmIWJnjJR7xCKIYErFgIE5iJIQgIyAoMzVWMhhNGCykmmYIMjwNjBWUtl_nh-a0rJ7xMxA2nZatuo7n75Er6WX__rSjrKbzlbm1POOWMh0X1bsbhdkOy6haaSmdzZazlfQDdpUrzwtVtVp7yOJSRvEWM6pfn8HwkcJrqXRVXZpnn-UE22_PuM21ImqKPVU5JP8LxFuSGrxrO81jknJco2npJ0FwFgQXwQhLJkOh0SgxQdwiLoPgzciA2e7Xu1--r-zPvFTlg_3tm8TxSBxne_W0hvPlRS-fW89uVFqLPTallIqKmKik4pKfg9MLprIMbTwlJbldCuxSVJ8Kh8goQZOpIndOgR8U2LlC9MOpuu-7XjIeh9qQtI7EwdRwQmdFQRM5KAoJWYYJHcVMN2YbmtduGTHHNC38p7W4s6HFT66Cowg4jQijFG5olu2NT27Slq76zlOjSSc36a7tqRgPU0drtA2PTj6mB2fQT7a2tj5dIy6vf_i8_e7Vzsdvsxdjd1rVgmtl-DW97In2AuTlRsa0utW2WO...	HTTP Parser: Title: Sign in to your Microsoft account does not match URL
Source: https://login.live.com/ppsecure/post.srf?username=test%40test.com&client_id=51483342-085c-4d86-bf88-cf50c7252078&cobrandid=deb3f74a-ed5b-4ef1-8d3c-92b85dd47352&contextid=BCFFA89199F39A66&opid=011F4B69C481BA5B&bk=1729784148&uaid=a1a476821133ba4d4b62508a3f1846fc&pid=15216	HTTP Parser: Title: Sign in to your Microsoft account does not match URL
Source: https://login.microsoftonline.com/common/login	HTTP Parser: Title: Sign in to Outlook does not match URL

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZFPTNNgGMb7raNuOGVyIvFiGk_Ebm2_rv26BE3dGDg29g8HaKTpvrasuK5l7cYc4WJCQjyReDCBk4YTJ-LBmBkTEz3hhTMnjoSDGk8cPLjpxaNP3jx5kvfyvr9nkuRiXPI2-1c8M3SGNU2OwcYw_aPW-Gj0eefgNbyR78_Vii_uTWR-7YGw2rA6Rgw79nsATgA4B-AwIIkQiQmIWJnjJR7xCKIYErFgIE5iJIQgIyAoMzVWMhhNGCykmmYIMjwNjBWUtl_nh-a0rJ7xMxA2nZatuo7n75Er6WX__rSjrKbzlbm1POOWMh0X1bsbhdkOy6haaSmdzZazlfQDdpUrzwtVtVp7yOJSRvEWM6pfn8HwkcJrqXRVXZpnn-UE22_PuM21ImqKPVU5JP8LxFuSGrxrO81jknJco2npJ0FwFgQXwQhLJkOh0SgxQdwiLoPgzciA2e7Xu1--r-zPvFTlg_3tm8TxSBxne_W0hvPlRS-fW89uVFqLPTallIqKmKik4pKfg9MLprIMbTwlJbldCuxSVJ8Kh8goQZOpIndOgR8U2LlC9MOpuu-7XjIeh9qQtI7EwdRwQmdFQRM5KAoJWYYJHcVMN2YbmtduGTHHNC38p7W4s6HFT66Cowg4jQijFG5olu2NT27Slq76zlOjSSc36a7tqRgPU0drtA2PTj6mB2fQT7a2tj5dIy6vf_i8_e7Vzsdvsxdjd1rVgmtl-DW97In2AuTlRsa0utW2WO...	HTTP Parser: Iframe src: https://fpt.live.com?session_id=a1a476821133ba4d4b62508a3f1846fc&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SI
Source: https://login.live.com/ppsecure/post.srf?username=test%40test.com&client_id=51483342-085c-4d86-bf88-cf50c7252078&cobrandid=deb3f74a-ed5b-4ef1-8d3c-92b85dd47352&contextid=BCFFA89199F39A66&opid=011F4B69C481BA5B&bk=1729784148&uaid=a1a476821133ba4d4b62508a3f1846fc&pid=15216	HTTP Parser: Iframe src: https://fpt.live.com?session_id=a1a476821133ba4d4b62508a3f1846fc&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SI
Source: https://login.live.com/ppsecure/post.srf?username=test%40test.com&client_id=51483342-085c-4d86-bf88-cf50c7252078&cobrandid=deb3f74a-ed5b-4ef1-8d3c-92b85dd47352&contextid=BCFFA89199F39A66&opid=011F4B69C481BA5B&bk=1729784148&uaid=a1a476821133ba4d4b62508a3f1846fc&pid=15216	HTTP Parser: Iframe src: https://fpt.live.com?session_id=a1a476821133ba4d4b62508a3f1846fc&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SI
Source: https://login.microsoftonline.com/common/login	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://login.microsoftonline.com/common/login	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://login.microsoftonline.com/common/login	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://login.microsoftonline.com/common/login	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://login.microsoftonline.com/common/login	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A&sso_reload=true	HTTP Parser: <input type="password" .../> found
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZFPTNNgGMb7raNuOGVyIvFiGk_Ebm2_rv26BE3dGDg29g8HaKTpvrasuK5l7cYc4WJCQjyReDCBk4YTJ-LBmBkTEz3hhTMnjoSDGk8cPLjpxaNP3jx5kvfyvr9nkuRiXPI2-1c8M3SGNU2OwcYw_aPW-Gj0eefgNbyR78_Vii_uTWR-7YGw2rA6Rgw79nsATgA4B-AwIIkQiQmIWJnjJR7xCKIYErFgIE5iJIQgIyAoMzVWMhhNGCykmmYIMjwNjBWUtl_nh-a0rJ7xMxA2nZatuo7n75Er6WX__rSjrKbzlbm1POOWMh0X1bsbhdkOy6haaSmdzZazlfQDdpUrzwtVtVp7yOJSRvEWM6pfn8HwkcJrqXRVXZpnn-UE22_PuM21ImqKPVU5JP8LxFuSGrxrO81jknJco2npJ0FwFgQXwQhLJkOh0SgxQdwiLoPgzciA2e7Xu1--r-zPvFTlg_3tm8TxSBxne_W0hvPlRS-fW89uVFqLPTallIqKmKik4pKfg9MLprIMbTwlJbldCuxSVJ8Kh8goQZOpIndOgR8U2LlC9MOpuu-7XjIeh9qQtI7EwdRwQmdFQRM5KAoJWYYJHcVMN2YbmtduGTHHNC38p7W4s6HFT66Cowg4jQijFG5olu2NT27Slq76zlOjSSc36a7tqRgPU0drtA2PTj6mB2fQT7a2tj5dIy6vf_i8_e7Vzsdvsxdjd1rVgmtl-DW97In2AuTlRsa0utW2WO...	HTTP Parser: <input type="password" .../> found
Source: https://login.microsoftonline.com/common/login	HTTP Parser: <input type="password" .../> found

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A	HTTP Parser: No favicon
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZFPTNNgGMb7raNuOGVyIvFiGk_Ebm2_rv26BE3dGDg29g8HaKTpvrasuK5l7cYc4WJCQjyReDCBk4YTJ-LBmBkTEz3hhTMnjoSDGk8cPLjpxaNP3jx5kvfyvr9nkuRiXPI2-1c8M3SGNU2OwcYw_aPW-Gj0eefgNbyR78_Vii_uTWR-7YGw2rA6Rgw79nsATgA4B-AwIIkQiQmIWJnjJR7xCKIYErFgIE5iJIQgIyAoMzVWMhhNGCykmmYIMjwNjBWUtl_nh-a0rJ7xMxA2nZatuo7n75Er6WX__rSjrKbzlbm1POOWMh0X1bsbhdkOy6haaSmdzZazlfQDdpUrzwtVtVp7yOJSRvEWM6pfn8HwkcJrqXRVXZpnn-UE22_PuM21ImqKPVU5JP8LxFuSGrxrO81jknJco2npJ0FwFgQXwQhLJkOh0SgxQdwiLoPgzciA2e7Xu1--r-zPvFTlg_3tm8TxSBxne_W0hvPlRS-fW89uVFqLPTallIqKmKik4pKfg9MLprIMbTwlJbldCuxSVJ8Kh8goQZOpIndOgR8U2LlC9MOpuu-7XjIeh9qQtI7EwdRwQmdFQRM5KAoJWYYJHcVMN2YbmtduGTHHNC38p7W4s6HFT66Cowg4jQijFG5olu2NT27Slq76zlOjSSc36a7tqRgPU0drtA2PTj6mB2fQT7a2tj5dIy6vf_i8_e7Vzsdvsxdjd1rVgmtl-DW97In2AuTlRsa0utW2WO...	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/login	HTTP Parser: No favicon

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZFPTNNgGMb7raNuOGVyIvFiGk_Ebm2_rv26BE3dGDg29g8HaKTpvrasuK5l7cYc4WJCQjyReDCBk4YTJ-LBmBkTEz3hhTMnjoSDGk8cPLjpxaNP3jx5kvfyvr9nkuRiXPI2-1c8M3SGNU2OwcYw_aPW-Gj0eefgNbyR78_Vii_uTWR-7YGw2rA6Rgw79nsATgA4B-AwIIkQiQmIWJnjJR7xCKIYErFgIE5iJIQgIyAoMzVWMhhNGCykmmYIMjwNjBWUtl_nh-a0rJ7xMxA2nZatuo7n75Er6WX__rSjrKbzlbm1POOWMh0X1bsbhdkOy6haaSmdzZazlfQDdpUrzwtVtVp7yOJSRvEWM6pfn8HwkcJrqXRVXZpnn-UE22_PuM21ImqKPVU5JP8LxFuSGrxrO81jknJco2npJ0FwFgQXwQhLJkOh0SgxQdwiLoPgzciA2e7Xu1--r-zPvFTlg_3tm8TxSBxne_W0hvPlRS-fW89uVFqLPTallIqKmKik4pKfg9MLprIMbTwlJbldCuxSVJ8Kh8goQZOpIndOgR8U2LlC9MOpuu-7XjIeh9qQtI7EwdRwQmdFQRM5KAoJWYYJHcVMN2YbmtduGTHHNC38p7W4s6HFT66Cowg4jQijFG5olu2NT27Slq76zlOjSSc36a7tqRgPU0drtA2PTj6mB2fQT7a2tj5dIy6vf_i8_e7Vzsdvsxdjd1rVgmtl-DW97In2AuTlRsa0utW2WO	HTTP Parser: No <meta name="author".. found
Source: https://login.live.com/ppsecure/post.srf?username=test%40test.com&client_id=51483342-085c-4d86-bf88-cf50c7252078&cobrandid=deb3f74a-ed5b-4ef1-8d3c-92b85dd47352&contextid=BCFFA89199F39A66&opid=011F4B69C481BA5B&bk=1729784148&uaid=a1a476821133ba4d4b62508a3f1846fc&pid=15216	HTTP Parser: No <meta name="author".. found
Source: https://login.live.com/ppsecure/post.srf?username=test%40test.com&client_id=51483342-085c-4d86-bf88-cf50c7252078&cobrandid=deb3f74a-ed5b-4ef1-8d3c-92b85dd47352&contextid=BCFFA89199F39A66&opid=011F4B69C481BA5B&bk=1729784148&uaid=a1a476821133ba4d4b62508a3f1846fc&pid=15216	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/login	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/login	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/login	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/login	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/login	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/login	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/login	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/login	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZFPTNNgGMb7raNuOGVyIvFiGk_Ebm2_rv26BE3dGDg29g8HaKTpvrasuK5l7cYc4WJCQjyReDCBk4YTJ-LBmBkTEz3hhTMnjoSDGk8cPLjpxaNP3jx5kvfyvr9nkuRiXPI2-1c8M3SGNU2OwcYw_aPW-Gj0eefgNbyR78_Vii_uTWR-7YGw2rA6Rgw79nsATgA4B-AwIIkQiQmIWJnjJR7xCKIYErFgIE5iJIQgIyAoMzVWMhhNGCykmmYIMjwNjBWUtl_nh-a0rJ7xMxA2nZatuo7n75Er6WX__rSjrKbzlbm1POOWMh0X1bsbhdkOy6haaSmdzZazlfQDdpUrzwtVtVp7yOJSRvEWM6pfn8HwkcJrqXRVXZpnn-UE22_PuM21ImqKPVU5JP8LxFuSGrxrO81jknJco2npJ0FwFgQXwQhLJkOh0SgxQdwiLoPgzciA2e7Xu1--r-zPvFTlg_3tm8TxSBxne_W0hvPlRS-fW89uVFqLPTallIqKmKik4pKfg9MLprIMbTwlJbldCuxSVJ8Kh8goQZOpIndOgR8U2LlC9MOpuu-7XjIeh9qQtI7EwdRwQmdFQRM5KAoJWYYJHcVMN2YbmtduGTHHNC38p7W4s6HFT66Cowg4jQijFG5olu2NT27Slq76zlOjSSc36a7tqRgPU0drtA2PTj6mB2fQT7a2tj5dIy6vf_i8_e7Vzsdvsxdjd1rVgmtl-DW97In2AuTlRsa0utW2WO...	HTTP Parser: No <meta name="copyright".. found
Source: https://login.live.com/ppsecure/post.srf?username=test%40test.com&client_id=51483342-085c-4d86-bf88-cf50c7252078&cobrandid=deb3f74a-ed5b-4ef1-8d3c-92b85dd47352&contextid=BCFFA89199F39A66&opid=011F4B69C481BA5B&bk=1729784148&uaid=a1a476821133ba4d4b62508a3f1846fc&pid=15216	HTTP Parser: No <meta name="copyright".. found
Source: https://login.live.com/ppsecure/post.srf?username=test%40test.com&client_id=51483342-085c-4d86-bf88-cf50c7252078&cobrandid=deb3f74a-ed5b-4ef1-8d3c-92b85dd47352&contextid=BCFFA89199F39A66&opid=011F4B69C481BA5B&bk=1729784148&uaid=a1a476821133ba4d4b62508a3f1846fc&pid=15216	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/login	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/login	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/login	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/login	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/login	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/login	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/login	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/login	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.177:443 -> 192.168.2.17:49823 version: TLS 1.2

Networking

Performs DNS queries with encoded ASCII data (may be used to data exfiltration)

Source: unknown	DNS traffic detected with encoded ASCII: query: 3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com; decoded parts: :((m]Ja6E5
Source: unknown	DNS traffic detected with encoded ASCII: query: 3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com; decoded parts: :((m]Ja6E5
Source: unknown	DNS traffic detected with encoded ASCII: query: 3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com; decoded parts: :((m]Ja6E5
Source: unknown	DNS traffic detected with encoded ASCII: query: 3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com; decoded parts: :((m]Ja6E5

Source: global traffic

HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=73s5fwxgyy7g2cX&MD=3SepasZF HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_nin8k2ycrbzww8zl5vxkaq2.css HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_QLF_8apNRJD3OCol8jwtxw2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_QLF_8apNRJD3OCol8jwtxw2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_QLF_8apNRJD3OCol8jwtxw2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /owa/prefetch.aspx HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/appbackgrounds/49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc2e13.jpg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/appbackgrounds/49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc2e13.jpg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pidpdisambiguation_8e15caf4c90cec4857ee.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pidpdisambiguation_8e15caf4c90cec4857ee.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_account_aad_a8332c62695d74843a11daf39a74e552.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_account_msa_3b879963b4f70829fd7a25cbc9519792.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_account_aad_a8332c62695d74843a11daf39a74e552.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_account_msa_3b879963b4f70829fd7a25cbc9519792.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/js/login_en_-dc6Oo3iAoBIzmNJ3pErjQ2.js HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/js/login_en_-dc6Oo3iAoBIzmNJ3pErjQ2.js HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/chunks/oneds-analytics-js_077217740c853b5d4fe8.js HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/2_bc3d32a696895f78c19d.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/2_bc3d32a696895f78c19d.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/chunks/oneds-analytics-js_077217740c853b5d4fe8.js HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=73s5fwxgyy7g2cX&MD=3SepasZF HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /16.000.30389.5/images/favicon.ico HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16.000.30389.5/images/favicon.ico HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_QLF_8apNRJD3OCol8jwtxw2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: -240X-DeviceID: 01000A41090080B6X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDoAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAARNP6WICFWQ2dz8Am%2BFFwugI99GhmRQUxNmmaiBtCXOSVhF4I9Gr17YCgE2faFnAw0puC%2Bf23qaO2OeyKPnLhOW6GEkaYDCM%2BqR3YdCibnQy1X8VxPE642r9t4uDjQXiuh3dHw0viEvx5DXO4u4twZDhCyrgeWcX/8Mh2kaHwn2t501EYdyLm2td3JLRDJ3z6ixmCo443IyS2rXA7o5dqKdxIWPRP0NMiZugCYInQVOhEbkd3QHXYeVmzqm7kUT1WM%2BENilDTfkv1Qv8PXDNLmFeACCY7sitrMKfwYkQ61DVFEWqVN/qADveBIjh2PasuHW0P/djIFkjK5BiD7wWalQQZgAAEDiVLv9PDWDHUvWpNgGjbe2wAfVXp/1ZuTlQmxUAxa3uenMZbBfHMJVH1WMJRSzxtui30DDNk3JAZT2BUafUlW8h49ntpQfNKhc2N0g/3hgBTNVC6KSfKa0aeFapQyBfC/GfC/hDp4zQPjfMq2SiLSw2njmmS8jH1RtFii9BgxbKmQhLL0LffYHVBkq2F3X7KFMFHZ1UDHMY0QFwinAVYSnRuLcN5zzru5PsC1JVOLMStpHVXJpckpLKti7DUEz2yf9URtC5Y2ejDwNhPORLxSMOzdgDZecjNOafanutlGis082WRxDA4m7ncX9VBA8rwPcKwEet6afxJxT7r%2BXEsb4iYLD8ESzpXNQ7Lg31gjghFDLJxFA3rDQd3fkG8sGBwLeuFn%2BZ38xLYU2tSL2N/Grn9n1cK5E5oEYPrhqSyLoZ6hzTIFHnHkzwW3bBZ9yr/wc93RNsUGP/88CBL5oOd7vXqaRw0XVfVyUAEUPvhWFriGibJaKUYtsOPw4KLqUTtSKvpZjnEpkJy/TC5RpSCSOYMZ3xFa2ZJXh9qGkcJjPVbd4jBD6Kw8DxsFfxbx7MeLqYfchjbZHAdKJUtF89raJdl9oB%26p%3DX-Agent-DeviceId: 01000A41090080B6X-BM-CBT: 1729784162User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: A23938E08D0145AE838779E8D90F3F5AX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_QLF_8apNRJD3OCol8jwtxw2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /owa/prefetch.aspx HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ClientId=0C6D15CADB384F3688AA45313AB12D6B; OIDC=1
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_89db715e3340a2e8ecd8.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_89db715e3340a2e8ecd8.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/arrow_left_43280e0ba671a1d8b5e34f1931c4fe4b.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/arrow_left_43280e0ba671a1d8b5e34f1931c4fe4b.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /owa/prefetch.aspx HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ClientId=0C6D15CADB384F3688AA45313AB12D6B; OIDC=1
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_DQTmGfOEMmPUR-Vehc8U6Q2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_DQTmGfOEMmPUR-Vehc8U6Q2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /owa/prefetch.aspx HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ClientId=0C6D15CADB384F3688AA45313AB12D6B; OIDC=1
Source: global traffic	HTTP traffic detected: GET /owa/prefetch.aspx HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ClientId=0C6D15CADB384F3688AA45313AB12D6B; OIDC=1
Source: global traffic	HTTP traffic detected: GET /owa/prefetch.aspx HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ClientId=0C6D15CADB384F3688AA45313AB12D6B; OIDC=1
Source: global traffic	HTTP traffic detected: GET /owa/prefetch.aspx HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ClientId=0C6D15CADB384F3688AA45313AB12D6B; OIDC=1
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedError_Core_e44ULT7v2HGQHqHgp6vqIA2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.error.strings-en.min_v1eniakvll_1x20aakd_sg2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergederror_customizationloader_7e45d168059bd2885d00.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.error.strings-en.min_v1eniakvll_1x20aakd_sg2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedError_Core_e44ULT7v2HGQHqHgp6vqIA2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/check_small_48540c930333871c385fcba2c659ccdb.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergederror_customizationloader_7e45d168059bd2885d00.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/close_790189870c9543725dc3f5a15fb25e46.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergederror_stringcustomizationhelper_a7fa53f8687b4e38205f.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/check_small_48540c930333871c385fcba2c659ccdb.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/close_790189870c9543725dc3f5a15fb25e46.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergederror_stringcustomizationhelper_a7fa53f8687b4e38205f.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: 3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: outlook.office365.com
Source: global traffic	DNS traffic detected: DNS query: r4.res.office365.com
Source: global traffic	DNS traffic detected: DNS query: acctcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: logincdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: fpt.live.com
Source: global traffic	DNS traffic detected: DNS query: account.live.com
Source: global traffic	DNS traffic detected: DNS query: passwordreset.microsoftonline.com

Source: chromecache_155.1.dr	String found in binary or memory: http://github.com/jquery/globalize
Source: chromecache_225.1.dr, chromecache_174.1.dr, chromecache_230.1.dr, chromecache_143.1.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_225.1.dr, chromecache_174.1.dr, chromecache_230.1.dr, chromecache_143.1.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_225.1.dr, chromecache_174.1.dr, chromecache_230.1.dr, chromecache_143.1.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_137.1.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_137.1.dr	String found in binary or memory: https://login.windows-ppe.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.177:443 -> 192.168.2.17:49823 version: TLS 1.2

Source: classification engine

Classification label: sus23.troj.win@23/165@40/9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=2040,i,5767944486962329334,844409809218667319,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=2040,i,5767944486962329334,844409809218667319,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	1 Exfiltration Over Alternative Protocol	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Data Encoding	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	1 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
http://knockoutjs.com/	0%	URL Reputation	safe
https://login.microsoftonline.com	0%	URL Reputation	safe
http://www.opensource.org/licenses/mit-license.php)	0%	URL Reputation	safe
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0044.t-0009.fb-t-msedge.net	13.107.253.72	true	false	unknown
sni1gl.wpc.alphacdn.net	152.199.21.175	true	false	unknown
sni1gl.wpc.omegacdn.net	152.199.21.175	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
s-part-0017.t-0009.fb-t-msedge.net	13.107.253.45	true	false	unknown
www.google.com	142.250.185.132	true	false	unknown
HHN-efz.ms-acdc.office.com	52.98.152.194	true	false	unknown
s-part-0039.t-0009.fb-t-msedge.net	13.107.253.67	true	false	unknown
passwordreset.microsoftonline.com	unknown	unknown	true	unknown
identity.nel.measure.office.net	unknown	unknown	true	unknown
r4.res.office365.com	unknown	unknown	true	unknown
aadcdn.msftauth.net	unknown	unknown	true	unknown
logincdn.msftauth.net	unknown	unknown	true	unknown
login.microsoftonline.com	unknown	unknown	true	unknown
fpt.live.com	unknown	unknown	true	unknown
account.live.com	unknown	unknown	true	unknown
3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com	unknown	unknown	true	unknown
acctcdn.msftauth.net	unknown	unknown	true	unknown
outlook.office365.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A&sso_reload=true	false		unknown
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=a1a47682-1133-ba4d-4b62-508a3f1846fc&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638653809127282838.86c4e817-7883-4839-b07e-a46c47bae493&state=DYtBEoAgDMSKjM-pQFvp8hxwOHv0-_aQXDJJRJSDI0g1RN4V_VbU0cQFAsWF_thGc3ZA2aCDV_XN0yL4mtuGpnjP8n6z_A	false		unknown
https://login.microsoftonline.com/common/login	false		unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js	false	URL Reputation: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_QLF_8apNRJD3OCol8jwtxw2.js	false		unknown
https://outlook.office365.com/owa/prefetch.aspx	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://github.com/jquery/globalize	chromecache_155.1.dr	false		unknown
http://knockoutjs.com/	chromecache_225.1.dr, chromecache_174.1.dr, chromecache_230.1.dr, chromecache_143.1.dr	false	URL Reputation: safe	unknown
https://login.microsoftonline.com	chromecache_137.1.dr	false	URL Reputation: safe	unknown
http://www.opensource.org/licenses/mit-license.php)	chromecache_225.1.dr, chromecache_174.1.dr, chromecache_230.1.dr, chromecache_143.1.dr	false	URL Reputation: safe	unknown
https://github.com/douglascrockford/JSON-js	chromecache_225.1.dr, chromecache_174.1.dr, chromecache_230.1.dr, chromecache_143.1.dr	false		unknown
https://login.windows-ppe.net	chromecache_137.1.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.98.152.194	HHN-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.253.45	s-part-0017.t-0009.fb-t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.253.67	s-part-0039.t-0009.fb-t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
152.199.21.175	sni1gl.wpc.alphacdn.net	United States	15133	EDGECASTUS	false
52.98.152.242	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.17

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541327
Start date and time:	2024-10-24 17:34:34 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus23.troj.win@23/165@40/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, TextInputHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.67, 142.250.185.174, 64.233.167.84, 40.99.9.82, 40.100.55.2, 52.98.33.130, 52.98.90.2, 52.98.71.50, 52.98.50.18, 52.98.84.82, 52.98.90.178, 52.98.50.66, 52.98.40.34, 52.98.65.18, 52.98.70.130, 52.98.66.98, 34.104.35.123, 40.126.32.76, 20.190.160.14, 40.126.32.136, 20.190.160.17, 40.126.32.72, 20.190.160.22, 40.126.32.74, 40.126.32.138, 192.229.221.95, 2.16.164.19, 2.16.164.49, 20.190.159.71, 20.190.159.75, 40.126.31.71, 20.190.159.73, 20.190.159.4, 20.190.159.64, 40.126.31.67, 40.126.31.73, 23.38.98.96, 23.38.98.104, 20.190.160.20, 40.126.32.134, 40.126.32.133, 142.250.185.74, 142.250.186.170, 216.58.206.42, 142.250.186.106, 216.58.212.170, 216.58.206.74, 142.250.184.234, 172.217.16.202, 142.250.185.106, 142.250.186.42, 142.250.184.202, 142.250.185.138, 172.217.18.106, 142.250.185.202, 142.250.185.234, 172.217.18.10, 40.126.32.140, 52.167.30.171, 142.250.181.234, 172.217.16.138, 142.250.185.170, 142.250.186.74, 142.250.186.138, 40.126.32.68, 51.11.192.48,
Excluded domains from analysis (whitelisted): greenid-prod-pme.eastus2.cloudapp.azure.com, azurefd-t-fb-prod.trafficmanager.net, lgincdnmsftuswe2.azureedge.net, pme-greenid-prod.trafficmanager.net, slscr.update.microsoft.com, na.privatelink.msidentity.com, clientservices.googleapis.com, browser.events.data.trafficmanager.net, ak.privatelink.msidentity.com, clients2.google.com, ocsp.digicert.com, login.live.com, update.googleapis.com, acctcdnvzeuno.azureedge.net, acctcdnvzeuno.ec.azureedge.net, www.bing.com, e40491.dscg.akamaiedge.net, fpt2.microsoft.com, fs.microsoft.com, acctcdnmsftuswe2.azureedge.net, content-autofill.googleapis.com, aadcdnoriginwus2.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, lgincdnvzeuno.ec.azureedge.net, aadcdn.msauth.net, www.googleapis.com, onedscolprdfrc01.francecentral.cloudapp.azure.com, edgedl.me.gvt1.com, nel.measure.office.net.edgesuite.net, www.tm.f.prd.aadg.trafficmanager.net, aadcdnoriginwus2.afd.azureedge.net, account.msa.msidentity.com, clients.l.google.com, fpt.microso
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com

Input	Output
URL: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Sign in to continue to Outlook", "prominent_button_name": "Next", "text_input_field_labels": [ "Email, phone, or Skype" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft" ] }
	```json { "brands": [ "Microsoft" ] }
URL: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Sign in to continue to Outlook", "prominent_button_name": "Next", "text_input_field_labels": [ "test" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft" ] }
	```json { "brands": [ "Microsoft" ] }
URL: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Sign in to continue to Outlook", "prominent_button_name": "Next", "text_input_field_labels": [ "test@test.col" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft" ] }
	```json { "brands": [ "Microsoft" ] }
URL: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Sign in", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Email, phone, or Skype", "No account? Create one.", "Can't access your account?" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft" ] }
	```json { "brands": [ "Microsoft" ] }
URL: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Sign in to continue to Outlook", "prominent_button_name": "Next", "text_input_field_labels": [ "Email, phone, or Skype" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft" ] }
	```json { "brands": [ "Microsoft" ] }
URL: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Sign in to continue to Outlook", "prominent_button_name": "Next", "text_input_field_labels": [ "test@test.l" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft" ] }
	```json { "brands": [ "Microsoft" ] }
URL: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Sign in to continue to Outlook", "prominent_button_name": "Next", "text_input_field_labels": [ "test@test.com" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft" ] }
	```json { "brands": [ "Microsoft" ] }
URL: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Tired of seeing this? Rename your personal Microsoft account.", "prominent_button_name": "Back", "text_input_field_labels": [ "Work or school account", "Personal account" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft" ] }
	```json { "brands": [ "Microsoft" ] }
URL: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Enter password", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Enter password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft" ] }
	```json { "brands": [ "Microsoft" ] }
URL: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2fo Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Enter password", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Enter password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2fo Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft" ] }
	```json { "brands": [ "Microsoft" ] }
URL: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2fo Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Enter password", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Enter password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2fo Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft" ] }
	```json { "brands": [ "Microsoft" ] }
URL: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2fo Model: gpt-4o	```json{ "legit_domain": "live.com", "classification": "wellknown", "reasons": [ "The URL 'login.live.com' is a subdomain of 'live.com', which is a legitimate domain owned by Microsoft.", "Microsoft is a well-known brand, and 'live.com' is associated with Microsoft's services, such as Outlook and other online services.", "The URL does not contain any suspicious elements such as misspellings, extra characters, or unusual domain extensions.", "The input field 'Enter password' is consistent with a login page, which is expected for a Microsoft service." ], "riskscore": 1}
URL: login.live.com Brands: Microsoft Input Fields: Enter password
URL: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2fo Model: gpt-4o	```json{ "legit_domain": "live.com", "classification": "wellknown", "reasons": [ "The URL 'login.live.com' is a subdomain of 'live.com', which is a legitimate domain owned by Microsoft.", "Microsoft is a well-known brand, and 'live.com' is commonly associated with Microsoft services.", "The URL does not contain any suspicious elements such as misspellings, extra characters, or unusual domain extensions.", "The input field 'Enter password' is typical for a login page, which aligns with the URL 'login.live.com'." ], "riskscore": 1}
URL: login.live.com Brands: Microsoft Input Fields: Enter password
URL: https://login.live.com/ppsecure/post.srf?username=test%40test.com&client_id=51483342-085c-4d86-bf88-cf50c7252078&cobrandid=deb3f74a-ed5b-4ef1-8d3c-92b85dd47352&contextid=BCFFA89199F39A66&opid=011F4B69C481BA5B&bk=1729784148&uaid=a1a476821133ba4d4b62508a3f1 Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Sign-in is blocked", "prominent_button_name": "Reset your password", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: https://login.live.com/ppsecure/post.srf?username=test%40test.com&client_id=51483342-085c-4d86-bf88-cf50c7252078&cobrandid=deb3f74a-ed5b-4ef1-8d3c-92b85dd47352&contextid=BCFFA89199F39A66&opid=011F4B69C481BA5B&bk=1729784148&uaid=a1a476821133ba4d4b62508a3f1 Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft" ] }
	```json { "brands": [ "Microsoft" ] }
URL: https://login.live.com/ppsecure/post.srf?username=test%40test.com&client_id=51483342-085c-4d86-bf88-cf50c7252078&cobrandid=deb3f74a-ed5b-4ef1-8d3c-92b85dd47352&contextid=BCFFA89199F39A66&opid=011F4B69C481BA5B&bk=1729784148&uaid=a1a476821133ba4d4b62508a3f1 Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Sign-in is blocked", "prominent_button_name": "Reset your password", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: https://login.live.com/ppsecure/post.srf?username=test%40test.com&client_id=51483342-085c-4d86-bf88-cf50c7252078&cobrandid=deb3f74a-ed5b-4ef1-8d3c-92b85dd47352&contextid=BCFFA89199F39A66&opid=011F4B69C481BA5B&bk=1729784148&uaid=a1a476821133ba4d4b62508a3f1 Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft" ] }
	```json { "brands": [ "Microsoft" ] }
URL: https://login.microsoftonline.com/common/login Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Your account or password is incorrect. If you don't remember your password, reset it now.", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: https://login.microsoftonline.com/common/login Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft" ] }
	```json { "brands": [ "Microsoft" ] }
URL: https://login.microsoftonline.com/common/login Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Your account or password is incorrect. If you don't remember your password, reset it now.", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: https://login.microsoftonline.com/common/login Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft" ] }
	```json { "brands": [ "Microsoft" ] }
URL: https://login.microsoftonline.com/common/login Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Your account or password is incorrect. If you don't remember your password, reset it now.", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Enter password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: https://login.microsoftonline.com/common/login Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Enter password", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Enter password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://login.microsoftonline.com/common/login Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Your account or password is incorrect. If you don't remember your password, reset it now.", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Enter password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: https://login.microsoftonline.com/common/login Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Your account or password is incorrect. If you don't remember your password, reset it now.", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Enter password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: https://login.microsoftonline.com/common/login Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "If you contact your administrator, send this info to them.", "prominent_button_name": "Copy info to clipboard", "text_input_field_labels": [ "Request Id", "Correlation Id", "Timestamp", "Message" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: https://login.microsoftonline.com/common/login Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft" ] }
	```json { "brands": [ "Microsoft" ] }
URL: https://login.microsoftonline.com/common/login Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft" ] }
	```json { "brands": [ "Microsoft" ] }
URL: https://login.microsoftonline.com/common/login Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft" ] }
	```json { "brands": [ "Microsoft" ] }
URL: https://login.microsoftonline.com/common/login Model: claude-3-haiku-20240307	```json { "brands": [] }
	```json { "brands": [] }
URL: https://login.microsoftonline.com/common/login Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft" ] }
	```json { "brands": [ "Microsoft" ] }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 14:35:07 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.988079977814125
Encrypted:	false
SSDEEP:	48:8GVdrTM7BqHCuidAKZdA1JehwiZUklqehly+3:8GTwDwmy
MD5:	E78D84373D27491FD121879FC0704963
SHA1:	8FD48AA69440F483D15E2F97CF10787B4156F7B3
SHA-256:	4D63AA692054BF3B9F7D5BBCE9A59DA379EEB879A1590AE7BAC3BCAF1EBF0ACE
SHA-512:	FF5285520873C43C68AB91EC5421794644CAAFE00A6AAA059ADBF931ACDD37B3A4CD7A6D2A3F0CF40C8F1A548767543971383C883432A8EFF044037CC814D1D0
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....V.N&......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IXYX\|....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXYc\|....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VXYc\|....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VXYc\|...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VXYd\|...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............s~......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 14:35:07 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.004251774069895
Encrypted:	false
SSDEEP:	48:8AVdrTM7BqHCuidAKZdA10eh/iZUkAQkqehWy+2:8ATwDa9Q/y
MD5:	7C1AF60DF95AFB369DAE18359B9B5691
SHA1:	E29EC0696C4FC9F96AA4710B875F1177C4887067
SHA-256:	0925A4EFC2570EC9CCA67B92351FF46A2CCC443CE7604C1100C34D257F6E2437
SHA-512:	4A86F10F1109A7DE95DAC6B3242E1BBABFE745A227B679EF797D84C1CE0A07B41BBCD8A44B973342ECD3EDA16BBC9B333FE6948E69A1FDBD57B1E16A8E87FADA
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....[..N&......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IXYX\|....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXYc\|....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VXYc\|....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VXYc\|...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VXYd\|...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............s~......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.015070928663274
Encrypted:	false
SSDEEP:	48:8eVdrTM7BjHCuidAKZdA14tIeh7sFiZUkmgqeh7sYy+BX:8eTwGSniy
MD5:	1C40BE38BF58B33F454F0F489137E8BD
SHA1:	D515B3C030A95534D683EECB3046B3DF7398CE6A
SHA-256:	01E131BB18A3274A368A361D341ADFDD75688CFE0F7DEFD179B2502F80ADD1C2
SHA-512:	C51B905D7D4E6FB93A8573C00490E787CADDCE4D7F206F5ACDB6CAA03D2651628A3F0DC40E6CCA88D7618215CB6D5C8214B24393172FB4992748A112DA3B5EB3
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IXYX\|....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXYc\|....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VXYc\|....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VXYc\|...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............s~......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 14:35:07 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.003987878492614
Encrypted:	false
SSDEEP:	48:8XVdrTM7BqHCuidAKZdA1behDiZUkwqehKy+R:8XTwDRAy
MD5:	1B4A83831CE459C69A10F03FA9BA9A90
SHA1:	241D0751072A3CC0DAEDC8A3261A2273ECC4CA39
SHA-256:	22FF10E3123CCBD4B2CE3C872A247989F58185D7530CD6D84BE2F5478295C891
SHA-512:	98D98D5D9FC07DDAEB189A43CD34E6DCE087883D813EF78B27FE077CDAFCA875E4FDB4EBDBF68713E854F7F8D9C8AEEA41E707DE6404930423FB4B4A6139D0E8
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......N&......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IXYX\|....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXYc\|....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VXYc\|....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VXYc\|...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VXYd\|...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............s~......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 14:35:07 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9920773600070443
Encrypted:	false
SSDEEP:	48:8kVdrTM7BqHCuidAKZdA1VehBiZUk1W1qehky+C:8kTwDx9Ey
MD5:	78D0E7146493E242D6DFE2B7AD3C3137
SHA1:	49E623879A05B8BFD50A76D71415D025CB6167A3
SHA-256:	47C73C70594AAD79CA49E2522EE8AE753B64B836EDA142A2F527B9273B4A4A1F
SHA-512:	1812194BD2F597E2611055ECD08F4FEFF634A7087FBA745587CC72CD60F1A63101256D0EDF342FA93D69CE26923E7641E76FA688E6299CA6AAF413D178247AAA
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......N&......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IXYX\|....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXYc\|....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VXYc\|....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VXYc\|...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VXYd\|...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............s~......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 14:35:07 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.002666467152114
Encrypted:	false
SSDEEP:	48:8rVdrTM7BqHCuidAKZdA1duT6ehOuTbbiZUk5OjqehOuTbiy+yT+:8rTwDhTTTbxWOvTbiy7T
MD5:	5AA19214DB9CECFCD99F0673D3B914D5
SHA1:	A2518DFB78B99C50BAC386615CB5501ADADA3F59
SHA-256:	7745C1C357653D120C320027F638F3C8BB5D26FA343C73428278A5CEBA7209EC
SHA-512:	72A483578CDC9C60D4D4E067615A19A3EDBAA28124D980DE4A600AA24C8E313F14CB374149BEC00B9AA44C7AA5A436A3E13996DDD411A4D7F697573A027B66A0
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....?.N&......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IXYX\|....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXYc\|....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VXYc\|....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VXYc\|...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VXYd\|...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............s~......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986
Category:	dropped
Size (bytes):	116365
Entropy (8bit):	7.997737813291819
Encrypted:	true
SSDEEP:	1536:9IyZY3F6VvgB9lnrhw1h+WbhcNtrpUzwXkqGeKTgcao2AYvXMpclkcKAXWG8NYh:9BZ5hu91Nwz+trpGmkReMgcaQYXlkcjR
MD5:	2D3FBED6DDD719FCC1BFB500B612FCEC
SHA1:	CD91B795DDE806AC8A38E51CCB6E8BAD8E57DA1B
SHA-256:	B2566B646F02DF4CE30B05D8223B78130A719D4EC9E4794A0106C371ADE33CC7
SHA-512:	A870E514B325D6FDC4D154438A8DD333C7AB46E545C1B27AC4869D9F1D8594CA1CDC530F5E96C835220DDAD4E1CEF841673696978031B5237E783972AEE701D1
Malicious:	false
Reputation:	low
Preview:	...........k[.H.(.}..[..-..c.0DFxHBz.I......O.a...#yt......k...J..&...........^.~...._..j...W;.8<.....]....m...~.}<.8~s.~=.(....qm.Oy.~....jaP......h.F^......\|oZ.G.M-...,...a..~..GW\|...L....N.(y...Z-..Cm......p.......?.5/.QmS..b^K...jw..8.}..Q.....!.o..8...&X.x-.Im.F.D..U;.....-.T.:...1........8Ka..M.L.ZZ'....>........x....v.S;.<...0J.I.0.G.....B.F..c.k.~....C.:...r..,.w.q~....q......#42V.q..f\|.kK...1o.mP.}.......N..n.w6.%^M.d.;...~2I.Z..fs...S/......F..=?...5....s..N.+.A.mx...j.T......?..W._p6.\|.}\|.{O.....2..`..._......g....j..xb^^...a.y.....s......4....q.Y..^T....X,.....m..~v,.....WP.U...:O".YoRX...7..S...zI.v.......mq.....E.,z.%....L\|.>.M.'i..ki3.u+.~...x.=...?6.%?.[.G.`Z=.$.w..4.."...R.1.k.\|..N.`......3...7.].'.E..).az......<a....4q..6.(..=~..........frk..?M#^Q.z..A..M.f.......S....s..d.e91._,zO.[X.......4.G..!.9Vg.......j.-?~.z.w..f.M............,...Z....w5..#.^..M.P.'.X.n/..mW.\|......0...w../...>\...l.......h...q>.w...FC[....7.

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
URL:	https://logincdn.msauth.net/shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 137

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (3450), with CRLF line terminators
Category:	downloaded
Size (bytes):	3452
Entropy (8bit):	5.117912766689607
Encrypted:	false
SSDEEP:	96:3qO9I9Sz9KHULI5m4UidBGLosqAsosushswsosry:a2IYz95qTdBac
MD5:	CB06E9A552B197D5C0EA600B431A3407
SHA1:	04E167433F2F1038C78F387F8A166BB6542C2008
SHA-256:	1F4EDBD2416E15BD82E61BA1A8E5558D44C4E914536B1B07712181BF57934021
SHA-512:	1B4A3919E442EE4D2F30AE29B1C70DF7274E5428BCB6B3EDD84DCB92D60A0D6BDD9FA6D9DDE8EAB341FF4C12DE00A50858BF1FC5B6135B71E9E177F5A9ED34B9
Malicious:	false
Reputation:	low
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(t,e){for(var s in e)t[s]=e[s]}(this,function(t){function e(n){if(s[n])return s[n].exports;var i=s[n]={exports:{},id:n,loaded:!1};return t[n].call(i.exports,i,i.exports,e),i.loaded=!0,i.exports}var s={};return e.m=t,e.c=s,e.p="",e(0)}([function(t,e){function s(t){for(var e=f[S],s=0,n=e.length;s<n;++s)if(e[s]===t)return!0;return!1}function n(t){if(!t)return null;for(var e=t+"=",s=document.cookie.split(";"),n=0,i=s.length;n<i;n++){var a=s[n].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===a.indexOf(e))return a.substring(e.length)}return null}function i(t,e,s){if(t)for(var n=t.split(":"),i=null,a=0,r=n.length;a<r;++a){var c=null,S=n[a].split("$");if(0===a&&(i=parseInt(S.shift()),!i))return;var l=S.length;if(l>=1){var p=o(i,S[0]);if(!p\|\|s[p])continue;c={signInName:p,idp:"msa",isSignedIn:!0}}if(l>=3&&(c.firstName=o(i,S[1]),c.lastName=o(i,S[2])),l>=4){var f=S[3],d=f.split("\|");c.otherHashedAliases=d}if(l>=5){var h=parseInt(S[4],16);h&&(c.

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 2477
Category:	dropped
Size (bytes):	1009
Entropy (8bit):	7.787888874744244
Encrypted:	false
SSDEEP:	24:XJKpSe6fksZVzK5nIFgOzOyW24A4NbSzW3g2whg8yiff:XJJcsve5nPvyW24A4xSKQXvf
MD5:	8984F3389334F3D6F548FC2B37F29D3A
SHA1:	201A8A7FA8C83A4DDC64EAEC3CC2C31874518FFE
SHA-256:	8B5CE863FAAAF3E3690E37ADECB9FF5BE8C16994C9EAA737A952D6C696804F32
SHA-512:	04B54B2E77D36044F8F3D54AAC71D526731AEA9A80A8789D38A3D282CA52979380F9EFFB53EC8F91A1B941D5B3B2D190CEA7524895A0C568A71E7056BC134F7F
Malicious:	false
Reputation:	low
Preview:	..........]....6.........!)Q..L..u.....vg..n..2y..2E.=.e....?\|..<^..o....r{zy..../O....^N...y...^^_/..............v....\|~<......g...n\|...o...}.-_..O.J-..9.V{."$.\..r.X...#."...\).X_S.\.5'..E.:..[........SM....H.]%.T..a[.....Q.. ..P..5..-..4.D.MT`....c+:.{..VUA...k.........5>.\|.(y.a.......w.R......uV....,EL....qE..P`..E).9.b.-.2.@.5n..z.<V.L s.c.[9.u..Lf..L...$x...C........l....^.......z....!....,..h...J(.]....e...2.:......L.T.h..X...]h..w.j..e..F....F.J.6/f..9sg..P2.9.:c5..W.\|.2..G7 .K0\|.a.}.s...".$..M4.s..E....m0.l].....&.......Z..w.&_..........$....v.XY{3C....6V\|...Vv.6...*.+...F..\|.SJ..}...+...`....G...5@..q.@b.q]...:{.Q.c....8..;.....+.HK.....T .q..U..{.o...w.....j.f..\|.S...wI....C..m.'R.1.S..s...X>.Y.m..)i...J....N".EVqK..v.m..X{..Q...e...%d...U.p.u.....G.0.N..hXg...?1.,...@....[....\|.6".J.fD..H...T6.L..$....N_.c[....Wv...K...iy....k.>t...8m.....d.T `.v.b.]=.p...nwi.........M./.o.Y.. .....n..Mk{a.,0 .}1.3...2..........W/....e?Sz.

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 379
Category:	dropped
Size (bytes):	254
Entropy (8bit):	7.066074991728423
Encrypted:	false
SSDEEP:	6:XtS8G99k8e6my4IIFqXUJ59lDFCnhUGlZX8My/dOtrE:XAH99kRX1YQBDFCnDXdWYtrE
MD5:	847A4212B99B9076EE39328B24CD30AF
SHA1:	73F15078CF1D396485F644A79B6E25EF0637685D
SHA-256:	29DC0C26C372805325EB7EB926769E832A60B47BEF96A66436EC3EC05CD6128E
SHA-512:	9AF77E9ED8BD9A39A47F36AAC2D01B5AF5D56C04CD933427DF95CC80904D7EE7AC3F7F9443D8AEF236CC84FB4DC4CC335AF0BF8F9BC0C13D720187096D149220
Malicious:	false
Reputation:	low
Preview:	..........mP.n. ...D.xY0.\..{. 7...y.F!.....T..Y.Y..n...q^.[O}..w.SJ.j..3.....%)....x.f.K}..}\.=E.D....!.n.......Ma..G.=+.%.w..WX...9.A...........X...V...bOB&2.H....15{.fT...V-.#..m..f...V2<...~....l%4.....Ie.TL69.....vW.....v.3.v.O..}..{...

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113766
Category:	dropped
Size (bytes):	35170
Entropy (8bit):	7.993669499179372
Encrypted:	true
SSDEEP:	768:u9kHX02Kz4HS90LgehZHDTBrsFThxVLqj4Ryfs6dBv9TzrP:334z4HS90phZ5rsFdtW3v9TnP
MD5:	4B27E3FE40C38D759030BD63BAD5D5BC
SHA1:	F6427020AEFBC66EA6D36B5BB86D2F8CC327581C
SHA-256:	1F979704AF851D1131AEB02E5E4B5C67798B5488DE0BA7C76FE1B873FD535A34
SHA-512:	97685335D0A8986D7BD1262A251D83AE50C207B0CCC25410CE97D2438D44D4948E6F34903EBD8564FB224CB8BFF14C6A63470C7DFB9FB63084CA32F28162094E
Malicious:	false
Reputation:	low
Preview:	...........kC.H.0......e....0.pX..Iv3..\f..0YY.m..e$.K..o...j..g.3.lpW.......[..Y.?k.Y.......8~.a..../_.;]{.............v...0..q.Dk.w...h-....Z<..l.fA..k3.7..dm....b..-...(,.$...4...f...e...AV..z.mA....O.9........k..h-.......<Z[.GQ.v3....Oq..y:..(..k.$_...._..h-...q..S.ck.=.T......Sq@.:.A.c.(....SDq..Ac.t..m.$Lc....Z...K...O<....f9..p...0Z..3.<...$YK.x.F......v....nm..s$...&..dQ4.......n-.-.......E.XD..-5~...f.....t...-_.....fsg...8kZ..\|.{{....p+Lg.t9I..P./ap......o9Wx.._{....k..,...............................7.\|..t...Ax.7..b..v..v.m-...~v..Z....r..._........,...A........:....\|..t.. [.C..f...N..S..kz~.Z.....k.j,.W.j$.kw.*,........(........~.....&..i...Y.]2..8.........-...O.(......m.....~<.&..v}.......o.hr.........f....c-....}V....uz.e' ...A...l.>...T....~}}...Xu28.!....../..&L.t.va..d.J..A..G.z.;...bk...<.E....b..l..ir.?..&.n.`.......Wdw_l....?~...h.{.%.N.0..<..d+.i;.........`....#.q..._As....5pKq....l..\...";{_...:.x...<......T...F.<(...[

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 143

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46090)
Category:	downloaded
Size (bytes):	141866
Entropy (8bit):	5.429983887489752
Encrypted:	false
SSDEEP:	1536:PyeDOMSQ6fTPRUbx3XCg/MJA5N4ii5WLeV5guLDY2Js0VgtWiTJmxyCXP3onrGGW:wMc1g/Mq5p1Mv+UyJbBw+Icwf
MD5:	2509D4C564AFC2C77D16BA6CA509B39F
SHA1:	201F1D80F8EEA9F5E8A7A7224CFF18674344F886
SHA-256:	D468D9F009E53FE1C47B9D6FDEFA3FF1A8C239973F11A6F892848E341EA17CCD
SHA-512:	C928C36D58BB0B2740E9BE3F3CA3F49624253F8DAD93BA7524E55F24CCCAF630E35FCA8C596CBCE50A0C1214C4986034FD3E26D98F759949C179C54009D5D93E
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */!function(e){function t(t){for(var n,r,i=t[0],a=t[1],s=0,u=[];s<i.length;s++)

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	17453
Entropy (8bit):	3.890509953257612
Encrypted:	false
SSDEEP:	192:P7FRTHQpmA3ZkXOL25cYty7l6UWUjMJBSab/vR+yzP:P/cpmgkF5+JWUjMp40P
MD5:	7916A894EBDE7D29C2CC29B267F1299F
SHA1:	78345CA08F9E2C3C2CC9B318950791B349211296
SHA-256:	D8F5AB3E00202FD3B45BE1ACD95D677B137064001E171BC79B06826D98F1E1D3
SHA-512:	2180ABE47FBF76E2E0608AB3A4659C1B7AB027004298D81960DC575CC2E912ECCA8C131C6413EBBF46D2AAA90E392EB00E37AED7A79CDC0AC71BA78D828A84C7
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc2e13.jpg
Preview:	.....Phttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta>

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406594
Category:	downloaded
Size (bytes):	116257
Entropy (8bit):	7.997611207087735
Encrypted:	true
SSDEEP:	3072:DE0ZVdpagSQYd6R1+Q0Dsyzo2fDmhCx+ZkEIIkfrWk/1:Dfdg380oyzo2qhEpvIY
MD5:	D79589EF5E53B3CE2CB188E1C233F1B5
SHA1:	62F96C1BED01A64C2E3017979F51FA7ED3653E23
SHA-256:	F34DE0A54D08A60882232E7505C6E7AC06440A854C32C2B22AC8A223E1BFE53F
SHA-512:	F70F513D2C156A3F19E3D6F2BCE95B7320C688528114EB82476044A3D9C58E56641E4A407F390EA9CCB7838310D1FFFAB160FD3E9287C3F2D24D62C61D9643C0
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergederror_customizationloader_7e45d168059bd2885d00.js
Preview:	...........k[.H.(.}..[..-..c.0 #<$!=.$..dzz.'...X..<.@h....VUI%Y...}.w..`]Ju.u.l.T...O.....]\.._.N....rr..v.w..>.^..>^..l..]N..6......^.G.0..Q...a4.#/.q...F.7....Lxm.._.0.kS?N.k>..k&T..jg^.<.N....6.....a8{..IR.........)..1....G...?.....(..qR....w.H...b...E...6..d"..]`IYkL..c*....GP....a.~.]..0h.&...-..Ye..b.jIX{.S..\|<~pS.y....\|.W.]...U.f.;..tZ..xT....5.m....C.&...r..,.w.q~....q.......#42V.q..f\|.kK...1o.mP.}.......N..n.w6.%^M.d.;..7~2I.[..vs..7S/......F...8...%....s....k.A.Mx...j.L......?..W._p6.\|..x.{O.....2..`..._.......g....j..xb^]..v.E....k.\.....8..8F3a.E.....72............m.b)..B...m.E.......v............'.^.].. v..D[..}."7i.&..x...p;....jS.$.I....Z..z...o.<....v........#`0..\|...Zl.Y]..Em...x..O>FS'a0U.....w........"....0..[..].g....a.8[\|........ct.K..s.C3..`c....(c=.o.k3.z.....).....F.i..../....-,k..Zp..m..Y........X^...i.......[.o..zykH..uLoy.b_R.}.....W..r..j/..:.(..^,Y..K...>_..U.~..........f...m..6......@m.DN.8..[@jq...~v....

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 119648
Category:	dropped
Size (bytes):	40454
Entropy (8bit):	7.992737010031678
Encrypted:	true
SSDEEP:	768:zJUZY53jznALsvTo+bJoiJRHaLurK8F2v7/t06IRN6m5n18UWUnf+:9c4XAoLo+bJvzq8F2v7F0zRN629nW
MD5:	1D65BDDAE4EAEEFC77CB9CFECC565B5D
SHA1:	A7D87150DA1DF6AE6DB87D98760DB7D753DBF6B9
SHA-256:	B98D5BA052230DB0ABC1B0E7B09D814114F6B7C316836BEB88E7B49057DAFEC0
SHA-512:	F2CF9D120D7E18AE3FD77CD85176401A3EB7DB4AF10E16D58C21D86F738FC74525A21E3A319197435E43E50E61DFA8CB2F7207962105360E7BE5652A28165944
Malicious:	false
Reputation:	low
Preview:	............{{..7..y...D4e.sH.v.w......m.r.....&..b.`.P."r...~k..\(...=n#.2..5.N..N~.v'....g..G......N.~q.i.KWq.d.I..N..Z.'.,-........>.e...&Y..'ON......K\|.KQ.........^..WI.QT.oe.>..V........w.,/.Y.6..U.......Lo..U..C..{U......T....,.==.\..KrY..'wI..2wIyMw.K/.........B..{45r..r..Lw..3....I!l..lL.m....\|!..k...J...Y.......Q.I.Wt...........-....Y..mI...vs.S.TP.....]P..;j3..."..Q.]P?.+qK7.q..]J}....qt[..D.j\."....&j..3.......72.fQ..l%_..A...$.m6..>.QD@... ^F.v..2z@uao,.\|....@../....05.....4x...".I..(.._..e..R..HT.{.2O.....lT.we. _.P.'Iz..\|..y...yM..j.P...~...~6j.D.Li.e..z.tu~.lV~...qN...fg...V.7.;...<..........}...yf...`>.....g.y.<q..7.i....h..\%%.q.z.>.......^...M..u.n..1...z7t.......y..S..Bc.).....X.~.\|F.....B0..E....d.B_.Z.....[.Z./..B8.e..-U....P..]N....k.%p...l<..\......A`W^...m.J5c...._I.j.t.......Q...1..B...>^...+d.p.o.bi.D..O...~... @..m*.4.z..uLd..Bc).:.x?..`..Ey....?.2...".....2}.?.FW.\|d.~9...~.C.V..y.'..M..........`...E.77>..~?=+gs..t

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986
Category:	downloaded
Size (bytes):	116365
Entropy (8bit):	7.997737813291819
Encrypted:	true
SSDEEP:	1536:9IyZY3F6VvgB9lnrhw1h+WbhcNtrpUzwXkqGeKTgcao2AYvXMpclkcKAXWG8NYh:9BZ5hu91Nwz+trpGmkReMgcaQYXlkcjR
MD5:	2D3FBED6DDD719FCC1BFB500B612FCEC
SHA1:	CD91B795DDE806AC8A38E51CCB6E8BAD8E57DA1B
SHA-256:	B2566B646F02DF4CE30B05D8223B78130A719D4EC9E4794A0106C371ADE33CC7
SHA-512:	A870E514B325D6FDC4D154438A8DD333C7AB46E545C1B27AC4869D9F1D8594CA1CDC530F5E96C835220DDAD4E1CEF841673696978031B5237E783972AEE701D1
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js
Preview:	...........k[.H.(.}..[..-..c.0DFxHBz.I......O.a...#yt......k...J..&...........^.~...._..j...W;.8<.....]....m...~.}<.8~s.~=.(....qm.Oy.~....jaP......h.F^......\|oZ.G.M-...,...a..~..GW\|...L....N.(y...Z-..Cm......p.......?.5/.QmS..b^K...jw..8.}..Q.....!.o..8...&X.x-.Im.F.D..U;.....-.T.:...1........8Ka..M.L.ZZ'....>........x....v.S;.<...0J.I.0.G.....B.F..c.k.~....C.:...r..,.w.q~....q......#42V.q..f\|.kK...1o.mP.}.......N..n.w6.%^M.d.;...~2I.Z..fs...S/......F..=?...5....s..N.+.A.mx...j.T......?..W._p6.\|.}\|.{O.....2..`..._......g....j..xb^^...a.y.....s......4....q.Y..^T....X,.....m..~v,.....WP.U...:O".YoRX...7..S...zI.v.......mq.....E.,z.%....L\|.>.M.'i..ki3.u+.~...x.=...?6.%?.[.G.`Z=.$.w..4.."...R.1.k.\|..N.`......3...7.].'.E..).az......<a....4q..6.(..=~..........frk..?M#^Q.z..A..M.f.......S....s..d.e91._,zO.[X.......4.G..!.9Vg.......j.-?~.z.w..f.M............,...Z....w5..#.^..M.P.'.X.n/..mW.\|......0...w../...>\...l.......h...q>.w...FC[....7.

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 449028
Category:	downloaded
Size (bytes):	122065
Entropy (8bit):	7.997626422878093
Encrypted:	true
SSDEEP:	3072:MWJZiGtRbjSj7NS6PV1gunmm+RWZ6tb6Km5toYKcvleGgwZHfF:MCZ7buS691gemmIg6tuvHvg+d
MD5:	AA8BC8C5EE9148CD994872B1438C5ED6
SHA1:	955C9B9B66442B43A6B6290CF54E20BBCF144E18
SHA-256:	66C62A7D3E076AAA538C7F589BB2661726F18EF9343DF6F06A714C37A04B7A61
SHA-512:	288E76CC63F72885B47515716389CD03F840237C269CB03463348A576A565D12497AD2AD52430F1888FE0F2468C755DD43D08498CF11A6CB864301B7739B8569
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_DQTmGfOEMmPUR-Vehc8U6Q2.js
Preview:	...........{W.H.8....F3...a,..E.Yc..i......,...Y.J2.1......R.LU....s.AY..................Oix..).NK7...KW...........`....G/..=.....3....0y..F.0......7.l.4..i)yd.Y...$..^.@....R......%o...J..gP.7..(.7.....0..V...j..#.Yi..,.<z.c..s.0..I)b...x...&....R..8..G.ji......-......\.pL...0@/....0h,...[U.DZ..7.R.....}6./...o.....:.;w.jn.1....._..<..b.{.... ..J.....9.8{.16eA...........:B#.K,N...8.T.....$.R..8...?.R.^3...n...$......K...N..p>.....<...........9.Y.......pj{.l.J..Y..W.........A.......:py.m...+..B........l..uO...v.G..q..VMw........`.<..;;.....{}0.US..O..m..v<x..%3..Tu`...U...;.~{....c.?....?...v ..-E..2......{+.?.....va8...i...8)W.....X..7... EC.h..e....D,.GA..W.Na!..T..$k..[..2..ry .1,D}LdY=..a.>\|k...-OE/.A...}./'V/..7%#..o(a.S....e!P8..UI.#.n.{).@.I....u.va.....$z#...[.BX......l.\|.U.Q.....&s\.nT..........Z...LK.~.\|."...D;U{6......T$.C..^\|%...e..!.5..T.......R........hY...~T...Z.....s...xZ\|.vcO..)+k..Up.)#O..!Qr.#ty..

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (59783), with CRLF line terminators
Category:	downloaded
Size (bytes):	663451
Entropy (8bit):	5.3635307555313165
Encrypted:	false
SSDEEP:	12288:YhqblwQ9eTw/suNyIzaJS/pWYawUWufSxwDr2o/5YP1B:Yhqblt9e8/sMzaJS/pWYawUWufSxwDrW
MD5:	761CE9E68C8D14F49B8BF1A0257B69D6
SHA1:	8CF5D714D35EFFA54F3686065CB62CCE028E2C77
SHA-256:	BEAA65AD34340E61E9E701458E2CCFF8F9073FDEBBC3593A2C7EC8AFEACB69C1
SHA-512:	CEC948666FBA0F56D3DA27A931033C3A581C9C00FEC4D3DDCF41324525B5B5321AE3AB89581ECC7F497DE85EF684AB277C8A2DB393D526416CEB76C91A1B9263
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.8069.28/scripts/boot.worldwide.0.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.0.mouse.js'] = (new Date()).getTime();../* Empty file */;Function.__typeName="Function";Function.__class=!0;Function.createCallback=function(n,t){return function(){var r=arguments.length;if(r>0){for(var u=[],i=0;i<r;i++)u[i]=arguments[i];u[r]=t;return n.apply(this,u)}return n.call(this,t)}};Function.prototype.bind=Function.prototype.bind\|\|function(n){if(typeof this!="function")throw new TypeError("bind(): we can only bind to functions");var u=Array.prototype.slice.call(arguments,1),r=this,t=function(){},i=function(){return r.apply(this instanceof t?this:n,u.concat(Array.prototype.slice.call(arguments)))};this.prototype&&(t.prototype=this.prototype);i.prototype=new t;return i};Function.createDelegate=function(n,t){return function(){return t.apply(n,arguments)}};Function.emptyFunction=Function.emptyMethod=function(){};Error.__typeNam

Chrome Cache Entry: 150

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (994), with no line terminators
Category:	downloaded
Size (bytes):	994
Entropy (8bit):	4.934955158256183
Encrypted:	false
SSDEEP:	12:U8Chx3fpler8DDMv1+I+zpcuVkicq32EXgBA5e2KMLT:JC3G0z1Ddf2NGe2KG
MD5:	E2110B813F02736A4726197271108119
SHA1:	D7AC10CC425A7B67BF16DDA0AAEF1FEB00A79857
SHA-256:	6D1BE7ED96DD494447F348986317FAF64728CCF788BE551F2A621B31DDC929AC
SHA-512:	E79CF6DB777D62690DB9C975B5494085C82E771936DB614AF9C75DB7CE4B6CA0A224B7DFB858437EF1E33C6026D772BE9DBBB064828DB382A4703CB34ECEF1CF
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.8069.28/resources/images/0/sprite1.mouse.css
Preview:	.image-loading_blackbg-gif{background:url('loading_blackbg.gif');width:16px;height:16px}.image-loading_whitebg-gif{background:url('loading_whitebg.gif');width:16px;height:16px}.image-thinking16_blue-gif{background:url('thinking16_blue.gif');width:16px;height:16px}.image-thinking16_grey-gif{background:url('thinking16_grey.gif');width:16px;height:16px}.image-thinking16_white-gif{background:url('thinking16_white.gif');width:16px;height:16px}.image-thinking24-gif{background:url('thinking24.gif');width:24px;height:24px}.image-thinking32_blue-gif{background:url('thinking32_blue.gif');width:32px;height:32px}.image-thinking32_grey-gif{background:url('thinking32_grey.gif');width:32px;height:32px}.image-thinking32_white-gif{background:url('thinking32_white.gif');width:32px;height:32px}.image-clear1x1-gif{width:1px;height:1px;background:url('sprite1.mouse.png') -0 -0}.csimg{padding:0;border:none;background-repeat:no-repeat;-webkit-touch-callout:none}span.csimg{-ms-high-contrast-adjust:none}

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 449728
Category:	downloaded
Size (bytes):	122269
Entropy (8bit):	7.9974362643305215
Encrypted:	true
SSDEEP:	3072:DqMdt2M2z1jeNS76MAxjW1EZgVzuqZ+qNotqrG8/yiKJSgJF:jc1NUxCECVzuqZN7/9sSC
MD5:	D2625A3B7A80F9E0F6BFD8FDBEEDB164
SHA1:	A1114F7EE86956E5F6DF604B2C3F25107AA3F124
SHA-256:	C6DDC0AE20A875A5E972A9961A6D139C7E28E64CCEE0CE47BA0CC294B7DEAD16
SHA-512:	F4D2F226DFFC191C21739BC6814ECC502A4B0D62E928F2526786B3AF774737E628C8E550ACBCDF99EEF455E034C5264439B4A8EE08D33D45CE9AE76FF5B513F1
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_QLF_8apNRJD3OCol8jwtxw2.js
Preview:	...........{w.8.8.....fn..(...J...'..v.gb..wS..Y..ud.+.y....?.$%.SU.{.=..y.,.\|. .. ......si...S..z...4.\|v}\....(].Fg...........4.\|V...v..R.....N....NX\......$.g...Q.'s...{q......Ke..rKWv....U..Am......._..CR...sX..\... f.E....9.....8.$..9.{.F.....Kv.J1KJ.0J.x?..!B.Zcj....8t..s...........8_...L...U..ie..\|.JIXz.....x.`Z...bj......I..a.,z...~)..D...%.2....-M#;@...`..i......cTt.Z.fs...L/.8..s...R..^...J.?.0.W..K.z.h..Z.5....d...>L..a1.:.......C.G........?c^....,]-...q8..@.u.b.,..+...`_.....qry.?]..<>.L....+..R........d..uO...v.G..q..VMw.......`.<..{{...o.;}0.US..O..u..v<x..%s..Tu`...Uvw.[.nw....C.?....?..!v ..-E..2.....n.;+.?.....ua8...i....$)W.....\..7...0EC.h.&e.6..D,YDA..W.Na!.T..$k..;..2..ju(.1,D}LdY=..a.>\|k....NE/.A...}{+'V/..W%#..o)a.S....c!P8..UI.".n.{.. .$..y.:K......i......-..!,XL.....>....J..G....X7..@L.L...h-.p..%R?.>e.......=....@O......w/.....2.....L..taJV.HJ...gV.H.C.z...n.P?...v....[.9e.O<-..:......5......D.(9...<X

Chrome Cache Entry: 152

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57443
Category:	dropped
Size (bytes):	16326
Entropy (8bit):	7.987374325584103
Encrypted:	false
SSDEEP:	384:GTwafLJjHlgnek9V15z6Brrwb9tYt3skOUAQC1:GTtTJjHlgneqTz658ht/eAQw
MD5:	C217AE35B8592DC9F1E680487DAD094F
SHA1:	2E642562C2BFD8968629317FF212684C7EB59193
SHA-256:	D41992E79D7BCFCC1F32597208DD99033D99C04882EAFCC8508F2FA0EE728C6B
SHA-512:	EAF3BF49BCF58A7F7C39CBF35FD75862FEE98F611536080DFC794D288274CB9D67E95D0299679F7981E110B2577A47579D3623C7F11A6AC2A0CFA56AAEA2CAB0
Malicious:	false
Reputation:	low
Preview:	...........}Ms#.......\.@..'F.........C)$....`.......Q.x7...}..'.}..?e#...QU]....Vo.................?........w!......=.G...P.../......8z....q._5....g..}g..31......l...],.b..;..`...Y....3..5.uGAi..NP.6<.w.(..`...y..d.N.x..^u.....^...?..N........Fq.....z..wgN./..Ep/f..c/.D4~X.W~).s/.E8...T...8,:..Q.>............4....F,&c.)n.[.pcQp...4...6...i.............CkL=....'.\..L......2.A..o.u..."p.. Xx.......'l.[w..'c/^.FP.....q.h4.R+X.x...d..M.}.Z,..RP..E.T......8 .v....Iw.X..?.r......nk....?Wj..a.\|..........JAs.j.7.....?.)..t.z.-..m.]..3y...3@.3YO.KSz]...4.b........V..+.%.[.&........l.H>G.^<..{.$"..-.i.........`qcw...`.[....as[.+.X...n..X..%,:......am."a....^o@@.`].....( (b...k..B.0.....AX.D.?...,..-<@k.;..(*..C.]...:.nn..8..s...."4.. ...J...P.n....F.3G..u..;9&.{.2.80.XB.....@.qw.:../.`.P?.+t..w6.a~..7...8k..U._......k,..o.....yQ..r.....}.E...B.r......?{...\fB....-.).Fb.;.p.N?(..P.?..p....F........)p..,`l...o@.;.x.....:..f.E....<0..#K\...K(?K/OX

Chrome Cache Entry: 153

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
Category:	dropped
Size (bytes):	35168
Entropy (8bit):	7.99275807202193
Encrypted:	true
SSDEEP:	768:FlTfWbX2KT+Hid0L7lumndasuVyeLtCR4sqvrdYnN6UcepZtf/r6:LgbT+Hid0TFbeLtUGvrdCNqepbHr6
MD5:	D3B6AE9986DF244AB03412CC700335D0
SHA1:	BAAA1F9899178938F3881F09B18265E47DA806E3
SHA-256:	CA50059111D30C2E212C90805792EB543548AEF0D4941E886A778E3DCE0B9066
SHA-512:	755C57FBC9BECE435A477F76C5E8198CA8942C23BE667ACAB83A00E5CD4F54075B10AA07C7FDC10C38FC3D5C0C406C9132FEB5B67BA5BCCC57EF796054A84E7C
Malicious:	false
Reputation:	low
Preview:	...........kC.H.0......e....0.pX..Iv3..\f..0YY.m..e$.K..o...j..g.3.lpW.......[..Y.?k.Y.......8~.a..../_.;]{.............v...0..q.Dk.w...h-....Z<..l.fA..k3.7..dm....b..-...(,.$...4...f...e...AV..z.mA....O.9........k..h-.......<Z[.GQ.v3....Oq..y:..(..k.$_...._..h-...q..S.ck.=.T......Sq@.:.A.c.(....SDq..Ac.t..m.$Lc....Z...K...O<....f9..p...0Z..3.<...$YK.x.F......v....nm..s$...&..dQ4.......n-.-.......E.XD..-5~...f.....t...-_.....fsg...8kZ..\|.{{....p+Lg.t9I..P./ap......o9Wx.._{....k..,...............................7.\|..t...Ax.7..b..v..v.m-...~v...:....r..._........,...A........:..z.>.y..u.....N...^..S.......z~@..;...n...K........x..A]....F.8X&Em..P.s.....a.g.\|.d......._..C`.xQ...\..'...QP....?.R.{?....\|.>........E4.GRz...z.k.z.}....h..>.{[E.:.....Pu. ..e6_.o.p*.w...>...:...o.k~...~..&E._..}}.}%[. ..#......z.5M.b.....z..k.H.4...l..D.o...z..M.+../..`....?y.J4.=....u.....Z.....E.d.....{0H^...8.....9..h......d..6j......../..z..V<.`.F.xm.y..yt.J....

Chrome Cache Entry: 154

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7007
Category:	downloaded
Size (bytes):	2419
Entropy (8bit):	7.9084162154611555
Encrypted:	false
SSDEEP:	48:XMZLME8ac0UTyw+G0mNbF8pDRfciXxBce7Fh5hqoucAKFBwMJiUh4BTiFT:70Uh7NapDbNl8oucAKFSMJzhn
MD5:	9FAF36E3F793E68A83548EEE5622A222
SHA1:	220342B65C5563A249E462B779F2DC46BE3AD5A8
SHA-256:	E16E9ABCEFABFF8B5DD9895E4331F137E94A3D64354AD989951342A1B2813A39
SHA-512:	49B8E11A9B32FF76E7A5090D1E0C8CEFD4B9EDE08A8346DFB186B6DCCE2F712F7446CA944C01419F83499329CE1BDC296DCC32BFABE8471BB5A945E0CD0485F8
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pidpdisambiguation_8e15caf4c90cec4857ee.js
Preview:	...........Xmo.8..._Ak.D....8U...l..&9...).Z.-..)..._..~C.._......$....p.y.C.~..A.......=ow....~.n_.;x.....^.._.G....J4.!Ap.cI\|....Q.q.s...(..............N<%QH..I}...2A.....j...,....F...l..S...b\Q. ..T[..L..0..4.......\.B.x....L`.l.FX.$.B..T.......LfQ.......p......)....,Z..,.:KN.i..> ..'....P6D..H.v..B...'.rJ.D...a.8....Kj..y.A@.S4..... qx(...S6...S.SD...IWf#"..c....'T....B.%g{.w..z.Z?...V.P..ZmHU....G5.'..Kp..........w.M.....>x..x.)+l.-G....."....B.........e..G.9...4MH?.....P.n.{z...r.D.....o..a..9H...eR...z.cH...=..p.[..K.9\.-..u....-\..aM.HxG..... >$.....].t....c...kf...Qd..:..j...4..I.j.....aG.uR......G..8...........@I.E.vR...R.+p$.>......g........fT?^...=.Z..?).....)..i...D...../...G0.....RP.~ ^...[n.H%.6\9...S.\~.W../...G}:\DqjfA.n.@.#.c...?.".Y....c..h...G.m$.O..3l...'_..-..A8 /..K:.m.....(S[.d.j..;^..f.j....S9....l.pV...+.R.f.U^......T.+....%..2..l....,^:i.p...w....d..C..2.4......+...........Y.x.H.F...o.CYa.NA5.D...t-M\Q.&.W.....

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (59783), with CRLF line terminators
Category:	downloaded
Size (bytes):	663451
Entropy (8bit):	5.3635307555313165
Encrypted:	false
SSDEEP:	12288:YhqblwQ9eTw/suNyIzaJS/pWYawUWufSxwDr2o/5YP1B:Yhqblt9e8/sMzaJS/pWYawUWufSxwDrW
MD5:	761CE9E68C8D14F49B8BF1A0257B69D6
SHA1:	8CF5D714D35EFFA54F3686065CB62CCE028E2C77
SHA-256:	BEAA65AD34340E61E9E701458E2CCFF8F9073FDEBBC3593A2C7EC8AFEACB69C1
SHA-512:	CEC948666FBA0F56D3DA27A931033C3A581C9C00FEC4D3DDCF41324525B5B5321AE3AB89581ECC7F497DE85EF684AB277C8A2DB393D526416CEB76C91A1B9263
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.8093.17/scripts/boot.worldwide.0.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.0.mouse.js'] = (new Date()).getTime();../* Empty file */;Function.__typeName="Function";Function.__class=!0;Function.createCallback=function(n,t){return function(){var r=arguments.length;if(r>0){for(var u=[],i=0;i<r;i++)u[i]=arguments[i];u[r]=t;return n.apply(this,u)}return n.call(this,t)}};Function.prototype.bind=Function.prototype.bind\|\|function(n){if(typeof this!="function")throw new TypeError("bind(): we can only bind to functions");var u=Array.prototype.slice.call(arguments,1),r=this,t=function(){},i=function(){return r.apply(this instanceof t?this:n,u.concat(Array.prototype.slice.call(arguments)))};this.prototype&&(t.prototype=this.prototype);i.prototype=new t;return i};Function.createDelegate=function(n,t){return function(){return t.apply(n,arguments)}};Function.emptyFunction=Function.emptyMethod=function(){};Error.__typeNam

Chrome Cache Entry: 156

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 362433
Category:	downloaded
Size (bytes):	98380
Entropy (8bit):	7.996853333459762
Encrypted:	true
SSDEEP:	1536:iTeZ7J6sUJC7ckHh2A308MCbr2/D+m0eknviolCF8uAy3KV0AACROueSQrR3nd:iaZ7XU0PBF0NCKKReDFF8xWKPFoSQrxd
MD5:	22FB039F8816D650972D54BC41D3A338
SHA1:	CF8F64B92766F29751C794167947F665CA09B7A3
SHA-256:	FF6AD7DAF997CC9F67CE2E226E460C55C8E89E228C99181D03E8CA7FC610E131
SHA-512:	29D242307B39A566EE23D1C1B125D44A20BD8AD44CF0C052D29BB487EBE75154C4A330B512FB08A4B97BBC69D9B8BEDF80799A6F1EEA5CB25AF5764E34FE2AD5
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedError_Core_e44ULT7v2HGQHqHgp6vqIA2.js
Preview:	...........{W.8.8.....3.......... .i ........&.9..c..>..I..8.{f.u....R.U..J...7.....o.Oep....O+._zW'.K..G...;.~{=.(....+#...w....A%.~...4....g.7.Ie....U.Q..s..2......$\|.T...\:Q.^.].5..Am......N...cR...wY..<.m..A...cQ...w.+...q8J.s.....3H.7aT..Ub.TFa.<.~........o1&p....A.#.(....C..t...2a0y.).H+....PI..{8..........9.v0=........f....dR..<...b.{..M. ..W.. .es0q.8b.....cTt.^.....Qaq.N.l.sK...1.I2.T...Q.#.T.usg....:.zL.il}.4.......p6.81t.}..y..6._l....g.WV.r6..TN.g..d[..{9._J......;........:py\|.....;Ve.\............p..~oD..7b.n....A..S..`.<..[[zh;.......'a.>e.G'....).b..0.U....M.6...tk.Y.X..hE7..]?..$@..H..##...6..#.G....M..s...n-~.GIU..K1@{.4\|{......b..U...^.X2..i....)......d.}+0&.i.Lk.\..B..Q..Y.H......gi.S..e.C?...jbw..yW2b\....:.0.M~k.6..#Z^z...s..k..R.Q.....Y.%.$.N..X@.\.2.a.b*.f..3.0M'D.v.q.D.....0u.\| ......RK;..D...,b.F@.Ss...{50...D..../....J.>..-f.z:].....R....)y.<............}-...%........._8..!...rSF..%C..G..a-

Chrome Cache Entry: 157

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	659798
Entropy (8bit):	5.352921769071548
Encrypted:	false
SSDEEP:	12288:nEMsQrWEWbnByixmwgXZewhYcFiG4DUIxo:nEMsJpBJgHKcFQNo
MD5:	9786D38346567E5E93C7D03B06E3EA2D
SHA1:	23EF8C59C5C9AA5290865933B29C9C56AB62E3B0
SHA-256:	263307E3FE285C85CB77CF5BA69092531CE07B7641BF316EF496DCB5733AF76C
SHA-512:	4962CDF483281AB39D339A7DA105A88ADDB9C210C9E36EA5E36611D7135D19FEC8B3C9DBA3E97ABB36D580F194F1860813071FD6CBEDE85D3E88952D099D6805
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.8069.28/scripts/boot.worldwide.1.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.1.mouse.js'] = (new Date()).getTime();..;_a.d.G=function(n,t){this.b=n;this.a=t};_a.d.G.prototype={b:0,a:0};_a.fo=function(n){this.s=n};_a.fo.prototype={s:null,t:null,i:function(){return this.s.currentTarget},e:function(){return this.t?this.t.x:this.s.pageX},f:function(){return this.t?this.t.y:this.s.pageY},o:function(){return this.s.relatedTarget},b:function(){return this.s.target},n:function(){return this.s.timeStamp\|\|+new Date},a:function(){var n=this.s.which;!n&&_a.o.a().K&&this.s.type==="keypress"&&(n=this.u());return n},u:function(){return this.s.keyCode},m:function(){return this.s.originalEvent},j:function(){return this.s.type},k:function(){return this.s.originalEvent.touches},q:function(){return this.s.isDefaultPrevented()},g:function(){return this.s.shiftKey},h:function(){return _j.G.a().P?this.s.metaKey:this.s.ctrlKey},l:

Chrome Cache Entry: 158

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513
Category:	dropped
Size (bytes):	276
Entropy (8bit):	7.316609873335077
Encrypted:	false
SSDEEP:	6:XtqDFR4m68lkQfanvbEzXI0iP427cnLPw6/aqqmb/:XUD34sMDaXI0demb/
MD5:	4E3510919D29D18EEB6E3E8B2687D2F5
SHA1:	31522A9EC576A462C3F1FFA65C010D4EB77E9A85
SHA-256:	1707BE1284617ACC0A66A14448207214D55C3DA4AAF25854E137E138E089257E
SHA-512:	DFAD29E3CF9E51D1749961B47382A5151B1F3C98DEABF2B63742EB6B7F7743EE9B605D646A730CF3E087D4F07E43107C8A01FF5F68020C7BF933EBA370175682
Malicious:	false
Reputation:	low
Preview:	...........Q=o. ..+.......=t....E.k["...../g;n.,....{.......2....e.......J).8..).5.....>,.ih...^s...&M.Ta..m........C.N5.G.!.-...}.9.~........u.3..@i..qK.U.......E.........S.......A.....6...G..g...,f3g.5F..I...G@<..L.:`.N&.?R....d..(.7._....z.L.......s....

Chrome Cache Entry: 159

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 119648
Category:	downloaded
Size (bytes):	40454
Entropy (8bit):	7.992737010031678
Encrypted:	true
SSDEEP:	768:zJUZY53jznALsvTo+bJoiJRHaLurK8F2v7/t06IRN6m5n18UWUnf+:9c4XAoLo+bJvzq8F2v7F0zRN629nW
MD5:	1D65BDDAE4EAEEFC77CB9CFECC565B5D
SHA1:	A7D87150DA1DF6AE6DB87D98760DB7D753DBF6B9
SHA-256:	B98D5BA052230DB0ABC1B0E7B09D814114F6B7C316836BEB88E7B49057DAFEC0
SHA-512:	F2CF9D120D7E18AE3FD77CD85176401A3EB7DB4AF10E16D58C21D86F738FC74525A21E3A319197435E43E50E61DFA8CB2F7207962105360E7BE5652A28165944
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js
Preview:	............{{..7..y...D4e.sH.v.w......m.r.....&..b.`.P."r...~k..\(...=n#.2..5.N..N~.v'....g..G......N.~q.i.KWq.d.I..N..Z.'.,-........>.e...&Y..'ON......K\|.KQ.........^..WI.QT.oe.>..V........w.,/.Y.6..U.......Lo..U..C..{U......T....,.==.\..KrY..'wI..2wIyMw.K/.........B..{45r..r..Lw..3....I!l..lL.m....\|!..k...J...Y.......Q.I.Wt...........-....Y..mI...vs.S.TP.....]P..;j3..."..Q.]P?.+qK7.q..]J}....qt[..D.j\."....&j..3.......72.fQ..l%_..A...$.m6..>.QD@... ^F.v..2z@uao,.\|....@../....05.....4x...".I..(.._..e..R..HT.{.2O.....lT.we. _.P.'Iz..\|..y...yM..j.P...~...~6j.D.Li.e..z.tu~.lV~...qN...fg...V.7.;...<..........}...yf...`>.....g.y.<q..7.i....h..\%%.q.z.>.......^...M..u.n..1...z7t.......y..S..Bc.).....X.~.\|F.....B0..E....d.B_.Z.....[.Z./..B8.e..-U....P..]N....k.%p...l<..\......A`W^...m.J5c...._I.j.t.......Q...1..B...>^...+d.p.o.bi.D..O...~... @..m*.4.z..uLd..Bc).:.x?..`..Ey....?.2...".....2}.?.FW.\|d.~9...~.C.V..y.'..M..........`...E.77>..~?=+gs..t

Chrome Cache Entry: 160

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 11970
Category:	downloaded
Size (bytes):	4880
Entropy (8bit):	7.966397036823352
Encrypted:	false
SSDEEP:	96:ofNeE7Z1LD3/d8kYLn3N+n+D1miSZM0tGb4Ha4tAydO7dEY343WY:okQD3/d8Jd+n+s1jtGcHHtJc7dEYIGY
MD5:	03C76051E45F8BAFD592731BA31E82BB
SHA1:	58F5464CCAB2D8096ABCA4E4324DE38B7C4B829E
SHA-256:	F8D8EEB949623360942057B5ABDB018AC7AEDE91092961BA52A417F4C64700A7
SHA-512:	253A9F9D5F59AEC12DF2B69AB71414F6EA76EBD5464C66DD107347E20E303610BC371764EEFCBEC3FA031CC03A30C556486AD9DD833A2B6FAAA3714BDC2DDA95
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js
Preview:	...........Z{s..._..Fs.2.(9..RX..;[.m..LoWR2..JL)R....K.}...ERV...lfb.yp....'...........;..~:.8a.....=.:{}..pZ..E..(N...u....R.I...L.2...%..8LX$.%S..V2.$.gI.+l..Iv....3.....s}v.....q...lu..B.4S.T.0.ih.:i.X..d7.x.`..S..Y...S...!y.......`.P,.Z.<\|vI+-.\.cN..r .9..`..._..g....'K.;...........e...'N..\|[........Y1U~..\..b....%....w&nWX.'wl..X^....s).R.....z}.....h.<&r..V"!.j.7q.\|.j.'.S..O.O9s...^vz/:.#.&.J..~.;......;.y..@z.;.u.yy...)..?......'..l..i.........>.........s......[h...].^^.....v....NO\|...._...._.._......[..)is:}{..5..{.m......n%...{......7....hw.{^@.s%c....,r.{/.d.....x[..f..D..s.....1_..G.[.....A...E>.W.u"\|.Q.A.n.....+l.>...b..S..Tt....z.,..Gb20'q",..d...>....vx..@.?]..u6............9...y.n.6..k\.U..#..)...R/.b...`...<P.M~.......K.l1...Vm.xX..A............Oa...cq.......[1....@O...Z..d....X..-Gr..UI...,KD....r.v.Yii..s..Z`vl0.F.....Q....Gf.;.2.....\...X#..r.....Q.=L...D.s..d...W.@..#....I@....zmO..fA.g.v.&.......M....,N....

Chrome Cache Entry: 161

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 449028
Category:	dropped
Size (bytes):	122065
Entropy (8bit):	7.997626422878093
Encrypted:	true
SSDEEP:	3072:MWJZiGtRbjSj7NS6PV1gunmm+RWZ6tb6Km5toYKcvleGgwZHfF:MCZ7buS691gemmIg6tuvHvg+d
MD5:	AA8BC8C5EE9148CD994872B1438C5ED6
SHA1:	955C9B9B66442B43A6B6290CF54E20BBCF144E18
SHA-256:	66C62A7D3E076AAA538C7F589BB2661726F18EF9343DF6F06A714C37A04B7A61
SHA-512:	288E76CC63F72885B47515716389CD03F840237C269CB03463348A576A565D12497AD2AD52430F1888FE0F2468C755DD43D08498CF11A6CB864301B7739B8569
Malicious:	false
Reputation:	low
Preview:	...........{W.H.8....F3...a,..E.Yc..i......,...Y.J2.1......R.LU....s.AY..................Oix..).NK7...KW...........`....G/..=.....3....0y..F.0......7.l.4..i)yd.Y...$..^.@....R......%o...J..gP.7..(.7.....0..V...j..#.Yi..,.<z.c..s.0..I)b...x...&....R..8..G.ji......-......\.pL...0@/....0h,...[U.DZ..7.R.....}6./...o.....:.;w.jn.1....._..<..b.{.... ..J.....9.8{.16eA...........:B#.K,N...8.T.....$.R..8...?.R.^3...n...$......K...N..p>.....<...........9.Y.......pj{.l.J..Y..W.........A.......:py.m...+..B........l..uO...v.G..q..VMw........`.<..;;.....{}0.US..O..m..v<x..%3..Tu`...U...;.~{....c.?....?...v ..-E..2......{+.?.....va8...i...8)W.....X..7... EC.h..e....D,.GA..W.Na!..T..$k..[..2..ry .1,D}LdY=..a.>\|k...-OE/.A...}./'V/..7%#..o(a.S....e!P8..UI.#.n.{).@.I....u.va.....$z#...[.BX......l.\|.U.Q.....&s\.nT..........Z...LK.~.\|."...D;U{6......T$.C..^\|%...e..!.5..T.......R........hY...~T...Z.....s...xZ\|.vcO..)+k..Up.)#O..!Qr.#ty..

Chrome Cache Entry: 162

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5139
Entropy (8bit):	7.865234009830226
Encrypted:	false
SSDEEP:	96:oX2DsRVNYc82nTGTirCPqKO1gDPFjDiwK3aM5yO/bUlVV6JKo5N9jIMw7RLW1ZHb:ofRgc82nTprQsgDNDP7QgVVoH9+kMK9
MD5:	8B36337037CFF88C3DF203BB73D58E41
SHA1:	1ADA36FA207B8B96B2A5F55078BFE2A97ACEAD0E
SHA-256:	E4E1E65871749D18AEA150643C07E0AAB2057DA057C6C57EC1C3C43580E1C898
SHA-512:	97D8CC97C4577631D8D58C0D9276EE55E4B80128080220F77E01E45385C20FE55D208122A8DFA5DADCB87543B1BC291B98DBBA44E8A2BA90D17C638C15D48793
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...V...H.............tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:DB120779422011EA9888910153D3A5E6" xmpMM:DocumentID="xmp.did:DB12077A422011EA9888910153D3A5E6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DB120777422011EA9888910153D3A5E6" stRef:documentID="xmp.did:DB120778422011EA9888910153D3A5E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>P.WI....IDATx..]]l.......(.5.K0P..0...E.qT..J X)F.(5X....J.}(m.R5.Q...RUEUPU~.....qp@.b......L...k.m"0......"c.3

Chrome Cache Entry: 163

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 270
Category:	dropped
Size (bytes):	190
Entropy (8bit):	6.864386660871438
Encrypted:	false
SSDEEP:	3:FttwDcyj0iAIW7CiH4P7WxW87y4CC8lrkBzvsPECVpGOoAqwcMl9Xd6/zEk/:XtwDDP30rH4Pyxy4j8lrUvTUf3cwmN/
MD5:	AE9FBF7DA7492B12D4A3E8E016661379
SHA1:	4348F5D88E575FFA9CA6DF4326DB86CBFE437252
SHA-256:	3E1AA58732ED06C27F36460506AE841719F7D873AB6215F6A29ACE2144EFED32
SHA-512:	D1D28CC62F8E7E91C274719013D5AE695D1E3E45F7BEF1D4CFDECEC936C6C961427B2E40C317E381158D9F063DDE96310641352A481DEBC8C9CB06E4316A6647
Malicious:	false
Reputation:	low
Preview:	..........u....0.._e.W.u#b0...7..-A .a<...7.&...O..tl}.C0.....1F.K>.P.(..X..r......m..m....d.J..&O.m..,.-6.g{..[......`A4zj...k.OEUHUH.K..E.ib..e...#/.."...$...1.3..'.....7.7"......

Chrome Cache Entry: 164

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 90677
Category:	downloaded
Size (bytes):	32811
Entropy (8bit):	7.992877953733209
Encrypted:	true
SSDEEP:	768:fDPYSdMWwCyzH8REcKPN/8p0x7UQzlRMXv1FevViDAqA:a8REcsUp0xUQzc/8VCAV
MD5:	2E287EB418940084B921590C6E672C9E
SHA1:	1FC75A9DAA054EF88AAEA181F3A9B4CBA2B6B6E1
SHA-256:	6C2C58DAAE76131A00D1BFEE20852F372CF594BE7F4A8848ACC42F8BF72C1BBD
SHA-512:	A77F69571B0F04F4A2354D9E18E41EF86F22274EAED20C02215B632BFEF09C6543A83591E9DB3F2B4036A9684BFF666EB6A7B253BA18893500E9CD541AB752A0
Malicious:	false
Reputation:	low
URL:	https://logincdn.msauth.net/shared/5/chunks/oneds-analytics-js_077217740c853b5d4fe8.js
Preview:	...........iw.8.?.~>....%."9K'R...q:.fw.,.n_.Z.l.eRMR^b.O...A.N...yq.t,b!.....BU....4kM.Lr..I.]DE.&..TF..K.J.9.7.$....(..'?....f...tG...?y8~0..;..w;[....;.u........D.......N:W.d........E..eR...q..sJG.O.Z,....l......~.........'.d.......n.N..@.../....l'...".J3Y..n3Y...o..T...P0..j..-.....v.m7T.LM. .....Ev.7...IC.q..[.t>nj.e..OE<m...l)^.K.......8:M.&.]zz..j.X..K........'3..Tk....Z.2.GQ6..Fi._.\|v.Bf.W?...T.]:j(.%F.)..t_^........8.:..DN..8....B.>\|<..~..\|H.x.q.=-.f.~..{.z..&t...e.LfE,.;.d...n.....2..FH. .Y,.J...EC.cj. .F......o.....\...&\.J..fJiJ.S..4.5..NM]m.....Q.....e.O..iSs'........'Z..6A(Y.8..eQ.....2..I.?...;dS..I...D..@./7t.:z.......c...dF..B.......9...8)..h.........<.I...2.\FY+.=S.8...$Qv...<..IL.x".w9_..3.."-nfR.(..WDN..L.....z..I8.E..Ub......d..M.....sq.N........p..lX...A]3Y....j...%.`N..G.v..6.m.KH.M......Z..a2.N.....4....,u.O.vWM...=d..J.r`..b.....N.hzp..C..?.. ......:..M6............;.w.."B.^.ZP.N.:.[..(:...(.y.)q...

Chrome Cache Entry: 165

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	downloaded
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 166

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 11970
Category:	dropped
Size (bytes):	4880
Entropy (8bit):	7.966397036823352
Encrypted:	false
SSDEEP:	96:ofNeE7Z1LD3/d8kYLn3N+n+D1miSZM0tGb4Ha4tAydO7dEY343WY:okQD3/d8Jd+n+s1jtGcHHtJc7dEYIGY
MD5:	03C76051E45F8BAFD592731BA31E82BB
SHA1:	58F5464CCAB2D8096ABCA4E4324DE38B7C4B829E
SHA-256:	F8D8EEB949623360942057B5ABDB018AC7AEDE91092961BA52A417F4C64700A7
SHA-512:	253A9F9D5F59AEC12DF2B69AB71414F6EA76EBD5464C66DD107347E20E303610BC371764EEFCBEC3FA031CC03A30C556486AD9DD833A2B6FAAA3714BDC2DDA95
Malicious:	false
Reputation:	low
Preview:	...........Z{s..._..Fs.2.(9..RX..;[.m..LoWR2..JL)R....K.}...ERV...lfb.yp....'...........;..~:.8a.....=.:{}..pZ..E..(N...u....R.I...L.2...%..8LX$.%S..V2.$.gI.+l..Iv....3.....s}v.....q...lu..B.4S.T.0.ih.:i.X..d7.x.`..S..Y...S...!y.......`.P,.Z.<\|vI+-.\.cN..r .9..`..._..g....'K.;...........e...'N..\|[........Y1U~..\..b....%....w&nWX.'wl..X^....s).R.....z}.....h.<&r..V"!.j.7q.\|.j.'.S..O.O9s...^vz/:.#.&.J..~.;......;.y..@z.;.u.yy...)..?......'..l..i.........>.........s......[h...].^^.....v....NO\|...._...._.._......[..)is:}{..5..{.m......n%...{......7....hw.{^@.s%c....,r.{/.d.....x[..f..D..s.....1_..G.[.....A...E>.W.u"\|.Q.A.n.....+l.>...b..S..Tt....z.,..Gb20'q",..d...>....vx..@.?]..u6............9...y.n.6..k\.U..#..)...R/.b...`...<P.M~.......K.l1...Vm.xX..A............Oa...cq.......[1....@O...Z..d....X..-Gr..UI...,KD....r.v.Yii..s..Z`vl0.F.....Q....Gf.;.2.....\...X#..r.....Q.=L...D.s..d...W.@..#....I@....zmO..fA.g.v.&.......M....,N....

Chrome Cache Entry: 167

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 31504
Category:	downloaded
Size (bytes):	10932
Entropy (8bit):	7.980153556375268
Encrypted:	false
SSDEEP:	192:0YLmT2S6qMKULyA5z3v4Azpkjx3j9/Q42FuLgaFLaQWogyDWotEy:5LYi1TLvjzpkjD/7UuLhFLaQBgQWoz
MD5:	AC8D3184D07423641943601689D3087A
SHA1:	ACE51BC1E6D182A084DE045B49EF623EBC2A950F
SHA-256:	85769F4952C5365630ACA973804AECD8B18CAF4818792AA653977F2E0F637356
SHA-512:	458DF58E7513F0C51C7D89B01CC557DE999BEFACA12C5D4CAF428175644CAAA86A9F2EAF285E769B30ABDF0267931323AAF3B422D0C9DF8E59EC3C051860B6C8
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.error.strings-en.min_v1eniakvll_1x20aakd_sg2.js
Preview:	...........}.r.8..h8...6...Y..%..,.%...5..Z.d.)R.K.4....}....%....uq.z6b..E.....Ld&...i0O.08../...%./..(...~..$...>....0J.w......"../..Z..+\.O./.dS.M...y....sx./...r^....Z/...t..fx:o..w.2.3<..9..O.....%8...(.VpT..._......n..QG.s3VoS/..b..G.t.../&.2..e/..eL.(...4)=......D........K1C.6aZ.S...4L.oF....u.v.Dt?..H..gw.C...Q$V.t>.q....r<.z.-L.....0rK.N\..h......2......>.(.%.(9%.K.$..[...4w..#4:-.\|..P.m.azA.Y:...J..\ZyA........`)Fr.<.5.0Z:..O.X..E.\|.....g".....o.$.8y.`.^"..JH.....Et..P.V"y..R$..j%.`...q.#0...O\.+..F..h.(..k3.;6...M...)V.T.. 80.^..h$.....(..X.......hVi..`..0Xx...g....'...ET.<W..\....0.J...".V4.....$i.c.2......X...F.L...c.\|D.)-...I. -..l7.;.s.r?.1..[.=.0..(\|.N..H.........F.Yi..+.F.3(..a........).D..\|:...(.OL....8.....8..$D..K"......$ax...@.?.?.. .Ji.C.w.z0...j...a..3`......I....h..=..AHg.....+.\c.....U"IQ.r.k..Ham.........R<..5.... c.OB.I.Pd..R0-.\X.........T.U..9w..=t..6........`.k`^.UH.X.xA.$..:....2....^..!.^.....[0..:@.3

Chrome Cache Entry: 168

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	36
Entropy (8bit):	4.503258334775644
Encrypted:	false
SSDEEP:	3:Eq62iczBr9ks:EqdiczBys
MD5:	06B313E93DD76909460FBFC0CD98CB6B
SHA1:	C4F9B2BBD840A4328F85F54873C434336A193888
SHA-256:	B4532478707B495D0BB1C21C314AEF959DD1A5E0F66E52DAD5FC332C8B697CBA
SHA-512:	EFD7E8195D9C126883C71FED3EFEDE55916848B784F8434ED2677DF5004436F7EDE9F80277CB4675C4DEB8F243B2705A3806B412FAA8842E039E9DC467C11645
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSFwmCAmly1gHbXRIFDdFbUVISBQ1Xevf9?alt=proto
Preview:	ChgKDQ3RW1FSGgQIVhgCIAEKBw1Xevf9GgA=

Chrome Cache Entry: 169

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
Category:	downloaded
Size (bytes):	35168
Entropy (8bit):	7.99275807202193
Encrypted:	true
SSDEEP:	768:FlTfWbX2KT+Hid0L7lumndasuVyeLtCR4sqvrdYnN6UcepZtf/r6:LgbT+Hid0TFbeLtUGvrdCNqepbHr6
MD5:	D3B6AE9986DF244AB03412CC700335D0
SHA1:	BAAA1F9899178938F3881F09B18265E47DA806E3
SHA-256:	CA50059111D30C2E212C90805792EB543548AEF0D4941E886A778E3DCE0B9066
SHA-512:	755C57FBC9BECE435A477F76C5E8198CA8942C23BE667ACAB83A00E5CD4F54075B10AA07C7FDC10C38FC3D5C0C406C9132FEB5B67BA5BCCC57EF796054A84E7C
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js
Preview:	...........kC.H.0......e....0.pX..Iv3..\f..0YY.m..e$.K..o...j..g.3.lpW.......[..Y.?k.Y.......8~.a..../_.;]{.............v...0..q.Dk.w...h-....Z<..l.fA..k3.7..dm....b..-...(,.$...4...f...e...AV..z.mA....O.9........k..h-.......<Z[.GQ.v3....Oq..y:..(..k.$_...._..h-...q..S.ck.=.T......Sq@.:.A.c.(....SDq..Ac.t..m.$Lc....Z...K...O<....f9..p...0Z..3.<...$YK.x.F......v....nm..s$...&..dQ4.......n-.-.......E.XD..-5~...f.....t...-_.....fsg...8kZ..\|.{{....p+Lg.t9I..P./ap......o9Wx.._{....k..,...............................7.\|..t...Ax.7..b..v..v.m-...~v...:....r..._........,...A........:..z.>.y..u.....N...^..S.......z~@..;...n...K........x..A]....F.8X&Em..P.s.....a.g.\|.d......._..C`.xQ...\..'...QP....?.R.{?....\|.>........E4.GRz...z.k.z.}....h..>.{[E.:.....Pu. ..e6_.o.p*.w...>...:...o.k~...~..&E._..}}.}%[. ..#......z.5M.b.....z..k.H.4...l..D.o...z..M.+../..`....?y.J4.=....u.....Z.....E.d.....{0H^...8.....9..h......d..6j......../..z..V<.`.F.xm.y..yt.J....

Chrome Cache Entry: 170

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1378
Category:	downloaded
Size (bytes):	628
Entropy (8bit):	7.6610853322771
Encrypted:	false
SSDEEP:	12:X6/EjXb5e1vpPDySPLiDB/3YLZzrlDuLRndk6l3WZi1epo7IyhadSH8Ib1yfuI:X6cP5e3dgYLMk69Ii1epryt/Md
MD5:	6F68E9881DF18F8E251AB57D5786239B
SHA1:	C0F7A01A288752833390FC330995F25488BCE8EC
SHA-256:	B33E30351B2F4EF67D53D2C6DBE189A4D572425037E4F1264A0190DC4A820845
SHA-512:	B33DFF67480DF940FA0565B231E02F26840DCB5135A4A2FF3C310AA062D3D4B456FA9C8C6E2BC59EC76B515EA1B36D574A5701771BCEE7CEE97B99EF60A803C6
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_account_aad_a8332c62695d74843a11daf39a74e552.svg
Preview:	..........m.Mo.0.....]%F..6...rX.;..&i..].&HZ...#%...B..4.W$.....>....v8...f....g.O/.3k....ms.o....m...a8.......u..4>.]....r~8...%.....x.m.y].....u.>..7....l.]....i..fC.[O..z.)..r..........g!(.+....4.P9.0@.......R.......^q.I[..7.....Q;...6.N....a.d.%....:...6FE.}.......}s.`LV..Q.U. 8..}..y.&..I..a.\.8%..kgoo.Q6...>.5.8..!.....".t9].v.B) `.G6.V.E\..AJQU.7...J.oS..........@......l.....{.r..KP@......9YD..U......&..:..d......+/...(..:.S_...S......n..z.a...,.,&VB......eJR)...R.H3])>....9O.........KDi.O..#...-?D.1..N.p....h.#.Z.[/..!.h..$..S..Phdqd....}.....E>g..q5..J.T......u.....i.b...

Chrome Cache Entry: 171

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 9285
Category:	downloaded
Size (bytes):	3921
Entropy (8bit):	7.948633187405583
Encrypted:	false
SSDEEP:	96:CAQtXXFpyJsBFK/nyVtNUbGRGVQ3U1owJ6BDWkUapiSNIpI97qT:7cXXj4X/+tCGRWQk6bwxaCpI9W
MD5:	BA9DA2AE129596B81DE1FAFFB02CD0F7
SHA1:	8208ED791107C4D13D2DB619560EAC4707B03074
SHA-256:	23DC170CF8AE0615D3E4A6F406DAE6A0FC002BB3CA385C0C2957BFE7000F147B
SHA-512:	068268534557DE84E01F01EE2E9D025F4651183AA7A46D67286FD2E2482FEC84C618F1559CEE8256F9FC1F5CE1F8EB6F5808A2F67E49CBAB1C05758A80A5FA19
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js
Preview:	...........Zks.6..>..F.d2.9.f.....+;..+...V..EB......m]K.}O.$E..$..26.G..8}.....Q.(.z..#.E^h.>...Bj..Z.R.r..GJ..eo.2..4UY..X....U-^..{N..3..P;:x[w...._y..[...'.....r]D..~.nr...y=..#[-.BN............~4.uV+;.m.:..\siUi...,.KW.......a&h....)...^.N....v.3.@..a.bT.....-!\.......y.WY...J?G.i.V1.T..;;n'...U..Z ..t2...5.....E2..7PoG..s.."....z...M;Ap.z.......8..}..:\|.f8.......I2G....J..Q.....OS.T!c.s........u.....0....;.k.$............s..V..K....xa..H......h....Z.yE.s..oN.x @.gnex.}E..1;7 .A.q.f]..W.!..........7,K&2.`].Y.'..j..X.A..n.I....ZxF.W.......~6O...-..[?..~..y.M...;..=.B.^....h.k.=<...0.Z........4.......K... .1K.@.<...nY.^s..p.......J..p0..>..}5.:l..?.Y.N.Z.Bu[....GTz...`.#..d...3!...4....wzp. ..Iws...W..E.o....5{..3...I\|!.]..E. o.'M..`.. ...U.(.X# .r..:..;.D....JV.Jx..4..j....5}.B.VI....)1x5..dN...(...q.y..cF..*......$......"s$.j...M`.Bu..A2..W.....\...=+...l..6..c.E0q3....7....]....&v..]...^.....u.z.cp..4\.L,.-..(..

Chrome Cache Entry: 172

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 600 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	132
Entropy (8bit):	4.945787382366693
Encrypted:	false
SSDEEP:	3:yionv//thPnFuXf8Lts7CX9/gm6Kp0syxtuIdsvFQAahUMZ/jp:6v/lhPBR/C+aNuqsvFQA0UMpp
MD5:	3EDA15637AFEAC6078F56C9DCC9BBDB8
SHA1:	97B900884183CB8CF99BA069EEDC280C599C1B74
SHA-256:	68C66D144855BA2BC8B8BEE88BB266047367708C1E281A21B9D729B1FBD23429
SHA-512:	06B21827589FCAF63B085DB2D662737B24A39A697FF9138BDF188408647C3E90784B355F2B8390160CA487992C033CE735599271EE35873E1941812AB6C34B52
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.8069.28/resources/images/0/sprite1.mouse.png
Preview:	.PNG........IHDR...X..........x......sRGB.........gAMA......a.....pHYs..........o.d....IDATHK..1......Om.O ...j.a...\BW....IEND.B`.

Chrome Cache Entry: 173

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57443
Category:	downloaded
Size (bytes):	16326
Entropy (8bit):	7.987374325584103
Encrypted:	false
SSDEEP:	384:GTwafLJjHlgnek9V15z6Brrwb9tYt3skOUAQC1:GTtTJjHlgneqTz658ht/eAQw
MD5:	C217AE35B8592DC9F1E680487DAD094F
SHA1:	2E642562C2BFD8968629317FF212684C7EB59193
SHA-256:	D41992E79D7BCFCC1F32597208DD99033D99C04882EAFCC8508F2FA0EE728C6B
SHA-512:	EAF3BF49BCF58A7F7C39CBF35FD75862FEE98F611536080DFC794D288274CB9D67E95D0299679F7981E110B2577A47579D3623C7F11A6AC2A0CFA56AAEA2CAB0
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js
Preview:	...........}Ms#.......\.@..'F.........C)$....`.......Q.x7...}..'.}..?e#...QU]....Vo.................?........w!......=.G...P.../......8z....q._5....g..}g..31......l...],.b..;..`...Y....3..5.uGAi..NP.6<.w.(..`...y..d.N.x..^u.....^...?..N........Fq.....z..wgN./..Ep/f..c/.D4~X.W~).s/.E8...T...8,:..Q.>............4....F,&c.)n.[.pcQp...4...6...i.............CkL=....'.\..L......2.A..o.u..."p.. Xx.......'l.[w..'c/^.FP.....q.h4.R+X.x...d..M.}.Z,..RP..E.T......8 .v....Iw.X..?.r......nk....?Wj..a.\|..........JAs.j.7.....?.)..t.z.-..m.]..3y...3@.3YO.KSz]...4.b........V..+.%.[.&........l.H>G.^<..{.$"..-.i.........`qcw...`.[....as[.+.X...n..X..%,:......am."a....^o@@.`].....( (b...k..B.0.....AX.D.?...,..-<@k.;..(*..C.]...:.nn..8..s...."4.. ...J...P.n....F.3G..u..;9&.{.2.80.XB.....@.qw.:../.`.P?.+t..w6.a~..7...8k..U._......k,..o.....yQ..r.....}.E...B.r......?{...\fB....-.).Fb.;.p.N?(..P.?..p....F........)p..,`l...o@.;.x.....:..f.E....<0..#K\...K(?K/OX

Chrome Cache Entry: 174

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46090)
Category:	dropped
Size (bytes):	141866
Entropy (8bit):	5.429983887489752
Encrypted:	false
SSDEEP:	1536:PyeDOMSQ6fTPRUbx3XCg/MJA5N4ii5WLeV5guLDY2Js0VgtWiTJmxyCXP3onrGGW:wMc1g/Mq5p1Mv+UyJbBw+Icwf
MD5:	2509D4C564AFC2C77D16BA6CA509B39F
SHA1:	201F1D80F8EEA9F5E8A7A7224CFF18674344F886
SHA-256:	D468D9F009E53FE1C47B9D6FDEFA3FF1A8C239973F11A6F892848E341EA17CCD
SHA-512:	C928C36D58BB0B2740E9BE3F3CA3F49624253F8DAD93BA7524E55F24CCCAF630E35FCA8C596CBCE50A0C1214C4986034FD3E26D98F759949C179C54009D5D93E
Malicious:	false
Reputation:	low
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */!function(e){function t(t){for(var n,r,i=t[0],a=t[1],s=0,u=[];s<i.length;s++)

Chrome Cache Entry: 175

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	659798
Entropy (8bit):	5.352921769071548
Encrypted:	false
SSDEEP:	12288:nEMsQrWEWbnByixmwgXZewhYcFiG4DUIxo:nEMsJpBJgHKcFQNo
MD5:	9786D38346567E5E93C7D03B06E3EA2D
SHA1:	23EF8C59C5C9AA5290865933B29C9C56AB62E3B0
SHA-256:	263307E3FE285C85CB77CF5BA69092531CE07B7641BF316EF496DCB5733AF76C
SHA-512:	4962CDF483281AB39D339A7DA105A88ADDB9C210C9E36EA5E36611D7135D19FEC8B3C9DBA3E97ABB36D580F194F1860813071FD6CBEDE85D3E88952D099D6805
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.8093.20/scripts/boot.worldwide.1.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.1.mouse.js'] = (new Date()).getTime();..;_a.d.G=function(n,t){this.b=n;this.a=t};_a.d.G.prototype={b:0,a:0};_a.fo=function(n){this.s=n};_a.fo.prototype={s:null,t:null,i:function(){return this.s.currentTarget},e:function(){return this.t?this.t.x:this.s.pageX},f:function(){return this.t?this.t.y:this.s.pageY},o:function(){return this.s.relatedTarget},b:function(){return this.s.target},n:function(){return this.s.timeStamp\|\|+new Date},a:function(){var n=this.s.which;!n&&_a.o.a().K&&this.s.type==="keypress"&&(n=this.u());return n},u:function(){return this.s.keyCode},m:function(){return this.s.originalEvent},j:function(){return this.s.type},k:function(){return this.s.originalEvent.touches},q:function(){return this.s.isDefaultPrevented()},g:function(){return this.s.shiftKey},h:function(){return _j.G.a().P?this.s.metaKey:this.s.ctrlKey},l:

Chrome Cache Entry: 176

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 600 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	132
Entropy (8bit):	4.945787382366693
Encrypted:	false
SSDEEP:	3:yionv//thPnFuXf8Lts7CX9/gm6Kp0syxtuIdsvFQAahUMZ/jp:6v/lhPBR/C+aNuqsvFQA0UMpp
MD5:	3EDA15637AFEAC6078F56C9DCC9BBDB8
SHA1:	97B900884183CB8CF99BA069EEDC280C599C1B74
SHA-256:	68C66D144855BA2BC8B8BEE88BB266047367708C1E281A21B9D729B1FBD23429
SHA-512:	06B21827589FCAF63B085DB2D662737B24A39A697FF9138BDF188408647C3E90784B355F2B8390160CA487992C033CE735599271EE35873E1941812AB6C34B52
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.8093.17/resources/images/0/sprite1.mouse.png
Preview:	.PNG........IHDR...X..........x......sRGB.........gAMA......a.....pHYs..........o.d....IDATHK..1......Om.O ...j.a...\BW....IEND.B`.

Chrome Cache Entry: 177

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	68
Entropy (8bit):	4.925790510960767
Encrypted:	false
SSDEEP:	3:pvAP2ybsTEwTp+AFcbKRR:p4PTbsTEmpNcc
MD5:	88A9F7A8F7681BBFD0C42E3AED069D5E
SHA1:	2933C1BBE7AB6C2A20DA92400E50C69F837F5A8F
SHA-256:	0E0C579E7D9FE8DA04A7E301963EFDCB3B102436234608EC6AEDBE225BFDFE5F
SHA-512:	7C6B805474E25C3810AF30A313BCDB9323DE84706AC30FB41ADD016936143434223B7217486DE09AF87003E6862361CD7E60BB1C0B1FED2A2E49AE04ED44A8FA
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSEAlwWwY0Nini5hIFDVd69_0=?alt=proto
Preview:	CjAKLg1Xevf9GgQISxgCKiEIClIdChNAIS4jKiRfLT8rJiUvLCleKDo9EAEY/////w8=

Chrome Cache Entry: 178

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 2477
Category:	downloaded
Size (bytes):	1009
Entropy (8bit):	7.787888874744244
Encrypted:	false
SSDEEP:	24:XJKpSe6fksZVzK5nIFgOzOyW24A4NbSzW3g2whg8yiff:XJJcsve5nPvyW24A4xSKQXvf
MD5:	8984F3389334F3D6F548FC2B37F29D3A
SHA1:	201A8A7FA8C83A4DDC64EAEC3CC2C31874518FFE
SHA-256:	8B5CE863FAAAF3E3690E37ADECB9FF5BE8C16994C9EAA737A952D6C696804F32
SHA-512:	04B54B2E77D36044F8F3D54AAC71D526731AEA9A80A8789D38A3D282CA52979380F9EFFB53EC8F91A1B941D5B3B2D190CEA7524895A0C568A71E7056BC134F7F
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/check_small_48540c930333871c385fcba2c659ccdb.svg
Preview:	..........]....6.........!)Q..L..u.....vg..n..2y..2E.=.e....?\|..<^..o....r{zy..../O....^N...y...^^_/..............v....\|~<......g...n\|...o...}.-_..O.J-..9.V{."$.\..r.X...#."...\).X_S.\.5'..E.:..[........SM....H.]%.T..a[.....Q.. ..P..5..-..4.D.MT`....c+:.{..VUA...k.........5>.\|.(y.a.......w.R......uV....,EL....qE..P`..E).9.b.-.2.@.5n..z.<V.L s.c.[9.u..Lf..L...$x...C........l....^.......z....!....,..h...J(.]....e...2.:......L.T.h..X...]h..w.j..e..F....F.J.6/f..9sg..P2.9.:c5..W.\|.2..G7 .K0\|.a.}.s...".$..M4.s..E....m0.l].....&.......Z..w.&_..........$....v.XY{3C....6V\|...Vv.6...*.+...F..\|.SJ..}...+...`....G...5@..q.@b.q]...:{.Q.c....8..;.....+.HK.....T .q..U..{.o...w.....j.f..\|.S...wI....C..m.'R.1.S..s...X>.Y.m..)i...J....N".EVqK..v.m..X{..Q...e...%d...U.p.u.....G.0.N..hXg...?1.,...@....[....\|.6".J.fD..H...T6.L..$....N_.c[....Wv...K...iy....k.>t...8m.....d.T `.v.b.]=.p...nwi.........M./.o.Y.. .....n..Mk{a.,0 .}1.3...2..........W/....e?Sz.

Chrome Cache Entry: 179

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513
Category:	downloaded
Size (bytes):	276
Entropy (8bit):	7.316609873335077
Encrypted:	false
SSDEEP:	6:XtqDFR4m68lkQfanvbEzXI0iP427cnLPw6/aqqmb/:XUD34sMDaXI0demb/
MD5:	4E3510919D29D18EEB6E3E8B2687D2F5
SHA1:	31522A9EC576A462C3F1FFA65C010D4EB77E9A85
SHA-256:	1707BE1284617ACC0A66A14448207214D55C3DA4AAF25854E137E138E089257E
SHA-512:	DFAD29E3CF9E51D1749961B47382A5151B1F3C98DEABF2B63742EB6B7F7743EE9B605D646A730CF3E087D4F07E43107C8A01FF5F68020C7BF933EBA370175682
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/arrow_left_43280e0ba671a1d8b5e34f1931c4fe4b.svg
Preview:	...........Q=o. ..+.......=t....E.k["...../g;n.,....{.......2....e.......J).8..).5.....>,.ih...^s...&M.Ta..m........C.N5.G.!.-...}.9.~........u.3..@i..qK.U.......E.........S.......A.....6...G..g...,f3g.5F..I...G@<..L.:`.N&.?R....d..(.7._....z.L.......s....

Chrome Cache Entry: 180

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 9285
Category:	dropped
Size (bytes):	3921
Entropy (8bit):	7.948633187405583
Encrypted:	false
SSDEEP:	96:CAQtXXFpyJsBFK/nyVtNUbGRGVQ3U1owJ6BDWkUapiSNIpI97qT:7cXXj4X/+tCGRWQk6bwxaCpI9W
MD5:	BA9DA2AE129596B81DE1FAFFB02CD0F7
SHA1:	8208ED791107C4D13D2DB619560EAC4707B03074
SHA-256:	23DC170CF8AE0615D3E4A6F406DAE6A0FC002BB3CA385C0C2957BFE7000F147B
SHA-512:	068268534557DE84E01F01EE2E9D025F4651183AA7A46D67286FD2E2482FEC84C618F1559CEE8256F9FC1F5CE1F8EB6F5808A2F67E49CBAB1C05758A80A5FA19
Malicious:	false
Reputation:	low
Preview:	...........Zks.6..>..F.d2.9.f.....+;..+...V..EB......m]K.}O.$E..$..26.G..8}.....Q.(.z..#.E^h.>...Bj..Z.R.r..GJ..eo.2..4UY..X....U-^..{N..3..P;:x[w...._y..[...'.....r]D..~.nr...y=..#[-.BN............~4.uV+;.m.:..\siUi...,.KW.......a&h....)...^.N....v.3.@..a.bT.....-!\.......y.WY...J?G.i.V1.T..;;n'...U..Z ..t2...5.....E2..7PoG..s.."....z...M;Ap.z.......8..}..:\|.f8.......I2G....J..Q.....OS.T!c.s........u.....0....;.k.$............s..V..K....xa..H......h....Z.yE.s..oN.x @.gnex.}E..1;7 .A.q.f]..W.!..........7,K&2.`].Y.'..j..X.A..n.I....ZxF.W.......~6O...-..[?..~..y.M...;..=.B.^....h.k.=<...0.Z........4.......K... .1K.@.<...nY.^s..p.......J..p0..>..}5.:l..?.Y.N.Z.Bu[....GTz...`.#..d...3!...4....wzp. ..Iws...W..E.o....5{..3...I\|!.]..E. o.'M..`.. ...U.(.X# .r..:..;.D....JV.Jx..4..j....5}.B.VI....)1x5..dN...(...q.y..cF..*......$......"s$.j...M`.Bu..A2..W.....\...=+...l..6..c.E0q3....7....]....&v..]...^.....u.z.cp..4\.L,.-..(..

Chrome Cache Entry: 181

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (59783), with CRLF line terminators
Category:	downloaded
Size (bytes):	663451
Entropy (8bit):	5.3635307555313165
Encrypted:	false
SSDEEP:	12288:YhqblwQ9eTw/suNyIzaJS/pWYawUWufSxwDr2o/5YP1B:Yhqblt9e8/sMzaJS/pWYawUWufSxwDrW
MD5:	761CE9E68C8D14F49B8BF1A0257B69D6
SHA1:	8CF5D714D35EFFA54F3686065CB62CCE028E2C77
SHA-256:	BEAA65AD34340E61E9E701458E2CCFF8F9073FDEBBC3593A2C7EC8AFEACB69C1
SHA-512:	CEC948666FBA0F56D3DA27A931033C3A581C9C00FEC4D3DDCF41324525B5B5321AE3AB89581ECC7F497DE85EF684AB277C8A2DB393D526416CEB76C91A1B9263
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.8093.20/scripts/boot.worldwide.0.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.0.mouse.js'] = (new Date()).getTime();../* Empty file */;Function.__typeName="Function";Function.__class=!0;Function.createCallback=function(n,t){return function(){var r=arguments.length;if(r>0){for(var u=[],i=0;i<r;i++)u[i]=arguments[i];u[r]=t;return n.apply(this,u)}return n.call(this,t)}};Function.prototype.bind=Function.prototype.bind\|\|function(n){if(typeof this!="function")throw new TypeError("bind(): we can only bind to functions");var u=Array.prototype.slice.call(arguments,1),r=this,t=function(){},i=function(){return r.apply(this instanceof t?this:n,u.concat(Array.prototype.slice.call(arguments)))};this.prototype&&(t.prototype=this.prototype);i.prototype=new t;return i};Function.createDelegate=function(n,t){return function(){return t.apply(n,arguments)}};Function.emptyFunction=Function.emptyMethod=function(){};Error.__typeNam

Chrome Cache Entry: 182

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1378
Category:	dropped
Size (bytes):	628
Entropy (8bit):	7.6610853322771
Encrypted:	false
SSDEEP:	12:X6/EjXb5e1vpPDySPLiDB/3YLZzrlDuLRndk6l3WZi1epo7IyhadSH8Ib1yfuI:X6cP5e3dgYLMk69Ii1epryt/Md
MD5:	6F68E9881DF18F8E251AB57D5786239B
SHA1:	C0F7A01A288752833390FC330995F25488BCE8EC
SHA-256:	B33E30351B2F4EF67D53D2C6DBE189A4D572425037E4F1264A0190DC4A820845
SHA-512:	B33DFF67480DF940FA0565B231E02F26840DCB5135A4A2FF3C310AA062D3D4B456FA9C8C6E2BC59EC76B515EA1B36D574A5701771BCEE7CEE97B99EF60A803C6
Malicious:	false
Reputation:	low
Preview:	..........m.Mo.0.....]%F..6...rX.;..&i..].&HZ...#%...B..4.W$.....>....v8...f....g.O/.3k....ms.o....m...a8.......u..4>.]....r~8...%.....x.m.y].....u.>..7....l.]....i..fC.[O..z.)..r..........g!(.+....4.P9.0@.......R.......^q.I[..7.....Q;...6.N....a.d.%....:...6FE.}.......}s.`LV..Q.U. 8..}..y.&..I..a.\.8%..kgoo.Q6...>.5.8..!.....".t9].v.B) `.G6.V.E\..AJQU.7...J.oS..........@......l.....{.r..KP@......9YD..U......&..:..d......+/...(..:.S_...S......n..z.a...,.,&VB......eJR)...R.H3])>....9O.........KDi.O..#...-?D.1..N.p....h.#.Z.[/..!.h..$..S..Phdqd....}.....E>g..q5..J.T......u.....i.b...

Chrome Cache Entry: 183

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	low
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 184

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	659798
Entropy (8bit):	5.352921769071548
Encrypted:	false
SSDEEP:	12288:nEMsQrWEWbnByixmwgXZewhYcFiG4DUIxo:nEMsJpBJgHKcFQNo
MD5:	9786D38346567E5E93C7D03B06E3EA2D
SHA1:	23EF8C59C5C9AA5290865933B29C9C56AB62E3B0
SHA-256:	263307E3FE285C85CB77CF5BA69092531CE07B7641BF316EF496DCB5733AF76C
SHA-512:	4962CDF483281AB39D339A7DA105A88ADDB9C210C9E36EA5E36611D7135D19FEC8B3C9DBA3E97ABB36D580F194F1860813071FD6CBEDE85D3E88952D099D6805
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.8093.17/scripts/boot.worldwide.1.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.1.mouse.js'] = (new Date()).getTime();..;_a.d.G=function(n,t){this.b=n;this.a=t};_a.d.G.prototype={b:0,a:0};_a.fo=function(n){this.s=n};_a.fo.prototype={s:null,t:null,i:function(){return this.s.currentTarget},e:function(){return this.t?this.t.x:this.s.pageX},f:function(){return this.t?this.t.y:this.s.pageY},o:function(){return this.s.relatedTarget},b:function(){return this.s.target},n:function(){return this.s.timeStamp\|\|+new Date},a:function(){var n=this.s.which;!n&&_a.o.a().K&&this.s.type==="keypress"&&(n=this.u());return n},u:function(){return this.s.keyCode},m:function(){return this.s.originalEvent},j:function(){return this.s.type},k:function(){return this.s.originalEvent.touches},q:function(){return this.s.isDefaultPrevented()},g:function(){return this.s.shiftKey},h:function(){return _j.G.a().P?this.s.metaKey:this.s.ctrlKey},l:

Chrome Cache Entry: 185

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113766
Category:	downloaded
Size (bytes):	35170
Entropy (8bit):	7.993669499179372
Encrypted:	true
SSDEEP:	768:u9kHX02Kz4HS90LgehZHDTBrsFThxVLqj4Ryfs6dBv9TzrP:334z4HS90phZ5rsFdtW3v9TnP
MD5:	4B27E3FE40C38D759030BD63BAD5D5BC
SHA1:	F6427020AEFBC66EA6D36B5BB86D2F8CC327581C
SHA-256:	1F979704AF851D1131AEB02E5E4B5C67798B5488DE0BA7C76FE1B873FD535A34
SHA-512:	97685335D0A8986D7BD1262A251D83AE50C207B0CCC25410CE97D2438D44D4948E6F34903EBD8564FB224CB8BFF14C6A63470C7DFB9FB63084CA32F28162094E
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergederror_stringcustomizationhelper_a7fa53f8687b4e38205f.js
Preview:	...........kC.H.0......e....0.pX..Iv3..\f..0YY.m..e$.K..o...j..g.3.lpW.......[..Y.?k.Y.......8~.a..../_.;]{.............v...0..q.Dk.w...h-....Z<..l.fA..k3.7..dm....b..-...(,.$...4...f...e...AV..z.mA....O.9........k..h-.......<Z[.GQ.v3....Oq..y:..(..k.$_...._..h-...q..S.ck.=.T......Sq@.:.A.c.(....SDq..Ac.t..m.$Lc....Z...K...O<....f9..p...0Z..3.<...$YK.x.F......v....nm..s$...&..dQ4.......n-.-.......E.XD..-5~...f.....t...-_.....fsg...8kZ..\|.{{....p+Lg.t9I..P./ap......o9Wx.._{....k..,...............................7.\|..t...Ax.7..b..v..v.m-...~v..Z....r..._........,...A........:....\|..t.. [.C..f...N..S..kz~.Z.....k.j,.W.j$.kw.*,........(........~.....&..i...Y.]2..8.........-...O.(......m.....~<.&..v}.......o.hr.........f....c-....}V....uz.e' ...A...l.>...T....~}}...Xu28.!....../..&L.t.va..d.J..A..G.z.;...bk...<.E....b..l..ir.?..&.n.`.......Wdw_l....?~...h.{.%.N.0..<..d+.i;.........`....#.q..._As....5pKq....l..\...";{_...:.x...<......T...F.<(...[

Chrome Cache Entry: 186

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	182
Entropy (8bit):	5.111382121361486
Encrypted:	false
SSDEEP:	3:PouVKQnFqDmJS4RKYPOyzAEtGFUvzUbG3SQLDUfQ3zfc7MBWhtoAc9Zxu:h4Qn4mc4sLWAEtSUbU63lUYDfYMch07U
MD5:	B74499BDA902C84D1468A84DA5F443FB
SHA1:	0A3259A9852BE07405F10D39293466137C44BB4F
SHA-256:	0BA26423ED3348AE5C95A103E7D7AF6EA3B202C4A4830EFF7D609558925A5382
SHA-512:	B82A3F5996F65F36565E066845E673B7AB1587F6A64B7CD41225A5867CE6CFC38CE0DB7349AA0855C23F2E562C26D932EF53DB9DA9E42228D58C54B0DC6EBBD4
Malicious:	false
Reputation:	low
URL:	https://fpt.live.com/?session_id=a1a476821133ba4d4b62508a3f1846fc&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SI
Preview:	<!DOCTYPE html>..<html xmlns="http://www.w3.org/1999/xhtml">..<head>.. <title></title>.. <script>window.parent.postMessage('dfp:OK', '*');</script>..</head>..<body/>..</html>..

Chrome Cache Entry: 187

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 379
Category:	downloaded
Size (bytes):	254
Entropy (8bit):	7.066074991728423
Encrypted:	false
SSDEEP:	6:XtS8G99k8e6my4IIFqXUJ59lDFCnhUGlZX8My/dOtrE:XAH99kRX1YQBDFCnDXdWYtrE
MD5:	847A4212B99B9076EE39328B24CD30AF
SHA1:	73F15078CF1D396485F644A79B6E25EF0637685D
SHA-256:	29DC0C26C372805325EB7EB926769E832A60B47BEF96A66436EC3EC05CD6128E
SHA-512:	9AF77E9ED8BD9A39A47F36AAC2D01B5AF5D56C04CD933427DF95CC80904D7EE7AC3F7F9443D8AEF236CC84FB4DC4CC335AF0BF8F9BC0C13D720187096D149220
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_account_msa_3b879963b4f70829fd7a25cbc9519792.svg
Preview:	..........mP.n. ...D.xY0.\..{. 7...y.F!.....T..Y.Y..n...q^.[O}..w.SJ.j..3.....%)....x.f.K}..}\.=E.D....!.n.......Ma..G.=+.%.w..WX...9.A...........X...V...bOB&2.H....15{.fT...V-.#..m..f...V2<...~....l%4.....Ie.TL69.....vW.....v.3.v.O..}..{...

Chrome Cache Entry: 188

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	low
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 189

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 270
Category:	downloaded
Size (bytes):	190
Entropy (8bit):	6.864386660871438
Encrypted:	false
SSDEEP:	3:FttwDcyj0iAIW7CiH4P7WxW87y4CC8lrkBzvsPECVpGOoAqwcMl9Xd6/zEk/:XtwDDP30rH4Pyxy4j8lrUvTUf3cwmN/
MD5:	AE9FBF7DA7492B12D4A3E8E016661379
SHA1:	4348F5D88E575FFA9CA6DF4326DB86CBFE437252
SHA-256:	3E1AA58732ED06C27F36460506AE841719F7D873AB6215F6A29ACE2144EFED32
SHA-512:	D1D28CC62F8E7E91C274719013D5AE695D1E3E45F7BEF1D4CFDECEC936C6C961427B2E40C317E381158D9F063DDE96310641352A481DEBC8C9CB06E4316A6647
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/close_790189870c9543725dc3f5a15fb25e46.svg
Preview:	..........u....0.._e.W.u#b0...7..-A .a<...7.&...O..tl}.C0.....1F.K>.P.(..X..r......m..m....d.J..&O.m..,.-6.g{..[......`A4zj...k.OEUHUH.K..E.ib..e...#/.."...$...1.3..'.....7.7"......

Chrome Cache Entry: 190

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 191

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5139
Entropy (8bit):	7.865234009830226
Encrypted:	false
SSDEEP:	96:oX2DsRVNYc82nTGTirCPqKO1gDPFjDiwK3aM5yO/bUlVV6JKo5N9jIMw7RLW1ZHb:ofRgc82nTprQsgDNDP7QgVVoH9+kMK9
MD5:	8B36337037CFF88C3DF203BB73D58E41
SHA1:	1ADA36FA207B8B96B2A5F55078BFE2A97ACEAD0E
SHA-256:	E4E1E65871749D18AEA150643C07E0AAB2057DA057C6C57EC1C3C43580E1C898
SHA-512:	97D8CC97C4577631D8D58C0D9276EE55E4B80128080220F77E01E45385C20FE55D208122A8DFA5DADCB87543B1BC291B98DBBA44E8A2BA90D17C638C15D48793
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png
Preview:	.PNG........IHDR...V...H.............tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:DB120779422011EA9888910153D3A5E6" xmpMM:DocumentID="xmp.did:DB12077A422011EA9888910153D3A5E6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DB120777422011EA9888910153D3A5E6" stRef:documentID="xmp.did:DB120778422011EA9888910153D3A5E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>P.WI....IDATx..]]l.......(.5.K0P..0...E.qT..J X)F.(5X....J.}(m.R5.Q...RUEUPU~.....qp@.b......L...k.m"0......"c.3

Chrome Cache Entry: 192

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 193

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113378
Category:	downloaded
Size (bytes):	20400
Entropy (8bit):	7.980289584022803
Encrypted:	false
SSDEEP:	384:8RvmaMFysnOXZ2m9zM+udO6GGUpeAU02oDGnN5EsQwWUQGGwDO8Ua:8pmm7ZFM+ObGGUIjN5PJV3PDDUa
MD5:	F0DE9A98DBDFA8C02742CE6D92FB2524
SHA1:	CDEC682AEB9E39EDCCC2374DAB26F04DB754A8B5
SHA-256:	FAF4294F27A542B0F9EA2A7CB2711529AB027CD84A5F5BADFAE752100855E6BE
SHA-512:	856FC9AB199997E69A9487372BC0083564F7115B3E0678CF1D542B9864E9A88D5FFB85697FD93538DC9439071E3BCD4B8BCCBFC610E1A45DE104D6362D8ADCD9
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_nin8k2ycrbzww8zl5vxkaq2.css
Preview:	...........}k..6..w...R..J.H=GSI..x.9...}T.....)Q..f<...~.F.h..x..{+.-.....h..n....</v.ev......W.,.bU..rW.I...0x...C..2...6]..W_......../x.........~.z.}.\|.#x......AgO.\|XgU...4 .^'U...mP.A.].Z.U.!..Y.......:.ve.?.!..d.N...xJ...mR......0.@p...lKr/...E.-. .....\|l.4.o.i.......L.iF..T{.n....2....VEY.y=..=..T+V./.b....\....7.sH.w{.h.....!.."F.k.!.......d...mS.rh.&G.../..h&..RE"!.A/.......A....L...8.q.M...t[...R...>.6;R..^.Vu..9.[F........>A.:HT}w]......2........p......'T.^]}.^..yJ>.<..pq..h.\|..j....j.x..-...c...f...=".)..U.X'.M..l.]ZVtl\.I..}.0.~B0Y'.N...E.4.Xd..e...a.........."..9+d.&..l.$E..R.u.g.Q..w&...~I. .y..D.4;..'.."-.....b...)k.n.M...,3J.z_..&2f.h;.&.R.y..P..X.....\P.....r...B.$........<....H5.M.."'#.6mQl..mQ5.=.\...O.....^..jM..u.F..Oh.lNI..j..T..u...I..._........{.\...{..._\|..={O..z..>......x..5Q.D7?{...^...^.......o.=.z......v......z.C...Gtw...0!..M@....^...^.x..G....W...{...)..y.<c3...^>{......7._..'d__...;R.

Chrome Cache Entry: 194

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2, software=paint.net 4.2.9], baseline, precision 8, 50x28, components 3
Category:	downloaded
Size (bytes):	987
Entropy (8bit):	6.922003634904799
Encrypted:	false
SSDEEP:	24:PJjxEK0nWpBzo0XxDuLHeOWXG4OZ7DAJuLHenX3D+VRmK9cR+w/b:lxEX4OuERAVwR/QP/b
MD5:	E58AAFC980614A9CD7796BEA7B5EA8F0
SHA1:	D4CAC92DCDE0CAF7C571E6D791101DA94FDBD2CA
SHA-256:	8B34A475187302935336BF43A2BF2A4E0ADB9A1E87953EA51F6FCF0EF52A4A1D
SHA-512:	2DAC06596A11263DF1CFAB03EDA26D0A67B9A4C3BAA6FB6129CDBF0A157C648F5B0F5859B5CA689EFDF80F946BF4D854BA2B2C66877C5CE3897D72148741FCC9
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/appbackgrounds/49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg
Preview:	......JFIF.....H.H.....fExif..MM..................>...........F.(...........1.........N.......H.......H....paint.net 4.2.9....C....................................................................C.........................................................................2..!............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......[.4..lz.....K.S..p.>.9.r9j..'.\.qrW..mo...X9ZV<./x...EX...m.Prj..A.EtG...K..mr....Lc.T.8...nlY.V.{6...R...]..(.y...)^.5V.IVO.W.B.19.R\...f.U.....'..S:..k.6..).f.n._3*....}.y.8.EusH..y.`.mA...W.}...bL..:..b.<f..(lH#R....v._...........9N~S..

Chrome Cache Entry: 195

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	660449
Entropy (8bit):	5.4121922690110535
Encrypted:	false
SSDEEP:	12288:3PUKyvwjOOvwZ1ARuxntuicBh8hS11dsUA:yvjZ+/pIUA
MD5:	D9E3D2CE0228D2A5079478AAE5759698
SHA1:	412F45951C6AEDA5F3DF2C52533171FC7BDD5961
SHA-256:	7041D585609800051E4F451792AEC2B8BD06A4F2D29ED6F5AD8841AAE5107502
SHA-512:	06700C65BEF4002EBFBFF9D856C12E8D71F408BACA2D2103DDE1C28319B6BD3859FA9D289D8AEB6DD484E802040F6EE537F31F97B4B60A6B120A6882C992207A
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.8069.28/scripts/boot.worldwide.3.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.3.mouse.js'] = (new Date()).getTime();..;_n.a.jR=function(n){return n.dS()};_n.a.jZ=function(n){return n.eh()};_n.a.jP=function(n){return n.cC()};_n.a.jQ=function(n){return n.ca()};_n.a.hZ=function(n){return n.dO};_n.a.jU=function(n){return n.ed()};_n.a.jT=function(n){return n.ea()};_n.a.kb=function(n){return n.ej()};_n.a.hM=function(n){return 300};_n.a.fh=function(n){return n.V};_n.a.jV=function(n){return n.bI()};_n.a.ie=function(n){return n.mh()};_n.a.km=function(n){return n.bl()};_n.a.ka=function(n){return n.ei()};_n.a.ko=function(n){return n.cV()};_n.a.eX=function(n){return _y.E.isInstanceOfType(n)?n.y:null};_n.a.jN=function(n){return n.c()};_n.a.gm=function(n){return n.b()};_n.a.jM=function(n){return n.b()};_n.a.ib=function(n){return n.jM()};_n.a.iq=function(n){return n.bG};_n.a.iX=function(n){return _n.V.isInstanceOfType(n)?n

Chrome Cache Entry: 196

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	662286
Entropy (8bit):	5.315860951951661
Encrypted:	false
SSDEEP:	12288:YfmmzLJTD/JilMGk4hBR310FaHHxpJy7qVfb4cSPo:Yfm+T7US7SR310FaHHTJy7qJ4rPo
MD5:	12204899D75FC019689A92ED57559B94
SHA1:	CCF6271C6565495B18C1CED2F7273D5875DBFB1F
SHA-256:	39DAFD5ACA286717D9515F24CF9BE0C594DFD1DDF746E6973B1CE5DE8B2DD21B
SHA-512:	AA397E6ABD4C54538E42CCEDA8E3AA64ACE76E50B231499C20E88CF09270AECD704565BC9BD3B27D90429965A0233F99F27697F66829734FF02511BD096CF030
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.8093.17/scripts/boot.worldwide.2.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.2.mouse.js'] = (new Date()).getTime();.._y.lC=function(){};_y.lC.registerInterface("_y.lC");_y.jw=function(){};_y.jw.registerInterface("_y.jw");_y.lA=function(){};_y.lA.registerInterface("_y.lA");var IDelayedSendEvent=function(){};IDelayedSendEvent.registerInterface("IDelayedSendEvent");var IIsShowingComposeInReadingPaneEvent=function(){};IIsShowingComposeInReadingPaneEvent.registerInterface("IIsShowingComposeInReadingPaneEvent");var ISendFailedO365Event=function(){};ISendFailedO365Event.registerInterface("ISendFailedO365Event");var ISendFailureRemoveO365Event=function(){};ISendFailureRemoveO365Event.registerInterface("ISendFailureRemoveO365Event");_y.gw=function(){};_y.gw.registerInterface("_y.gw");_y.iB=function(){};_y.iB.registerInterface("_y.iB");_y.ih=function(){};_y.ih.registerInterface("_y.ih");_y.jy=function(){};_y.jy.regis

Chrome Cache Entry: 197

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 600 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	132
Entropy (8bit):	4.945787382366693
Encrypted:	false
SSDEEP:	3:yionv//thPnFuXf8Lts7CX9/gm6Kp0syxtuIdsvFQAahUMZ/jp:6v/lhPBR/C+aNuqsvFQA0UMpp
MD5:	3EDA15637AFEAC6078F56C9DCC9BBDB8
SHA1:	97B900884183CB8CF99BA069EEDC280C599C1B74
SHA-256:	68C66D144855BA2BC8B8BEE88BB266047367708C1E281A21B9D729B1FBD23429
SHA-512:	06B21827589FCAF63B085DB2D662737B24A39A697FF9138BDF188408647C3E90784B355F2B8390160CA487992C033CE735599271EE35873E1941812AB6C34B52
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.8093.20/resources/images/0/sprite1.mouse.png
Preview:	.PNG........IHDR...X..........x......sRGB.........gAMA......a.....pHYs..........o.d....IDATHK..1......Om.O ...j.a...\BW....IEND.B`.

Chrome Cache Entry: 198

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 199

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 200

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	660449
Entropy (8bit):	5.4121922690110535
Encrypted:	false
SSDEEP:	12288:3PUKyvwjOOvwZ1ARuxntuicBh8hS11dsUA:yvjZ+/pIUA
MD5:	D9E3D2CE0228D2A5079478AAE5759698
SHA1:	412F45951C6AEDA5F3DF2C52533171FC7BDD5961
SHA-256:	7041D585609800051E4F451792AEC2B8BD06A4F2D29ED6F5AD8841AAE5107502
SHA-512:	06700C65BEF4002EBFBFF9D856C12E8D71F408BACA2D2103DDE1C28319B6BD3859FA9D289D8AEB6DD484E802040F6EE537F31F97B4B60A6B120A6882C992207A
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.8093.17/scripts/boot.worldwide.3.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.3.mouse.js'] = (new Date()).getTime();..;_n.a.jR=function(n){return n.dS()};_n.a.jZ=function(n){return n.eh()};_n.a.jP=function(n){return n.cC()};_n.a.jQ=function(n){return n.ca()};_n.a.hZ=function(n){return n.dO};_n.a.jU=function(n){return n.ed()};_n.a.jT=function(n){return n.ea()};_n.a.kb=function(n){return n.ej()};_n.a.hM=function(n){return 300};_n.a.fh=function(n){return n.V};_n.a.jV=function(n){return n.bI()};_n.a.ie=function(n){return n.mh()};_n.a.km=function(n){return n.bl()};_n.a.ka=function(n){return n.ei()};_n.a.ko=function(n){return n.cV()};_n.a.eX=function(n){return _y.E.isInstanceOfType(n)?n.y:null};_n.a.jN=function(n){return n.c()};_n.a.gm=function(n){return n.b()};_n.a.jM=function(n){return n.b()};_n.a.ib=function(n){return n.jM()};_n.a.iq=function(n){return n.bG};_n.a.iX=function(n){return _n.V.isInstanceOfType(n)?n

Chrome Cache Entry: 201

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 26668
Category:	downloaded
Size (bytes):	7396
Entropy (8bit):	7.976611464277348
Encrypted:	false
SSDEEP:	192:kqZJHI2ENUqioi4id7Cf05lG39Vpj0c5fZVnTsvbL0eiHeqXKfK:kWJaUq9i4O7Vf49/0EZVnTsDoeoBKfK
MD5:	48C27946ED9410E6D7D1B3943FB9CE1B
SHA1:	EE9E887F2003233B4E253580D6CAA7847901287A
SHA-256:	7F3A4F17869661B043C41FF8E40814A07DA0CE726F26BB28D8C7D6CDD00E4CDF
SHA-512:	054FE4C8F7F7CE36FC9492700C86132D8E54C68EC6B14193736D7D826019C705D7ED6EE3FCE476079C30FAA6228EA7EB5F838A7096C6E9FB2CD949BD8E27F53B
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_89db715e3340a2e8ecd8.js
Preview:	...........]mw.6.......q.-..I...e}...ql..$.&9:..I.).%!...~g.....$..{.UO-..........<.....j[....`.r.].h......_..A..x}:.).?...6......I...Pc....#.;.&.....h..4>.Z.........F#........zN.Z.g.@..5....e..~O..2.TsBOP.."L.6.=.k...N.7.......S....I2..j.Dsb.%.kc......X3...nd....._......._....h...6,..f.....[.A.L[.y.}1.?.h .Y".......]nV.....Y...A.X..J.w..DP!...$vB.y..L.3.)......MGK.E.....h.Y....V._..535........M....bk.....C.r.%....O.#.e....O.'...+..........D68.....\|..hGl..a.W.,.nE..L.. ...#lC......Z......?.@..t.9../ ..V...}.d..<...><{..~...k<.]..NIH.q{..m.?3H._....k. .\|}o...^... .../...;....2..;.9...&..].1.G......$B2.Y.........1\|...... S,}a.!..m."k.td....>.Ay...........L..A...Q...z.y.....C(:Nxr..,&3.7Oi...m.\|....&.....fB..u*E... "j&..@T......tC..}......s..:3JFp..I.8.s....t.%.M...>......./.V.$..4. f.(....b@...s...3.(.5..&gPL.}..R..c.t...^......).\|.h.f{...hO.......p...P.x8.}(..#..+.....q..wB.!.)[`.J!#.D......\|8O...i.......$....'..R....'.8l..e..<..+r..#..E..@.D.7B

Chrome Cache Entry: 202

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	low
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 203

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2622), with CRLF line terminators
Category:	downloaded
Size (bytes):	2743
Entropy (8bit):	5.662042719154843
Encrypted:	false
SSDEEP:	48:t1XXw+kOhX/BxVgnK/Q6GiuGq9juwbae13NhcKBLd4JAaDoir0ZemPPp92OEIIQ/:H9W3iuV96wDrHBZ4JAaDToZ7UO1n/
MD5:	73783D271FF69A837676C457ABE09971
SHA1:	FC6B91EC5456A029B622D71E57796B168168ECC5
SHA-256:	1E1149C208E549305661DB705FB035261A2746577C99CF4D33852E98ED8FC375
SHA-512:	F66C9C6990168330A3A5810B80581AC9FBC66B9D2BC5DF77F31B85D0B9A1360CE5E8B5D4EDB05C98A222BEC207B7E6A8CCF5CCF2573376106A7189F08C0BD6C1
Malicious:	false
Reputation:	low
URL:	https://fpt2.microsoft.com/Clear.HTML?ctx=Ls1.0&wl=False&session_id=a1a476821133ba4d4b62508a3f1846fc&id=75399bdd-660e-d6f5-a9d3-46d7d9fd26db&w=8DCF4418A980C2F&tkt=taBcrIH61PuCVH7eNCyH0F58uBDuZFZOunQHZt3FuglU5xhm6Jz5fjLB87lht%252foTzlN4Q8K6ok7CIe4o34X3QJHWLPglxWByfQmm5q7CFQgd6hTqTdB82eNIzFyFgUC10btVn65bck1qSFkck06HufyJdYSPrDRBccn0LcWo53a%252brbWx%252buJtqH9Zx1vfYFHq45yNV84P%252bPmPHcaOvYVqJynKdv%252bUdcJHHj5gJA%252fyUwkAMTtUgafq4U0YoXd1BJtpxliFlVhm5rk%252bk6ZJJlP2kzbhshq0VtXg01T6tHp3xV0%252bMD%252bPSb00ZC%252bQrRQW0dmI&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d
Preview:	<!DOCTYPE html>..<html xmlns="http://www.w3.org/1999/xhtml">..<head>.. <title></title>..</head>..<script>function BaseStamp() { this.GetStorageQsInfo = function () { if (window.localStorage) { var n = window.localStorage.getItem(lsKey); var lsupd = "False"; if (lsupd === "true" && n) { var xhr = new XMLHttpRequest(), method = "GET", url = target + "updatels.html?ofid=" + n + "&session_id=" + sid + "&CustomerId=" + cid; xhr.open(method, url, true); xhr.onreadystatechange = function () { if (xhr.readyState === XMLHttpRequest.DONE && xhr.status === 200) { var update = xhr.responseText; if (update && update.toLowerCase() === "true") { window.localStorage.setItem(lsKey, id); } } }; xhr.send(); } if (n && n != null && n != "" \|\| (window.localStorage.setItem(lsKey, id), n = id), id != n) return "session_id=" + sid + "&CustomerId=" + cid + "&fid=" + id + "&ofid=" + n + "&w=" + ticks + "&auth=" + encodeURIComponent(authKey) } return "" }; this.newXMLHttp = function () { var n = null; return

Chrome Cache Entry: 204

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	6
Entropy (8bit):	2.584962500721156
Encrypted:	false
SSDEEP:	3:fCu:au
MD5:	AAAB7A355103063D9EEB4824A3A6B374
SHA1:	E51555F02C32321F3E48F07A0FA5AF46DF835BFC
SHA-256:	79BA862622D6FA84AC7E4F98EB95043A255FC2C81711E9400A8AA4D4B1608471
SHA-512:	D1A0C9C4F628459F5CA904405B2A66A69425A50E8DCE1BAA43161D784EB219BD3E1FD9447BCBACC314652EDA08CF0B02C863C87F3AC1534AE0F62A414C191F1B
Malicious:	false
Reputation:	low
URL:	https://fpt.live.com/Images/Clear.PNG?ctx=jscb1.0&session_id=a1a476821133ba4d4b62508a3f1846fc&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&esi=YnVhPU1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMTcuMC4wLjAgU2FmYXJpLzUzNy4zNiZvcz1XaW4zMiZscHJvYz00Jm9sPXRydWUmcnR0PTI1MCZjaHJtPXRydWUmcHJvc3ViPTIwMDMwMTA3JmV2YWw9MzMmYXBwdj01LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2JmxzPXRydWUmZG09OCZtdHA9MCZuYz03NCZwcj0xJnNyPTEyODB4MTAyNCZzY2Q9MjQmYXNyPTEyODB4OTg0JnR6PS0zMDAmZHN0PTYwJnR6bz0tMjQwJmJsPWVuLVVTJm10aD0yN2Y1MWQzMTQ5ZTZiZjIwOWI2NmJkMzg3YjBhZjNjNCZtdG49MiZwbj01JnBoPWYzYWMyMmFjNTljNmRjYjg3NDEwOWQwOTNjNTI1NWU4JnA9cGx1Z2luX2ZsYXNoJTNEZmFsc2UlMjZwbHVnaW5fd2luZG93c19tZWRpYV9wbGF5ZXIlM0RmYWxzZSUyNnBsdWdpbl9hZG9iZV9hY3JvYmF0JTNEZmFsc2UlMjZwbHVnaW5fc2lsdmVybGlnaHQlM0RmYWxzZSUyNnBsdWdpbl9xdWlja3RpbWUlM0RmYWxzZSUyNnBsdWdpbl9zaG9ja3dhdmUlM0RmYWxzZSUyNnBsdWdpbl9yZWFscGxheWVyJTNEZmFsc2UlMjZwbHVnaW5fdmxjX3BsYXllciUzRGZhbHNlJTI2cGx1Z2luX2RldmFsdnIlM0RmYWxzZSUyNnBsdWdpbl9zdmdfdmlld2VyJTNEZmFsc2UlMjZwbHVnaW5famF2YSUzRGZhbHNlJmZoPTJhMjk4NDlhZjA3ZGQxNjFkZGM3MzA0MGJlMjVmM2YwJmZuPTExMiZmZG09MmMwMDEsMjEyMDAwMDAsZTVhODBlMCwxMDAwMDAyLDE4MGZmZjVlLDNkZDdkZmVmLDNmZWZlNmE3LDNmZGRmZmY4LDAsMCZsaD1odHRwcyUzQSUyRiUyRmZwdC5saXZlLmNvbSUyRiUzRnNlc3Npb25faWQlM0RhMWE0NzY4MjExMzNiYTRkNGI2MjUwOGEzZjE4NDZmYyUyNkN1c3RvbWVySWQlM0QzM2UwMTkyMS00ZDY0LTRmOGMtYTA1NS01YmRhZmZkNWUzM2QlMjZQYWdlSWQlM0RTSSZkcj1odHRwcyUzQSUyRiUyRmxvZ2luLmxpdmUuY29tJTJGJnc9OERDRjQ0MThBOTgwQzJGJmlkPTc1Mzk5YmRkLTY2MGUtZDZmNS1hOWQzLTQ2ZDdkOWZkMjZkYiZhPSZjPWIwZWFkYjkzNDE2NmI2OTYwN2I4MjU5MjIzMzYxNzZk&eci=eyJ1dmRyIjoiR29vZ2xlIEluYy4gKEdvb2dsZSkiLCJ1cmRyIjoiQU5HTEUgKEdvb2dsZSwgVnVsa2FuIDEuMy4wIChTd2lmdFNoYWRlciBEZXZpY2UgKFN1Ynplcm8pICgweDAwMDBDMERFKSksIFN3aWZ0U2hhZGVyIGRyaXZlcikiLCJ2ZHIiOiJXZWJLaXQiLCJyZHIiOiJXZWJLaXQgV2ViR0wiLCJpZHVoIjoiMTViNmNhNDcyNjliZTQyODc1Njg1MDY5MzdlOTkxN2MifQ==&PageId=SI&u1=&u3=10.0.0&u4=x86&u5=64&u2=(Google%20Chrome%2C117.0.5938.149)%2C(Not%3BA%3DBrand%2C8.0.0.0)%2C(Chromium%2C117.0.5938.149)&met=eyJmcGwiOjE3Mjk3ODQxNTE1MDQsImJydyI6IjAuNTAiLCJkaXMiOiIwLjEwIiwidG16IjoiMC4wMCIsImxhbiI6IjAuMTAiLCJzb2YiOiI5NDIuNjAiLCJleHQiOiIwLjIwIiwicHJiIjoiMC4wMCIsIkdldENhbnZhc0RhdGEiOiIyMS42MCIsInBsIjoyMi4zOTk5OTk5OTk5OTQxOCwiZnAiOiIxMDM1LjMwIn0=
Preview:	dfp:OK

Chrome Cache Entry: 205

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	662286
Entropy (8bit):	5.315860951951661
Encrypted:	false
SSDEEP:	12288:YfmmzLJTD/JilMGk4hBR310FaHHxpJy7qVfb4cSPo:Yfm+T7US7SR310FaHHTJy7qJ4rPo
MD5:	12204899D75FC019689A92ED57559B94
SHA1:	CCF6271C6565495B18C1CED2F7273D5875DBFB1F
SHA-256:	39DAFD5ACA286717D9515F24CF9BE0C594DFD1DDF746E6973B1CE5DE8B2DD21B
SHA-512:	AA397E6ABD4C54538E42CCEDA8E3AA64ACE76E50B231499C20E88CF09270AECD704565BC9BD3B27D90429965A0233F99F27697F66829734FF02511BD096CF030
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.8093.20/scripts/boot.worldwide.2.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.2.mouse.js'] = (new Date()).getTime();.._y.lC=function(){};_y.lC.registerInterface("_y.lC");_y.jw=function(){};_y.jw.registerInterface("_y.jw");_y.lA=function(){};_y.lA.registerInterface("_y.lA");var IDelayedSendEvent=function(){};IDelayedSendEvent.registerInterface("IDelayedSendEvent");var IIsShowingComposeInReadingPaneEvent=function(){};IIsShowingComposeInReadingPaneEvent.registerInterface("IIsShowingComposeInReadingPaneEvent");var ISendFailedO365Event=function(){};ISendFailedO365Event.registerInterface("ISendFailedO365Event");var ISendFailureRemoveO365Event=function(){};ISendFailureRemoveO365Event.registerInterface("ISendFailureRemoveO365Event");_y.gw=function(){};_y.gw.registerInterface("_y.gw");_y.iB=function(){};_y.iB.registerInterface("_y.iB");_y.ih=function(){};_y.ih.registerInterface("_y.ih");_y.jy=function(){};_y.jy.regis

Chrome Cache Entry: 206

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	660449
Entropy (8bit):	5.4121922690110535
Encrypted:	false
SSDEEP:	12288:3PUKyvwjOOvwZ1ARuxntuicBh8hS11dsUA:yvjZ+/pIUA
MD5:	D9E3D2CE0228D2A5079478AAE5759698
SHA1:	412F45951C6AEDA5F3DF2C52533171FC7BDD5961
SHA-256:	7041D585609800051E4F451792AEC2B8BD06A4F2D29ED6F5AD8841AAE5107502
SHA-512:	06700C65BEF4002EBFBFF9D856C12E8D71F408BACA2D2103DDE1C28319B6BD3859FA9D289D8AEB6DD484E802040F6EE537F31F97B4B60A6B120A6882C992207A
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.8093.20/scripts/boot.worldwide.3.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.3.mouse.js'] = (new Date()).getTime();..;_n.a.jR=function(n){return n.dS()};_n.a.jZ=function(n){return n.eh()};_n.a.jP=function(n){return n.cC()};_n.a.jQ=function(n){return n.ca()};_n.a.hZ=function(n){return n.dO};_n.a.jU=function(n){return n.ed()};_n.a.jT=function(n){return n.ea()};_n.a.kb=function(n){return n.ej()};_n.a.hM=function(n){return 300};_n.a.fh=function(n){return n.V};_n.a.jV=function(n){return n.bI()};_n.a.ie=function(n){return n.mh()};_n.a.km=function(n){return n.bl()};_n.a.ka=function(n){return n.ei()};_n.a.ko=function(n){return n.cV()};_n.a.eX=function(n){return _y.E.isInstanceOfType(n)?n.y:null};_n.a.jN=function(n){return n.c()};_n.a.gm=function(n){return n.b()};_n.a.jM=function(n){return n.b()};_n.a.ib=function(n){return n.jM()};_n.a.iq=function(n){return n.bG};_n.a.iX=function(n){return _n.V.isInstanceOfType(n)?n

Chrome Cache Entry: 207

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	662286
Entropy (8bit):	5.315860951951661
Encrypted:	false
SSDEEP:	12288:YfmmzLJTD/JilMGk4hBR310FaHHxpJy7qVfb4cSPo:Yfm+T7US7SR310FaHHTJy7qJ4rPo
MD5:	12204899D75FC019689A92ED57559B94
SHA1:	CCF6271C6565495B18C1CED2F7273D5875DBFB1F
SHA-256:	39DAFD5ACA286717D9515F24CF9BE0C594DFD1DDF746E6973B1CE5DE8B2DD21B
SHA-512:	AA397E6ABD4C54538E42CCEDA8E3AA64ACE76E50B231499C20E88CF09270AECD704565BC9BD3B27D90429965A0233F99F27697F66829734FF02511BD096CF030
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.8069.28/scripts/boot.worldwide.2.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.2.mouse.js'] = (new Date()).getTime();.._y.lC=function(){};_y.lC.registerInterface("_y.lC");_y.jw=function(){};_y.jw.registerInterface("_y.jw");_y.lA=function(){};_y.lA.registerInterface("_y.lA");var IDelayedSendEvent=function(){};IDelayedSendEvent.registerInterface("IDelayedSendEvent");var IIsShowingComposeInReadingPaneEvent=function(){};IIsShowingComposeInReadingPaneEvent.registerInterface("IIsShowingComposeInReadingPaneEvent");var ISendFailedO365Event=function(){};ISendFailedO365Event.registerInterface("ISendFailedO365Event");var ISendFailureRemoveO365Event=function(){};ISendFailureRemoveO365Event.registerInterface("ISendFailureRemoveO365Event");_y.gw=function(){};_y.gw.registerInterface("_y.gw");_y.iB=function(){};_y.iB.registerInterface("_y.iB");_y.ih=function(){};_y.ih.registerInterface("_y.ih");_y.jy=function(){};_y.jy.regis

Chrome Cache Entry: 208

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	low
URL:	https://logincdn.msauth.net/shared/5/images/2_bc3d32a696895f78c19d.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 209

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 31504
Category:	dropped
Size (bytes):	10932
Entropy (8bit):	7.980153556375268
Encrypted:	false
SSDEEP:	192:0YLmT2S6qMKULyA5z3v4Azpkjx3j9/Q42FuLgaFLaQWogyDWotEy:5LYi1TLvjzpkjD/7UuLhFLaQBgQWoz
MD5:	AC8D3184D07423641943601689D3087A
SHA1:	ACE51BC1E6D182A084DE045B49EF623EBC2A950F
SHA-256:	85769F4952C5365630ACA973804AECD8B18CAF4818792AA653977F2E0F637356
SHA-512:	458DF58E7513F0C51C7D89B01CC557DE999BEFACA12C5D4CAF428175644CAAA86A9F2EAF285E769B30ABDF0267931323AAF3B422D0C9DF8E59EC3C051860B6C8
Malicious:	false
Reputation:	low
Preview:	...........}.r.8..h8...6...Y..%..,.%...5..Z.d.)R.K.4....}....%....uq.z6b..E.....Ld&...i0O.08../...%./..(...~..$...>....0J.w......"../..Z..+\.O./.dS.M...y....sx./...r^....Z/...t..fx:o..w.2.3<..9..O.....%8...(.VpT..._......n..QG.s3VoS/..b..G.t.../&.2..e/..eL.(...4)=......D........K1C.6aZ.S...4L.oF....u.v.Dt?..H..gw.C...Q$V.t>.q....r<.z.-L.....0rK.N\..h......2......>.(.%.(9%.K.$..[...4w..#4:-.\|..P.m.azA.Y:...J..\ZyA........`)Fr.<.5.0Z:..O.X..E.\|.....g".....o.$.8y.`.^"..JH.....Et..P.V"y..R$..j%.`...q.#0...O\.+..F..h.(..k3.;6...M...)V.T.. 80.^..h$.....(..X.......hVi..`..0Xx...g....'...ET.<W..\....0.J...".V4.....$i.c.2......X...F.L...c.\|D.)-...I. -..l7.;.s.r?.1..[.=.0..(\|.N..H.........F.Yi..+.F.3(..a........).D..\|:...(.OL....8.....8..$D..K"......$ax...@.?.?.. .Ji.C.w.z0...j...a..3`......I....h..=..AHg.....+.\c.....U"IQ.r.k..Ham.........R<..5.... c.OB.I.Pd..R0-.\X.........T.U..9w..=t..6........`.k`^.UH.X.xA.$..:....2....^..!.^.....[0..:@.3

Chrome Cache Entry: 210

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 951232
Category:	downloaded
Size (bytes):	240155
Entropy (8bit):	7.9988281762566436
Encrypted:	true
SSDEEP:	6144:rvsbtuMAdnnXGmCJ5rn0UBx1l4/owVD+XJgYWQ+M+:tMABGmCJBn0UXHUJVD+FWQU
MD5:	A975AE5428F41BF6F5A1FF0C4262CECF
SHA1:	A152FF4BF49D98D4896ACAD470A4F62C11C7C930
SHA-256:	A7F324054B5C353A9C2532094DAE56131FEE1EE335985F7ED5805ED8FB3EBCB3
SHA-512:	426CF35103BCC6C5CAC3C266151EDAC4DBDEC7C1AF849F42EC582739FF524FC3BB3E222AF08DB356A105E22743CBDFCEDC8182CDC6FB2D50597C0E6D4EF12DF6
Malicious:	false
Reputation:	low
URL:	https://logincdn.msauth.net/shared/5/js/login_en_-dc6Oo3iAoBIzmNJ3pErjQ2.js
Preview:	...........kw.. ....[7K.<.....[..q'.yu....=^..[L$R!);...~.'I9.>sf.....A.P(.U..........Y:.Y)7..$/.I....b&.....iv$.......'/.>.U......l.,.1.........(D.....`.vd....Z.".W.!~R.Y.s.. .y\|9.....<.....B..f_..s.^O.I..U..\|..i..%./.9.?..^..e.....J....IQ..w.y.-.(..,.@....ju&..j..Vy.aOf3Y...%..r.............?.^..I!........P..F.....6.^Z.....FI4;.=....U....= ....'.>T..&._....:...8!....?.q.Z.Lb%....R...:.t>VZ.I.....\|V.E..=Y..tQ.8qJ....D..\|3tC...yQ..A.......$. Ag...Q..Q.)O.<>..p.w..f..v..i....m./.....8..u...@^..a>.Xh..A..9.d......A.c".nmM...89...... =8..+....nwN.Y.;.D._\. ..........W..x....+....Z......Mg...!.,...N.....vJJ._..J.....fT%.*jy)....ID/@..C.q...M..c>.E.A.-.x...U...,i..>..B&@Wr&q.w..N...u....[2S...z.V.HN....<o+.#t4.'R..'..V..$.5...n..bg.D.....VL..2X.ZK%.E6v...`...n.,`...'..U.'.....V.,.....L.....R.i........7U.mq.Zd.\|.PE..".\|.E.4.g..\f..i@...8o-Y.r.gf......~.a.Te..Y.....v9-.@.1N.n7[.f0.$.)Ulw.ay..Z.+...<R...a..?..g.?....3..

Chrome Cache Entry: 211

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	17453
Entropy (8bit):	3.890509953257612
Encrypted:	false
SSDEEP:	192:P7FRTHQpmA3ZkXOL25cYty7l6UWUjMJBSab/vR+yzP:P/cpmgkF5+JWUjMp40P
MD5:	7916A894EBDE7D29C2CC29B267F1299F
SHA1:	78345CA08F9E2C3C2CC9B318950791B349211296
SHA-256:	D8F5AB3E00202FD3B45BE1ACD95D677B137064001E171BC79B06826D98F1E1D3
SHA-512:	2180ABE47FBF76E2E0608AB3A4659C1B7AB027004298D81960DC575CC2E912ECCA8C131C6413EBBF46D2AAA90E392EB00E37AED7A79CDC0AC71BA78D828A84C7
Malicious:	false
Reputation:	low
Preview:	.....Phttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta>

Chrome Cache Entry: 212

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406594
Category:	dropped
Size (bytes):	116257
Entropy (8bit):	7.997611207087735
Encrypted:	true
SSDEEP:	3072:DE0ZVdpagSQYd6R1+Q0Dsyzo2fDmhCx+ZkEIIkfrWk/1:Dfdg380oyzo2qhEpvIY
MD5:	D79589EF5E53B3CE2CB188E1C233F1B5
SHA1:	62F96C1BED01A64C2E3017979F51FA7ED3653E23
SHA-256:	F34DE0A54D08A60882232E7505C6E7AC06440A854C32C2B22AC8A223E1BFE53F
SHA-512:	F70F513D2C156A3F19E3D6F2BCE95B7320C688528114EB82476044A3D9C58E56641E4A407F390EA9CCB7838310D1FFFAB160FD3E9287C3F2D24D62C61D9643C0
Malicious:	false
Reputation:	low
Preview:	...........k[.H.(.}..[..-..c.0 #<$!=.$..dzz.'...X..<.@h....VUI%Y...}.w..`]Ju.u.l.T...O.....]\.._.N....rr..v.w..>.^..>^..l..]N..6......^.G.0..Q...a4.#/.q...F.7....Lxm.._.0.kS?N.k>..k&T..jg^.<.N....6.....a8{..IR.........)..1....G...?.....(..qR....w.H...b...E...6..d"..]`IYkL..c*....GP....a.~.]..0h.&...-..Ye..b.jIX{.S..\|<~pS.y....\|.W.]...U.f.;..tZ..xT....5.m....C.&...r..,.w.q~....q.......#42V.q..f\|.kK...1o.mP.}.......N..n.w6.%^M.d.;..7~2I.[..vs..7S/......F...8...%....s....k.A.Mx...j.L......?..W._p6.\|..x.{O.....2..`..._.......g....j..xb^]..v.E....k.\.....8..8F3a.E.....72............m.b)..B...m.E.......v............'.^.].. v..D[..}."7i.&..x...p;....jS.$.I....Z..z...o.<....v........#`0..\|...Zl.Y]..Em...x..O>FS'a0U.....w........"....0..[..].g....a.8[\|........ct.K..s.C3..`c....(c=.o.k3.z.....).....F.i..../....-,k..Zp..m..Y........X^...i.......[.o..zykH..uLoy.b_R.}.....W..r..j/..:.(..^,Y..K...>_..U.~..........f...m..6......@m.DN.8..[@jq...~v....

Chrome Cache Entry: 213

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://logincdn.msauth.net/16.000.30389.5/images/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 214

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 951232
Category:	dropped
Size (bytes):	240155
Entropy (8bit):	7.9988281762566436
Encrypted:	true
SSDEEP:	6144:rvsbtuMAdnnXGmCJ5rn0UBx1l4/owVD+XJgYWQ+M+:tMABGmCJBn0UXHUJVD+FWQU
MD5:	A975AE5428F41BF6F5A1FF0C4262CECF
SHA1:	A152FF4BF49D98D4896ACAD470A4F62C11C7C930
SHA-256:	A7F324054B5C353A9C2532094DAE56131FEE1EE335985F7ED5805ED8FB3EBCB3
SHA-512:	426CF35103BCC6C5CAC3C266151EDAC4DBDEC7C1AF849F42EC582739FF524FC3BB3E222AF08DB356A105E22743CBDFCEDC8182CDC6FB2D50597C0E6D4EF12DF6
Malicious:	false
Reputation:	low
Preview:	...........kw.. ....[7K.<.....[..q'.yu....=^..[L$R!);...~.'I9.>sf.....A.P(.U..........Y:.Y)7..$/.I....b&.....iv$.......'/.>.U......l.,.1.........(D.....`.vd....Z.".W.!~R.Y.s.. .y\|9.....<.....B..f_..s.^O.I..U..\|..i..%./.9.?..^..e.....J....IQ..w.y.-.(..,.@....ju&..j..Vy.aOf3Y...%..r.............?.^..I!........P..F.....6.^Z.....FI4;.=....U....= ....'.>T..&._....:...8!....?.q.Z.Lb%....R...:.t>VZ.I.....\|V.E..=Y..tQ.8qJ....D..\|3tC...yQ..A.......$. Ag...Q..Q.)O.<>..p.w..f..v..i....m./.....8..u...@^..a>.Xh..A..9.d......A.c".nmM...89...... =8..+....nwN.Y.;.D._\. ..........W..x....+....Z......Mg...!.,...N.....vJJ._..J.....fT%.*jy)....ID/@..C.q...M..c>.E.A.-.x...U...,i..>..B&@Wr&q.w..N...u....[2S...z.V.HN....<o+.#t4.'R..'..V..$.5...n..bg.D.....VL..2X.ZK%.E6v...`...n.,`...'..U.'.....V.,.....L.....R.i........7U.mq.Zd.\|.PE..".\|.E.4.g..\f..i@...8o-Y.r.gf......~.a.Te..Y.....v9-.@.1N.n7[.f0.$.)Ulw.ay..Z.+...<R...a..?..g.?....3..

Chrome Cache Entry: 215

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 216

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 449728
Category:	dropped
Size (bytes):	122269
Entropy (8bit):	7.9974362643305215
Encrypted:	true
SSDEEP:	3072:DqMdt2M2z1jeNS76MAxjW1EZgVzuqZ+qNotqrG8/yiKJSgJF:jc1NUxCECVzuqZN7/9sSC
MD5:	D2625A3B7A80F9E0F6BFD8FDBEEDB164
SHA1:	A1114F7EE86956E5F6DF604B2C3F25107AA3F124
SHA-256:	C6DDC0AE20A875A5E972A9961A6D139C7E28E64CCEE0CE47BA0CC294B7DEAD16
SHA-512:	F4D2F226DFFC191C21739BC6814ECC502A4B0D62E928F2526786B3AF774737E628C8E550ACBCDF99EEF455E034C5264439B4A8EE08D33D45CE9AE76FF5B513F1
Malicious:	false
Reputation:	low
Preview:	...........{w.8.8.....fn..(...J...'..v.gb..wS..Y..ud.+.y....?.$%.SU.{.=..y.,.\|. .. ......si...S..z...4.\|v}\....(].Fg...........4.\|V...v..R.....N....NX\......$.g...Q.'s...{q......Ke..rKWv....U..Am......._..CR...sX..\... f.E....9.....8.$..9.{.F.....Kv.J1KJ.0J.x?..!B.Zcj....8t..s...........8_...L...U..ie..\|.JIXz.....x.`Z...bj......I..a.,z...~)..D...%.2....-M#;@...`..i......cTt.Z.fs...L/.8..s...R..^...J.?.0.W..K.z.h..Z.5....d...>L..a1.:.......C.G........?c^....,]-...q8..@.u.b.,..+...`_.....qry.?]..<>.L....+..R........d..uO...v.G..q..VMw.......`.<..{{...o.;}0.US..O..u..v<x..%s..Tu`...Uvw.[.nw....C.?....?..!v ..-E..2.....n.;+.?.....ua8...i....$)W.....\..7...0EC.h.&e.6..D,YDA..W.Na!.T..$k..;..2..ju(.1,D}LdY=..a.>\|k....NE/.A...}{+'V/..W%#..o)a.S....c!P8..UI.".n.{.. .$..y.:K......i......-..!,XL.....>....J..G....X7..@L.L...h-.p..%R?.>e.......=....@O......w/.....2.....L..taJV.HJ...gV.H.C.z...n.P?...v....[.9e.O<-..:......5......D.(9...<X

Chrome Cache Entry: 217

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 362433
Category:	dropped
Size (bytes):	98380
Entropy (8bit):	7.996853333459762
Encrypted:	true
SSDEEP:	1536:iTeZ7J6sUJC7ckHh2A308MCbr2/D+m0eknviolCF8uAy3KV0AACROueSQrR3nd:iaZ7XU0PBF0NCKKReDFF8xWKPFoSQrxd
MD5:	22FB039F8816D650972D54BC41D3A338
SHA1:	CF8F64B92766F29751C794167947F665CA09B7A3
SHA-256:	FF6AD7DAF997CC9F67CE2E226E460C55C8E89E228C99181D03E8CA7FC610E131
SHA-512:	29D242307B39A566EE23D1C1B125D44A20BD8AD44CF0C052D29BB487EBE75154C4A330B512FB08A4B97BBC69D9B8BEDF80799A6F1EEA5CB25AF5764E34FE2AD5
Malicious:	false
Reputation:	low
Preview:	...........{W.8.8.....3.......... .i ........&.9..c..>..I..8.{f.u....R.U..J...7.....o.Oep....O+._zW'.K..G...;.~{=.(....+#...w....A%.~...4....g.7.Ie....U.Q..s..2......$\|.T...\:Q.^.].5..Am......N...cR...wY..<.m..A...cQ...w.+...q8J.s.....3H.7aT..Ub.TFa.<.~........o1&p....A.#.(....C..t...2a0y.).H+....PI..{8..........9.v0=........f....dR..<...b.{..M. ..W.. .es0q.8b.....cTt.^.....Qaq.N.l.sK...1.I2.T...Q.#.T.usg....:.zL.il}.4.......p6.81t.}..y..6._l....g.WV.r6..TN.g..d[..{9._J......;........:py\|.....;Ve.\............p..~oD..7b.n....A..S..`.<..[[zh;.......'a.>e.G'....).b..0.U....M.6...tk.Y.X..hE7..]?..$@..H..##...6..#.G....M..s...n-~.GIU..K1@{.4\|{......b..U...^.X2..i....)......d.}+0&.i.Lk.\..B..Q..Y.H......gi.S..e.C?...jbw..yW2b\....:.0.M~k.6..#Z^z...s..k..R.Q.....Y.%.$.N..X@.\.2.a.b*.f..3.0M'D.v.q.D.....0u.\| ......RK;..D...,b.F@.Ss...{50...D..../....J.>..-f.z:].....R....)y.<............}-...%........._8..!...rSF..%C..G..a-

Chrome Cache Entry: 218

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 90677
Category:	dropped
Size (bytes):	32811
Entropy (8bit):	7.992877953733209
Encrypted:	true
SSDEEP:	768:fDPYSdMWwCyzH8REcKPN/8p0x7UQzlRMXv1FevViDAqA:a8REcsUp0xUQzc/8VCAV
MD5:	2E287EB418940084B921590C6E672C9E
SHA1:	1FC75A9DAA054EF88AAEA181F3A9B4CBA2B6B6E1
SHA-256:	6C2C58DAAE76131A00D1BFEE20852F372CF594BE7F4A8848ACC42F8BF72C1BBD
SHA-512:	A77F69571B0F04F4A2354D9E18E41EF86F22274EAED20C02215B632BFEF09C6543A83591E9DB3F2B4036A9684BFF666EB6A7B253BA18893500E9CD541AB752A0
Malicious:	false
Reputation:	low
Preview:	...........iw.8.?.~>....%."9K'R...q:.fw.,.n_.Z.l.eRMR^b.O...A.N...yq.t,b!.....BU....4kM.Lr..I.]DE.&..TF..K.J.9.7.$....(..'?....f...tG...?y8~0..;..w;[....;.u........D.......N:W.d........E..eR...q..sJG.O.Z,....l......~.........'.d.......n.N..@.../....l'...".J3Y..n3Y...o..T...P0..j..-.....v.m7T.LM. .....Ev.7...IC.q..[.t>nj.e..OE<m...l)^.K.......8:M.&.]zz..j.X..K........'3..Tk....Z.2.GQ6..Fi._.\|v.Bf.W?...T.]:j(.%F.)..t_^........8.:..DN..8....B.>\|<..~..\|H.x.q.=-.f.~..{.z..&t...e.LfE,.;.d...n.....2..FH. .Y,.J...EC.cj. .F......o.....\...&\.J..fJiJ.S..4.5..NM]m.....Q.....e.O..iSs'........'Z..6A(Y.8..eQ.....2..I.?...;dS..I...D..@./7t.:z.......c...dF..B.......9...8)..h.........<.I...2.\FY+.=S.8...$Qv...<..IL.x".w9_..3.."-nfR.(..WDN..L.....z..I8.E..Ub......d..M.....sq.N........p..lX...A]3Y....j...%.`N..G.v..6.m.KH.M......Z..a2.N.....4....,u.O.vWM...=d..J.r`..b.....N.hzp..C..?.. ......:..M6............;.w.."B.^.ZP.N.:.[..(:...(.y.)q...

Chrome Cache Entry: 219

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2, software=paint.net 4.2.9], baseline, precision 8, 50x28, components 3
Category:	dropped
Size (bytes):	987
Entropy (8bit):	6.922003634904799
Encrypted:	false
SSDEEP:	24:PJjxEK0nWpBzo0XxDuLHeOWXG4OZ7DAJuLHenX3D+VRmK9cR+w/b:lxEX4OuERAVwR/QP/b
MD5:	E58AAFC980614A9CD7796BEA7B5EA8F0
SHA1:	D4CAC92DCDE0CAF7C571E6D791101DA94FDBD2CA
SHA-256:	8B34A475187302935336BF43A2BF2A4E0ADB9A1E87953EA51F6FCF0EF52A4A1D
SHA-512:	2DAC06596A11263DF1CFAB03EDA26D0A67B9A4C3BAA6FB6129CDBF0A157C648F5B0F5859B5CA689EFDF80F946BF4D854BA2B2C66877C5CE3897D72148741FCC9
Malicious:	false
Reputation:	low
Preview:	......JFIF.....H.H.....fExif..MM..................>...........F.(...........1.........N.......H.......H....paint.net 4.2.9....C....................................................................C.........................................................................2..!............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......[.4..lz.....K.S..p.>.9.r9j..'.\.qrW..mo...X9ZV<./x...EX...m.Prj..A.EtG...K..mr....Lc.T.8...nlY.V.{6...R...]..(.y...)^.5V.IVO.W.B.19.R\...f.U.....'..S:..k.6..).f.n._3*....}.y.8.EusH..y.`.mA...W.}...bL..:..b.<f..(lH#R....v._...........9N~S..

Chrome Cache Entry: 220

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	232394
Entropy (8bit):	5.54543362321178
Encrypted:	false
SSDEEP:	1536:yldzLx/ivZfjbOv/LBbLeXeKEXK81KKVKKdKbSK0cKcyKf75DMkvqBCWcDAPf4bT:Ux/ivZfjbOv/LBbLMTq9cDw4bLl1We/
MD5:	AF8D946B64D139A380CF3A1C27BDBEB0
SHA1:	C76845B6FFEAF14450795C550260EB618ABD60AB
SHA-256:	37619B16288166CC76403F0B7DF6586349B2D5628DE00D5850C815D019B17904
SHA-512:	C5CFB514F993310676E834C8A5477576BD57C82A8665387F9909BA0D4C3C2DE693E738ACAA74E7B4CA20894EA2FEEA5CF9A2428767D03FE1DE9C84538FDC3EE9
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.8069.28/resources/styles/0/boot.worldwide.mouse.css
Preview:	.feedbackList{-webkit-animation-duration:.17s;-moz-animation-duration:.17s;animation-duration:.17s;-webkit-animation-name:feedbackListFrames;-moz-animation-name:feedbackListFrames;animation-name:feedbackListFrames;-webkit-animation-fill-mode:both;-moz-animation-fill-mode:both;animation-fill-mode:both}@-webkit-keyframes feedbackListFrames{from{-webkit-transform:scale(1,1);transform:scale(1,1);-webkit-animation-timing-function:cubic-bezier(.33,0,.67,1);animation-timing-function:cubic-bezier(.33,0,.67,1)}to{-webkit-transform:scale(1.03,1.03);transform:scale(1.03,1.03)}}@-moz-keyframes feedbackListFrames{from{-moz-transform:scale(1,1);transform:scale(1,1);-moz-animation-timing-function:cubic-bezier(.33,0,.67,1);animation-timing-function:cubic-bezier(.33,0,.67,1)}to{-moz-transform:scale(1.03,1.03);transform:scale(1.03,1.03)}}@keyframes feedbackListFrames{from{-webkit-transform:scale(1,1);-moz-transform:scale(1,1);transform:scale(1,1);-webkit-animation-timing-function:cubic-bezier(.33,0,.67,

Chrome Cache Entry: 221

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 222

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	low
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 223

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 224

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HaY:6Y
MD5:	D2D53FA462C0BAECF299727EBB244751
SHA1:	6EC0B3DD1D25F41CE2DBCCFFD223F7BA7C931357
SHA-256:	E1C06F97FD2A1180AFDCA3B43AF1C7978E513B63050B9BB9B76D8F8BCA16CD5E
SHA-512:	DC6794B2372610A1F702E1792625037FD4A0A19FE909695091C2A5FDB6DCDAC44997F04F2C9130C1487FB526743A9C1218B956C4AD253EBD3AC63C9D74ABE32F
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSEAnPksLt9w2frxIFDTmc0RY=?alt=proto
Preview:	CgkKBw05nNEWGgA=

Chrome Cache Entry: 225

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64616)
Category:	dropped
Size (bytes):	449728
Entropy (8bit):	5.448588781180164
Encrypted:	false
SSDEEP:	6144:u7PuGBkXlRK2d/ZkpZYRsmA2pmBe9OpRUS4cEHKE0H3NX44/:u7D0Zkp6umhpsUSu0
MD5:	40B17FF1AA4D4490F7382A25F23C2DC7
SHA1:	401F26BDF93A14779CA131C29E385C97F1FF9830
SHA-256:	9019F3CFFB86BF28F83D0E85EEBF21FD0A37C4BF159EDFCB6F18D0DF12CB5E02
SHA-512:	2A197A7165E9EB5BF3860BDD3845A8D7F6A47CAEF801DB15E1D21906329D6C79F32BF28CBAFC83C2FAA131F71C3F81FB9668116AAF999644AB6887F61508FE48
Malicious:	false
Reputation:	low
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */!function(e){function n(n){for(var t,i,o=n[0],r=n[1],s=0,c=[];s<o.length;s++)

Chrome Cache Entry: 226

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	6
Entropy (8bit):	2.584962500721156
Encrypted:	false
SSDEEP:	3:fCu:au
MD5:	AAAB7A355103063D9EEB4824A3A6B374
SHA1:	E51555F02C32321F3E48F07A0FA5AF46DF835BFC
SHA-256:	79BA862622D6FA84AC7E4F98EB95043A255FC2C81711E9400A8AA4D4B1608471
SHA-512:	D1A0C9C4F628459F5CA904405B2A66A69425A50E8DCE1BAA43161D784EB219BD3E1FD9447BCBACC314652EDA08CF0B02C863C87F3AC1534AE0F62A414C191F1B
Malicious:	false
Reputation:	low
Preview:	dfp:OK

Chrome Cache Entry: 227

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 228

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7007
Category:	dropped
Size (bytes):	2419
Entropy (8bit):	7.9084162154611555
Encrypted:	false
SSDEEP:	48:XMZLME8ac0UTyw+G0mNbF8pDRfciXxBce7Fh5hqoucAKFBwMJiUh4BTiFT:70Uh7NapDbNl8oucAKFSMJzhn
MD5:	9FAF36E3F793E68A83548EEE5622A222
SHA1:	220342B65C5563A249E462B779F2DC46BE3AD5A8
SHA-256:	E16E9ABCEFABFF8B5DD9895E4331F137E94A3D64354AD989951342A1B2813A39
SHA-512:	49B8E11A9B32FF76E7A5090D1E0C8CEFD4B9EDE08A8346DFB186B6DCCE2F712F7446CA944C01419F83499329CE1BDC296DCC32BFABE8471BB5A945E0CD0485F8
Malicious:	false
Reputation:	low
Preview:	...........Xmo.8..._Ak.D....8U...l..&9...).Z.-..)..._..~C.._......$....p.y.C.~..A.......=ow....~.n_.;x.....^.._.G....J4.!Ap.cI\|....Q.q.s...(..............N<%QH..I}...2A.....j...,....F...l..S...b\Q. ..T[..L..0..4.......\.B.x....L`.l.FX.$.B..T.......LfQ.......p......)....,Z..,.:KN.i..> ..'....P6D..H.v..B...'.rJ.D...a.8....Kj..y.A@.S4..... qx(...S6...S.SD...IWf#"..c....'T....B.%g{.w..z.Z?...V.P..ZmHU....G5.'..Kp..........w.M.....>x..x.)+l.-G....."....B.........e..G.9...4MH?.....P.n.{z...r.D.....o..a..9H...eR...z.cH...=..p.[..K.9\.-..u....-\..aM.HxG..... >$.....].t....c...kf...Qd..:..j...4..I.j.....aG.uR......G..8...........@I.E.vR...R.+p$.>......g........fT?^...=.Z..?).....)..i...D...../...G0.....RP.~ ^...[n.H%.6\9...S.\~.W../...G}:\DqjfA.n.@.#.c...?.".Y....c..h...G.m$.O..3l...'_..-..A8 /..K:.m.....(S[.d.j..;^..f.j....S9....l.pV...+.R.f.U^......T.+....%..2..l....,^:i.p...w....d..C..2.4......+...........Y.x.H.F...o.CYa.NA5.D...t-M\Q.&.W.....

Chrome Cache Entry: 229

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (994), with no line terminators
Category:	downloaded
Size (bytes):	994
Entropy (8bit):	4.934955158256183
Encrypted:	false
SSDEEP:	12:U8Chx3fpler8DDMv1+I+zpcuVkicq32EXgBA5e2KMLT:JC3G0z1Ddf2NGe2KG
MD5:	E2110B813F02736A4726197271108119
SHA1:	D7AC10CC425A7B67BF16DDA0AAEF1FEB00A79857
SHA-256:	6D1BE7ED96DD494447F348986317FAF64728CCF788BE551F2A621B31DDC929AC
SHA-512:	E79CF6DB777D62690DB9C975B5494085C82E771936DB614AF9C75DB7CE4B6CA0A224B7DFB858437EF1E33C6026D772BE9DBBB064828DB382A4703CB34ECEF1CF
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.8093.17/resources/images/0/sprite1.mouse.css
Preview:	.image-loading_blackbg-gif{background:url('loading_blackbg.gif');width:16px;height:16px}.image-loading_whitebg-gif{background:url('loading_whitebg.gif');width:16px;height:16px}.image-thinking16_blue-gif{background:url('thinking16_blue.gif');width:16px;height:16px}.image-thinking16_grey-gif{background:url('thinking16_grey.gif');width:16px;height:16px}.image-thinking16_white-gif{background:url('thinking16_white.gif');width:16px;height:16px}.image-thinking24-gif{background:url('thinking24.gif');width:24px;height:24px}.image-thinking32_blue-gif{background:url('thinking32_blue.gif');width:32px;height:32px}.image-thinking32_grey-gif{background:url('thinking32_grey.gif');width:32px;height:32px}.image-thinking32_white-gif{background:url('thinking32_white.gif');width:32px;height:32px}.image-clear1x1-gif{width:1px;height:1px;background:url('sprite1.mouse.png') -0 -0}.csimg{padding:0;border:none;background-repeat:no-repeat;-webkit-touch-callout:none}span.csimg{-ms-high-contrast-adjust:none}

Chrome Cache Entry: 230

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64616)
Category:	downloaded
Size (bytes):	449728
Entropy (8bit):	5.448588781180164
Encrypted:	false
SSDEEP:	6144:u7PuGBkXlRK2d/ZkpZYRsmA2pmBe9OpRUS4cEHKE0H3NX44/:u7D0Zkp6umhpsUSu0
MD5:	40B17FF1AA4D4490F7382A25F23C2DC7
SHA1:	401F26BDF93A14779CA131C29E385C97F1FF9830
SHA-256:	9019F3CFFB86BF28F83D0E85EEBF21FD0A37C4BF159EDFCB6F18D0DF12CB5E02
SHA-512:	2A197A7165E9EB5BF3860BDD3845A8D7F6A47CAEF801DB15E1D21906329D6C79F32BF28CBAFC83C2FAA131F71C3F81FB9668116AAF999644AB6887F61508FE48
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_QLF_8apNRJD3OCol8jwtxw2.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */!function(e){function n(n){for(var t,i,o=n[0],r=n[1],s=0,c=[];s<o.length;s++)

Chrome Cache Entry: 231

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 26668
Category:	dropped
Size (bytes):	7396
Entropy (8bit):	7.976611464277348
Encrypted:	false
SSDEEP:	192:kqZJHI2ENUqioi4id7Cf05lG39Vpj0c5fZVnTsvbL0eiHeqXKfK:kWJaUq9i4O7Vf49/0EZVnTsDoeoBKfK
MD5:	48C27946ED9410E6D7D1B3943FB9CE1B
SHA1:	EE9E887F2003233B4E253580D6CAA7847901287A
SHA-256:	7F3A4F17869661B043C41FF8E40814A07DA0CE726F26BB28D8C7D6CDD00E4CDF
SHA-512:	054FE4C8F7F7CE36FC9492700C86132D8E54C68EC6B14193736D7D826019C705D7ED6EE3FCE476079C30FAA6228EA7EB5F838A7096C6E9FB2CD949BD8E27F53B
Malicious:	false
Reputation:	low
Preview:	...........]mw.6.......q.-..I...e}...ql..$.&9:..I.).%!...~g.....$..{.UO-..........<.....j[....`.r.].h......_..A..x}:.).?...6......I...Pc....#.;.&.....h..4>.Z.........F#........zN.Z.g.@..5....e..~O..2.TsBOP.."L.6.=.k...N.7.......S....I2..j.Dsb.%.kc......X3...nd....._......._....h...6,..f.....[.A.L[.y.}1.?.h .Y".......]nV.....Y...A.X..J.w..DP!...$vB.y..L.3.)......MGK.E.....h.Y....V._..535........M....bk.....C.r.%....O.#.e....O.'...+..........D68.....\|..hGl..a.W.,.nE..L.. ...#lC......Z......?.@..t.9../ ..V...}.d..<...><{..~...k<.]..NIH.q{..m.?3H._....k. .\|}o...^... .../...;....2..;.9...&..].1.G......$B2.Y.........1\|...... S,}a.!..m."k.td....>.Ay...........L..A...Q...z.y.....C(:Nxr..,&3.7Oi...m.\|....&.....fB..u*E... "j&..@T......tC..}......s..:3JFp..I.8.s....t.%.M...>......./.V.$..4. f.(....b@...s...3.(.5..&gPL.}..R..c.t...^......).\|.h.f{...hO.......p...P.x8.}(..#..+.....q..wB.!.)[`.J!#.D......\|8O...i.......$....'..R....'.8l..e..<..+r..#..E..@.D.7B

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 17:35:04.266639948 CEST	49677	443	192.168.2.17	204.79.197.200
Oct 24, 2024 17:35:04.266665936 CEST	49678	443	192.168.2.17	204.79.197.200
Oct 24, 2024 17:35:04.266666889 CEST	49676	443	192.168.2.17	204.79.197.200
Oct 24, 2024 17:35:12.210304022 CEST	49710	443	192.168.2.17	142.250.185.132
Oct 24, 2024 17:35:12.210338116 CEST	443	49710	142.250.185.132	192.168.2.17
Oct 24, 2024 17:35:12.210431099 CEST	49710	443	192.168.2.17	142.250.185.132
Oct 24, 2024 17:35:12.211268902 CEST	49710	443	192.168.2.17	142.250.185.132
Oct 24, 2024 17:35:12.211280107 CEST	443	49710	142.250.185.132	192.168.2.17
Oct 24, 2024 17:35:13.236624956 CEST	443	49710	142.250.185.132	192.168.2.17
Oct 24, 2024 17:35:13.237085104 CEST	49710	443	192.168.2.17	142.250.185.132
Oct 24, 2024 17:35:13.237095118 CEST	443	49710	142.250.185.132	192.168.2.17
Oct 24, 2024 17:35:13.238147974 CEST	443	49710	142.250.185.132	192.168.2.17
Oct 24, 2024 17:35:13.238241911 CEST	49710	443	192.168.2.17	142.250.185.132
Oct 24, 2024 17:35:13.239301920 CEST	49710	443	192.168.2.17	142.250.185.132
Oct 24, 2024 17:35:13.239382982 CEST	443	49710	142.250.185.132	192.168.2.17
Oct 24, 2024 17:35:13.291732073 CEST	49710	443	192.168.2.17	142.250.185.132
Oct 24, 2024 17:35:13.291743994 CEST	443	49710	142.250.185.132	192.168.2.17
Oct 24, 2024 17:35:13.338794947 CEST	49710	443	192.168.2.17	142.250.185.132
Oct 24, 2024 17:35:14.469774008 CEST	49712	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:14.469829082 CEST	443	49712	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:14.470047951 CEST	49712	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:14.472301960 CEST	49712	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:14.472327948 CEST	443	49712	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:14.548974991 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:14.549060106 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:14.549232006 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:14.549417019 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:14.549452066 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:15.400826931 CEST	443	49712	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:15.400930882 CEST	49712	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:15.403059006 CEST	49712	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:15.403089046 CEST	443	49712	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:15.403359890 CEST	443	49712	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:15.455833912 CEST	49712	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:15.473392010 CEST	49712	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:15.519342899 CEST	443	49712	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:15.615159035 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:15.616238117 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:15.616265059 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:15.617290974 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:15.617368937 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:15.621464968 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:15.621529102 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:15.621675968 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:15.621684074 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:15.662679911 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:15.786108971 CEST	443	49712	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:15.786137104 CEST	443	49712	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:15.786144972 CEST	443	49712	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:15.786159039 CEST	443	49712	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:15.786166906 CEST	443	49712	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:15.786175013 CEST	443	49712	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:15.786266088 CEST	49712	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:15.786293983 CEST	443	49712	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:15.786326885 CEST	49712	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:15.786353111 CEST	49712	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:15.793055058 CEST	443	49712	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:15.793203115 CEST	49712	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:15.793207884 CEST	443	49712	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:15.794747114 CEST	443	49712	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:15.794816971 CEST	49712	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:15.818146944 CEST	49712	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:15.818173885 CEST	443	49712	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:15.818191051 CEST	49712	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:15.818197012 CEST	443	49712	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:15.875940084 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:15.930679083 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:15.997020960 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:15.997035980 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:15.997090101 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:15.997132063 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:15.997184038 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:15.997215033 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:15.997227907 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:15.997237921 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:15.997237921 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:15.997255087 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:15.997270107 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:16.118536949 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.118566990 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.118643045 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:16.118664026 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.118690014 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:16.118705034 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:16.240773916 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.240806103 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.240936995 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:16.240936995 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:16.240961075 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.241002083 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:16.361928940 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.361960888 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.362031937 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:16.362059116 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.362077951 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:16.362098932 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:16.481888056 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.481908083 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.481976986 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:16.482004881 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.482048988 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:16.599426031 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.599443913 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.599505901 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:16.599525928 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.599566936 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:16.599586010 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:16.718904018 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.718940020 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.718986988 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:16.719001055 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.719047070 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:16.719062090 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:16.836323023 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.836349964 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.836445093 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:16.836473942 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.836513996 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:16.843461990 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.843512058 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.843535900 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:16.843544960 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.843556881 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.843590975 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:16.843837023 CEST	49713	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:16.843852997 CEST	443	49713	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.859494925 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:16.859533072 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:16.859659910 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:16.859888077 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:16.859899044 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:17.919640064 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:17.919985056 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:17.920028925 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:17.921042919 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:17.921119928 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:17.921427011 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:17.921494007 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:17.921581984 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:17.963352919 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:17.964670897 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:17.964734077 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.011676073 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:18.160712957 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.203687906 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:18.293585062 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.293596983 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.293621063 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.293636084 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.293649912 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.293668985 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:18.293715954 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.293749094 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:18.345685959 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:18.404736042 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.404763937 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.404800892 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.404822111 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.404830933 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:18.404849052 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.404866934 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:18.404869080 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.404882908 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:18.404898882 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.404903889 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:18.404953003 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:18.517117023 CEST	49722	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:18.517168999 CEST	443	49722	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:18.517240047 CEST	49722	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:18.517446041 CEST	49722	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:18.517463923 CEST	443	49722	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:18.524012089 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.524028063 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.524069071 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.524194956 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.524225950 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:18.524225950 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:18.524302959 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.524369955 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:18.645746946 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.645765066 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.645940065 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:18.645975113 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.646034956 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:18.739113092 CEST	49723	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:18.739161015 CEST	443	49723	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:18.739243031 CEST	49723	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:18.739434004 CEST	49724	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:18.739487886 CEST	443	49724	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:18.739563942 CEST	49724	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:18.740187883 CEST	49723	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:18.740223885 CEST	443	49723	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:18.740350962 CEST	49724	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:18.740370035 CEST	443	49724	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:18.762630939 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.762645960 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.762744904 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:18.762809038 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.762893915 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:18.881680965 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.881696939 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.881855011 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:18.881855011 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:18.881905079 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.882539034 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:18.998567104 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.998589039 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:18.998687029 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:18.998720884 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:19.000432014 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:19.116127014 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:19.116193056 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:19.116254091 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:19.116326094 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:19.116368055 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:19.116393089 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:19.121228933 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:19.121340990 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:19.121356010 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:19.121432066 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:19.121436119 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:19.121514082 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:19.121670008 CEST	49718	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:19.121697903 CEST	443	49718	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:19.279503107 CEST	443	49722	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:19.304059029 CEST	49722	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:19.304074049 CEST	443	49722	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:19.305284023 CEST	443	49722	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:19.305351973 CEST	49722	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:19.309907913 CEST	49722	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:19.309986115 CEST	443	49722	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:19.310197115 CEST	49722	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:19.310208082 CEST	443	49722	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:19.350730896 CEST	49722	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:19.465713024 CEST	443	49724	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:19.466418982 CEST	49724	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:19.466434002 CEST	443	49724	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:19.467483997 CEST	443	49724	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:19.467560053 CEST	49724	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:19.467926979 CEST	49724	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:19.467992067 CEST	443	49724	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:19.468116045 CEST	49724	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:19.468125105 CEST	443	49724	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:19.485944033 CEST	443	49723	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:19.486188889 CEST	49723	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:19.486207008 CEST	443	49723	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:19.487672091 CEST	443	49723	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:19.487740040 CEST	49723	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:19.488086939 CEST	49723	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:19.488164902 CEST	443	49723	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:19.488306046 CEST	49723	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:19.488312006 CEST	443	49723	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:19.509684086 CEST	49724	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:19.540668011 CEST	49723	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:19.558734894 CEST	443	49722	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:19.558763027 CEST	443	49722	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:19.558775902 CEST	443	49722	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:19.558790922 CEST	443	49722	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:19.558799028 CEST	443	49722	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:19.558804035 CEST	443	49722	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:19.558840036 CEST	49722	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:19.558865070 CEST	443	49722	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:19.558907032 CEST	49722	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:19.558943033 CEST	49722	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:19.561000109 CEST	443	49722	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:19.561074972 CEST	49722	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:19.561080933 CEST	443	49722	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:19.561136961 CEST	49722	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:19.561340094 CEST	49722	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:19.561359882 CEST	443	49722	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:19.561388016 CEST	49722	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:19.561486959 CEST	49722	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.631131887 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 24, 2024 17:35:20.650346041 CEST	443	49723	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.650418997 CEST	443	49723	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.650440931 CEST	443	49723	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.650461912 CEST	443	49723	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.650504112 CEST	443	49723	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.650511980 CEST	49723	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.650528908 CEST	443	49723	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.650587082 CEST	443	49723	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.650636911 CEST	49723	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.650636911 CEST	49723	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.650667906 CEST	49723	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.651767015 CEST	443	49723	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.651942968 CEST	443	49723	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.652009964 CEST	49723	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.652133942 CEST	49723	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.652172089 CEST	443	49723	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.652194977 CEST	49723	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.652232885 CEST	49723	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.653940916 CEST	443	49724	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.653986931 CEST	443	49724	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.654007912 CEST	443	49724	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.654048920 CEST	49724	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.654051065 CEST	443	49724	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.654081106 CEST	49724	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.654083014 CEST	443	49724	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.654102087 CEST	443	49724	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.654107094 CEST	49724	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.654126883 CEST	49724	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.654155016 CEST	49724	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.661813974 CEST	443	49724	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.661864042 CEST	443	49724	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.661895037 CEST	49724	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.661916018 CEST	443	49724	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.661940098 CEST	49724	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.661964893 CEST	49724	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.666296959 CEST	443	49724	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.666368961 CEST	443	49724	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.666383982 CEST	49724	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.666393042 CEST	443	49724	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.666429996 CEST	49724	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.666450024 CEST	49724	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.671053886 CEST	49729	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:20.671118021 CEST	443	49729	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:20.671232939 CEST	49729	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:20.671391964 CEST	443	49724	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.671439886 CEST	49729	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:20.671449900 CEST	443	49724	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.671458960 CEST	443	49729	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:20.671472073 CEST	49724	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.671489000 CEST	443	49724	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.671519041 CEST	49724	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.671534061 CEST	49724	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.674771070 CEST	443	49724	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.674887896 CEST	443	49724	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.674911022 CEST	49724	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.674932957 CEST	443	49724	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.674947023 CEST	49724	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.677423000 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:20.677459002 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:20.677529097 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:20.677747965 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:20.677764893 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:20.681173086 CEST	49731	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.681196928 CEST	443	49731	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.681282043 CEST	49731	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.681838989 CEST	49731	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:20.681854010 CEST	443	49731	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:20.946712971 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 24, 2024 17:35:21.417687893 CEST	443	49731	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:21.417996883 CEST	49731	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:21.418025970 CEST	443	49731	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:21.418492079 CEST	443	49731	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:21.418845892 CEST	49731	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:21.418941021 CEST	443	49731	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:21.419019938 CEST	49731	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:21.422557116 CEST	443	49729	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:21.422827959 CEST	49729	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:21.422894955 CEST	443	49729	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:21.423913002 CEST	443	49729	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:21.424000025 CEST	49729	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:21.424297094 CEST	49729	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:21.424367905 CEST	443	49729	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:21.424421072 CEST	49729	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:21.463331938 CEST	443	49731	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:21.466713905 CEST	49729	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:21.466736078 CEST	443	49729	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:21.514714003 CEST	49729	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:21.561677933 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 24, 2024 17:35:21.669084072 CEST	443	49731	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:21.669111967 CEST	443	49731	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:21.669177055 CEST	49731	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:21.669194937 CEST	443	49731	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:21.669260979 CEST	49731	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:21.676893950 CEST	443	49729	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:21.676917076 CEST	443	49729	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:21.676924944 CEST	443	49729	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:21.676950932 CEST	443	49729	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:21.676964998 CEST	443	49729	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:21.676979065 CEST	443	49729	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:21.677036047 CEST	49729	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:21.677083969 CEST	443	49729	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:21.677113056 CEST	49729	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:21.677150011 CEST	49729	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:21.677812099 CEST	49729	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:21.677846909 CEST	443	49729	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:21.698024035 CEST	49690	443	192.168.2.17	204.79.197.200
Oct 24, 2024 17:35:21.704997063 CEST	443	49690	204.79.197.200	192.168.2.17
Oct 24, 2024 17:35:21.705084085 CEST	49690	443	192.168.2.17	204.79.197.200
Oct 24, 2024 17:35:21.720112085 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:21.720398903 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:21.720426083 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:21.720782042 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:21.721086025 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:21.721153975 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:21.721215010 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:21.767329931 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:21.787125111 CEST	443	49731	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:21.787147999 CEST	443	49731	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:21.787367105 CEST	49731	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:21.787393093 CEST	443	49731	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:21.787508011 CEST	49731	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:21.790076971 CEST	443	49731	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:21.790149927 CEST	49731	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:21.790158033 CEST	443	49731	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:21.790172100 CEST	443	49731	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:21.790229082 CEST	49731	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:21.790532112 CEST	49731	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:21.790545940 CEST	443	49731	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:21.793116093 CEST	49732	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:21.793142080 CEST	443	49732	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:21.793220997 CEST	49732	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:21.793479919 CEST	49732	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:21.793489933 CEST	443	49732	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:21.954895020 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.003849030 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:22.070465088 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.070480108 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.070525885 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.070554972 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.070574045 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:22.070591927 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.070635080 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:22.070668936 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:22.189439058 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.189465046 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.189574957 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:22.189606905 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.189677954 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:22.306878090 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.306941986 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.307008028 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:22.307040930 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.307097912 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:22.307122946 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:22.424365997 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.424391031 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.424515009 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:22.424534082 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.424587011 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:22.542387009 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.542449951 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.542562962 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:22.542635918 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.542676926 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:22.542700052 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:22.550957918 CEST	443	49732	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:22.551229954 CEST	49732	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:22.551258087 CEST	443	49732	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:22.551734924 CEST	443	49732	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:22.552042007 CEST	49732	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:22.552138090 CEST	443	49732	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:22.552187920 CEST	49732	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:22.599330902 CEST	443	49732	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:22.604712009 CEST	49732	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:22.658693075 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.658746958 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.658822060 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:22.658895969 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.658938885 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:22.658962965 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:22.775711060 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 24, 2024 17:35:22.776021004 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.776043892 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.776118040 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:22.776139975 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.776190996 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:22.810652018 CEST	443	49732	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:22.810681105 CEST	443	49732	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:22.810688972 CEST	443	49732	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:22.810714960 CEST	443	49732	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:22.810733080 CEST	443	49732	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:22.810746908 CEST	443	49732	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:22.810755968 CEST	49732	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:22.810770988 CEST	443	49732	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:22.810797930 CEST	49732	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:22.810825109 CEST	49732	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:22.892663002 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.892689943 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.892973900 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:22.893003941 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.893086910 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:22.928719997 CEST	443	49732	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:22.928754091 CEST	443	49732	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:22.928879023 CEST	49732	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:22.928904057 CEST	443	49732	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:22.928953886 CEST	49732	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:22.931185007 CEST	443	49732	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:22.931269884 CEST	49732	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:22.931274891 CEST	443	49732	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:22.931330919 CEST	49732	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:22.931668997 CEST	49732	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:22.931684971 CEST	443	49732	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:22.940256119 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.940326929 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.940378904 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:22.940407991 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:22.940427065 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:22.940457106 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.057379961 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.057444096 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.057676077 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.057676077 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.057704926 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.057759047 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.173363924 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.173392057 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.173541069 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.173573017 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.173650026 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.244703054 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.244735956 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.244828939 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.244853020 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.244913101 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.293385983 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.293412924 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.293518066 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.293586016 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.293667078 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.408833027 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.408854961 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.408984900 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.409010887 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.409060001 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.480262041 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.480283022 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.480417967 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.480437040 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.480496883 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.532263994 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.532285929 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.532386065 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.532453060 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.532526016 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.647104979 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.647161961 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.647244930 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.647330046 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.647376060 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.647406101 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.651051998 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.651096106 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.651145935 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.651160955 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.651192904 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.651221037 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.767612934 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.767636061 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.767755032 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.767782927 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.767828941 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.771970987 CEST	443	49710	142.250.185.132	192.168.2.17
Oct 24, 2024 17:35:23.772030115 CEST	443	49710	142.250.185.132	192.168.2.17
Oct 24, 2024 17:35:23.772082090 CEST	49710	443	192.168.2.17	142.250.185.132
Oct 24, 2024 17:35:23.832524061 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.832540989 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.832706928 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.832719088 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.832799911 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.887510061 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.887533903 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.887597084 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.887609005 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:23.887671947 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:23.983604908 CEST	49710	443	192.168.2.17	142.250.185.132
Oct 24, 2024 17:35:23.983624935 CEST	443	49710	142.250.185.132	192.168.2.17
Oct 24, 2024 17:35:24.000891924 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:24.000916958 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:24.000989914 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:24.001003027 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:24.001045942 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:24.005765915 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:24.005781889 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:24.005845070 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:24.005851984 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:24.005889893 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:24.127474070 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:24.127537966 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:24.128237009 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:24.128237009 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:24.128309011 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:24.128391027 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:24.132159948 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:24.132209063 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:24.132282019 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:24.132303953 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:24.132332087 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:24.132376909 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:24.239375114 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:24.239443064 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:24.239476919 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:24.239499092 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:24.239528894 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:24.239562988 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:24.243343115 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:24.243390083 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:24.243427038 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:24.243433952 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:24.243464947 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:24.243478060 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:24.245851994 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:24.245934963 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:24.245943069 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:24.246023893 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:24.246079922 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:24.246104002 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:24.246124029 CEST	443	49730	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:24.246134043 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:24.246170044 CEST	49730	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:24.249715090 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:24.249753952 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:24.249841928 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:24.250055075 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:24.250068903 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:24.267230034 CEST	49736	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:24.267242908 CEST	443	49736	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:24.267344952 CEST	49736	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:24.267508984 CEST	49736	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:24.267520905 CEST	443	49736	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:24.792529106 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 24, 2024 17:35:25.000788927 CEST	443	49736	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:25.002970934 CEST	49736	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:25.002985954 CEST	443	49736	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:25.003289938 CEST	443	49736	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:25.003715992 CEST	49736	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:25.003763914 CEST	443	49736	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:25.003901958 CEST	49736	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:25.051326990 CEST	443	49736	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:25.059331894 CEST	49736	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:25.091018915 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 24, 2024 17:35:25.135565996 CEST	443	49736	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:25.135577917 CEST	443	49736	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:25.135606050 CEST	443	49736	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:25.135668993 CEST	49736	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:25.135679960 CEST	443	49736	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:25.135715008 CEST	49736	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:25.135982037 CEST	443	49736	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:25.136060953 CEST	49736	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:25.137253046 CEST	49736	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:25.137269974 CEST	443	49736	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:25.137319088 CEST	49736	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:25.137319088 CEST	49736	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:25.140233994 CEST	49738	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:25.140260935 CEST	443	49738	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:25.140362024 CEST	49738	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:25.140569925 CEST	49738	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:25.140578985 CEST	443	49738	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:25.141396046 CEST	49739	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:25.141438007 CEST	443	49739	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:25.141504049 CEST	49739	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:25.141789913 CEST	49739	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:25.141807079 CEST	443	49739	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:25.184727907 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 24, 2024 17:35:25.304599047 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:25.304954052 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:25.304972887 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:25.305291891 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:25.305608988 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:25.305659056 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:25.305911064 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:25.347335100 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:25.562637091 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:25.613694906 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:25.680001974 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:25.680012941 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:25.680058956 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:25.680088043 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:25.680094004 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:25.680115938 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:25.680126905 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:25.680141926 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:25.680171967 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:25.693721056 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 24, 2024 17:35:26.824085951 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.824105978 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.824162006 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.824244022 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.824244022 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.824264050 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.824362993 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.828222990 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.828258038 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.828347921 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.828360081 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.828537941 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.833385944 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.833429098 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.833513975 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.833513975 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.833534002 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.833947897 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.837430000 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.837480068 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.837549925 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.837549925 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.837558985 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.837801933 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.840611935 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.840667963 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.840740919 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.840740919 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.840749979 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.841022015 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.843539953 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.843624115 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.843642950 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.843652010 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.843705893 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.846524954 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.846581936 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.846611023 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.846623898 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.846683979 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.846683979 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.848848104 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.848911047 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.848972082 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.848972082 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.848982096 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.849140882 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.851501942 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.851552963 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.851589918 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.851598024 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.851612091 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.851651907 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.853274107 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.853297949 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.853400946 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.853410959 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.853466988 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.875129938 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.875190973 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.875269890 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.875281096 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.875307083 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.875334978 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.897305012 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 24, 2024 17:35:26.955598116 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.955663919 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.955949068 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.955949068 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.955971003 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:26.956361055 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:26.960421085 CEST	443	49738	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:26.960850000 CEST	49738	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:26.960864067 CEST	443	49738	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:26.961328030 CEST	443	49738	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:26.961796045 CEST	49738	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:26.961796045 CEST	49738	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:26.961822987 CEST	443	49738	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:26.961883068 CEST	443	49738	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:26.966041088 CEST	443	49739	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:26.966237068 CEST	49739	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:26.966264963 CEST	443	49739	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:26.966604948 CEST	443	49739	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:26.966866970 CEST	49739	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:26.966916084 CEST	443	49739	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:26.966953993 CEST	49739	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:27.007328987 CEST	443	49739	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:27.007725954 CEST	49739	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:27.008111954 CEST	49738	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:27.025188923 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.025254011 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.025361061 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.025361061 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.025381088 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.025994062 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.092295885 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.092564106 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.092576027 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.092595100 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.092649937 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.092649937 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.102526903 CEST	49740	443	192.168.2.17	184.28.90.27
Oct 24, 2024 17:35:27.102583885 CEST	443	49740	184.28.90.27	192.168.2.17
Oct 24, 2024 17:35:27.102669954 CEST	49740	443	192.168.2.17	184.28.90.27
Oct 24, 2024 17:35:27.104000092 CEST	49740	443	192.168.2.17	184.28.90.27
Oct 24, 2024 17:35:27.104017019 CEST	443	49740	184.28.90.27	192.168.2.17
Oct 24, 2024 17:35:27.109127045 CEST	443	49739	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:27.109153986 CEST	443	49739	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:27.109217882 CEST	443	49739	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:27.109219074 CEST	49739	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:27.111437082 CEST	49739	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:27.111700058 CEST	49739	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:27.111716032 CEST	443	49739	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:27.152729988 CEST	443	49738	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:27.152760029 CEST	443	49738	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:27.152837992 CEST	443	49738	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:27.152935982 CEST	49738	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:27.152935982 CEST	49738	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:27.153728008 CEST	49738	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:27.153760910 CEST	443	49738	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:27.156563997 CEST	49741	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:27.156599998 CEST	443	49741	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:27.156774044 CEST	49741	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:27.157028913 CEST	49741	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:27.157047033 CEST	443	49741	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:27.168396950 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:27.168437004 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:27.168526888 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:27.168713093 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:27.168728113 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:27.191410065 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.191467047 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.191529036 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.191546917 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.191591978 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.191592932 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.191602945 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.210513115 CEST	49744	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:35:27.210566044 CEST	443	49744	52.98.152.194	192.168.2.17
Oct 24, 2024 17:35:27.210870028 CEST	49744	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:35:27.211110115 CEST	49744	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:35:27.211124897 CEST	443	49744	52.98.152.194	192.168.2.17
Oct 24, 2024 17:35:27.231785059 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.261306047 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.261341095 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.261544943 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.261544943 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.261574984 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.263470888 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.328077078 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.328121901 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.328211069 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.328211069 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.328226089 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.328388929 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.430538893 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.430557966 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.430704117 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.430737019 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.430795908 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.499562979 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.499583006 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.499661922 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.499680042 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.499718904 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.550708055 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.550729036 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.550801992 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.550822973 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.550883055 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.618753910 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.618773937 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.618841887 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.618870974 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.618916988 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.671838045 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.671861887 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.671946049 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.671972990 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.672013998 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.738318920 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.738337994 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.738652945 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.738672972 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.738734007 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.789406061 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.789423943 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.789513111 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.789532900 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.789571047 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.874618053 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.874667883 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.874726057 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.874741077 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.874782085 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.909630060 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.909653902 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.909754038 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.909765005 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.909804106 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.918118954 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.918191910 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.918210030 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.918220997 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.918277025 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.924362898 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:27.924906969 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:27.924921989 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:27.925556898 CEST	49735	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:27.925580025 CEST	443	49735	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:27.925987005 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:27.926054955 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:27.926597118 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:27.926651001 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:27.926743984 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:27.926753044 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:27.930499077 CEST	443	49741	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:27.931490898 CEST	49741	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:27.931504011 CEST	443	49741	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:27.931871891 CEST	443	49741	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:27.935770988 CEST	49741	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:27.935854912 CEST	443	49741	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:27.935997009 CEST	49741	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:27.969065905 CEST	443	49740	184.28.90.27	192.168.2.17
Oct 24, 2024 17:35:27.969136000 CEST	49740	443	192.168.2.17	184.28.90.27
Oct 24, 2024 17:35:27.976725101 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:27.977703094 CEST	49741	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:27.977715969 CEST	443	49741	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:27.993024111 CEST	49740	443	192.168.2.17	184.28.90.27
Oct 24, 2024 17:35:27.993047953 CEST	443	49740	184.28.90.27	192.168.2.17
Oct 24, 2024 17:35:27.993350983 CEST	443	49740	184.28.90.27	192.168.2.17
Oct 24, 2024 17:35:28.039722919 CEST	49740	443	192.168.2.17	184.28.90.27
Oct 24, 2024 17:35:28.078828096 CEST	49740	443	192.168.2.17	184.28.90.27
Oct 24, 2024 17:35:28.079128027 CEST	443	49741	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:28.079149008 CEST	443	49741	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:28.079205990 CEST	443	49741	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:28.079206944 CEST	49741	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:28.079252005 CEST	49741	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:28.080996037 CEST	49741	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:28.081013918 CEST	443	49741	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:28.123332024 CEST	443	49740	184.28.90.27	192.168.2.17
Oct 24, 2024 17:35:28.181881905 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.181909084 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.181916952 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.181943893 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.181972027 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.181981087 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.181998014 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.182053089 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.182053089 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.299688101 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.299710035 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.299802065 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.299814939 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.299874067 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.325165987 CEST	443	49740	184.28.90.27	192.168.2.17
Oct 24, 2024 17:35:28.325397015 CEST	49740	443	192.168.2.17	184.28.90.27
Oct 24, 2024 17:35:28.325417042 CEST	443	49740	184.28.90.27	192.168.2.17
Oct 24, 2024 17:35:28.325428963 CEST	49740	443	192.168.2.17	184.28.90.27
Oct 24, 2024 17:35:28.325758934 CEST	443	49740	184.28.90.27	192.168.2.17
Oct 24, 2024 17:35:28.325855970 CEST	443	49740	184.28.90.27	192.168.2.17
Oct 24, 2024 17:35:28.325915098 CEST	49740	443	192.168.2.17	184.28.90.27
Oct 24, 2024 17:35:28.348323107 CEST	443	49744	52.98.152.194	192.168.2.17
Oct 24, 2024 17:35:28.348545074 CEST	49744	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:35:28.348573923 CEST	443	49744	52.98.152.194	192.168.2.17
Oct 24, 2024 17:35:28.349591970 CEST	443	49744	52.98.152.194	192.168.2.17
Oct 24, 2024 17:35:28.349652052 CEST	49744	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:35:28.349668980 CEST	443	49744	52.98.152.194	192.168.2.17
Oct 24, 2024 17:35:28.349711895 CEST	49744	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:35:28.350703001 CEST	49744	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:35:28.350769997 CEST	443	49744	52.98.152.194	192.168.2.17
Oct 24, 2024 17:35:28.350940943 CEST	49744	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:35:28.350950956 CEST	443	49744	52.98.152.194	192.168.2.17
Oct 24, 2024 17:35:28.368801117 CEST	49745	443	192.168.2.17	184.28.90.27
Oct 24, 2024 17:35:28.368858099 CEST	443	49745	184.28.90.27	192.168.2.17
Oct 24, 2024 17:35:28.368980885 CEST	49745	443	192.168.2.17	184.28.90.27
Oct 24, 2024 17:35:28.369328022 CEST	49745	443	192.168.2.17	184.28.90.27
Oct 24, 2024 17:35:28.369344950 CEST	443	49745	184.28.90.27	192.168.2.17
Oct 24, 2024 17:35:28.402708054 CEST	49744	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:35:28.417395115 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.417418003 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.417498112 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.417521000 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.419493914 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.535556078 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.535578966 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.535693884 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.535711050 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.535763979 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.626101017 CEST	443	49744	52.98.152.194	192.168.2.17
Oct 24, 2024 17:35:28.626130104 CEST	443	49744	52.98.152.194	192.168.2.17
Oct 24, 2024 17:35:28.626303911 CEST	49744	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:35:28.626332045 CEST	443	49744	52.98.152.194	192.168.2.17
Oct 24, 2024 17:35:28.626389980 CEST	49744	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:35:28.627372026 CEST	49744	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:35:28.627403021 CEST	443	49744	52.98.152.194	192.168.2.17
Oct 24, 2024 17:35:28.627549887 CEST	443	49744	52.98.152.194	192.168.2.17
Oct 24, 2024 17:35:28.627624035 CEST	49744	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:35:28.627641916 CEST	49744	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:35:28.654277086 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.654301882 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.654412985 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.654438019 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.655556917 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.773058891 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.773081064 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.773267984 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.773293018 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.773348093 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.890583038 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.890609026 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.890846014 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.890872002 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.891014099 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.892304897 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.892370939 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.892379999 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.892393112 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.892435074 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.892577887 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.892591000 CEST	443	49742	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.892601967 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.892648935 CEST	49742	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.897733927 CEST	49748	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:28.897778034 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:28.897877932 CEST	49748	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:28.898245096 CEST	49748	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:28.898256063 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:28.938261032 CEST	49749	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.938297033 CEST	443	49749	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.938425064 CEST	49749	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.938566923 CEST	49750	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.938616991 CEST	443	49750	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.938671112 CEST	49750	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.939285994 CEST	49751	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.939296007 CEST	443	49751	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.939460039 CEST	49751	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.939553022 CEST	49749	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.939567089 CEST	443	49749	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.940016031 CEST	49750	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.940021038 CEST	49752	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.940031052 CEST	443	49750	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.940059900 CEST	443	49752	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.940130949 CEST	49752	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.940155983 CEST	49751	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.940164089 CEST	443	49751	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.940310955 CEST	49752	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.940334082 CEST	443	49752	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.952579975 CEST	49753	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.952615023 CEST	443	49753	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:28.952708960 CEST	49753	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.952898026 CEST	49753	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:28.952919960 CEST	443	49753	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.014805079 CEST	49754	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.014836073 CEST	443	49754	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.014924049 CEST	49754	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.015140057 CEST	49754	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.015151024 CEST	443	49754	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.212129116 CEST	443	49745	184.28.90.27	192.168.2.17
Oct 24, 2024 17:35:29.212388992 CEST	49745	443	192.168.2.17	184.28.90.27
Oct 24, 2024 17:35:29.213774920 CEST	49745	443	192.168.2.17	184.28.90.27
Oct 24, 2024 17:35:29.213804007 CEST	443	49745	184.28.90.27	192.168.2.17
Oct 24, 2024 17:35:29.214076996 CEST	443	49745	184.28.90.27	192.168.2.17
Oct 24, 2024 17:35:29.215311050 CEST	49745	443	192.168.2.17	184.28.90.27
Oct 24, 2024 17:35:29.263358116 CEST	443	49745	184.28.90.27	192.168.2.17
Oct 24, 2024 17:35:29.311749935 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 24, 2024 17:35:29.460447073 CEST	443	49745	184.28.90.27	192.168.2.17
Oct 24, 2024 17:35:29.460520983 CEST	443	49745	184.28.90.27	192.168.2.17
Oct 24, 2024 17:35:29.461514950 CEST	49745	443	192.168.2.17	184.28.90.27
Oct 24, 2024 17:35:29.461606979 CEST	49745	443	192.168.2.17	184.28.90.27
Oct 24, 2024 17:35:29.461606979 CEST	49745	443	192.168.2.17	184.28.90.27
Oct 24, 2024 17:35:29.461654902 CEST	443	49745	184.28.90.27	192.168.2.17
Oct 24, 2024 17:35:29.461687088 CEST	443	49745	184.28.90.27	192.168.2.17
Oct 24, 2024 17:35:29.661433935 CEST	443	49751	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.661843061 CEST	49751	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.661883116 CEST	443	49751	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.662828922 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:29.662929058 CEST	443	49751	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.663012981 CEST	49751	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.663141966 CEST	49748	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:29.663151979 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:29.663449049 CEST	49751	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.663515091 CEST	443	49751	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.663518906 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:29.663630962 CEST	49751	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.663639069 CEST	443	49751	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.663873911 CEST	49748	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:29.663952112 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:29.663997889 CEST	49748	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:29.668858051 CEST	443	49750	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.669084072 CEST	49750	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.669152021 CEST	443	49750	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.670267105 CEST	443	49750	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.670559883 CEST	49750	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.670684099 CEST	49750	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.670700073 CEST	443	49750	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.670744896 CEST	443	49750	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.676101923 CEST	443	49749	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.676348925 CEST	49749	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.676359892 CEST	443	49749	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.676703930 CEST	443	49749	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.676995993 CEST	49749	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.677057981 CEST	443	49749	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.677109957 CEST	49749	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.677697897 CEST	443	49752	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.678551912 CEST	49752	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.678617954 CEST	443	49752	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.679693937 CEST	443	49752	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.679768085 CEST	49752	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.680051088 CEST	49752	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.680121899 CEST	443	49752	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.680160999 CEST	49752	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.695184946 CEST	443	49753	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.695399046 CEST	49753	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.695442915 CEST	443	49753	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.696644068 CEST	443	49753	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.696733952 CEST	49753	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.697006941 CEST	49753	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.697088003 CEST	443	49753	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.697118998 CEST	49753	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.708810091 CEST	49751	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.711364031 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:29.723340988 CEST	443	49749	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.724883080 CEST	49752	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.724888086 CEST	49750	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.724909067 CEST	443	49752	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.739341974 CEST	443	49753	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.740895987 CEST	49753	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.740922928 CEST	443	49753	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.767030954 CEST	443	49754	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.767592907 CEST	49754	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.767658949 CEST	443	49754	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.768986940 CEST	443	49754	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.769081116 CEST	49754	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.769442081 CEST	49754	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.769526005 CEST	443	49754	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.769608974 CEST	49754	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.769629002 CEST	443	49754	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.772751093 CEST	49752	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.788755894 CEST	49753	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.807029963 CEST	443	49750	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.807123899 CEST	443	49750	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.807176113 CEST	49750	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.808038950 CEST	49750	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.808060884 CEST	443	49750	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.808689117 CEST	49756	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.808720112 CEST	443	49756	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.808787107 CEST	49756	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.809401035 CEST	49756	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.809415102 CEST	443	49756	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.811250925 CEST	443	49749	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.811306000 CEST	443	49749	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.811352015 CEST	49749	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.812012911 CEST	49757	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:29.812040091 CEST	443	49757	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:29.812102079 CEST	49757	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:29.812349081 CEST	49757	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:29.812362909 CEST	443	49757	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:29.812743902 CEST	49749	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.812767982 CEST	443	49749	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.815644026 CEST	49758	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:29.815709114 CEST	443	49758	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:29.815798044 CEST	49758	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:29.816119909 CEST	49758	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:29.816152096 CEST	443	49758	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:29.820772886 CEST	49754	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.903256893 CEST	443	49754	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.903485060 CEST	443	49754	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.903536081 CEST	49754	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.903537989 CEST	443	49754	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.903584957 CEST	49754	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.904277086 CEST	49754	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.904289961 CEST	443	49754	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.905705929 CEST	443	49751	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.905729055 CEST	443	49751	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.905738115 CEST	443	49751	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.905767918 CEST	443	49751	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.905818939 CEST	443	49751	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.905833006 CEST	49751	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.905848980 CEST	443	49751	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.905870914 CEST	49751	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.905901909 CEST	49751	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.906718016 CEST	49751	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:29.906733036 CEST	443	49751	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:29.907839060 CEST	49759	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:29.907857895 CEST	443	49759	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:29.907929897 CEST	49759	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:29.908135891 CEST	49759	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:29.908144951 CEST	443	49759	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:29.911648035 CEST	49760	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:29.911676884 CEST	443	49760	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:29.911756992 CEST	49760	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:29.912025928 CEST	49760	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:29.912040949 CEST	443	49760	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:29.920919895 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:29.920939922 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:29.920963049 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:29.921020031 CEST	49748	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:29.921036005 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:29.921070099 CEST	49748	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:29.921103001 CEST	49748	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:29.995785952 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 24, 2024 17:35:30.007412910 CEST	443	49752	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.007436991 CEST	443	49752	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.007443905 CEST	443	49752	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.007463932 CEST	443	49752	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.007476091 CEST	443	49752	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.007487059 CEST	443	49752	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.007530928 CEST	49752	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:30.007553101 CEST	443	49752	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.007566929 CEST	49752	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:30.007575989 CEST	443	49752	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.007602930 CEST	49752	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:30.007627010 CEST	49752	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:30.008383989 CEST	49752	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:30.008394957 CEST	443	49752	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.011066914 CEST	49761	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.011094093 CEST	443	49761	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.011173010 CEST	49761	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.011389971 CEST	49761	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.011401892 CEST	443	49761	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.040510893 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.040538073 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.040615082 CEST	49748	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.040623903 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.040666103 CEST	49748	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.055524111 CEST	443	49753	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.055552959 CEST	443	49753	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.055563927 CEST	443	49753	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.055634022 CEST	443	49753	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.055753946 CEST	49753	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:30.055753946 CEST	49753	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:30.056416988 CEST	49753	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:30.056437969 CEST	443	49753	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.159563065 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.159584999 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.159882069 CEST	49748	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.159893036 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.159940004 CEST	49748	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.279282093 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.279301882 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.279372931 CEST	49748	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.279385090 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.279417992 CEST	49748	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.398168087 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.398189068 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.398248911 CEST	49748	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.398261070 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.398286104 CEST	49748	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.398307085 CEST	49748	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.518681049 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.518701077 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.519337893 CEST	49748	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.519349098 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.520544052 CEST	49748	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.560581923 CEST	443	49756	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.560937881 CEST	49756	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:30.560956955 CEST	443	49756	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.561301947 CEST	443	49756	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.561852932 CEST	49756	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:30.561938047 CEST	443	49756	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.561984062 CEST	49756	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:30.577598095 CEST	443	49757	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.577925920 CEST	49757	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.577953100 CEST	443	49757	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.578305960 CEST	443	49757	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.578716993 CEST	49757	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.578763008 CEST	49757	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.578784943 CEST	443	49757	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.589757919 CEST	443	49758	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.590109110 CEST	49758	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.590145111 CEST	443	49758	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.591274023 CEST	443	49758	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.591618061 CEST	49758	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.591758013 CEST	49758	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.591815948 CEST	443	49758	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.607330084 CEST	443	49756	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.615864992 CEST	49756	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:30.631820917 CEST	49758	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.632059097 CEST	49757	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.638833046 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.638853073 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.638937950 CEST	49748	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.638948917 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.639085054 CEST	49748	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.639123917 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.639202118 CEST	49748	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.639205933 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.639256954 CEST	49748	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.639517069 CEST	49748	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.639533043 CEST	443	49748	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.640078068 CEST	49762	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.640130997 CEST	443	49762	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.640213013 CEST	49762	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.640599012 CEST	49762	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.640624046 CEST	443	49762	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.670707941 CEST	443	49760	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.671032906 CEST	49760	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.671056032 CEST	443	49760	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.671092987 CEST	443	49759	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.671382904 CEST	49759	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.671448946 CEST	443	49759	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.672101021 CEST	443	49760	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.672171116 CEST	49760	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.672509909 CEST	49760	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.672521114 CEST	443	49759	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.672575951 CEST	443	49760	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.672602892 CEST	49759	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.672950029 CEST	49759	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.673023939 CEST	443	49759	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.673111916 CEST	49760	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.673121929 CEST	443	49760	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.673264980 CEST	49759	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.673284054 CEST	443	49759	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.721959114 CEST	443	49757	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.722558022 CEST	443	49757	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.722712040 CEST	49757	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.722914934 CEST	49757	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.722937107 CEST	443	49757	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.725766897 CEST	49760	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.725773096 CEST	49759	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.981998920 CEST	443	49758	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.982223034 CEST	443	49758	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.982322931 CEST	49758	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.982989073 CEST	49758	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.983032942 CEST	443	49758	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.985038996 CEST	443	49761	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.985469103 CEST	443	49756	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.985495090 CEST	443	49756	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.985502958 CEST	443	49756	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.985563993 CEST	443	49756	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.985569954 CEST	443	49760	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.985586882 CEST	443	49760	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.985594034 CEST	49756	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:30.985615015 CEST	443	49756	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.985629082 CEST	443	49760	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.985646009 CEST	443	49756	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.985650063 CEST	49760	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.985651970 CEST	49761	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.985672951 CEST	443	49756	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.985675097 CEST	49760	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.985685110 CEST	49756	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:30.985716105 CEST	443	49761	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.985743999 CEST	49756	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:30.986676931 CEST	49760	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.986696959 CEST	443	49760	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.986821890 CEST	443	49761	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.986892939 CEST	49761	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.987910032 CEST	49761	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.987982988 CEST	443	49761	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.988508940 CEST	49761	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.988526106 CEST	443	49761	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.993033886 CEST	443	49756	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.993051052 CEST	443	49756	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.993073940 CEST	443	49756	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.993119001 CEST	443	49756	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.993172884 CEST	49756	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:30.993192911 CEST	49756	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:30.994030952 CEST	49756	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:30.994045973 CEST	443	49756	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:30.995762110 CEST	443	49759	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.995785952 CEST	443	49759	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.995793104 CEST	443	49759	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.995826006 CEST	443	49759	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.995858908 CEST	443	49759	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.995877981 CEST	443	49759	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.995902061 CEST	49759	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.995902061 CEST	49759	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.995940924 CEST	443	49759	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.995973110 CEST	49759	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.995973110 CEST	49759	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.996002913 CEST	443	49759	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:30.996032000 CEST	49759	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.996051073 CEST	49759	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.998373032 CEST	49759	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:30.998399973 CEST	443	49759	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:31.003782034 CEST	49763	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:31.003843069 CEST	443	49763	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:31.003932953 CEST	49763	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:31.004272938 CEST	49763	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:31.004301071 CEST	443	49763	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:31.029805899 CEST	49761	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:31.554241896 CEST	443	49761	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:31.554260969 CEST	443	49761	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:31.554270029 CEST	443	49761	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:31.554303885 CEST	443	49761	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:31.554332972 CEST	443	49761	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:31.554335117 CEST	49761	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:31.554354906 CEST	443	49761	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:31.554382086 CEST	443	49761	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:31.554395914 CEST	49761	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:31.554397106 CEST	49761	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:31.554428101 CEST	49761	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:31.555248976 CEST	49761	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:31.555284977 CEST	443	49761	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:31.692987919 CEST	443	49762	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:31.693365097 CEST	49762	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:31.693397999 CEST	443	49762	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:31.693739891 CEST	443	49762	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:31.694101095 CEST	49762	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:31.694164991 CEST	443	49762	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:31.694262028 CEST	49762	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:31.735333920 CEST	443	49762	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:31.771941900 CEST	443	49763	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:31.772274971 CEST	49763	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:31.772296906 CEST	443	49763	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:31.772679090 CEST	443	49763	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:31.773075104 CEST	49763	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:31.773152113 CEST	443	49763	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:31.773243904 CEST	49763	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:31.819322109 CEST	443	49763	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:31.835273981 CEST	443	49762	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:31.835294008 CEST	443	49762	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:31.835359097 CEST	443	49762	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:31.835388899 CEST	49762	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:31.835437059 CEST	49762	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:31.836229086 CEST	49762	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:31.836256027 CEST	443	49762	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:32.033981085 CEST	443	49763	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:32.033999920 CEST	443	49763	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:32.034018040 CEST	443	49763	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:32.034066916 CEST	49763	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:32.034095049 CEST	443	49763	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:32.034183979 CEST	49763	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:32.034214020 CEST	49763	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:32.153954983 CEST	443	49763	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:32.153979063 CEST	443	49763	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:32.154062986 CEST	49763	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:32.154099941 CEST	443	49763	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:32.154153109 CEST	49763	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:32.154288054 CEST	443	49763	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:32.154340029 CEST	49763	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:32.154347897 CEST	443	49763	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:32.154376030 CEST	443	49763	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:32.154395103 CEST	49763	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:32.154421091 CEST	49763	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:32.154834986 CEST	49763	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:32.154859066 CEST	443	49763	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:33.246906996 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 24, 2024 17:35:33.549915075 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 24, 2024 17:35:34.123758078 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 24, 2024 17:35:34.155781031 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 24, 2024 17:35:35.360033989 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 24, 2024 17:35:37.765908003 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 24, 2024 17:35:39.596872091 CEST	49675	443	192.168.2.17	204.79.197.203
Oct 24, 2024 17:35:40.817948103 CEST	49767	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:40.817981005 CEST	443	49767	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:40.818061113 CEST	49767	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:40.818298101 CEST	49768	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:40.818396091 CEST	443	49768	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:40.818469048 CEST	49768	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:40.818670034 CEST	49767	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:40.818679094 CEST	443	49767	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:40.818854094 CEST	49768	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:40.818882942 CEST	443	49768	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:41.558576107 CEST	443	49768	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:41.558892012 CEST	49768	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:41.558918953 CEST	443	49768	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:41.560045004 CEST	443	49768	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:41.560434103 CEST	49768	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:41.560590982 CEST	49768	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:41.560604095 CEST	443	49768	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:41.568556070 CEST	443	49767	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:41.568834066 CEST	49767	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:41.568850994 CEST	443	49767	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:41.569194078 CEST	443	49767	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:41.570127010 CEST	49767	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:41.570184946 CEST	443	49767	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:41.570249081 CEST	49767	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:41.600951910 CEST	49768	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:41.600984097 CEST	443	49768	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:41.611339092 CEST	443	49767	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:41.698945045 CEST	443	49768	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:41.699004889 CEST	443	49768	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:41.699080944 CEST	49768	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:41.699143887 CEST	443	49768	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:41.699182987 CEST	443	49768	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:41.699246883 CEST	49768	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:41.699939013 CEST	49768	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:41.699974060 CEST	443	49768	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:41.702624083 CEST	49770	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:41.702718019 CEST	443	49770	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:41.702826023 CEST	49770	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:41.703063965 CEST	49770	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:41.703099012 CEST	443	49770	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:41.703660965 CEST	443	49767	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:41.703682899 CEST	443	49767	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:41.703733921 CEST	49767	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:41.703742981 CEST	443	49767	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:41.703804016 CEST	49767	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:41.704294920 CEST	49767	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:41.704312086 CEST	443	49767	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:41.706512928 CEST	49771	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:41.706547022 CEST	443	49771	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:41.706612110 CEST	49771	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:41.706801891 CEST	49771	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:41.706818104 CEST	443	49771	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:42.458277941 CEST	443	49770	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:42.458556890 CEST	49770	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:42.458575964 CEST	443	49770	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:42.459125042 CEST	443	49770	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:42.459414959 CEST	49770	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:42.459490061 CEST	443	49770	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:42.459511995 CEST	443	49771	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:42.459549904 CEST	49770	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:42.459700108 CEST	49771	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:42.459712982 CEST	443	49771	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:42.460020065 CEST	443	49771	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:42.460270882 CEST	49771	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:42.460320950 CEST	443	49771	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:42.460367918 CEST	49771	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:42.503551960 CEST	443	49771	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:42.503575087 CEST	443	49770	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:42.572918892 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 24, 2024 17:35:42.596048117 CEST	443	49770	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:42.596112967 CEST	443	49770	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:42.596180916 CEST	49770	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:42.596210957 CEST	443	49770	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:42.596241951 CEST	443	49770	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:42.596296072 CEST	49770	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:42.596349955 CEST	443	49771	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:42.596375942 CEST	443	49771	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:42.596528053 CEST	443	49771	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:42.596585035 CEST	49771	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:42.596585035 CEST	49771	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:42.597187996 CEST	49770	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:42.597203016 CEST	443	49770	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:42.597719908 CEST	49771	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:42.597734928 CEST	443	49771	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:43.240156889 CEST	49774	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:43.240195990 CEST	443	49774	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:43.240282059 CEST	49774	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:43.240852118 CEST	49774	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:43.240861893 CEST	443	49774	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:43.734960079 CEST	49680	443	192.168.2.17	20.189.173.13
Oct 24, 2024 17:35:44.286307096 CEST	443	49774	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:44.286695004 CEST	49774	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:44.286705017 CEST	443	49774	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:44.287015915 CEST	443	49774	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:44.287492990 CEST	49774	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:44.287539959 CEST	443	49774	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:44.287601948 CEST	49774	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:44.331352949 CEST	443	49774	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:44.422969103 CEST	443	49774	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:44.423027992 CEST	443	49774	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:44.423177958 CEST	443	49774	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:44.423240900 CEST	49774	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:44.423610926 CEST	49774	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:44.424379110 CEST	49774	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:44.424397945 CEST	443	49774	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:44.426930904 CEST	49776	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:44.426950932 CEST	443	49776	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:44.427037001 CEST	49776	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:44.427254915 CEST	49776	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:44.427267075 CEST	443	49776	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:44.701554060 CEST	49778	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:44.701607943 CEST	443	49778	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:44.701787949 CEST	49778	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:44.701824903 CEST	49779	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:44.701915026 CEST	443	49779	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:44.702028990 CEST	49779	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:44.702096939 CEST	49778	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:44.702125072 CEST	443	49778	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:44.702265024 CEST	49779	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:44.702310085 CEST	443	49779	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:45.207695007 CEST	443	49776	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:45.208151102 CEST	49776	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:45.208163977 CEST	443	49776	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:45.209250927 CEST	443	49776	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:45.209654093 CEST	49776	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:45.209820032 CEST	443	49776	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:45.209887028 CEST	49776	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:45.255332947 CEST	443	49776	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:45.351557016 CEST	443	49776	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:45.351624012 CEST	443	49776	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:45.351710081 CEST	49776	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:45.351730108 CEST	443	49776	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:45.351764917 CEST	443	49776	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:45.351875067 CEST	49776	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:45.352543116 CEST	49776	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:45.352555990 CEST	443	49776	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:45.439637899 CEST	443	49778	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:45.439975977 CEST	49778	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:45.439992905 CEST	443	49778	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:45.440304041 CEST	443	49778	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:45.440592051 CEST	49778	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:45.440639019 CEST	443	49778	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:45.440781116 CEST	49778	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:45.459944963 CEST	443	49779	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:45.460144043 CEST	49779	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:45.460164070 CEST	443	49779	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:45.460484028 CEST	443	49779	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:45.460764885 CEST	49779	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:45.460817099 CEST	443	49779	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:45.460939884 CEST	49779	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:45.487320900 CEST	443	49778	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:45.503340960 CEST	443	49779	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:45.571037054 CEST	443	49778	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:45.571202993 CEST	443	49778	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:45.571276903 CEST	49778	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:45.572246075 CEST	49778	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:45.572288990 CEST	443	49778	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:45.574994087 CEST	49780	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:45.575027943 CEST	443	49780	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:45.575102091 CEST	49780	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:45.575444937 CEST	49780	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:45.575464010 CEST	443	49780	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:45.637785912 CEST	443	49779	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:45.639607906 CEST	443	49779	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:45.639693975 CEST	49779	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:45.639940977 CEST	49779	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:45.639971018 CEST	443	49779	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:45.642884970 CEST	49781	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:45.642998934 CEST	443	49781	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:45.643121004 CEST	49781	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:45.643376112 CEST	49781	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:45.643413067 CEST	443	49781	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:46.329713106 CEST	443	49780	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:46.338082075 CEST	49780	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:46.338139057 CEST	443	49780	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:46.338561058 CEST	443	49780	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:46.339066982 CEST	49780	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:46.339148998 CEST	443	49780	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:46.341181993 CEST	49780	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:46.383337975 CEST	443	49780	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:46.422166109 CEST	443	49781	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:46.423594952 CEST	49781	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:46.423671961 CEST	443	49781	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:46.424195051 CEST	443	49781	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:46.426080942 CEST	49781	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:46.426177025 CEST	443	49781	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:46.426258087 CEST	49781	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:46.471338034 CEST	443	49781	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:46.472881079 CEST	49781	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:46.473649979 CEST	443	49780	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:46.473989964 CEST	443	49780	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:46.474071026 CEST	49780	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:46.474431992 CEST	49780	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:46.474479914 CEST	443	49780	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:46.566032887 CEST	443	49781	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:46.566135883 CEST	443	49781	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:46.566195011 CEST	49781	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:46.566776037 CEST	49781	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:35:46.566798925 CEST	443	49781	13.107.253.45	192.168.2.17
Oct 24, 2024 17:35:48.386408091 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:48.386445045 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:48.386507988 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:48.386755943 CEST	49785	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:48.386784077 CEST	443	49785	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:48.386858940 CEST	49785	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:48.386985064 CEST	49786	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:48.387017012 CEST	443	49786	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:48.387068033 CEST	49786	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:48.387219906 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:48.387236118 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:48.387372971 CEST	49785	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:48.387383938 CEST	443	49785	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:48.387512922 CEST	49786	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:48.387528896 CEST	443	49786	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:49.144304991 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.144320011 CEST	443	49785	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.144623995 CEST	49785	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.144643068 CEST	443	49785	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.144829035 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.144851923 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.145718098 CEST	443	49785	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.145802975 CEST	49785	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.145914078 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.145988941 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.147068024 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.147136927 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.147145987 CEST	49785	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.147206068 CEST	443	49785	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.147222042 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.147233009 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.197962999 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.198013067 CEST	49785	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.198024988 CEST	443	49785	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.246046066 CEST	49785	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.391659021 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.391731024 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.391752958 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.391793966 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.391836882 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.391937971 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.391937971 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.391961098 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.392116070 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.404225111 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.404241085 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.404335976 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.404347897 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.404396057 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.446142912 CEST	443	49786	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:49.446767092 CEST	49786	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:49.446796894 CEST	443	49786	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:49.448254108 CEST	443	49786	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:49.448333025 CEST	49786	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:49.449819088 CEST	49786	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:49.449934959 CEST	443	49786	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:49.500905991 CEST	49786	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:49.500920057 CEST	443	49786	152.199.21.175	192.168.2.17
Oct 24, 2024 17:35:49.520929098 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.520951033 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.521054983 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.521071911 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.521119118 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.523951054 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.523993969 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.524030924 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.524039030 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.524070024 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.524082899 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.547873020 CEST	49786	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:35:49.637001038 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.637052059 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.637098074 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.637109995 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.637135983 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.637151003 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.640007973 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.640057087 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.640100002 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.640106916 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.640134096 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.640151024 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.754743099 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.754761934 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.754843950 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.754858017 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.754889965 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.754906893 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.756915092 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.756930113 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.756993055 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.757002115 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.757042885 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.873471975 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.873495102 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.873564959 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.873580933 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.873620033 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.875251055 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.875267029 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.875334978 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.875343084 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.875380039 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.989890099 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.989917040 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.990145922 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.990173101 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.990227938 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.991420984 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.991436958 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.991509914 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:49.991517067 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:49.991565943 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.098145962 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.098166943 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.098263025 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.098279953 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.098330975 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.107568026 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.107590914 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.107655048 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.107664108 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.107718945 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.108511925 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.108550072 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.108573914 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.108578920 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.108592033 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.108606100 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.108637094 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.108912945 CEST	49784	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.108931065 CEST	443	49784	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.136405945 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:50.136439085 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:50.136524916 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:50.136814117 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:50.136828899 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:50.157219887 CEST	49788	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.157274008 CEST	443	49788	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.157386065 CEST	49788	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.157706022 CEST	49788	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.157723904 CEST	443	49788	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.192137003 CEST	49789	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.192167044 CEST	443	49789	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.192234039 CEST	49789	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.192675114 CEST	49789	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.192687035 CEST	443	49789	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.193341017 CEST	49790	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.193378925 CEST	443	49790	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.193458080 CEST	49790	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.193646908 CEST	49790	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.193656921 CEST	443	49790	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.898468018 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:50.898766041 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:50.898783922 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:50.899794102 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:50.899894953 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:50.900228024 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:50.900288105 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:50.900376081 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:50.900384903 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:50.912734032 CEST	443	49788	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.912946939 CEST	49788	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.912965059 CEST	443	49788	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.913305044 CEST	443	49788	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.913594007 CEST	49788	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.913661957 CEST	443	49788	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.913686037 CEST	49788	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.947870016 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:50.948313951 CEST	443	49789	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.948591948 CEST	49789	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.948605061 CEST	443	49789	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.951997995 CEST	443	49789	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.952070951 CEST	49789	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.952452898 CEST	49789	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.952526093 CEST	443	49789	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.952617884 CEST	49789	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.952624083 CEST	443	49789	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.955375910 CEST	443	49788	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.962337971 CEST	443	49790	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.962563038 CEST	49790	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.962578058 CEST	443	49790	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.963891029 CEST	49788	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.964453936 CEST	443	49790	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.964524031 CEST	49790	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.964818954 CEST	49790	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.964896917 CEST	443	49790	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:50.964934111 CEST	49790	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:50.995896101 CEST	49789	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:51.011329889 CEST	443	49790	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:51.011900902 CEST	49790	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:51.011915922 CEST	443	49790	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:51.059922934 CEST	49790	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:51.088654995 CEST	443	49789	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:51.088709116 CEST	443	49789	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:51.088803053 CEST	443	49789	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:51.088871002 CEST	49789	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:51.089500904 CEST	49789	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:51.089500904 CEST	49789	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:51.089520931 CEST	49789	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:51.093190908 CEST	49794	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.093225956 CEST	443	49794	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.093302011 CEST	49794	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.093550920 CEST	49794	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.093564034 CEST	443	49794	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.116507053 CEST	443	49790	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:51.116687059 CEST	443	49790	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:51.116744041 CEST	49790	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:51.117257118 CEST	49790	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:51.117271900 CEST	443	49790	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:51.120136023 CEST	49795	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.120172024 CEST	443	49795	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.120240927 CEST	49795	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.120448112 CEST	49795	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.120464087 CEST	443	49795	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.141448975 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.141479969 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.141486883 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.141530037 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.141554117 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.141568899 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.141578913 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.141598940 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.141633034 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.153537035 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.153553009 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.153640985 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.153656006 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.153706074 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.270100117 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.270168066 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.270210028 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.270226955 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.270267963 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.270287991 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.271719933 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.271766901 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.271811008 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.271819115 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.271831036 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.271855116 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.392232895 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.392302036 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.392344952 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.392355919 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.392379045 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.392405033 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.396245003 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.396292925 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.396334887 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.396347046 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.396389961 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.396411896 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.493328094 CEST	443	49788	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:51.493352890 CEST	443	49788	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:51.493360996 CEST	443	49788	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:51.493405104 CEST	443	49788	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:51.493436098 CEST	49788	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:51.493447065 CEST	443	49788	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:51.493455887 CEST	443	49788	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:51.493489027 CEST	49788	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:51.493510962 CEST	49788	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:51.496162891 CEST	443	49788	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:51.496180058 CEST	443	49788	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:51.496259928 CEST	49788	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:51.496268034 CEST	443	49788	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:51.496314049 CEST	49788	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:51.496490955 CEST	443	49788	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:51.496551991 CEST	443	49788	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:51.496659040 CEST	49788	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:51.496864080 CEST	49788	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:51.496876955 CEST	443	49788	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:51.500585079 CEST	49796	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.500624895 CEST	443	49796	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.500710964 CEST	49796	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.500988007 CEST	49796	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.501005888 CEST	443	49796	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.511132002 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.511162996 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.511224031 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.511234999 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.511245012 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.511286020 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.512701035 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.512722969 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.512777090 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.512785912 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.512830019 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.512896061 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.629689932 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.629712105 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.629786968 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.629802942 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.629863024 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.630683899 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.630702972 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.630753040 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.630759954 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.630799055 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.630816936 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.733638048 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.733663082 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.733766079 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.733799934 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.733866930 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.749169111 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.749191046 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.749408007 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.749439955 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.749499083 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.829296112 CEST	443	49794	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.829787016 CEST	49794	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.829797029 CEST	443	49794	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.830471992 CEST	443	49794	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.831175089 CEST	49794	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.831258059 CEST	443	49794	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.831351042 CEST	49794	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.871412039 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.871434927 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.871578932 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.871612072 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.871682882 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.872503042 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.872522116 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.872591019 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.872601032 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.872648954 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.874550104 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.874600887 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.874625921 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.874641895 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.874706984 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.875289917 CEST	49787	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.875322104 CEST	443	49787	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.875332117 CEST	443	49794	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.876518965 CEST	443	49795	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.876848936 CEST	49795	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.876861095 CEST	443	49795	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.877350092 CEST	443	49795	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.877861977 CEST	49795	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.877934933 CEST	443	49795	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:51.878034115 CEST	49795	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:51.923336983 CEST	443	49795	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:52.006442070 CEST	443	49794	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:52.008534908 CEST	443	49794	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:52.008620977 CEST	49794	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:52.008627892 CEST	443	49794	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:52.008692026 CEST	49794	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:52.009012938 CEST	49794	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:52.009030104 CEST	443	49794	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:52.018992901 CEST	443	49795	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:52.020136118 CEST	443	49795	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:52.020210028 CEST	49795	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:52.020473003 CEST	49795	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:52.020494938 CEST	443	49795	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:52.187333107 CEST	49682	80	192.168.2.17	192.229.211.108
Oct 24, 2024 17:35:52.244889021 CEST	443	49796	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:52.245316029 CEST	49796	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:52.245342016 CEST	443	49796	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:52.246347904 CEST	443	49796	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:52.246433973 CEST	49796	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:52.246835947 CEST	49796	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:52.246896982 CEST	443	49796	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:52.247016907 CEST	49796	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:52.247025013 CEST	443	49796	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:52.298943043 CEST	49796	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:52.482980967 CEST	443	49796	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:52.483001947 CEST	443	49796	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:52.483005047 CEST	443	49796	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:52.483052015 CEST	443	49796	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:52.483071089 CEST	443	49796	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:52.483084917 CEST	443	49796	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:52.483095884 CEST	49796	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:52.483108997 CEST	443	49796	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:52.483155012 CEST	49796	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:52.483165026 CEST	49796	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:52.495989084 CEST	443	49796	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:52.496001959 CEST	443	49796	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:52.496026993 CEST	443	49796	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:52.496088982 CEST	49796	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:52.496095896 CEST	443	49796	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:52.496128082 CEST	49796	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:52.496149063 CEST	49796	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:52.496599913 CEST	49796	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:52.496615887 CEST	443	49796	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:52.562614918 CEST	49797	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:52.562660933 CEST	443	49797	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:52.562876940 CEST	49797	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:52.563518047 CEST	49797	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:52.563529968 CEST	443	49797	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:52.886344910 CEST	49799	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:52.886356115 CEST	443	49799	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:52.886430025 CEST	49799	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:52.886612892 CEST	49799	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:52.886625051 CEST	443	49799	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:53.494903088 CEST	443	49797	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:53.495007038 CEST	49797	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:53.496725082 CEST	49797	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:53.496758938 CEST	443	49797	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:53.496999025 CEST	443	49797	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:53.498213053 CEST	49797	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:53.543334961 CEST	443	49797	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:53.625185013 CEST	443	49799	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:53.627046108 CEST	49799	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:53.627057076 CEST	443	49799	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:53.627559900 CEST	443	49799	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:53.628005028 CEST	49799	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:53.628084898 CEST	443	49799	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:53.628149033 CEST	49799	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:53.668915987 CEST	49799	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:53.668962002 CEST	443	49799	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:53.805680990 CEST	443	49797	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:53.805740118 CEST	443	49797	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:53.805788040 CEST	443	49797	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:53.805921078 CEST	49797	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:53.805921078 CEST	49797	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:53.805963039 CEST	443	49797	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:53.806144953 CEST	49797	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:53.807677031 CEST	443	49797	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:53.807720900 CEST	443	49797	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:53.807760000 CEST	49797	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:53.807775021 CEST	443	49797	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:53.807804108 CEST	49797	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:53.808634043 CEST	49797	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:53.808667898 CEST	443	49797	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:53.808690071 CEST	49797	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:53.808989048 CEST	443	49797	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:53.809075117 CEST	443	49797	52.149.20.212	192.168.2.17
Oct 24, 2024 17:35:53.809134007 CEST	49797	443	192.168.2.17	52.149.20.212
Oct 24, 2024 17:35:53.887753010 CEST	443	49785	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:53.887917995 CEST	443	49785	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:53.887981892 CEST	49785	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:53.976444006 CEST	49785	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:53.976473093 CEST	443	49785	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:54.094715118 CEST	443	49799	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:54.094738960 CEST	443	49799	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:54.094746113 CEST	443	49799	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:54.094763994 CEST	443	49799	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:54.094798088 CEST	443	49799	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:54.094811916 CEST	49799	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:54.094837904 CEST	443	49799	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:54.094852924 CEST	49799	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:54.094852924 CEST	49799	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:54.094887972 CEST	49799	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:54.094892979 CEST	443	49799	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:54.094933033 CEST	443	49799	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:54.094934940 CEST	49799	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:54.094979048 CEST	49799	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:54.095740080 CEST	49799	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:54.095756054 CEST	443	49799	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:54.099901915 CEST	49805	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:54.099950075 CEST	443	49805	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:54.100032091 CEST	49805	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:54.100294113 CEST	49805	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:54.100312948 CEST	443	49805	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:55.196294069 CEST	49698	80	192.168.2.17	93.184.221.240
Oct 24, 2024 17:35:55.202698946 CEST	80	49698	93.184.221.240	192.168.2.17
Oct 24, 2024 17:35:55.202790976 CEST	49698	80	192.168.2.17	93.184.221.240
Oct 24, 2024 17:35:55.251703024 CEST	49806	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:55.251744032 CEST	443	49806	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:55.251876116 CEST	49806	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:55.252051115 CEST	49806	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:55.252068996 CEST	443	49806	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:55.252791882 CEST	49807	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:55.252850056 CEST	443	49807	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:55.252928019 CEST	49807	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:55.253127098 CEST	49807	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:55.253158092 CEST	443	49807	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:55.529216051 CEST	443	49805	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:55.529740095 CEST	49805	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:55.529757977 CEST	443	49805	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:55.530884981 CEST	443	49805	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:55.531341076 CEST	49805	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:55.531476021 CEST	443	49805	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:55.531513929 CEST	49805	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:55.577027082 CEST	49805	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:55.577035904 CEST	443	49805	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:55.778172970 CEST	443	49805	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:55.778232098 CEST	443	49805	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:55.778273106 CEST	443	49805	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:55.778301001 CEST	49805	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:55.778342009 CEST	443	49805	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:55.778357983 CEST	49805	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:55.778363943 CEST	443	49805	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:55.778420925 CEST	49805	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:55.778429985 CEST	443	49805	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:55.778498888 CEST	443	49805	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:55.778547049 CEST	49805	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:55.778556108 CEST	443	49805	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:55.778640985 CEST	443	49805	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:55.778696060 CEST	49805	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:55.779340029 CEST	49805	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:35:55.779361010 CEST	443	49805	13.107.246.45	192.168.2.17
Oct 24, 2024 17:35:56.010027885 CEST	443	49806	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:56.010346889 CEST	49806	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:56.010368109 CEST	443	49806	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:56.010843992 CEST	443	49806	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:56.011142015 CEST	49806	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:56.011224985 CEST	443	49806	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:56.028805017 CEST	443	49807	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:56.029186010 CEST	49807	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:56.029249907 CEST	443	49807	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:56.030386925 CEST	443	49807	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:56.030720949 CEST	49807	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:56.030900955 CEST	443	49807	13.107.253.67	192.168.2.17
Oct 24, 2024 17:35:56.068928957 CEST	49806	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:35:56.080941916 CEST	49807	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:36:00.526036024 CEST	49815	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:36:00.526083946 CEST	443	49815	13.107.253.67	192.168.2.17
Oct 24, 2024 17:36:00.526153088 CEST	49815	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:36:00.526372910 CEST	49815	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:36:00.526386976 CEST	443	49815	13.107.253.67	192.168.2.17
Oct 24, 2024 17:36:00.745628119 CEST	443	49806	13.107.253.67	192.168.2.17
Oct 24, 2024 17:36:00.745713949 CEST	443	49806	13.107.253.67	192.168.2.17
Oct 24, 2024 17:36:00.745806932 CEST	49806	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:36:00.762451887 CEST	443	49807	13.107.253.67	192.168.2.17
Oct 24, 2024 17:36:00.762547016 CEST	443	49807	13.107.253.67	192.168.2.17
Oct 24, 2024 17:36:00.762629032 CEST	49807	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:36:00.823496103 CEST	49807	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:36:00.823537111 CEST	443	49807	13.107.253.67	192.168.2.17
Oct 24, 2024 17:36:00.823577881 CEST	49806	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:36:00.823610067 CEST	443	49806	13.107.253.67	192.168.2.17
Oct 24, 2024 17:36:01.292457104 CEST	443	49815	13.107.253.67	192.168.2.17
Oct 24, 2024 17:36:01.292726994 CEST	49815	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:36:01.292761087 CEST	443	49815	13.107.253.67	192.168.2.17
Oct 24, 2024 17:36:01.293148041 CEST	443	49815	13.107.253.67	192.168.2.17
Oct 24, 2024 17:36:01.293637991 CEST	49815	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:36:01.293704033 CEST	443	49815	13.107.253.67	192.168.2.17
Oct 24, 2024 17:36:01.339085102 CEST	49815	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:36:01.935981989 CEST	49818	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:01.935990095 CEST	443	49818	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:01.936053991 CEST	49818	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:01.936395884 CEST	49818	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:01.936408043 CEST	443	49818	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:04.271807909 CEST	443	49818	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:04.273387909 CEST	49818	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:04.273421049 CEST	443	49818	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:04.273938894 CEST	443	49818	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:04.274595976 CEST	49818	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:04.274682999 CEST	443	49818	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:04.316090107 CEST	49818	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:04.542731047 CEST	49820	443	192.168.2.17	13.107.5.88
Oct 24, 2024 17:36:04.542785883 CEST	443	49820	13.107.5.88	192.168.2.17
Oct 24, 2024 17:36:04.542876005 CEST	49820	443	192.168.2.17	13.107.5.88
Oct 24, 2024 17:36:04.574873924 CEST	49820	443	192.168.2.17	13.107.5.88
Oct 24, 2024 17:36:04.574893951 CEST	443	49820	13.107.5.88	192.168.2.17
Oct 24, 2024 17:36:04.812576056 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:04.812613964 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:04.812685966 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:04.812983036 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:04.812998056 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:05.328155041 CEST	443	49820	13.107.5.88	192.168.2.17
Oct 24, 2024 17:36:05.328254938 CEST	49820	443	192.168.2.17	13.107.5.88
Oct 24, 2024 17:36:05.332400084 CEST	49820	443	192.168.2.17	13.107.5.88
Oct 24, 2024 17:36:05.332433939 CEST	443	49820	13.107.5.88	192.168.2.17
Oct 24, 2024 17:36:05.332839012 CEST	443	49820	13.107.5.88	192.168.2.17
Oct 24, 2024 17:36:05.377468109 CEST	49820	443	192.168.2.17	13.107.5.88
Oct 24, 2024 17:36:05.423337936 CEST	443	49820	13.107.5.88	192.168.2.17
Oct 24, 2024 17:36:05.505084991 CEST	443	49820	13.107.5.88	192.168.2.17
Oct 24, 2024 17:36:05.506726027 CEST	443	49820	13.107.5.88	192.168.2.17
Oct 24, 2024 17:36:05.506799936 CEST	49820	443	192.168.2.17	13.107.5.88
Oct 24, 2024 17:36:05.509351969 CEST	49820	443	192.168.2.17	13.107.5.88
Oct 24, 2024 17:36:05.557667971 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:05.559173107 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:05.559182882 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:05.559762001 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:05.560116053 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:05.560199976 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:05.560286045 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:05.603322983 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:05.683053017 CEST	49823	443	192.168.2.17	2.23.209.177
Oct 24, 2024 17:36:05.683083057 CEST	443	49823	2.23.209.177	192.168.2.17
Oct 24, 2024 17:36:05.683290958 CEST	49823	443	192.168.2.17	2.23.209.177
Oct 24, 2024 17:36:05.688358068 CEST	49823	443	192.168.2.17	2.23.209.177
Oct 24, 2024 17:36:05.688371897 CEST	443	49823	2.23.209.177	192.168.2.17
Oct 24, 2024 17:36:05.802979946 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:05.803018093 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:05.803041935 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:05.803082943 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:05.803112030 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:05.803133965 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:05.803164005 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:05.814173937 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:05.814199924 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:05.814249992 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:05.814259052 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:05.814304113 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:05.933548927 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:05.933592081 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:05.933640957 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:05.933655977 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:05.933693886 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:05.933717012 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:06.030563116 CEST	443	49815	13.107.253.67	192.168.2.17
Oct 24, 2024 17:36:06.030636072 CEST	443	49815	13.107.253.67	192.168.2.17
Oct 24, 2024 17:36:06.031191111 CEST	49815	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:36:06.052295923 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:06.052335024 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:06.052385092 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:06.052417040 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:06.052442074 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:06.052467108 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:06.053845882 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:06.053869963 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:06.053955078 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:06.053966045 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:06.054007053 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:06.171478987 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:06.171509981 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:06.171574116 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:06.171602964 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:06.171622992 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:06.171649933 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:06.267919064 CEST	49815	443	192.168.2.17	13.107.253.67
Oct 24, 2024 17:36:06.267947912 CEST	443	49815	13.107.253.67	192.168.2.17
Oct 24, 2024 17:36:06.277899027 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:06.277931929 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:06.278023958 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:06.278043985 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:06.278091908 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:06.290668011 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:06.290750980 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:06.290756941 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:06.290774107 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:06.290829897 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:06.291069031 CEST	49821	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:06.291079998 CEST	443	49821	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:06.295392036 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:06.295476913 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:06.295733929 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:06.295964003 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:06.295998096 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:06.355386972 CEST	49825	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:36:06.355412006 CEST	443	49825	52.98.152.194	192.168.2.17
Oct 24, 2024 17:36:06.355619907 CEST	49825	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:36:06.355928898 CEST	49825	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:36:06.355943918 CEST	443	49825	52.98.152.194	192.168.2.17
Oct 24, 2024 17:36:06.538717031 CEST	443	49823	2.23.209.177	192.168.2.17
Oct 24, 2024 17:36:06.538819075 CEST	49823	443	192.168.2.17	2.23.209.177
Oct 24, 2024 17:36:06.605290890 CEST	49823	443	192.168.2.17	2.23.209.177
Oct 24, 2024 17:36:06.605313063 CEST	443	49823	2.23.209.177	192.168.2.17
Oct 24, 2024 17:36:06.605645895 CEST	443	49823	2.23.209.177	192.168.2.17
Oct 24, 2024 17:36:06.605693102 CEST	49823	443	192.168.2.17	2.23.209.177
Oct 24, 2024 17:36:06.607916117 CEST	49823	443	192.168.2.17	2.23.209.177
Oct 24, 2024 17:36:06.607961893 CEST	443	49823	2.23.209.177	192.168.2.17
Oct 24, 2024 17:36:06.896231890 CEST	443	49823	2.23.209.177	192.168.2.17
Oct 24, 2024 17:36:06.896275997 CEST	443	49823	2.23.209.177	192.168.2.17
Oct 24, 2024 17:36:06.896302938 CEST	49823	443	192.168.2.17	2.23.209.177
Oct 24, 2024 17:36:06.896320105 CEST	443	49823	2.23.209.177	192.168.2.17
Oct 24, 2024 17:36:06.896358013 CEST	49823	443	192.168.2.17	2.23.209.177
Oct 24, 2024 17:36:06.896358013 CEST	49823	443	192.168.2.17	2.23.209.177
Oct 24, 2024 17:36:06.896683931 CEST	443	49823	2.23.209.177	192.168.2.17
Oct 24, 2024 17:36:06.896744967 CEST	443	49823	2.23.209.177	192.168.2.17
Oct 24, 2024 17:36:06.896795034 CEST	49823	443	192.168.2.17	2.23.209.177
Oct 24, 2024 17:36:06.896795034 CEST	49823	443	192.168.2.17	2.23.209.177
Oct 24, 2024 17:36:06.903583050 CEST	49823	443	192.168.2.17	2.23.209.177
Oct 24, 2024 17:36:06.903605938 CEST	443	49823	2.23.209.177	192.168.2.17
Oct 24, 2024 17:36:06.903654099 CEST	49823	443	192.168.2.17	2.23.209.177
Oct 24, 2024 17:36:06.903654099 CEST	49823	443	192.168.2.17	2.23.209.177
Oct 24, 2024 17:36:07.062740088 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.063066959 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:07.063101053 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.063486099 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.063862085 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:07.063921928 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.064037085 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:07.107330084 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.314928055 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.314959049 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.314981937 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.315045118 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:07.315115929 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.315176010 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:07.315176010 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:07.320200920 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.320229053 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.320312977 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:07.320334911 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.320365906 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:07.320384979 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:07.434736967 CEST	443	49818	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:07.434895992 CEST	443	49818	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:07.434974909 CEST	49818	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:07.454287052 CEST	443	49825	52.98.152.194	192.168.2.17
Oct 24, 2024 17:36:07.456979036 CEST	49825	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:36:07.456990957 CEST	443	49825	52.98.152.194	192.168.2.17
Oct 24, 2024 17:36:07.458623886 CEST	443	49825	52.98.152.194	192.168.2.17
Oct 24, 2024 17:36:07.458723068 CEST	49825	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:36:07.458731890 CEST	443	49825	52.98.152.194	192.168.2.17
Oct 24, 2024 17:36:07.458792925 CEST	49825	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:36:07.459186077 CEST	49825	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:36:07.459274054 CEST	443	49825	52.98.152.194	192.168.2.17
Oct 24, 2024 17:36:07.459403038 CEST	49825	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:36:07.459408998 CEST	443	49825	52.98.152.194	192.168.2.17
Oct 24, 2024 17:36:07.502222061 CEST	49825	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:36:07.555649042 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.555663109 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.555681944 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.555845976 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:07.555845976 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:07.555882931 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.555938005 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:07.556972027 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.556993008 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.557084084 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:07.557099104 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.557162046 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:07.671118021 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.671139002 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.671257019 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:07.671272993 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.671380043 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:07.726311922 CEST	443	49825	52.98.152.194	192.168.2.17
Oct 24, 2024 17:36:07.726346970 CEST	443	49825	52.98.152.194	192.168.2.17
Oct 24, 2024 17:36:07.726399899 CEST	49825	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:36:07.726413965 CEST	443	49825	52.98.152.194	192.168.2.17
Oct 24, 2024 17:36:07.726485014 CEST	49825	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:36:07.727127075 CEST	49825	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:36:07.727169991 CEST	443	49825	52.98.152.194	192.168.2.17
Oct 24, 2024 17:36:07.727225065 CEST	49825	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:36:07.759028912 CEST	49818	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:07.759057045 CEST	443	49818	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:07.907387972 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.907402992 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.907443047 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.907563925 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:07.907563925 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:07.907629967 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.907768965 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:07.908750057 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.908791065 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.908835888 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:07.908849955 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:07.908914089 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:07.909106970 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:08.023252010 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:08.023343086 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:08.023478031 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:08.023478031 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:08.024668932 CEST	49824	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:08.024712086 CEST	443	49824	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:11.399563074 CEST	49828	443	192.168.2.17	142.250.185.132
Oct 24, 2024 17:36:11.399610996 CEST	443	49828	142.250.185.132	192.168.2.17
Oct 24, 2024 17:36:11.404078960 CEST	49828	443	192.168.2.17	142.250.185.132
Oct 24, 2024 17:36:11.404408932 CEST	49828	443	192.168.2.17	142.250.185.132
Oct 24, 2024 17:36:11.404429913 CEST	443	49828	142.250.185.132	192.168.2.17
Oct 24, 2024 17:36:12.268997908 CEST	443	49828	142.250.185.132	192.168.2.17
Oct 24, 2024 17:36:12.269424915 CEST	49828	443	192.168.2.17	142.250.185.132
Oct 24, 2024 17:36:12.269448042 CEST	443	49828	142.250.185.132	192.168.2.17
Oct 24, 2024 17:36:12.269958973 CEST	443	49828	142.250.185.132	192.168.2.17
Oct 24, 2024 17:36:12.270282030 CEST	49828	443	192.168.2.17	142.250.185.132
Oct 24, 2024 17:36:12.270374060 CEST	443	49828	142.250.185.132	192.168.2.17
Oct 24, 2024 17:36:12.322056055 CEST	49828	443	192.168.2.17	142.250.185.132
Oct 24, 2024 17:36:15.494151115 CEST	49832	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:15.494198084 CEST	443	49832	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:15.494447947 CEST	49832	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:15.494738102 CEST	49832	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:15.494752884 CEST	443	49832	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:16.252058029 CEST	443	49832	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:16.252378941 CEST	49832	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:16.252402067 CEST	443	49832	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:16.252722025 CEST	443	49832	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:16.253027916 CEST	49832	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:16.253076077 CEST	443	49832	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:16.253175020 CEST	49832	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:16.295330048 CEST	443	49832	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:16.387170076 CEST	443	49832	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:16.387196064 CEST	443	49832	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:16.387274027 CEST	443	49832	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:16.387432098 CEST	49832	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:16.387432098 CEST	49832	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:16.390358925 CEST	49832	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:16.390387058 CEST	443	49832	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:16.394171953 CEST	49833	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:16.394262075 CEST	443	49833	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:16.394392014 CEST	49833	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:16.394618034 CEST	49833	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:16.394656897 CEST	443	49833	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:16.678617954 CEST	49834	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:16.678673029 CEST	443	49834	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:16.678898096 CEST	49834	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:16.679025888 CEST	49834	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:16.679037094 CEST	443	49834	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:17.171163082 CEST	443	49833	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:17.171627045 CEST	49833	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:17.171696901 CEST	443	49833	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:17.172061920 CEST	443	49833	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:17.172481060 CEST	49833	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:17.172554016 CEST	443	49833	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:17.172643900 CEST	49833	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:17.219331980 CEST	443	49833	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:17.314049959 CEST	443	49833	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:17.314116001 CEST	443	49833	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:17.314276934 CEST	443	49833	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:17.314291954 CEST	49833	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:17.314336061 CEST	49833	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:17.314908981 CEST	49833	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:17.314949989 CEST	443	49833	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:17.431458950 CEST	443	49834	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:17.431695938 CEST	49834	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:17.431710005 CEST	443	49834	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:17.432075024 CEST	443	49834	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:17.432367086 CEST	49834	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:17.432424068 CEST	443	49834	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:17.432519913 CEST	49834	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:17.479326010 CEST	443	49834	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:17.564543009 CEST	443	49834	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:17.564610004 CEST	443	49834	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:17.564764977 CEST	49834	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:17.565490961 CEST	49834	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:17.565506935 CEST	443	49834	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:17.568044901 CEST	49835	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:17.568135023 CEST	443	49835	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:17.568243027 CEST	49835	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:17.568454027 CEST	49835	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:17.568494081 CEST	443	49835	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:18.347112894 CEST	443	49835	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:18.349477053 CEST	49835	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:18.349509954 CEST	443	49835	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:18.350675106 CEST	443	49835	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:18.356179953 CEST	49835	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:18.356262922 CEST	443	49835	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:18.356364012 CEST	49835	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:18.399324894 CEST	443	49835	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:18.728339911 CEST	443	49835	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:18.728504896 CEST	443	49835	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:18.728585958 CEST	49835	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:18.729372025 CEST	49835	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:18.729427099 CEST	443	49835	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:19.341741085 CEST	49839	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:19.341747999 CEST	443	49839	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:19.341821909 CEST	49839	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:19.342010975 CEST	49839	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:19.342020035 CEST	443	49839	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:20.064584017 CEST	443	49839	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:20.064815998 CEST	49839	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:20.064829111 CEST	443	49839	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:20.065121889 CEST	443	49839	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:20.065448046 CEST	49839	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:20.065502882 CEST	443	49839	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:20.105520010 CEST	49839	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:22.150872946 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:22.150930882 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:22.151020050 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:22.151492119 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:22.151506901 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:22.263674021 CEST	443	49828	142.250.185.132	192.168.2.17
Oct 24, 2024 17:36:22.263823032 CEST	443	49828	142.250.185.132	192.168.2.17
Oct 24, 2024 17:36:22.263884068 CEST	49828	443	192.168.2.17	142.250.185.132
Oct 24, 2024 17:36:22.265352964 CEST	49828	443	192.168.2.17	142.250.185.132
Oct 24, 2024 17:36:22.265371084 CEST	443	49828	142.250.185.132	192.168.2.17
Oct 24, 2024 17:36:22.433677912 CEST	49842	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:36:22.433744907 CEST	443	49842	52.98.152.194	192.168.2.17
Oct 24, 2024 17:36:22.433825970 CEST	49842	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:36:22.434087038 CEST	49842	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:36:22.434103012 CEST	443	49842	52.98.152.194	192.168.2.17
Oct 24, 2024 17:36:23.537931919 CEST	443	49842	52.98.152.194	192.168.2.17
Oct 24, 2024 17:36:23.538450003 CEST	49842	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:36:23.538538933 CEST	443	49842	52.98.152.194	192.168.2.17
Oct 24, 2024 17:36:23.539627075 CEST	443	49842	52.98.152.194	192.168.2.17
Oct 24, 2024 17:36:23.539720058 CEST	49842	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:36:23.539748907 CEST	443	49842	52.98.152.194	192.168.2.17
Oct 24, 2024 17:36:23.539818048 CEST	49842	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:36:23.540164948 CEST	49842	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:36:23.540226936 CEST	443	49842	52.98.152.194	192.168.2.17
Oct 24, 2024 17:36:23.540410995 CEST	49842	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:36:23.540424109 CEST	443	49842	52.98.152.194	192.168.2.17
Oct 24, 2024 17:36:23.586189985 CEST	49842	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:36:23.805486917 CEST	443	49842	52.98.152.194	192.168.2.17
Oct 24, 2024 17:36:23.805550098 CEST	443	49842	52.98.152.194	192.168.2.17
Oct 24, 2024 17:36:23.805635929 CEST	49842	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:36:23.805685997 CEST	443	49842	52.98.152.194	192.168.2.17
Oct 24, 2024 17:36:23.805767059 CEST	49842	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:36:23.806731939 CEST	49842	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:36:23.806823015 CEST	443	49842	52.98.152.194	192.168.2.17
Oct 24, 2024 17:36:23.806900978 CEST	49842	443	192.168.2.17	52.98.152.194
Oct 24, 2024 17:36:24.547492981 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:24.547866106 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:24.547895908 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:24.548249006 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:24.548576117 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:24.548650980 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:24.603101015 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:24.820677996 CEST	443	49839	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:24.820765972 CEST	443	49839	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:24.820854902 CEST	49839	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:24.825783014 CEST	49839	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:24.825814962 CEST	443	49839	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:26.212167025 CEST	49846	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:26.212173939 CEST	443	49846	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:26.212225914 CEST	49846	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:26.212768078 CEST	49846	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:26.212779045 CEST	443	49846	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:26.974919081 CEST	443	49846	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:26.975177050 CEST	49846	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:26.975203037 CEST	443	49846	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:26.976385117 CEST	443	49846	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:26.976691008 CEST	49846	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:26.976878881 CEST	443	49846	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:27.029136896 CEST	49846	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:27.223594904 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:27.271338940 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:27.473798990 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:27.473825932 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:27.473838091 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:27.473860025 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:27.473869085 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:27.473879099 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:27.473917961 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:27.473946095 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:27.473963022 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:27.473998070 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:27.590805054 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:27.590833902 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:27.590936899 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:27.590961933 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:27.591140032 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:27.708419085 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:27.708451033 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:27.708607912 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:27.708607912 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:27.708635092 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:27.708677053 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:27.825894117 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:27.825920105 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:27.826035976 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:27.826060057 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:27.826109886 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:27.945916891 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:27.945945978 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:27.946016073 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:27.946034908 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:27.946078062 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:28.062661886 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:28.062714100 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:28.062769890 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:28.062793016 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:28.062829971 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:28.062850952 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:28.179595947 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:28.179620028 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:28.179709911 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:28.179744959 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:28.179764986 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:28.179790974 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:28.180165052 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:28.180224895 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:28.180233002 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:28.180265903 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:28.180306911 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:28.200007915 CEST	49841	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:28.200072050 CEST	443	49841	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:28.254323006 CEST	49847	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:28.254360914 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:28.254442930 CEST	49847	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:28.257078886 CEST	49847	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:28.257093906 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:28.382441998 CEST	49848	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:28.382500887 CEST	443	49848	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:28.382590055 CEST	49848	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:28.382890940 CEST	49848	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:28.382904053 CEST	443	49848	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:29.015672922 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.016019106 CEST	49847	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:29.016050100 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.016446114 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.016944885 CEST	49847	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:29.017034054 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.017143011 CEST	49847	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:29.063342094 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.271677971 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.271704912 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.271723986 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.271811008 CEST	49847	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:29.271842957 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.271902084 CEST	49847	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:29.520966053 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.520982027 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.521022081 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.521122932 CEST	49847	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:29.521167994 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.521200895 CEST	49847	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:29.521234035 CEST	49847	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:29.522499084 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.522517920 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.522604942 CEST	49847	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:29.522623062 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.522700071 CEST	49847	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:29.523874044 CEST	443	49848	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:29.524195910 CEST	49848	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:29.524216890 CEST	443	49848	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:29.527846098 CEST	443	49848	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:29.527924061 CEST	49848	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:29.527940989 CEST	443	49848	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:29.527983904 CEST	49848	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:29.528331995 CEST	49848	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:29.528508902 CEST	443	49848	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:29.528548002 CEST	49848	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:29.575334072 CEST	443	49848	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:29.584153891 CEST	49848	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:29.584181070 CEST	443	49848	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:29.625027895 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.625053883 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.625161886 CEST	49847	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:29.625195980 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.625257969 CEST	49847	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:29.631167889 CEST	49848	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:29.742312908 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.742332935 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.742420912 CEST	49847	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:29.742445946 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.742515087 CEST	49847	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:29.805016041 CEST	443	49848	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:29.805077076 CEST	443	49848	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:29.805244923 CEST	49848	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:29.805278063 CEST	443	49848	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:29.805335999 CEST	49848	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:29.805910110 CEST	49848	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:29.805984974 CEST	443	49848	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:29.806045055 CEST	49848	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:29.875232935 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.875248909 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.875350952 CEST	49847	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:29.875379086 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.875444889 CEST	49847	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:29.977174044 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.977186918 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.977302074 CEST	49847	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:29.977329016 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:29.977384090 CEST	49847	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:30.023000956 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:30.023086071 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:30.023271084 CEST	49847	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:30.023271084 CEST	49847	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:30.023593903 CEST	49847	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:30.023613930 CEST	443	49847	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:31.701752901 CEST	443	49846	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:31.701936960 CEST	443	49846	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:31.702116966 CEST	49846	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:32.241489887 CEST	49846	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:32.241513014 CEST	443	49846	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:32.260926008 CEST	49851	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:32.260936022 CEST	443	49851	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:32.261001110 CEST	49851	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:32.261486053 CEST	49851	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:32.261498928 CEST	443	49851	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:33.009982109 CEST	443	49851	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:33.010325909 CEST	49851	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:33.010389090 CEST	443	49851	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:33.011097908 CEST	443	49851	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:33.011514902 CEST	49851	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:33.011590004 CEST	443	49851	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:33.072186947 CEST	49851	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:33.095361948 CEST	49852	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:33.095413923 CEST	443	49852	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:33.095509052 CEST	49852	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:33.096520901 CEST	49852	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:33.096539021 CEST	443	49852	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:33.343420029 CEST	49853	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:33.343466997 CEST	443	49853	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:33.343561888 CEST	49853	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:33.344032049 CEST	49853	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:33.344043970 CEST	443	49853	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:33.850070000 CEST	443	49852	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:33.851052999 CEST	49852	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:33.851080894 CEST	443	49852	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:33.851645947 CEST	443	49852	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:33.852005005 CEST	49852	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:33.852087021 CEST	443	49852	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:33.894418955 CEST	49852	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:34.443581104 CEST	443	49853	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:34.443857908 CEST	49853	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:34.443871975 CEST	443	49853	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:34.444859982 CEST	443	49853	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:34.444921017 CEST	49853	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:34.444926977 CEST	443	49853	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:34.444969893 CEST	49853	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:34.445224047 CEST	49853	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:34.445270061 CEST	443	49853	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:34.445401907 CEST	49853	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:34.445406914 CEST	443	49853	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:34.499295950 CEST	49853	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:34.515283108 CEST	49786	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:36:34.515290022 CEST	443	49786	152.199.21.175	192.168.2.17
Oct 24, 2024 17:36:34.722505093 CEST	443	49853	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:34.722529888 CEST	443	49853	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:34.722770929 CEST	49853	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:34.722784996 CEST	443	49853	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:34.722842932 CEST	49853	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:34.723453999 CEST	49853	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:34.723490953 CEST	443	49853	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:34.723555088 CEST	49853	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:37.742583990 CEST	443	49851	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:37.742675066 CEST	443	49851	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:37.742831945 CEST	49851	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:38.591166973 CEST	443	49852	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:38.591378927 CEST	443	49852	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:38.591463089 CEST	49852	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:38.816229105 CEST	49851	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:38.816242933 CEST	49852	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:38.816284895 CEST	443	49852	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:38.816294909 CEST	443	49851	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:39.529947996 CEST	49856	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:39.529993057 CEST	443	49856	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:39.530086040 CEST	49856	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:39.530369043 CEST	49856	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:39.530384064 CEST	443	49856	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:40.268163919 CEST	443	49856	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:40.268573046 CEST	49856	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:40.268594027 CEST	443	49856	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:40.268920898 CEST	443	49856	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:40.269324064 CEST	49856	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:40.269377947 CEST	443	49856	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:40.322258949 CEST	49856	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:40.496449947 CEST	49858	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:40.496490002 CEST	443	49858	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:40.496562004 CEST	49858	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:40.506700993 CEST	49858	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:40.506714106 CEST	443	49858	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:40.739629984 CEST	49859	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:40.739672899 CEST	443	49859	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:40.739748001 CEST	49859	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:40.740062952 CEST	49859	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:40.740075111 CEST	443	49859	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:41.256716967 CEST	443	49858	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:41.257302999 CEST	49858	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:41.257323980 CEST	443	49858	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:41.257678986 CEST	443	49858	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:41.258100033 CEST	49858	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:41.258153915 CEST	443	49858	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:41.305417061 CEST	49858	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:41.880950928 CEST	443	49859	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:41.881309986 CEST	49859	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:41.881329060 CEST	443	49859	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:41.884974003 CEST	443	49859	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:41.885056019 CEST	49859	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:41.885063887 CEST	443	49859	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:41.885112047 CEST	49859	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:41.885473967 CEST	49859	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:41.885642052 CEST	443	49859	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:41.885694027 CEST	49859	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:41.931350946 CEST	443	49859	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:41.939229012 CEST	49859	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:41.939245939 CEST	443	49859	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:41.987258911 CEST	49859	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:42.362047911 CEST	443	49859	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:42.362076998 CEST	443	49859	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:42.362150908 CEST	49859	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:42.362165928 CEST	443	49859	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:42.362219095 CEST	49859	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:42.362485886 CEST	443	49859	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:42.362628937 CEST	443	49859	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:42.362698078 CEST	49859	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:42.363104105 CEST	49859	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:42.363115072 CEST	443	49859	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:42.363122940 CEST	49859	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:42.363162994 CEST	49859	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:45.018891096 CEST	443	49856	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:45.019066095 CEST	443	49856	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:45.019141912 CEST	49856	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:45.371720076 CEST	49856	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:45.371763945 CEST	443	49856	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:46.010196924 CEST	443	49858	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:46.010298014 CEST	443	49858	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:46.010364056 CEST	49858	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:46.824676037 CEST	49858	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:46.824712992 CEST	443	49858	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:49.487586021 CEST	443	49786	152.199.21.175	192.168.2.17
Oct 24, 2024 17:36:49.487683058 CEST	443	49786	152.199.21.175	192.168.2.17
Oct 24, 2024 17:36:49.487807035 CEST	49786	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:36:50.814762115 CEST	49786	443	192.168.2.17	152.199.21.175
Oct 24, 2024 17:36:50.814786911 CEST	443	49786	152.199.21.175	192.168.2.17
Oct 24, 2024 17:36:51.627433062 CEST	49865	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:51.627476931 CEST	443	49865	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:51.627535105 CEST	49865	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:51.628907919 CEST	49865	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:51.628921032 CEST	443	49865	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:52.364520073 CEST	443	49865	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:52.365278006 CEST	49865	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:52.365293026 CEST	443	49865	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:52.365773916 CEST	443	49865	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:52.366282940 CEST	49865	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:52.366364956 CEST	443	49865	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:52.410357952 CEST	49865	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:52.806247950 CEST	49866	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:52.806308985 CEST	443	49866	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:52.806406975 CEST	49866	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:52.806759119 CEST	49866	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:52.806777954 CEST	443	49866	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:52.949850082 CEST	49867	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:52.949898958 CEST	443	49867	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:52.949985981 CEST	49867	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:52.950263977 CEST	49867	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:52.950273991 CEST	443	49867	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:53.542665958 CEST	443	49866	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:53.543167114 CEST	49866	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:53.543207884 CEST	443	49866	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:53.543731928 CEST	443	49866	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:53.546013117 CEST	49866	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:53.546144962 CEST	443	49866	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:53.590477943 CEST	49866	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:54.063261986 CEST	443	49867	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:54.065579891 CEST	49867	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:54.065607071 CEST	443	49867	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:54.066771984 CEST	443	49867	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:54.067473888 CEST	49867	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:54.067625999 CEST	49867	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:54.067632914 CEST	443	49867	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:54.067651033 CEST	443	49867	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:54.115365982 CEST	49867	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:54.327513933 CEST	443	49867	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:54.327570915 CEST	443	49867	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:54.327631950 CEST	49867	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:54.327646971 CEST	443	49867	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:54.328522921 CEST	49867	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:54.328594923 CEST	443	49867	52.98.152.242	192.168.2.17
Oct 24, 2024 17:36:54.328665972 CEST	49867	443	192.168.2.17	52.98.152.242
Oct 24, 2024 17:36:57.535355091 CEST	443	49865	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:57.535528898 CEST	443	49865	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:57.535746098 CEST	49865	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:57.554806948 CEST	49865	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:57.554826021 CEST	443	49865	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:57.556654930 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:57.556696892 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:57.556756020 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:57.557090044 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:57.557107925 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:58.291480064 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:58.291805983 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:58.291867971 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:58.292365074 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:58.292680025 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:58.292774916 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:58.296550989 CEST	443	49866	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:58.296643972 CEST	443	49866	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:58.296719074 CEST	49866	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:58.347352028 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:58.394234896 CEST	49866	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:58.394287109 CEST	443	49866	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:58.412038088 CEST	49873	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:58.412101030 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:58.412184954 CEST	49873	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:58.412580967 CEST	49873	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:58.412612915 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:58.415442944 CEST	49874	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:58.415482044 CEST	443	49874	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:58.415550947 CEST	49874	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:58.415752888 CEST	49874	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:58.415766001 CEST	443	49874	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.145184994 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.145534039 CEST	49873	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.145567894 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.146038055 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.146339893 CEST	49873	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.146418095 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.146488905 CEST	49873	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.156459093 CEST	443	49874	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.156668901 CEST	49874	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.156687021 CEST	443	49874	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.157134056 CEST	443	49874	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.157411098 CEST	49874	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.157480955 CEST	443	49874	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.157495022 CEST	49874	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.187341928 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.203340054 CEST	443	49874	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.206406116 CEST	49874	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.292491913 CEST	443	49874	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.292511940 CEST	443	49874	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.292517900 CEST	443	49874	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.292553902 CEST	443	49874	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.292587042 CEST	443	49874	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.292684078 CEST	49874	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.294066906 CEST	49874	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.294066906 CEST	49874	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.296940088 CEST	49875	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:59.297017097 CEST	443	49875	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:59.297152996 CEST	49875	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:59.297420025 CEST	49875	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:59.297451973 CEST	443	49875	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:59.386300087 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.386353970 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.386375904 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.386467934 CEST	49873	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.386501074 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.386559963 CEST	49873	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.394906998 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.394937038 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.395059109 CEST	49873	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.395076036 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.395129919 CEST	49873	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.510493994 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.510520935 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.510605097 CEST	49873	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.510624886 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.510667086 CEST	49873	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.512377977 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.512399912 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.512469053 CEST	49873	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.512474060 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.512511969 CEST	49873	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.606388092 CEST	49874	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.606421947 CEST	443	49874	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.627896070 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.627922058 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.627995968 CEST	49873	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.628030062 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.628079891 CEST	49873	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.629390955 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.629412889 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.629451036 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.629466057 CEST	49873	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.629472017 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.629498005 CEST	49873	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.629534006 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.629580021 CEST	49873	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.630058050 CEST	49873	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.630074978 CEST	443	49873	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.632656097 CEST	49876	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:59.632684946 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:59.632741928 CEST	49876	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:59.633004904 CEST	49876	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:36:59.633019924 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:36:59.657331944 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.700589895 CEST	49877	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.700630903 CEST	443	49877	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.700707912 CEST	49877	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.701908112 CEST	49878	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.701936960 CEST	443	49878	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.702009916 CEST	49878	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.702162981 CEST	49877	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.702179909 CEST	443	49877	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.702425003 CEST	49878	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.702436924 CEST	443	49878	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.703321934 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.901947975 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.901978970 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.901987076 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.902116060 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.902143955 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.902159929 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.902167082 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.902242899 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.904058933 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.904081106 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.904134989 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.904151917 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:36:59.904181957 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:36:59.904205084 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.021194935 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.021214008 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.021344900 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.021384001 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.021450996 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.023113012 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.023128033 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.023201942 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.023216009 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.023274899 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.139027119 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.139053106 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.139147043 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.139172077 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.139223099 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.140567064 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.140587091 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.140647888 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.140654087 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.140696049 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.153583050 CEST	443	49875	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.153958082 CEST	49875	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.153968096 CEST	443	49875	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.155062914 CEST	443	49875	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.155508041 CEST	49875	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.155670881 CEST	443	49875	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.155673981 CEST	49875	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.199333906 CEST	443	49875	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.209358931 CEST	49875	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.254359007 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.254384995 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.254468918 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.254486084 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.254535913 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.255045891 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.255114079 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.255126953 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.255146980 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.255213976 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.255259037 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.255294085 CEST	443	49871	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.255347967 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.255347967 CEST	49871	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.258265018 CEST	49880	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.258322954 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.258394003 CEST	49880	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.258678913 CEST	49880	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.258692026 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.300256968 CEST	49881	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.300309896 CEST	443	49881	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.300398111 CEST	49881	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.300586939 CEST	49881	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.300602913 CEST	443	49881	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.303127050 CEST	49882	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.303169966 CEST	443	49882	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.303247929 CEST	49882	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.303406000 CEST	49882	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.303416014 CEST	443	49882	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.303472042 CEST	443	49875	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.303492069 CEST	443	49875	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.303497076 CEST	443	49875	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.303534031 CEST	443	49875	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.303571939 CEST	443	49875	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.303589106 CEST	49875	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.303608894 CEST	443	49875	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.303634882 CEST	49875	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.303634882 CEST	49875	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.303668976 CEST	49875	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.304677010 CEST	49875	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.304694891 CEST	443	49875	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.407212973 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.407625914 CEST	49876	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.407687902 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.408021927 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.408349991 CEST	49876	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.408409119 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.408483982 CEST	49876	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.433012009 CEST	443	49877	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.433492899 CEST	49877	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.433506012 CEST	443	49877	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.433948040 CEST	443	49877	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.434339046 CEST	49877	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.434401989 CEST	443	49877	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.434520006 CEST	49877	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.443748951 CEST	443	49878	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.444048882 CEST	49878	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.444071054 CEST	443	49878	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.444372892 CEST	443	49878	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.444670916 CEST	49878	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.444715023 CEST	443	49878	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.444802999 CEST	49878	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.451358080 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.475322008 CEST	443	49877	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.487323046 CEST	443	49878	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.563452005 CEST	443	49877	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.563545942 CEST	443	49877	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.563601017 CEST	49877	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.564496994 CEST	49877	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.564513922 CEST	443	49877	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.569133997 CEST	49883	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.569171906 CEST	443	49883	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.569256067 CEST	49883	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.569489002 CEST	49883	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.569504023 CEST	443	49883	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.576735020 CEST	443	49878	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.577001095 CEST	443	49878	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.577050924 CEST	49878	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.577497005 CEST	49878	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:00.577508926 CEST	443	49878	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:00.580610037 CEST	49884	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.580646992 CEST	443	49884	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.580734968 CEST	49884	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.580980062 CEST	49884	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.580991983 CEST	443	49884	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.661607027 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.661643028 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.661660910 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.661768913 CEST	49876	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.661803007 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.661859035 CEST	49876	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.672728062 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.672753096 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.672914982 CEST	49876	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.672950983 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.673010111 CEST	49876	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.790805101 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.790843964 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.791016102 CEST	49876	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.791054010 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.791109085 CEST	49876	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.792327881 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.792350054 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.792418957 CEST	49876	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.792426109 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.792467117 CEST	49876	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.910538912 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.910564899 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.910675049 CEST	49876	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.910748959 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.910788059 CEST	49876	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.910825014 CEST	49876	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.911839962 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.911854982 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.911962986 CEST	49876	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.911978960 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.912053108 CEST	49876	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.912235975 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.912328959 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.912422895 CEST	49876	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.912574053 CEST	49876	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.912612915 CEST	443	49876	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:00.912636995 CEST	49876	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:00.912703037 CEST	49876	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.006673098 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.008455038 CEST	49880	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.008485079 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.008850098 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.009179115 CEST	49880	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.009236097 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.009351969 CEST	49880	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.049032927 CEST	443	49881	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:01.049382925 CEST	49881	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:01.049403906 CEST	443	49881	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:01.051378012 CEST	443	49882	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:01.052480936 CEST	443	49881	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:01.052623987 CEST	49881	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:01.053339958 CEST	49882	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:01.053355932 CEST	443	49882	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:01.053663969 CEST	49881	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:01.053725004 CEST	443	49881	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:01.053812027 CEST	49881	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:01.053823948 CEST	443	49881	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:01.054775000 CEST	443	49882	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:01.054841995 CEST	49882	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:01.055275917 CEST	49882	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:01.055325031 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.055351973 CEST	443	49882	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:01.055468082 CEST	49882	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:01.055474043 CEST	443	49882	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:01.098387957 CEST	49881	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:01.098406076 CEST	49882	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:01.183176041 CEST	443	49881	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:01.183248997 CEST	443	49881	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:01.183404922 CEST	49881	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:01.184240103 CEST	49881	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:01.184298038 CEST	443	49881	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:01.187715054 CEST	49885	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.187747002 CEST	443	49885	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.187834978 CEST	49885	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.188122988 CEST	49885	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.188131094 CEST	443	49885	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.252145052 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.252170086 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.252187014 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.252235889 CEST	49880	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.252280951 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.252304077 CEST	49880	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.252326012 CEST	49880	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.265156984 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.265183926 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.265299082 CEST	49880	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.265347004 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.265398026 CEST	49880	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.295883894 CEST	443	49882	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:01.295913935 CEST	443	49882	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:01.295923948 CEST	443	49882	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:01.296011925 CEST	443	49882	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:01.296057940 CEST	49882	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:01.296070099 CEST	443	49882	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:01.296103001 CEST	443	49882	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:01.296118021 CEST	49882	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:01.296139956 CEST	49882	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:01.296155930 CEST	49882	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:01.329648018 CEST	443	49882	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:01.329684019 CEST	443	49882	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:01.329754114 CEST	49882	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:01.329782009 CEST	443	49882	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:01.329807043 CEST	49882	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:01.329821110 CEST	49882	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:01.330034018 CEST	443	49882	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:01.330086946 CEST	49882	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:01.330092907 CEST	443	49882	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:01.330141068 CEST	49882	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:01.330152035 CEST	443	49882	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:01.330198050 CEST	49882	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:01.333745003 CEST	443	49883	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.335119009 CEST	49882	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:01.335149050 CEST	443	49882	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:01.337877989 CEST	49883	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.337939978 CEST	443	49883	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.338532925 CEST	443	49883	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.339890003 CEST	443	49884	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.340285063 CEST	49883	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.340445995 CEST	443	49883	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.342896938 CEST	49884	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.342937946 CEST	443	49884	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.345213890 CEST	443	49884	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.345283031 CEST	49884	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.345607042 CEST	49883	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.345875978 CEST	49884	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.345976114 CEST	49884	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.346124887 CEST	443	49884	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.377248049 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.377275944 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.377379894 CEST	49880	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.377418041 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.377468109 CEST	49880	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.379458904 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.379478931 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.379544020 CEST	49880	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.379566908 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.379614115 CEST	49880	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.391339064 CEST	443	49883	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.398344040 CEST	49884	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.398366928 CEST	443	49884	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.418091059 CEST	49886	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.418154001 CEST	443	49886	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.418231964 CEST	49886	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.418447018 CEST	49886	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.418476105 CEST	443	49886	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.446361065 CEST	49884	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.479938030 CEST	443	49884	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.480127096 CEST	443	49884	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.480298996 CEST	49884	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.480871916 CEST	49884	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.480895042 CEST	443	49883	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.480901957 CEST	443	49884	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.481240034 CEST	443	49883	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.481313944 CEST	49883	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.482676983 CEST	49883	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.482727051 CEST	443	49883	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.492449045 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.492474079 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.492556095 CEST	49880	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.492588043 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.492705107 CEST	49880	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.494105101 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.494126081 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.494194984 CEST	49880	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.494215965 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.494261980 CEST	49880	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.607707977 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.607732058 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.607834101 CEST	49880	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.607863903 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.607922077 CEST	49880	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.608134031 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.608182907 CEST	49880	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.608190060 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.608216047 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.608262062 CEST	49880	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.608542919 CEST	49880	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.608563900 CEST	443	49880	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.946947098 CEST	443	49885	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.947241068 CEST	49885	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.947273970 CEST	443	49885	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.947643042 CEST	443	49885	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.947948933 CEST	49885	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.948014021 CEST	443	49885	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:01.948088884 CEST	49885	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:01.995342970 CEST	443	49885	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:02.087280035 CEST	443	49885	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:02.087702990 CEST	443	49885	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:02.087759018 CEST	49885	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:02.088399887 CEST	49885	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:02.088417053 CEST	443	49885	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:02.169884920 CEST	443	49886	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:02.170341969 CEST	49886	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:02.170372009 CEST	443	49886	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:02.170717001 CEST	443	49886	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:02.171111107 CEST	49886	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:02.171175957 CEST	443	49886	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:02.171298027 CEST	49886	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:02.215338945 CEST	443	49886	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:02.418000937 CEST	443	49886	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:02.418025970 CEST	443	49886	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:02.418040991 CEST	443	49886	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:02.418104887 CEST	49886	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:02.418134928 CEST	443	49886	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:02.418195009 CEST	49886	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:02.431140900 CEST	443	49886	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:02.431164980 CEST	443	49886	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:02.431255102 CEST	49886	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:02.431272984 CEST	443	49886	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:02.431632996 CEST	49886	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:02.433940887 CEST	443	49886	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:02.434015036 CEST	49886	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:02.434020042 CEST	443	49886	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:02.434070110 CEST	49886	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:02.434248924 CEST	49886	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:02.434278011 CEST	443	49886	13.107.253.45	192.168.2.17
Oct 24, 2024 17:37:02.434289932 CEST	49886	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:02.434340000 CEST	49886	443	192.168.2.17	13.107.253.45
Oct 24, 2024 17:37:04.218990088 CEST	49888	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:04.219021082 CEST	443	49888	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:04.219118118 CEST	49888	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:04.219517946 CEST	49888	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:04.219533920 CEST	443	49888	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:04.974570990 CEST	443	49888	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:04.974893093 CEST	49888	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:04.974910021 CEST	443	49888	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:04.975384951 CEST	443	49888	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:04.975691080 CEST	49888	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:04.975763083 CEST	443	49888	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:04.994332075 CEST	49889	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:04.994383097 CEST	443	49889	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:04.994456053 CEST	49889	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:04.994903088 CEST	49889	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:04.994916916 CEST	443	49889	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:05.026396990 CEST	49888	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:05.720268011 CEST	443	49889	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:05.740408897 CEST	49889	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:05.740443945 CEST	443	49889	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:05.740953922 CEST	443	49889	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:05.742065907 CEST	49889	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:05.742136002 CEST	443	49889	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:05.788459063 CEST	49889	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:09.715576887 CEST	443	49888	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:09.715754986 CEST	443	49888	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:09.715879917 CEST	49888	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:10.095804930 CEST	49888	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:10.095839024 CEST	443	49888	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:10.475390911 CEST	443	49889	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:10.475502014 CEST	443	49889	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:10.475750923 CEST	49889	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:10.823018074 CEST	49889	443	192.168.2.17	13.107.246.45
Oct 24, 2024 17:37:10.823079109 CEST	443	49889	13.107.246.45	192.168.2.17
Oct 24, 2024 17:37:11.463323116 CEST	49890	443	192.168.2.17	142.250.185.132
Oct 24, 2024 17:37:11.463376999 CEST	443	49890	142.250.185.132	192.168.2.17
Oct 24, 2024 17:37:11.463457108 CEST	49890	443	192.168.2.17	142.250.185.132
Oct 24, 2024 17:37:11.463879108 CEST	49890	443	192.168.2.17	142.250.185.132
Oct 24, 2024 17:37:11.463893890 CEST	443	49890	142.250.185.132	192.168.2.17
Oct 24, 2024 17:37:12.327368975 CEST	443	49890	142.250.185.132	192.168.2.17
Oct 24, 2024 17:37:12.327796936 CEST	49890	443	192.168.2.17	142.250.185.132
Oct 24, 2024 17:37:12.327816010 CEST	443	49890	142.250.185.132	192.168.2.17
Oct 24, 2024 17:37:12.328953981 CEST	443	49890	142.250.185.132	192.168.2.17
Oct 24, 2024 17:37:12.329301119 CEST	49890	443	192.168.2.17	142.250.185.132
Oct 24, 2024 17:37:12.329555988 CEST	443	49890	142.250.185.132	192.168.2.17
Oct 24, 2024 17:37:12.372435093 CEST	49890	443	192.168.2.17	142.250.185.132

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 17:35:06.554344893 CEST	53	49560	1.1.1.1	192.168.2.17
Oct 24, 2024 17:35:06.588099003 CEST	53	64156	1.1.1.1	192.168.2.17
Oct 24, 2024 17:35:07.389784098 CEST	54344	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:07.390219927 CEST	57146	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:07.398451090 CEST	53384	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:07.398608923 CEST	51574	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:07.417566061 CEST	53	57146	1.1.1.1	192.168.2.17
Oct 24, 2024 17:35:07.425426006 CEST	53	51574	1.1.1.1	192.168.2.17
Oct 24, 2024 17:35:07.946882963 CEST	53	58854	1.1.1.1	192.168.2.17
Oct 24, 2024 17:35:11.344816923 CEST	63395	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:11.344974995 CEST	64184	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:12.208590984 CEST	53	63395	1.1.1.1	192.168.2.17
Oct 24, 2024 17:35:12.208702087 CEST	53	64184	1.1.1.1	192.168.2.17
Oct 24, 2024 17:35:12.964711905 CEST	64056	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:12.964880943 CEST	51311	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:14.536997080 CEST	62113	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:14.537060022 CEST	60823	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:14.545577049 CEST	53	62113	1.1.1.1	192.168.2.17
Oct 24, 2024 17:35:14.546612978 CEST	53	60823	1.1.1.1	192.168.2.17
Oct 24, 2024 17:35:16.849406004 CEST	56659	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:16.849589109 CEST	53560	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:16.858283997 CEST	53	53560	1.1.1.1	192.168.2.17
Oct 24, 2024 17:35:16.859086037 CEST	53	56659	1.1.1.1	192.168.2.17
Oct 24, 2024 17:35:18.393279076 CEST	51874	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:18.393445015 CEST	58685	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:24.879019976 CEST	53	64169	1.1.1.1	192.168.2.17
Oct 24, 2024 17:35:27.199378014 CEST	52071	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:27.199587107 CEST	62947	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:27.209429979 CEST	53	62947	1.1.1.1	192.168.2.17
Oct 24, 2024 17:35:27.209901094 CEST	53	52071	1.1.1.1	192.168.2.17
Oct 24, 2024 17:35:28.661834955 CEST	62001	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:28.662002087 CEST	52266	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:28.663417101 CEST	64502	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:28.663562059 CEST	63502	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:29.045222998 CEST	53	51889	1.1.1.1	192.168.2.17
Oct 24, 2024 17:35:43.650270939 CEST	53	55419	1.1.1.1	192.168.2.17
Oct 24, 2024 17:35:48.361551046 CEST	61689	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:48.361665010 CEST	59817	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:48.390916109 CEST	60773	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:48.391033888 CEST	65169	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:48.401187897 CEST	53	65169	1.1.1.1	192.168.2.17
Oct 24, 2024 17:35:48.401199102 CEST	53	60773	1.1.1.1	192.168.2.17
Oct 24, 2024 17:35:50.531330109 CEST	58742	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:50.531471014 CEST	61817	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:50.563810110 CEST	53	55024	1.1.1.1	192.168.2.17
Oct 24, 2024 17:35:53.976846933 CEST	53891	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:53.976989985 CEST	55786	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:56.908370972 CEST	54320	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:35:56.908507109 CEST	52720	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:36:05.473968029 CEST	53	53847	1.1.1.1	192.168.2.17
Oct 24, 2024 17:36:06.276640892 CEST	53	61052	1.1.1.1	192.168.2.17
Oct 24, 2024 17:36:06.533684969 CEST	53	63033	1.1.1.1	192.168.2.17
Oct 24, 2024 17:36:22.006266117 CEST	138	138	192.168.2.17	192.168.2.255
Oct 24, 2024 17:36:22.150271893 CEST	62095	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:36:22.150435925 CEST	54798	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:36:22.158315897 CEST	53	62095	1.1.1.1	192.168.2.17
Oct 24, 2024 17:36:22.159329891 CEST	53	54798	1.1.1.1	192.168.2.17
Oct 24, 2024 17:36:28.373070002 CEST	63985	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:36:28.373243093 CEST	61661	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:36:28.381493092 CEST	53	63985	1.1.1.1	192.168.2.17
Oct 24, 2024 17:36:28.381508112 CEST	53	61661	1.1.1.1	192.168.2.17
Oct 24, 2024 17:36:29.821831942 CEST	62809	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:36:29.822115898 CEST	57667	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:36:34.401169062 CEST	53	54856	1.1.1.1	192.168.2.17
Oct 24, 2024 17:36:39.527329922 CEST	57273	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:36:39.527780056 CEST	53079	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:36:41.634989977 CEST	61098	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:36:41.635164022 CEST	56031	53	192.168.2.17	1.1.1.1
Oct 24, 2024 17:36:59.760123014 CEST	53	63046	1.1.1.1	192.168.2.17

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 24, 2024 17:35:50.140594959 CEST	192.168.2.17	1.1.1.1	c2eb	(Port unreachable)	Destination Unreachable
Oct 24, 2024 17:35:52.921552896 CEST	192.168.2.17	1.1.1.1	c298	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 24, 2024 17:35:07.389784098 CEST	192.168.2.17	1.1.1.1	0x76dc	Standard query (0)	3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:07.390219927 CEST	192.168.2.17	1.1.1.1	0x750	Standard query (0)	3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com	65	IN (0x0001)	false
Oct 24, 2024 17:35:07.398451090 CEST	192.168.2.17	1.1.1.1	0xb4f8	Standard query (0)	3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:07.398608923 CEST	192.168.2.17	1.1.1.1	0x6d93	Standard query (0)	3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com	65	IN (0x0001)	false
Oct 24, 2024 17:35:11.344816923 CEST	192.168.2.17	1.1.1.1	0x1735	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:11.344974995 CEST	192.168.2.17	1.1.1.1	0x3cfb	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 24, 2024 17:35:12.964711905 CEST	192.168.2.17	1.1.1.1	0x93a7	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:12.964880943 CEST	192.168.2.17	1.1.1.1	0x2b2c	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
Oct 24, 2024 17:35:14.536997080 CEST	192.168.2.17	1.1.1.1	0xd53e	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:14.537060022 CEST	192.168.2.17	1.1.1.1	0xf0d1	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Oct 24, 2024 17:35:16.849406004 CEST	192.168.2.17	1.1.1.1	0x9ac5	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:16.849589109 CEST	192.168.2.17	1.1.1.1	0x665c	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Oct 24, 2024 17:35:18.393279076 CEST	192.168.2.17	1.1.1.1	0xbbb3	Standard query (0)	identity.nel.measure.office.net	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:18.393445015 CEST	192.168.2.17	1.1.1.1	0xdae1	Standard query (0)	identity.nel.measure.office.net	65	IN (0x0001)	false
Oct 24, 2024 17:35:27.199378014 CEST	192.168.2.17	1.1.1.1	0xf87e	Standard query (0)	outlook.office365.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:27.199587107 CEST	192.168.2.17	1.1.1.1	0xcf8d	Standard query (0)	outlook.office365.com	65	IN (0x0001)	false
Oct 24, 2024 17:35:28.661834955 CEST	192.168.2.17	1.1.1.1	0xbc4	Standard query (0)	r4.res.office365.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:28.662002087 CEST	192.168.2.17	1.1.1.1	0x5599	Standard query (0)	r4.res.office365.com	65	IN (0x0001)	false
Oct 24, 2024 17:35:28.663417101 CEST	192.168.2.17	1.1.1.1	0x631b	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:28.663562059 CEST	192.168.2.17	1.1.1.1	0x7ab4	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
Oct 24, 2024 17:35:48.361551046 CEST	192.168.2.17	1.1.1.1	0xf99d	Standard query (0)	acctcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:48.361665010 CEST	192.168.2.17	1.1.1.1	0xb151	Standard query (0)	acctcdn.msftauth.net	65	IN (0x0001)	false
Oct 24, 2024 17:35:48.390916109 CEST	192.168.2.17	1.1.1.1	0x1ad1	Standard query (0)	logincdn.msftauth.net	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:48.391033888 CEST	192.168.2.17	1.1.1.1	0x1c11	Standard query (0)	logincdn.msftauth.net	65	IN (0x0001)	false
Oct 24, 2024 17:35:50.531330109 CEST	192.168.2.17	1.1.1.1	0xbb62	Standard query (0)	fpt.live.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:50.531471014 CEST	192.168.2.17	1.1.1.1	0xe18c	Standard query (0)	fpt.live.com	65	IN (0x0001)	false
Oct 24, 2024 17:35:53.976846933 CEST	192.168.2.17	1.1.1.1	0x8197	Standard query (0)	fpt.live.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:53.976989985 CEST	192.168.2.17	1.1.1.1	0x1cfc	Standard query (0)	fpt.live.com	65	IN (0x0001)	false
Oct 24, 2024 17:35:56.908370972 CEST	192.168.2.17	1.1.1.1	0x8f5f	Standard query (0)	account.live.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:56.908507109 CEST	192.168.2.17	1.1.1.1	0x14ab	Standard query (0)	account.live.com	65	IN (0x0001)	false
Oct 24, 2024 17:36:22.150271893 CEST	192.168.2.17	1.1.1.1	0xf8b	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:36:22.150435925 CEST	192.168.2.17	1.1.1.1	0xb1de	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Oct 24, 2024 17:36:28.373070002 CEST	192.168.2.17	1.1.1.1	0x79ab	Standard query (0)	outlook.office365.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:36:28.373243093 CEST	192.168.2.17	1.1.1.1	0xdbce	Standard query (0)	outlook.office365.com	65	IN (0x0001)	false
Oct 24, 2024 17:36:29.821831942 CEST	192.168.2.17	1.1.1.1	0x8126	Standard query (0)	r4.res.office365.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:36:29.822115898 CEST	192.168.2.17	1.1.1.1	0x4c1c	Standard query (0)	r4.res.office365.com	65	IN (0x0001)	false
Oct 24, 2024 17:36:39.527329922 CEST	192.168.2.17	1.1.1.1	0xcea5	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:36:39.527780056 CEST	192.168.2.17	1.1.1.1	0x98e2	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
Oct 24, 2024 17:36:41.634989977 CEST	192.168.2.17	1.1.1.1	0x8b02	Standard query (0)	passwordreset.microsoftonline.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:36:41.635164022 CEST	192.168.2.17	1.1.1.1	0xc5b8	Standard query (0)	passwordreset.microsoftonline.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 24, 2024 17:35:07.416126013 CEST	1.1.1.1	192.168.2.17	0x76dc	No error (0)	3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com	xsp-mvp.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:07.438299894 CEST	1.1.1.1	192.168.2.17	0xb4f8	No error (0)	3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com	xsp-mvp.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:12.208590984 CEST	1.1.1.1	192.168.2.17	0x1735	No error (0)	www.google.com		142.250.185.132	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:12.208702087 CEST	1.1.1.1	192.168.2.17	0x3cfb	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 24, 2024 17:35:12.972821951 CEST	1.1.1.1	192.168.2.17	0x2b2c	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:12.972924948 CEST	1.1.1.1	192.168.2.17	0x93a7	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:14.545577049 CEST	1.1.1.1	192.168.2.17	0xd53e	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:14.545577049 CEST	1.1.1.1	192.168.2.17	0xd53e	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:14.545577049 CEST	1.1.1.1	192.168.2.17	0xd53e	No error (0)	sni1gl.wpc.omegacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:14.546612978 CEST	1.1.1.1	192.168.2.17	0xf0d1	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:14.546612978 CEST	1.1.1.1	192.168.2.17	0xf0d1	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:16.858283997 CEST	1.1.1.1	192.168.2.17	0x665c	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:16.858283997 CEST	1.1.1.1	192.168.2.17	0x665c	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:16.859086037 CEST	1.1.1.1	192.168.2.17	0x9ac5	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:16.859086037 CEST	1.1.1.1	192.168.2.17	0x9ac5	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:16.859086037 CEST	1.1.1.1	192.168.2.17	0x9ac5	No error (0)	sni1gl.wpc.omegacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:18.405833960 CEST	1.1.1.1	192.168.2.17	0xbbb3	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:18.412086964 CEST	1.1.1.1	192.168.2.17	0xdae1	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:18.515244007 CEST	1.1.1.1	192.168.2.17	0x6a0f	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:18.515244007 CEST	1.1.1.1	192.168.2.17	0x6a0f	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:20.668781996 CEST	1.1.1.1	192.168.2.17	0xb429	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:20.668781996 CEST	1.1.1.1	192.168.2.17	0xb429	No error (0)	dual.s-part-0017.t-0009.fb-t-msedge.net	s-part-0017.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:20.668781996 CEST	1.1.1.1	192.168.2.17	0xb429	No error (0)	s-part-0017.t-0009.fb-t-msedge.net		13.107.253.45	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:27.209429979 CEST	1.1.1.1	192.168.2.17	0xcf8d	No error (0)	outlook.office365.com	ooc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:27.209429979 CEST	1.1.1.1	192.168.2.17	0xcf8d	No error (0)	ooc-g2.tm-4.office.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:27.209429979 CEST	1.1.1.1	192.168.2.17	0xcf8d	No error (0)	outlook.ms-acdc.office.com	HHN-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:27.209901094 CEST	1.1.1.1	192.168.2.17	0xf87e	No error (0)	outlook.office365.com	ooc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:27.209901094 CEST	1.1.1.1	192.168.2.17	0xf87e	No error (0)	ooc-g2.tm-4.office.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:27.209901094 CEST	1.1.1.1	192.168.2.17	0xf87e	No error (0)	outlook.ms-acdc.office.com	HHN-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:27.209901094 CEST	1.1.1.1	192.168.2.17	0xf87e	No error (0)	HHN-efz.ms-acdc.office.com		52.98.152.194	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:27.209901094 CEST	1.1.1.1	192.168.2.17	0xf87e	No error (0)	HHN-efz.ms-acdc.office.com		40.99.149.210	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:27.209901094 CEST	1.1.1.1	192.168.2.17	0xf87e	No error (0)	HHN-efz.ms-acdc.office.com		40.99.150.2	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:27.209901094 CEST	1.1.1.1	192.168.2.17	0xf87e	No error (0)	HHN-efz.ms-acdc.office.com		52.98.243.2	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:28.670943022 CEST	1.1.1.1	192.168.2.17	0x5599	No error (0)	r4.res.office365.com	r4.res.office365.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:28.671103001 CEST	1.1.1.1	192.168.2.17	0xbc4	No error (0)	r4.res.office365.com	r4.res.office365.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:28.671924114 CEST	1.1.1.1	192.168.2.17	0x631b	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:28.672810078 CEST	1.1.1.1	192.168.2.17	0x7ab4	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:48.376218081 CEST	1.1.1.1	192.168.2.17	0xd81f	No error (0)	shed.dual-low.s-part-0039.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:48.376218081 CEST	1.1.1.1	192.168.2.17	0xd81f	No error (0)	dual.s-part-0039.t-0009.fb-t-msedge.net	s-part-0039.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:48.376218081 CEST	1.1.1.1	192.168.2.17	0xd81f	No error (0)	s-part-0039.t-0009.fb-t-msedge.net		13.107.253.67	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:48.376236916 CEST	1.1.1.1	192.168.2.17	0x936d	No error (0)	shed.dual-low.s-part-0039.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:48.376236916 CEST	1.1.1.1	192.168.2.17	0x936d	No error (0)	dual.s-part-0039.t-0009.fb-t-msedge.net	s-part-0039.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:48.376236916 CEST	1.1.1.1	192.168.2.17	0x936d	No error (0)	s-part-0039.t-0009.fb-t-msedge.net		13.107.253.67	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:48.376247883 CEST	1.1.1.1	192.168.2.17	0xf99d	No error (0)	acctcdn.msftauth.net	acctcdn.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:48.376247883 CEST	1.1.1.1	192.168.2.17	0xf99d	No error (0)	scdn1efff.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:48.376247883 CEST	1.1.1.1	192.168.2.17	0xf99d	No error (0)	sni1gl.wpc.alphacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:48.376259089 CEST	1.1.1.1	192.168.2.17	0xb151	No error (0)	acctcdn.msftauth.net	acctcdn.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:48.376259089 CEST	1.1.1.1	192.168.2.17	0xb151	No error (0)	scdn1efff.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:48.399030924 CEST	1.1.1.1	192.168.2.17	0xf932	No error (0)	scdn38c07.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:48.399030924 CEST	1.1.1.1	192.168.2.17	0xf932	No error (0)	sni1gl.wpc.alphacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:48.401165962 CEST	1.1.1.1	192.168.2.17	0xc6f	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:48.401165962 CEST	1.1.1.1	192.168.2.17	0xc6f	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:48.401177883 CEST	1.1.1.1	192.168.2.17	0x3fd0	No error (0)	scdn38c07.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:48.401187897 CEST	1.1.1.1	192.168.2.17	0x1c11	No error (0)	logincdn.msftauth.net	scdn38c07.wpc.9da5e.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:48.401187897 CEST	1.1.1.1	192.168.2.17	0x1c11	No error (0)	scdn38c07.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:48.401199102 CEST	1.1.1.1	192.168.2.17	0x1ad1	No error (0)	logincdn.msftauth.net	scdn38c07.wpc.9da5e.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:48.401199102 CEST	1.1.1.1	192.168.2.17	0x1ad1	No error (0)	scdn38c07.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:48.401199102 CEST	1.1.1.1	192.168.2.17	0x1ad1	No error (0)	sni1gl.wpc.alphacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:48.411374092 CEST	1.1.1.1	192.168.2.17	0x2fa1	No error (0)	scdn1efff.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:48.411374092 CEST	1.1.1.1	192.168.2.17	0x2fa1	No error (0)	sni1gl.wpc.alphacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:48.411823034 CEST	1.1.1.1	192.168.2.17	0x48f0	No error (0)	scdn1efff.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:48.412781000 CEST	1.1.1.1	192.168.2.17	0x5b55	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:48.412781000 CEST	1.1.1.1	192.168.2.17	0x5b55	No error (0)	dual.s-part-0044.t-0009.fb-t-msedge.net	s-part-0044.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:48.412781000 CEST	1.1.1.1	192.168.2.17	0x5b55	No error (0)	s-part-0044.t-0009.fb-t-msedge.net		13.107.253.72	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:50.121419907 CEST	1.1.1.1	192.168.2.17	0xa3c0	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:50.121419907 CEST	1.1.1.1	192.168.2.17	0xa3c0	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:35:50.539393902 CEST	1.1.1.1	192.168.2.17	0xbb62	No error (0)	fpt.live.com	fpt.microsoft.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:50.539558887 CEST	1.1.1.1	192.168.2.17	0xe18c	No error (0)	fpt.live.com	fpt.microsoft.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:53.986253977 CEST	1.1.1.1	192.168.2.17	0x8197	No error (0)	fpt.live.com	fpt.microsoft.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:53.986294031 CEST	1.1.1.1	192.168.2.17	0x1cfc	No error (0)	fpt.live.com	fpt.microsoft.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:56.916553974 CEST	1.1.1.1	192.168.2.17	0x8f5f	No error (0)	account.live.com	account.msa.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:35:56.920447111 CEST	1.1.1.1	192.168.2.17	0x14ab	No error (0)	account.live.com	account.msa.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:36:19.340482950 CEST	1.1.1.1	192.168.2.17	0x4caf	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:36:19.340482950 CEST	1.1.1.1	192.168.2.17	0x4caf	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:36:22.158315897 CEST	1.1.1.1	192.168.2.17	0xf8b	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:36:22.158315897 CEST	1.1.1.1	192.168.2.17	0xf8b	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:36:22.158315897 CEST	1.1.1.1	192.168.2.17	0xf8b	No error (0)	sni1gl.wpc.omegacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:36:22.159329891 CEST	1.1.1.1	192.168.2.17	0xb1de	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:36:22.159329891 CEST	1.1.1.1	192.168.2.17	0xb1de	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:36:28.239097118 CEST	1.1.1.1	192.168.2.17	0x2397	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:36:28.239097118 CEST	1.1.1.1	192.168.2.17	0x2397	No error (0)	dual.s-part-0017.t-0009.fb-t-msedge.net	s-part-0017.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:36:28.239097118 CEST	1.1.1.1	192.168.2.17	0x2397	No error (0)	s-part-0017.t-0009.fb-t-msedge.net		13.107.253.45	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:36:28.381493092 CEST	1.1.1.1	192.168.2.17	0x79ab	No error (0)	outlook.office365.com	ooc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:36:28.381493092 CEST	1.1.1.1	192.168.2.17	0x79ab	No error (0)	ooc-g2.tm-4.office.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:36:28.381493092 CEST	1.1.1.1	192.168.2.17	0x79ab	No error (0)	outlook.ms-acdc.office.com	HHN-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:36:28.381493092 CEST	1.1.1.1	192.168.2.17	0x79ab	No error (0)	HHN-efz.ms-acdc.office.com		52.98.152.242	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:36:28.381493092 CEST	1.1.1.1	192.168.2.17	0x79ab	No error (0)	HHN-efz.ms-acdc.office.com		52.98.243.18	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:36:28.381493092 CEST	1.1.1.1	192.168.2.17	0x79ab	No error (0)	HHN-efz.ms-acdc.office.com		40.99.150.2	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:36:28.381493092 CEST	1.1.1.1	192.168.2.17	0x79ab	No error (0)	HHN-efz.ms-acdc.office.com		52.98.152.194	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:36:28.381508112 CEST	1.1.1.1	192.168.2.17	0xdbce	No error (0)	outlook.office365.com	ooc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:36:28.381508112 CEST	1.1.1.1	192.168.2.17	0xdbce	No error (0)	ooc-g2.tm-4.office.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:36:28.381508112 CEST	1.1.1.1	192.168.2.17	0xdbce	No error (0)	outlook.ms-acdc.office.com	FRA-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:36:29.829540014 CEST	1.1.1.1	192.168.2.17	0x8126	No error (0)	r4.res.office365.com	r4.res.office365.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:36:29.837081909 CEST	1.1.1.1	192.168.2.17	0x4c1c	No error (0)	r4.res.office365.com	r4.res.office365.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:36:39.535439014 CEST	1.1.1.1	192.168.2.17	0xcea5	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:36:39.535969973 CEST	1.1.1.1	192.168.2.17	0x98e2	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:36:41.642362118 CEST	1.1.1.1	192.168.2.17	0x8b02	No error (0)	passwordreset.microsoftonline.com	passwordreset.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 17:36:41.643302917 CEST	1.1.1.1	192.168.2.17	0xc5b8	No error (0)	passwordreset.microsoftonline.com	passwordreset.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

slscr.update.microsoft.com

https:

aadcdn.msftauth.net

aadcdn.msauth.net

outlook.office365.com

logincdn.msauth.net

fs.microsoft.com

evoke-windowsservices-tas.msedge.net

www.bing.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.17	49712	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:15 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=73s5fwxgyy7g2cX&MD=3SepasZF HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-24 15:35:15 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 4e115ce5-9230-4e8e-96bf-379a891c35ab MS-RequestId: 90ce9798-aea6-4197-87b5-8bd3dce43738 MS-CV: DYDlEGL9MEqVUBRC.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 24 Oct 2024 15:35:15 GMT Connection: close Content-Length: 24490
2024-10-24 15:35:15 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-24 15:35:15 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.17	49713	152.199.21.175	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:15 UTC	635	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:15 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 6690338 Cache-Control: public, max-age=31536000 Content-MD5: bedopN8eDQBhzbUu8GNGxA== Content-Type: application/x-javascript Date: Thu, 24 Oct 2024 15:35:15 GMT Etag: 0x8DCB563C85A43C4 Last-Modified: Mon, 05 Aug 2024 15:32:14 GMT Server: ECAcc (lhc/78A8) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: fb594470-e01e-0006-2151-e9b2d8000000 x-ms-version: 2009-09-19 Content-Length: 141866 Connection: close
2024-10-24 15:35:15 UTC	16383	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-10-24 15:35:16 UTC	16383	IN	Data Raw: 22 5d 2c 5b 22 23 32 30 32 30 32 30 22 5d 29 2c 73 3d 65 28 72 2c 5b 22 34 35 2c 35 30 2c 35 34 22 5d 2c 5b 22 23 32 64 33 32 33 36 22 5d 29 2c 75 3d 65 28 72 2c 5b 22 32 35 35 2c 32 35 30 2c 32 33 39 22 5d 2c 5b 22 23 66 66 66 61 65 66 22 5d 29 3b 69 66 28 6f 7c 7c 61 7c 7c 73 29 72 65 74 75 72 6e 22 62 6c 61 63 6b 22 3b 69 66 28 69 7c 7c 75 29 72 65 74 75 72 6e 22 77 68 69 74 65 22 7d 7d 7d 2c 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 64 6f 63 75 6d 65 6e 74 2e 64 65 66 61 75 6c 74 56 69 65 77 26 26 64 6f 63 75 6d 65 6e 74 2e 64 65 66 61 75 6c 74 56 69 65 77 2e 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 3f 64 6f 63 75 6d 65 6e 74 2e 64 65 66 61 75 6c 74 56 69 65 77 2e 67 65 74 43 6f Data Ascii: "],["#202020"]),s=e(r,["45,50,54"],["#2d3236"]),u=e(r,["255,250,239"],["#fffaef"]);if(o\|\|a\|\|s)return"black";if(i\|\|u)return"white"}}},getComputedStyle:function(e){return document.defaultView&&document.defaultView.getComputedStyle?document.defaultView.getCo
2024-10-24 15:35:16 UTC	16383	IN	Data Raw: 5f 50 41 53 53 57 4f 52 44 3a 22 38 30 30 34 33 35 35 37 22 2c 50 50 5f 45 5f 4f 54 54 5f 44 41 54 41 5f 49 4e 56 41 4c 49 44 3a 22 38 30 30 34 33 34 38 46 22 2c 50 50 5f 45 5f 4f 54 54 5f 41 4c 52 45 41 44 59 5f 43 4f 4e 53 55 4d 45 44 3a 22 38 30 30 34 33 34 39 30 22 2c 50 50 5f 45 5f 4f 54 54 5f 49 4e 56 41 4c 49 44 5f 50 55 52 50 4f 53 45 3a 22 38 30 30 34 33 34 39 36 22 2c 50 50 5f 45 5f 50 50 53 41 5f 52 50 54 5f 4e 4f 54 4f 41 44 44 52 45 53 53 3a 22 38 30 30 34 38 31 32 30 22 2c 50 50 5f 45 5f 53 54 52 4f 4e 47 50 52 4f 43 45 53 53 5f 42 41 44 44 45 56 49 43 45 4e 41 4d 45 3a 22 38 30 30 34 39 43 32 32 22 2c 50 50 5f 45 5f 49 4e 4c 49 4e 45 4c 4f 47 49 4e 5f 49 4e 56 41 4c 49 44 5f 53 4d 53 3a 22 38 30 30 34 33 34 45 31 22 2c 50 50 5f 45 5f 49 4e Data Ascii: _PASSWORD:"80043557",PP_E_OTT_DATA_INVALID:"8004348F",PP_E_OTT_ALREADY_CONSUMED:"80043490",PP_E_OTT_INVALID_PURPOSE:"80043496",PP_E_PPSA_RPT_NOTOADDRESS:"80048120",PP_E_STRONGPROCESS_BADDEVICENAME:"80049C22",PP_E_INLINELOGIN_INVALID_SMS:"800434E1",PP_E_IN
2024-10-24 15:35:16 UTC	16383	IN	Data Raw: 2e 2a 29 3f 24 2f 5d 2c 44 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 66 6f 72 28 76 61 72 20 72 3d 30 2c 6f 3d 65 2e 6c 65 6e 67 74 68 3b 72 3c 6f 3b 72 2b 2b 29 74 2e 63 61 6c 6c 28 6e 2c 65 5b 72 5d 2c 72 2c 65 29 7d 2c 41 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 64 65 78 4f 66 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 64 65 78 4f 66 2e 63 61 6c 6c 28 65 2c 74 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 69 66 28 65 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 2c 4c Data Ascii: .*)?$/],D:function(e,t,n){for(var r=0,o=e.length;r<o;r++)t.call(n,e[r],r,e)},A:"function"==typeof Array.prototype.indexOf?function(e,t){return Array.prototype.indexOf.call(e,t)}:function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},L
2024-10-24 15:35:16 UTC	16383	IN	Data Raw: 66 6e 2e 71 62 28 74 29 2c 53 2e 61 2e 41 62 28 74 2c 50 29 2c 53 2e 6f 70 74 69 6f 6e 73 2e 64 65 66 65 72 55 70 64 61 74 65 73 26 26 53 2e 54 61 2e 64 65 66 65 72 72 65 64 28 74 2c 21 30 29 2c 74 7d 3b 76 61 72 20 50 3d 7b 65 71 75 61 6c 69 74 79 43 6f 6d 70 61 72 65 72 3a 6e 2c 76 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 5b 77 5d 7d 2c 78 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6e 6f 74 69 66 79 53 75 62 73 63 72 69 62 65 72 73 28 74 68 69 73 5b 77 5d 2c 22 73 70 65 63 74 61 74 65 22 29 2c 74 68 69 73 2e 6e 6f 74 69 66 79 53 75 62 73 63 72 69 62 65 72 73 28 74 68 69 73 5b 77 5d 29 7d 2c 79 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6e 6f 74 69 66 79 53 75 62 73 63 72 69 62 65 72 73 28 74 68 69 73 5b Data Ascii: fn.qb(t),S.a.Ab(t,P),S.options.deferUpdates&&S.Ta.deferred(t,!0),t};var P={equalityComparer:n,v:function(){return this[w]},xa:function(){this.notifySubscribers(this[w],"spectate"),this.notifySubscribers(this[w])},ya:function(){this.notifySubscribers(this[
2024-10-24 15:35:16 UTC	16383	IN	Data Raw: 6f 6e 20 6f 28 65 29 7b 72 65 74 75 72 6e 20 53 2e 61 2e 47 61 28 53 2e 75 2e 47 28 65 29 2c 28 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 28 29 5b 6e 5d 7d 7d 29 29 7d 66 75 6e 63 74 69 6f 6e 20 69 28 65 2c 74 2c 72 29 7b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 3f 6f 28 65 2e 62 69 6e 64 28 6e 75 6c 6c 2c 74 2c 72 29 29 3a 53 2e 61 2e 47 61 28 65 2c 6e 29 7d 66 75 6e 63 74 69 6f 6e 20 63 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 6f 28 74 68 69 73 2e 67 65 74 42 69 6e 64 69 6e 67 73 2e 62 69 6e 64 28 74 68 69 73 2c 65 2c 74 29 29 7d 66 75 6e 63 74 69 6f 6e 20 64 28 65 2c 74 29 7b 76 61 72 20 6e 3d 53 2e 68 2e 66 69 72 73 74 43 68 69 6c 64 28 74 Data Ascii: on o(e){return S.a.Ga(S.u.G(e),(function(t,n){return function(){return e()[n]}}))}function i(e,t,r){return"function"==typeof e?o(e.bind(null,t,r)):S.a.Ga(e,n)}function c(e,t){return o(this.getBindings.bind(this,e,t))}function d(e,t){var n=S.h.firstChild(t
2024-10-24 15:35:16 UTC	16383	IN	Data Raw: 29 26 26 28 63 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 28 30 2c 74 29 2c 53 2e 75 2e 47 28 6e 2e 67 65 74 28 22 6f 70 74 69 6f 6e 73 41 66 74 65 72 52 65 6e 64 65 72 22 29 2c 6e 75 6c 6c 2c 5b 74 5b 30 5d 2c 65 21 3d 3d 44 3f 65 3a 61 5d 29 7d 29 2c 53 2e 61 2e 65 63 28 65 2c 66 2c 28 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 69 29 7b 72 65 74 75 72 6e 20 69 2e 6c 65 6e 67 74 68 26 26 28 70 3d 21 6c 26 26 69 5b 30 5d 2e 73 65 6c 65 63 74 65 64 3f 5b 53 2e 77 2e 4d 28 69 5b 30 5d 29 5d 3a 5b 5d 2c 68 3d 21 30 29 2c 72 3d 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 6f 70 74 69 6f 6e 22 29 2c 74 3d 3d 3d 44 3f 28 53 2e 61 2e 42 62 28 72 2c 6e 2e 67 65 74 28 22 6f 70 74 69 6f 6e 73 43 61 70 74 69 6f 6e 22 Data Ascii: )&&(c=function(e,t){i(0,t),S.u.G(n.get("optionsAfterRender"),null,[t[0],e!==D?e:a])}),S.a.ec(e,f,(function(t,r,i){return i.length&&(p=!l&&i[0].selected?[S.w.M(i[0])]:[],h=!0),r=e.ownerDocument.createElement("option"),t===D?(S.a.Bb(r,n.get("optionsCaption"
2024-10-24 15:35:16 UTC	7	IN	Data Raw: 27 27 29 3b 22 7d 2c Data Ascii: '');"},
2024-10-24 15:35:16 UTC	16383	IN	Data Raw: 6c 2e 74 6d 70 6c 2e 74 61 67 2e 6b 6f 5f 77 69 74 68 3d 7b 6f 70 65 6e 3a 22 77 69 74 68 28 24 31 29 20 7b 22 2c 63 6c 6f 73 65 3a 22 7d 20 22 7d 29 7d 2c 53 2e 24 61 2e 70 72 6f 74 6f 74 79 70 65 3d 6e 65 77 20 53 2e 63 61 2c 53 2e 24 61 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 53 2e 24 61 3b 76 61 72 20 65 3d 6e 65 77 20 53 2e 24 61 3b 30 3c 65 2e 48 64 26 26 53 2e 67 63 28 65 29 2c 53 2e 62 28 22 6a 71 75 65 72 79 54 6d 70 6c 54 65 6d 70 6c 61 74 65 45 6e 67 69 6e 65 22 2c 53 2e 24 61 29 7d 28 29 7d 29 29 7d 28 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 66 75 6e 63 74 69 6f 6e 20 72 28 65 29 7b 72 65 74 75 72 6e 28 72 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 22 73 79 Data Ascii: l.tmpl.tag.ko_with={open:"with($1) {",close:"} "})},S.$a.prototype=new S.ca,S.$a.prototype.constructor=S.$a;var e=new S.$a;0<e.Hd&&S.gc(e),S.b("jqueryTmplTemplateEngine",S.$a)}()}))}()},function(e,t,n){function r(e){return(r="function"==typeof Symbol&&"sy
2024-10-24 15:35:16 UTC	10795	IN	Data Raw: 28 6e 29 7d 72 65 74 75 72 6e 20 74 26 26 28 74 3d 74 2e 72 65 70 6c 61 63 65 28 2f 5c 3f 2f 67 2c 22 5c 5c 75 30 30 33 46 22 29 29 2c 74 7d 66 75 6e 63 74 69 6f 6e 20 53 28 65 29 7b 65 2e 68 65 61 64 65 72 73 3d 62 28 29 2c 65 2e 77 69 74 68 43 72 65 64 65 6e 74 69 61 6c 73 3d 61 2c 65 2e 62 72 65 61 6b 43 61 63 68 65 3d 73 2c 65 2e 72 65 73 70 6f 6e 73 65 54 79 70 65 3d 68 7d 66 75 6e 63 74 69 6f 6e 20 45 28 65 2c 74 2c 6e 2c 72 2c 6f 2c 69 29 7b 76 61 72 20 61 3d 6e 75 6c 6c 3b 69 66 28 74 29 7b 76 61 72 20 73 3d 74 2e 65 76 65 6e 74 4f 70 74 69 6f 6e 73 7c 7c 7b 7d 3b 69 66 28 73 2e 65 76 65 6e 74 49 64 3d 74 2e 65 76 65 6e 74 49 64 7c 7c 73 2e 65 76 65 6e 74 49 64 2c 73 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 68 69 64 69 6e 67 4d 6f 64 65 Data Ascii: (n)}return t&&(t=t.replace(/\?/g,"\\u003F")),t}function S(e){e.headers=b(),e.withCredentials=a,e.breakCache=s,e.responseType=h}function E(e,t,n,r,o,i){var a=null;if(t){var s=t.eventOptions\|\|{};if(s.eventId=t.eventId\|\|s.eventId,s.hasOwnProperty("hidingMode

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.17	49718	152.199.21.175	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:17 UTC	410	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:18 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 6690341 Cache-Control: public, max-age=31536000 Content-MD5: bedopN8eDQBhzbUu8GNGxA== Content-Type: application/x-javascript Date: Thu, 24 Oct 2024 15:35:18 GMT Etag: 0x8DCB563C85A43C4 Last-Modified: Mon, 05 Aug 2024 15:32:14 GMT Server: ECAcc (lhc/78A8) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: fb594470-e01e-0006-2151-e9b2d8000000 x-ms-version: 2009-09-19 Content-Length: 141866 Connection: close
2024-10-24 15:35:18 UTC	15652	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-10-24 15:35:18 UTC	16383	IN	Data Raw: 77 2e 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 6f 2c 22 3a 3a 62 65 66 6f 72 65 22 29 2e 63 6f 6e 74 65 6e 74 3b 45 3d 27 22 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 22 27 3d 3d 3d 69 2c 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 6f 29 2c 6e 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 72 29 7d 7d 72 65 74 75 72 6e 20 45 7d 2c 67 65 74 48 69 67 68 43 6f 6e 74 72 61 73 74 54 68 65 6d 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6e 29 7b 66 75 6e 63 74 69 6f 6e 20 72 28 65 2c 74 2c 6e 2c 72 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 52 65 67 45 78 70 28 22 5e 72 67 62 61 3f 5c 5c 28 22 2b 74 2b 22 2c 5c 5c 73 3f 22 2b 6e 2b 22 2c 5c 5c 73 3f 22 2b 72 2b 22 28 2c 5c 5c 73 3f 5c 5c 64 2b Data Ascii: w.getComputedStyle(o,"::before").content;E='"high-contrast"'===i,document.body.removeChild(o),n.removeChild(r)}}return E},getHighContrastTheme:function(){function e(e,t,n){function r(e,t,n,r){return new RegExp("^rgba?\\("+t+",\\s?"+n+",\\s?"+r+"(,\\s?\\d+
2024-10-24 15:35:18 UTC	16383	IN	Data Raw: 4d 4f 42 49 4c 45 43 52 45 44 53 5f 50 48 4f 4e 45 4e 55 4d 42 45 52 5f 54 4f 4f 53 48 4f 52 54 3a 22 38 30 30 34 35 38 30 36 22 2c 50 50 5f 45 5f 4d 4f 42 49 4c 45 43 52 45 44 53 5f 50 48 4f 4e 45 4e 55 4d 42 45 52 5f 54 4f 4f 4c 4f 4e 47 3a 22 38 30 30 34 35 38 30 37 22 2c 50 50 5f 45 5f 4d 4f 42 49 4c 45 43 52 45 44 53 5f 50 48 4f 4e 45 4e 55 4d 42 45 52 5f 49 4e 56 41 4c 49 44 3a 22 38 30 30 34 35 38 30 30 22 2c 50 50 5f 45 5f 4e 41 4d 45 5f 42 4c 41 4e 4b 3a 22 38 30 30 34 31 31 30 30 22 2c 50 50 5f 45 5f 45 4d 41 49 4c 5f 49 4e 43 4f 4d 50 4c 45 54 45 3a 22 38 30 30 34 31 31 30 44 22 2c 50 50 5f 45 5f 45 4d 41 49 4c 5f 49 4e 56 41 4c 49 44 3a 22 38 30 30 34 31 31 30 42 22 2c 50 50 5f 45 5f 4e 41 4d 45 5f 54 4f 4f 5f 53 48 4f 52 54 3a 22 38 30 30 34 Data Ascii: MOBILECREDS_PHONENUMBER_TOOSHORT:"80045806",PP_E_MOBILECREDS_PHONENUMBER_TOOLONG:"80045807",PP_E_MOBILECREDS_PHONENUMBER_INVALID:"80045800",PP_E_NAME_BLANK:"80041100",PP_E_EMAIL_INCOMPLETE:"8004110D",PP_E_EMAIL_INVALID:"8004110B",PP_E_NAME_TOO_SHORT:"8004
2024-10-24 15:35:18 UTC	16383	IN	Data Raw: 7c 7c 5b 5d 3b 53 2e 61 2e 44 28 6e 2e 6d 61 74 63 68 28 62 29 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 53 2e 61 2e 4e 61 28 6f 2c 65 2c 72 29 7d 29 29 2c 65 5b 74 5d 3d 6f 2e 6a 6f 69 6e 28 22 20 22 29 7d 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 69 3d 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 5b 5d 7d 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 2c 66 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 2c 70 3d 7b 7d 2c 68 3d 7b 7d 3b 70 5b 63 26 26 2f 46 69 72 65 66 6f 78 5c 2f 32 2f 69 2e 74 65 73 74 28 63 2e 75 73 65 72 41 67 65 6e 74 29 3f 22 4b 65 79 62 6f 61 72 64 45 76 65 6e 74 22 3a 22 55 49 45 76 65 6e 74 73 22 5d 3d 5b 22 6b 65 79 75 70 22 2c 22 6b 65 Data Ascii: \|\|[];S.a.D(n.match(b),(function(e){S.a.Na(o,e,r)})),e[t]=o.join(" ")}var o=Object.prototype.hasOwnProperty,i={__proto__:[]}instanceof Array,f="function"==typeof Symbol,p={},h={};p[c&&/Firefox\/2/i.test(c.userAgent)?"KeyboardEvent":"UIEvents"]=["keyup","ke
2024-10-24 15:35:18 UTC	16383	IN	Data Raw: 20 63 61 6e 20 61 63 74 20 61 73 20 64 65 70 65 6e 64 65 6e 63 69 65 73 22 29 3b 6e 2e 6f 64 2e 63 61 6c 6c 28 6e 2e 70 64 2c 65 2c 65 2e 66 64 7c 7c 28 65 2e 66 64 3d 2b 2b 6f 29 29 7d 7d 2c 47 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 72 2c 6f 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 65 28 29 2c 6e 2e 61 70 70 6c 79 28 72 2c 6f 7c 7c 5b 5d 29 7d 66 69 6e 61 6c 6c 79 7b 74 28 29 7d 7d 2c 71 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6e 29 72 65 74 75 72 6e 20 6e 2e 6f 2e 71 61 28 29 7d 2c 56 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6e 29 72 65 74 75 72 6e 20 6e 2e 6f 2e 56 61 28 29 7d 2c 59 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6e 29 72 65 74 75 72 6e 20 6e 2e 59 61 7d 2c 6f 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6e 29 72 65 74 75 72 Data Ascii: can act as dependencies");n.od.call(n.pd,e,e.fd\|\|(e.fd=++o))}},G:function(n,r,o){try{return e(),n.apply(r,o\|\|[])}finally{t()}},qa:function(){if(n)return n.o.qa()},Va:function(){if(n)return n.o.Va()},Ya:function(){if(n)return n.Ya},o:function(){if(n)retur
2024-10-24 15:35:18 UTC	16383	IN	Data Raw: 72 65 74 75 72 6e 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 62 69 6e 64 22 29 3b 63 61 73 65 20 38 3a 72 65 74 75 72 6e 20 53 2e 68 2e 56 64 28 65 29 3b 64 65 66 61 75 6c 74 3a 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 7d 2c 70 61 72 73 65 42 69 6e 64 69 6e 67 73 53 74 72 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 74 72 79 7b 76 61 72 20 6f 2c 69 3d 74 68 69 73 2e 6e 64 2c 61 3d 65 2b 28 72 26 26 72 2e 76 61 6c 75 65 41 63 63 65 73 73 6f 72 73 7c 7c 22 22 29 3b 69 66 28 21 28 6f 3d 69 5b 61 5d 29 29 7b 76 61 72 20 73 2c 75 3d 22 77 69 74 68 28 24 63 6f 6e 74 65 78 74 29 7b 77 69 74 68 28 24 64 61 74 61 7c 7c 7b 7d 29 7b 72 65 74 75 72 6e 7b 22 2b 53 2e 6d 2e 76 62 28 65 2c 72 29 2b 22 7d 7d 7d 22 3b 73 3d 6e 65 77 Data Ascii: return e.getAttribute("data-bind");case 8:return S.h.Vd(e);default:return null}},parseBindingsString:function(e,t,n,r){try{var o,i=this.nd,a=e+(r&&r.valueAccessors\|\|"");if(!(o=i[a])){var s,u="with($context){with($data\|\|{}){return{"+S.m.vb(e,r)+"}}}";s=new
2024-10-24 15:35:18 UTC	16383	IN	Data Raw: 74 5d 3a 6e 7d 66 75 6e 63 74 69 6f 6e 20 69 28 74 2c 6e 29 7b 69 66 28 68 26 26 6c 29 53 2e 69 2e 6d 61 28 65 2c 53 2e 69 2e 48 29 3b 65 6c 73 65 20 69 66 28 70 2e 6c 65 6e 67 74 68 29 7b 76 61 72 20 72 3d 30 3c 3d 53 2e 61 2e 41 28 70 2c 53 2e 77 2e 4d 28 6e 5b 30 5d 29 29 3b 53 2e 61 2e 5a 63 28 6e 5b 30 5d 2c 72 29 2c 68 26 26 21 72 26 26 53 2e 75 2e 47 28 53 2e 61 2e 46 62 2c 6e 75 6c 6c 2c 5b 65 2c 22 63 68 61 6e 67 65 22 5d 29 7d 7d 76 61 72 20 73 3d 65 2e 6d 75 6c 74 69 70 6c 65 2c 75 3d 30 21 3d 65 2e 6c 65 6e 67 74 68 26 26 73 3f 65 2e 73 63 72 6f 6c 6c 54 6f 70 3a 6e 75 6c 6c 2c 63 3d 53 2e 61 2e 66 28 74 28 29 29 2c 6c 3d 6e 2e 67 65 74 28 22 76 61 6c 75 65 41 6c 6c 6f 77 55 6e 73 65 74 22 29 26 26 6e 2e 68 61 73 28 22 76 61 6c 75 65 22 29 2c Data Ascii: t]:n}function i(t,n){if(h&&l)S.i.ma(e,S.i.H);else if(p.length){var r=0<=S.a.A(p,S.w.M(n[0]));S.a.Zc(n[0],r),h&&!r&&S.u.G(S.a.Fb,null,[e,"change"])}}var s=e.multiple,u=0!=e.length&&s?e.scrollTop:null,c=S.a.f(t()),l=n.get("valueAllowUnset")&&n.has("value"),
2024-10-24 15:35:19 UTC	16383	IN	Data Raw: 29 72 65 74 75 72 6e 20 32 7d 63 61 74 63 68 28 65 29 7b 7d 72 65 74 75 72 6e 20 31 7d 28 29 3b 74 68 69 73 2e 72 65 6e 64 65 72 54 65 6d 70 6c 61 74 65 53 6f 75 72 63 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 2c 6f 29 7b 69 66 28 6f 3d 6f 7c 7c 75 2c 72 3d 72 7c 7c 7b 7d 2c 32 3e 65 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 59 6f 75 72 20 76 65 72 73 69 6f 6e 20 6f 66 20 6a 51 75 65 72 79 2e 74 6d 70 6c 20 69 73 20 74 6f 6f 20 6f 6c 64 2e 20 50 6c 65 61 73 65 20 75 70 67 72 61 64 65 20 74 6f 20 6a 51 75 65 72 79 2e 74 6d 70 6c 20 31 2e 30 2e 30 70 72 65 20 6f 72 20 6c 61 74 65 72 2e 22 29 3b 76 61 72 20 69 3d 74 2e 64 61 74 61 28 22 70 72 65 63 6f 6d 70 69 6c 65 64 22 29 3b 72 65 74 75 72 6e 20 69 7c 7c 28 69 3d 74 2e 74 65 78 74 28 29 7c 7c 22 22 Data Ascii: )return 2}catch(e){}return 1}();this.renderTemplateSource=function(t,n,r,o){if(o=o\|\|u,r=r\|\|{},2>e)throw Error("Your version of jQuery.tmpl is too old. Please upgrade to jQuery.tmpl 1.0.0pre or later.");var i=t.data("precompiled");return i\|\|(i=t.text()\|\|""
2024-10-24 15:35:19 UTC	11533	IN	Data Raw: 65 74 49 6e 73 74 61 6e 63 65 28 77 69 6e 64 6f 77 2e 53 65 72 76 65 72 44 61 74 61 29 2c 63 3d 6e 28 35 29 2c 6c 3d 77 69 6e 64 6f 77 2c 64 3d 6c 2e 24 43 6f 6e 66 69 67 7c 7c 6c 2e 53 65 72 76 65 72 44 61 74 61 7c 7c 7b 7d 2c 66 3d 61 2e 4f 62 6a 65 63 74 2c 70 3d 73 2e 51 75 65 72 79 53 74 72 69 6e 67 3b 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 6e 3d 21 31 21 3d 3d 28 65 3d 65 7c 7c 7b 7d 29 2e 63 68 65 63 6b 41 70 69 43 61 6e 61 72 79 2c 61 3d 65 2e 77 69 74 68 43 72 65 64 65 6e 74 69 61 6c 73 7c 7c 21 31 2c 73 3d 65 2e 62 72 65 61 6b 43 61 63 68 65 7c 7c 21 31 2c 68 3d 65 2e 72 65 73 70 6f 6e 73 65 54 79 70 65 7c 7c 22 22 2c 67 3d 65 2e 6e 6f 74 69 66 79 4f 6e 43 6c 69 65 6e 74 41 62 6f 72 74 Data Ascii: etInstance(window.ServerData),c=n(5),l=window,d=l.$Config\|\|l.ServerData\|\|{},f=a.Object,p=s.QueryString;e.exports=function(e){var t=this,n=!1!==(e=e\|\|{}).checkApiCanary,a=e.withCredentials\|\|!1,s=e.breakCache\|\|!1,h=e.responseType\|\|"",g=e.notifyOnClientAbort

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.17	49722	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:19 UTC	658	OUT	GET /ests/2.1/content/cdnbundles/converged.v2.login.min_nin8k2ycrbzww8zl5vxkaq2.css HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:19 UTC	781	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:19 GMT Content-Type: text/css Content-Length: 20400 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 25 Sep 2024 21:42:27 GMT ETag: 0x8DCDDAAF34D1A25 x-ms-request-id: a8069f7c-c01e-002a-1ceb-1e23eb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153519Z-16849878b78k46f8kzwxznephs00000007ug000000008utd x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:19 UTC	15603	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 7d 6b 93 db 36 b2 e8 77 ff 0a ee a4 52 eb c9 4a 8c 48 3d 47 53 49 ad e3 78 93 39 c7 af b2 9d 7d 54 2a b5 c5 91 a8 11 8f 29 51 97 a4 66 3c ab a3 ff 7e f1 46 03 68 90 d4 78 b2 d9 7b 2b eb 8d 2d a2 1b 0d a0 d1 68 a0 81 6e e0 eb af fe 10 3c 2f 76 f7 65 76 b3 ae 83 a7 cf cf 83 57 d9 a2 2c aa 62 55 93 f4 72 57 94 49 9d 15 db 30 78 96 e7 01 43 aa 82 32 ad d2 f2 36 5d 86 c1 57 5f 7f fd d5 1f 9e f4 bb ff 2f 78 ff e1 d9 bb 0f c1 9b bf 04 1f 7e bc 7a f7 7d f0 96 7c fd 23 78 fd e6 c3 d5 f3 17 41 67 2a 4f 9e 7c 58 67 55 b0 ca f2 34 20 ff 5e 27 55 ba 0c 8a 6d 50 94 41 b6 5d 88 5a a7 55 b0 21 7f 97 59 92 07 ab b2 d8 04 f5 3a 0d 76 65 f1 3f e9 82 b4 21 cf aa 9a 64 ba 4e f3 e2 2e 78 4a c8 95 cb e0 6d 52 d6 f7 c1 d5 db f3 30 f8 40 70 0b d2 Data Ascii: }k6wRJH=GSIx9}T)Qf<~Fhx{+-hn</vevW,bUrWI0xC26]W_/x~z}\|#xAgO\|XgU4 ^'UmPA]ZU!Y:ve?!dN.xJmR0@p
2024-10-24 15:35:19 UTC	4797	IN	Data Raw: 8b ca ba c2 a2 2a 8b 88 bd ac 2c 12 31 2f 2a 2b 24 e5 a1 95 75 9e df 51 bb 5f 6a 19 63 dc bc c9 45 89 b5 70 47 5d 70 ca fb 9e 0e 20 56 49 be 20 69 14 01 46 49 a3 08 a2 a9 10 de 51 33 ab ab 42 ad 3a 03 51 82 c9 86 58 21 80 b6 66 35 88 5b 0b 1a d2 44 af 18 0e 06 e3 65 32 71 db a4 25 ce 20 03 a5 0f 01 b4 b6 c9 2f 95 2d 68 58 9b 7c d2 ca db f4 30 61 ec 73 a7 f6 1e b8 a8 5b 0e 36 f1 85 8e 36 04 a6 86 1b 02 93 e3 0d 14 66 70 df 93 6e 56 08 83 b4 76 40 43 45 db f0 b0 2e 10 57 99 1b 46 0a 7a 9a 6c 5e eb 5b 91 85 43 fa 34 bc 98 9d 23 97 02 03 20 96 48 ba 89 37 5f 87 50 e3 87 e3 60 22 80 5b d9 23 19 93 28 7f 18 bb 0c ee 13 f6 9e b3 cc 4f 7d b0 93 e5 be fa 81 1c e1 db 81 87 f8 c3 85 9e 97 26 d9 ad e4 e2 f9 d0 f9 26 d9 66 bb 7d ce d8 eb 5e a9 2b 2e 5f 31 9e 3c 14 8e Data Ascii: ,1/+$uQ_jcEpG]p VI iFIQ3B:QX!f5[De2q% /-hX\|0as[66fpnVv@CE.WFzl^[C4# H7_P`"[#(O}&&f}^+._1<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.17	49724	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:19 UTC	635	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_QLF_8apNRJD3OCol8jwtxw2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:20 UTC	792	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:19 GMT Content-Type: application/x-javascript Content-Length: 122269 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 02 Oct 2024 20:05:25 GMT ETag: 0x8DCE31D8E25C262 x-ms-request-id: 5cf67778-601e-0042-6fb6-217ad6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153519Z-r197bdfb6b4sn8wg20e97vn7ps0000000psg000000000tpr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:20 UTC	15592	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e4 bd 7b 77 e3 38 8e 38 fa ff fd 14 8e 66 6e da ee 28 2e cb af d8 4a ab b3 2e 27 a9 ca 76 12 67 62 a7 ba 77 53 99 1c 59 a2 1d 75 64 c9 2b c9 79 8c e3 fd ec 3f 00 24 25 ca 96 53 55 bd 7b ee 3d f7 dc 79 a4 2c 12 7c 81 20 08 80 20 f8 e1 e7 9d ff ab f4 73 69 ff fb ff 53 1a 8e 7a d7 a3 d2 e0 b4 34 fa 7c 76 7d 5c ba 82 af ff 28 5d 0e 46 67 fd 93 ef af 07 1b c5 ff 8f 1e bc b8 34 f1 7c 56 82 7f c7 76 cc dc 52 18 94 c2 a8 e4 05 4e 18 cd c3 c8 4e 58 5c 9a c1 df c8 b3 fd d2 24 0a 67 a5 e4 81 95 e6 51 f8 27 73 92 b8 e4 7b 71 02 85 c6 cc 0f 9f 4b 65 a8 2e 72 4b 57 76 94 bc 96 ce ae 2a 55 a8 9f 41 6d de d4 0b a0 b4 13 ce 5f e1 f7 43 52 0a c2 c4 73 58 c9 0e 5c aa cd 87 8f 20 66 a5 45 e0 b2 a8 f4 fc e0 39 0f a5 0b cf 89 c2 38 9c 24 a5 88 39 Data Ascii: {w88fn(.J.'vgbwSYud+y?$%SU{=y,\| siSz4\|v}\(]Fg4\|VvRNNX\$gQ's{qKe.rKWv*UAm_CRsX\ fE98$9
2024-10-24 15:35:20 UTC	16384	IN	Data Raw: 00 4b 69 b0 f5 a5 f6 21 6b b3 cb 4a f1 ed d6 0e 54 22 01 7b 7c 8b b0 36 c4 03 58 73 20 ac a4 4a b5 ad d4 6e ed d4 74 bb ca d0 d3 02 23 db 7c a7 2a 08 1a 89 14 bc b3 b2 96 07 5a 02 70 e0 27 3c bc 28 57 84 d4 5d 5e 06 3c 94 80 66 fb cf f6 6b ac ad 2a d0 20 ee 06 30 de c1 1c 3b 14 03 5e 6c e2 32 4e e4 8d f3 fd 57 ea cf 20 ca 99 40 0b 28 00 e9 a7 cc cf bf 13 ee c2 50 56 0b cd 19 7b 2c 73 e5 15 27 0c 2d 64 b3 39 5e c9 e1 ee 25 56 d1 9e 03 3c 05 00 07 d9 60 58 56 61 e5 1b 26 a7 c3 cc be e1 49 f7 eb f7 a6 4d 47 13 80 81 26 00 a1 f2 83 f4 2d 6e 79 67 33 16 af 95 43 fd 1d 3d 50 40 61 3a b6 a3 c7 2c 1e c3 a1 b7 e6 57 f7 11 bd bd c8 53 11 af 99 ac e7 fe 8e 5e 5f 4a ee 46 7d 96 8d 62 13 fa 31 d3 dd 9c 4b bc c7 0e 7b 48 d5 05 a8 2c 25 d1 15 ba 85 35 1e 6d 71 ee 63 56 Data Ascii: Ki!kJT"{\|6Xs Jnt#\|Zp'<(W]^<fk 0;^l2NW @(PV{,s'-d9^%V<`XVa&IMG&-nyg3C=P@a:,WS^_JF}b1K{H,%5mqcV
2024-10-24 15:35:20 UTC	16384	IN	Data Raw: ad dd f2 d7 de 0d 2c dc 7e cf 3d 81 cf 09 ba a1 13 41 89 a7 53 fa e6 c2 22 48 b1 7b a6 17 12 43 33 0a 6a b1 88 dd 7d 2e 8c ee da 00 eb 9b dc b9 6f 20 21 6c b5 1e d1 f2 31 1d df 45 54 ea 80 4b bd 03 d4 1b c0 52 72 d0 1b b9 3b 38 32 b6 1e 3b 8c ef 61 09 22 bc 51 c5 a6 7e 64 ee d1 23 d0 b1 b7 9d 04 ee b2 3a 1a e4 03 de 46 ab 50 a6 0a 90 a0 ea 0e c3 e4 d6 42 5a b3 5c 50 07 20 98 7b 5a da ce 4a be d2 8c 31 73 ca c7 a0 14 69 7b 61 80 85 06 00 7b 33 69 64 5d 89 c5 2d 7d 4d 3d 25 68 33 fa 08 f4 ff f0 4b f8 98 59 33 d9 be 88 a6 de 05 ac 1a 4e 4e 34 88 13 b4 2e ef 42 ae 8c a6 7e 4f 6c 9c c4 08 a1 7e 23 d2 8a b8 e9 7d f2 66 70 9e 44 ec cf e0 ca 99 4e bf 78 1f 8e 77 0f 0e df 90 79 15 f7 73 75 86 15 a0 a2 1e 3a bd 54 75 6f 4e 55 79 62 13 2d 24 fb 29 50 82 45 6b 94 f4 Data Ascii: ,~=AS"H{C3j}.o !l1ETKRr;82;a"Q~d#:FPBZ\P {ZJ1si{a{3id]-}M=%h3KY3NN4.B~Ol~#}fpDNxwysu:TuoNUyb-$)PEk
2024-10-24 15:35:20 UTC	16384	IN	Data Raw: ff d4 42 ef 2d 89 e3 f7 80 26 48 13 82 38 19 9a 47 0b 33 a8 38 69 54 06 c5 32 1a cb f9 9a 09 c8 b2 ed c4 ab b6 1e 18 c3 ab c9 17 91 ab 4a 6a 62 c6 ed 43 cd 2a e1 9b cc a6 60 4a e5 c2 25 57 35 f3 94 a8 22 52 8c fa a3 56 7f 2d 46 e4 21 09 3d b5 9b d8 2b c0 0d 38 a8 41 e4 02 e5 0f fd 92 2f 31 a3 b2 1d 2d 07 e1 72 ec fc 10 a4 40 ad bd 46 3f 2f 39 b9 5e 64 1f 5f e3 28 23 46 f1 59 84 9c f6 6b bf f2 0e c7 cb a9 d2 53 36 4e 1c 92 8a a7 e8 f9 4c 01 0c 3c d9 74 05 93 50 4f 51 03 e6 2c ef 8f ae 91 3b 9e 24 6f c2 f1 f0 51 e4 9e d2 dd 3d 0b 03 52 22 cb f3 61 54 96 45 7b 32 e3 0d 8a 4d d8 d6 38 91 be 97 d1 cf 92 a2 91 bf b3 9f 70 33 e1 11 f8 32 8e 73 ad a1 f8 2b 6c f3 0c 6d 2b c4 d7 49 01 0e fd 9e 8c 31 d4 54 7c 17 97 75 e7 68 08 6e ea 8e db 56 32 b9 eb 46 63 5d dc 0b Data Ascii: B-&H8G38iT2JjbC*`J%W5"RV-F!=+8A/1-r@F?/9^d_(#FYkS6NL<tPOQ,;$oQ=R"aTE{2M8p32s+lm+I1T\|uhnV2Fc]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.17	49723	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:19 UTC	654	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:20 UTC	791	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:19 GMT Content-Type: application/x-javascript Content-Length: 16326 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Tue, 27 Aug 2024 20:17:04 GMT ETag: 0x8DCC6D537C7BF24 x-ms-request-id: eb9927fb-a01e-006a-1deb-216cc1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153519Z-16849878b78mhkkf6kbvry07q000000007pg00000000u8kw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:20 UTC	15593	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 dd 7d 4d 73 23 c7 92 d8 dd bf 02 0f cf f1 86 5c f5 40 f8 e0 27 46 d0 18 04 c0 19 ec 90 00 04 80 43 29 24 19 d1 04 8a 60 bf 01 ba b1 dd 8d e1 f0 51 e3 78 37 1f f6 e0 ab 7d f3 c1 27 1f 7d f1 dd 3f 65 23 d6 bf c3 f9 51 55 5d d5 dd 00 c8 91 56 6f d7 0a c5 10 dd f5 95 95 95 95 95 99 95 99 fd 87 db b5 3f 8d bd c0 df 13 fb 8f ea 77 21 d8 f3 f7 1f bd db 3d ef 47 ff e7 fd 50 c4 eb d0 2f e0 ef 92 f8 b4 0a c2 38 7a f5 d1 0d 0b 71 03 5f 35 1e e5 bb fa e3 67 c7 9b d5 7d 67 11 b8 33 31 ab ff a1 f2 f9 95 6c 2a b0 e9 d4 5d 2c f6 62 d5 83 13 3b c9 ef 60 1f 1e b8 59 e3 0f e5 a4 e0 33 0e e3 35 1e 75 47 41 69 d9 10 4e 50 9a 36 3c f8 77 d5 28 16 9d 60 af bc ff 79 ef c7 64 1a 4e e0 78 00 fc 5e 75 9f a0 f4 1b de 5e 05 fa 87 3f 87 fb 4e 08 7f 8e f6 Data Ascii: }Ms#\@'FC)$`Qx7}'}?e#QU]Vo?w!=GP/8zq_5g}g31l*],b;`Y35uGAiNP6<w(`ydNx^u^?N
2024-10-24 15:35:20 UTC	733	IN	Data Raw: c0 f5 c3 79 67 55 de 72 6e 30 47 45 07 e2 e0 a1 a2 03 90 e8 a9 c6 72 0b fd 96 e1 b7 f4 fb 30 27 7d 00 6e 0b 06 59 a2 2f a7 1c 41 90 d7 5b 39 85 15 c9 af 0c df e0 d5 1a c3 7b 00 1d 0f 96 cc 31 14 f8 fd 00 92 38 f0 07 26 68 1f 8a 8f 02 83 09 f8 cc cc 8d 10 e1 e4 34 aa 0f 19 70 c2 8e cc 1c 39 82 4b ab 1f 9a f8 7d 5e 19 dd 82 51 6d 02 c8 68 0d cb 82 19 3d e0 68 3d 30 aa b2 07 f1 03 a3 85 32 be c1 a2 68 3c 24 e9 d6 00 eb 78 77 f8 c7 f3 e6 f9 e9 f9 49 d1 16 aa f8 dc e2 69 8e a0 fd 42 2a 87 f5 62 64 3c c1 2e c0 ac c9 aa 68 99 3c f0 39 1d 83 58 1d 4b 3a 00 96 ae dc 70 b4 e4 a7 ce 65 58 05 b4 fb 8e bc bf 10 3f 36 46 40 70 c5 0c 77 b9 d3 3a eb 0f b1 16 fb 6f 13 4b 51 87 90 96 0d 41 58 63 98 25 73 3f 2c 27 3c fd b0 42 76 1c 0c 01 29 d3 64 e9 c3 21 1c b1 69 b0 ed 3a Data Ascii: ygUrn0GEr0'}nY/A[9{18&h4p9K}^Qmh=h=02h<$xwIiB*bd<.h<9XK:peX?6F@pw:oKQAXc%s?,'<Bv)d!i:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.17	49731	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:21 UTC	652	OUT	GET /ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:21 UTC	818	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:21 GMT Content-Type: application/x-javascript Content-Length: 40454 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 26 Feb 2021 06:13:13 GMT ETag: 0x8D8DA1D997CA245 x-ms-request-id: 5226ad3e-b01e-000f-13eb-238a97000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153521Z-r197bdfb6b4kq4j5t834fh90qn0000000b20000000007nbw x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 15:35:21 UTC	15566	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bc bd 7b 7b db c6 b5 37 fa ff 79 9e f3 1d 44 34 65 01 73 48 91 76 93 77 17 14 c2 c7 91 9d c4 6d ee 72 9a a4 14 93 07 26 87 12 62 0a 60 00 50 b2 22 72 7f f6 b3 7e 6b 2e 18 5c 28 a7 dd fb 3d 6e 23 e2 32 98 eb 9a 35 eb be 4e 9f f4 4e 7e fd 76 27 f3 fb 93 db 67 a3 0f 47 93 93 fd 89 bf 0c 4e fe 7e 71 f2 69 b6 4b 57 71 99 64 e9 49 9c ae 4e b2 f2 5a e6 27 cb 2c 2d f3 e4 cd ae cc f2 82 8a fe fa 1b 3e 1d 65 f9 d5 e9 26 59 ca b4 90 27 4f 4e ff df ff a7 b7 de a5 4b 7c e9 4b 51 06 0f de 8e 9e 17 f4 dd b2 f4 a6 5e f6 e6 57 49 17 51 54 de 6f 65 b6 3e b9 c9 56 bb 8d ec f7 8f bc 18 c9 77 db 2c 2f 8b 59 fd 36 92 a3 55 b6 dc dd c8 b4 9c 95 d4 4c 6f 1c 84 55 ab c1 43 b2 f6 7b 55 91 a0 bc ce b3 bb 93 54 de 9d bc cc f3 2c f7 3d 3d e8 5c fe b6 4b Data Ascii: {{7yD4esHvwmr&b`P"r~k.\(=n#25NN~v'gGN~qiKWqdINZ',->e&Y'ONK\|KQ^WIQToe>Vw,/Y6ULoUC{UT,==\K
2024-10-24 15:35:21 UTC	16384	IN	Data Raw: 6a 37 f6 54 a3 53 80 b3 8b 66 36 d9 40 66 71 a7 f6 7e 7d 00 14 84 9b 6a 1d b2 83 5d d2 8d da ac bb b3 f2 bd 5f 19 87 ca 1d c8 fc 82 69 71 c0 49 8d 1e 0f 1e ba 8d 49 5b bc 03 11 00 0f 32 25 34 62 ec 48 9b 76 a5 6c df c9 61 61 5c 4f 16 6d 24 85 0d 90 a4 90 0a ba 89 4a bb de d5 f4 93 8f 7e de 7e 43 e8 ad 69 d7 7a 6c 7c 9a e7 7d cf 90 ee f2 a4 34 d7 8a e3 52 19 21 e0 4f da 1d 6b 64 6e cd 83 17 33 19 e2 a0 d0 33 c9 66 73 1a 23 84 0f b0 32 47 ba a8 4f 76 6f b4 55 ae 60 10 0e 1f 98 80 ec b0 a1 44 87 91 13 40 37 b4 d5 48 aa 34 21 34 e9 20 41 05 10 f7 96 c2 e8 33 e8 8e a3 2d aa ed 01 1e 4d 20 eb b9 66 38 fe ef b4 42 4d 8c 0f 95 18 bd c3 1a d4 e0 87 7f b3 11 7d 8a da 76 f6 7b 7e 1f f3 c9 fd 46 d2 fe 96 bb 54 4d ac 8b e5 ea 3d 30 88 5a 6a 6c 07 89 41 0d 86 d8 08 b6 Data Ascii: j7TSf6@fq~}j]_iqII[2%4bHvlaa\Om$J~~Cizl\|}4R!Okdn33fs#2GOvoU`D@7H4!4 A3-M f8BM}v{~FTM=0ZjlA
2024-10-24 15:35:21 UTC	8504	IN	Data Raw: a5 da 9a ae bd 98 27 04 15 a8 2a 4f 3d 22 ae 4c 5d f9 d4 34 8c 4a 81 1e db 57 05 e0 ac a0 50 43 d2 44 ce f7 89 56 6d 0d 9b 69 97 3f aa 42 f7 b4 6e d7 ad b4 df b9 b7 e5 f3 cd ce e6 e0 e1 cd 32 29 b4 db de 85 65 06 2f 09 f8 19 f7 2b f1 a3 6b 0c cd a5 e2 67 54 0f 68 a1 69 00 12 9f c2 02 6b ee 4a 0d 61 0f d4 18 0c 16 31 06 cd 07 ba f5 30 5f 9a b7 d5 05 e0 ac d4 1c 1c 7a d5 26 bf 1c a0 ae d1 0c 13 8a 4b 75 ab f9 e8 4d 65 f5 de 34 c1 4a 05 24 f3 e2 99 3d b5 67 66 58 d2 9a bd 17 df 0d 1a cb af b2 a4 15 8e f4 5e 86 b4 1c a6 ea a8 7e a8 99 7e 15 a9 cf 73 11 a1 3a 27 dc 8d da 1f 47 73 dd 32 1d 07 fc b4 8a d2 ea 08 62 72 58 a4 e7 f4 6e 2f 87 e9 6c 9d 10 86 76 6b 7c ee 9e 0b 77 e3 a8 c0 68 83 95 3d 51 6b 2e 39 99 ee 01 3a 00 dc 2a af c4 f9 de 56 18 b3 b8 3b 3e 5f 41 Data Ascii: 'O="L]4JWPCDVmi?Bn2)e/+kgThikJa10_z&KuMe4J$=gfX^~~s:'Gs2brXn/lvk\|wh=Qk.9:V;>_A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.17	49729	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:21 UTC	429	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:21 UTC	791	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:21 GMT Content-Type: application/x-javascript Content-Length: 16326 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Tue, 27 Aug 2024 20:17:04 GMT ETag: 0x8DCC6D537C7BF24 x-ms-request-id: 2dfa8e1f-201e-0006-1f47-228756000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153521Z-17fbfdc98bbq2x5bzrteug30v800000007g000000000507h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:21 UTC	15593	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 dd 7d 4d 73 23 c7 92 d8 dd bf 02 0f cf f1 86 5c f5 40 f8 e0 27 46 d0 18 04 c0 19 ec 90 00 04 80 43 29 24 19 d1 04 8a 60 bf 01 ba b1 dd 8d e1 f0 51 e3 78 37 1f f6 e0 ab 7d f3 c1 27 1f 7d f1 dd 3f 65 23 d6 bf c3 f9 51 55 5d d5 dd 00 c8 91 56 6f d7 0a c5 10 dd f5 95 95 95 95 95 99 95 99 fd 87 db b5 3f 8d bd c0 df 13 fb 8f ea 77 21 d8 f3 f7 1f bd db 3d ef 47 ff e7 fd 50 c4 eb d0 2f e0 ef 92 f8 b4 0a c2 38 7a f5 d1 0d 0b 71 03 5f 35 1e e5 bb fa e3 67 c7 9b d5 7d 67 11 b8 33 31 ab ff a1 f2 f9 95 6c 2a b0 e9 d4 5d 2c f6 62 d5 83 13 3b c9 ef 60 1f 1e b8 59 e3 0f e5 a4 e0 33 0e e3 35 1e 75 47 41 69 d9 10 4e 50 9a 36 3c f8 77 d5 28 16 9d 60 af bc ff 79 ef c7 64 1a 4e e0 78 00 fc 5e 75 9f a0 f4 1b de 5e 05 fa 87 3f 87 fb 4e 08 7f 8e f6 Data Ascii: }Ms#\@'FC)$`Qx7}'}?e#QU]Vo?w!=GP/8zq_5g}g31l*],b;`Y35uGAiNP6<w(`ydNx^u^?N
2024-10-24 15:35:21 UTC	733	IN	Data Raw: c0 f5 c3 79 67 55 de 72 6e 30 47 45 07 e2 e0 a1 a2 03 90 e8 a9 c6 72 0b fd 96 e1 b7 f4 fb 30 27 7d 00 6e 0b 06 59 a2 2f a7 1c 41 90 d7 5b 39 85 15 c9 af 0c df e0 d5 1a c3 7b 00 1d 0f 96 cc 31 14 f8 fd 00 92 38 f0 07 26 68 1f 8a 8f 02 83 09 f8 cc cc 8d 10 e1 e4 34 aa 0f 19 70 c2 8e cc 1c 39 82 4b ab 1f 9a f8 7d 5e 19 dd 82 51 6d 02 c8 68 0d cb 82 19 3d e0 68 3d 30 aa b2 07 f1 03 a3 85 32 be c1 a2 68 3c 24 e9 d6 00 eb 78 77 f8 c7 f3 e6 f9 e9 f9 49 d1 16 aa f8 dc e2 69 8e a0 fd 42 2a 87 f5 62 64 3c c1 2e c0 ac c9 aa 68 99 3c f0 39 1d 83 58 1d 4b 3a 00 96 ae dc 70 b4 e4 a7 ce 65 58 05 b4 fb 8e bc bf 10 3f 36 46 40 70 c5 0c 77 b9 d3 3a eb 0f b1 16 fb 6f 13 4b 51 87 90 96 0d 41 58 63 98 25 73 3f 2c 27 3c fd b0 42 76 1c 0c 01 29 d3 64 e9 c3 21 1c b1 69 b0 ed 3a Data Ascii: ygUrn0GEr0'}nY/A[9{18&h4p9K}^Qmh=h=02h<$xwIiB*bd<.h<9XK:peX?6F@pw:oKQAXc%s?,'<Bv)d!i:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.17	49730	152.199.21.175	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:21 UTC	637	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_QLF_8apNRJD3OCol8jwtxw2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:21 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 1867801 Cache-Control: public, max-age=31536000 Content-MD5: 0mJaO3qA+eD2v9j9vu2xZA== Content-Type: application/x-javascript Date: Thu, 24 Oct 2024 15:35:21 GMT Etag: 0x8DCE31CBFE0A3E9 Last-Modified: Wed, 02 Oct 2024 19:59:39 GMT Server: ECAcc (lhc/789E) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: c5df7839-701e-00c1-4e2d-15f32c000000 x-ms-version: 2009-09-19 Content-Length: 449728 Connection: close
2024-10-24 15:35:22 UTC	16383	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-10-24 15:35:22 UTC	16383	IN	Data Raw: 44 49 4e 47 5f 4e 4f 54 5f 41 4c 4c 4f 57 45 44 3a 22 38 30 30 34 37 38 44 37 22 2c 50 50 5f 45 5f 49 44 50 5f 42 49 4e 44 49 4e 47 5f 45 58 49 53 54 53 5f 53 41 4d 53 55 4e 47 3a 22 38 30 30 34 34 35 33 45 22 2c 50 50 5f 45 5f 54 52 41 4e 53 46 45 52 5f 54 4f 4b 45 4e 5f 49 4e 56 41 4c 49 44 5f 53 45 53 53 49 4f 4e 3a 22 38 30 30 34 33 35 41 30 22 7d 2c 6e 2e 45 73 74 73 45 72 72 6f 72 3d 7b 55 73 65 72 41 63 63 6f 75 6e 74 53 65 6c 65 63 74 69 6f 6e 49 6e 76 61 6c 69 64 3a 22 31 36 30 30 31 22 2c 55 73 65 72 55 6e 61 75 74 68 6f 72 69 7a 65 64 3a 22 35 30 30 32 30 22 2c 55 73 65 72 55 6e 61 75 74 68 6f 72 69 7a 65 64 41 70 69 56 65 72 73 69 6f 6e 4e 6f 74 53 75 70 70 6f 72 74 65 64 3a 22 35 30 30 32 30 31 22 2c 55 73 65 72 55 6e 61 75 74 68 6f 72 69 7a Data Ascii: DING_NOT_ALLOWED:"800478D7",PP_E_IDP_BINDING_EXISTS_SAMSUNG:"8004453E",PP_E_TRANSFER_TOKEN_INVALID_SESSION:"800435A0"},n.EstsError={UserAccountSelectionInvalid:"16001",UserUnauthorized:"50020",UserUnauthorizedApiVersionNotSupported:"500201",UserUnauthoriz
2024-10-24 15:35:22 UTC	16383	IN	Data Raw: 64 6f 63 75 6d 65 6e 74 2e 64 65 66 61 75 6c 74 56 69 65 77 2e 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 65 2c 6e 75 6c 6c 29 3a 65 2e 63 75 72 72 65 6e 74 53 74 79 6c 65 3f 65 2e 63 75 72 72 65 6e 74 53 74 79 6c 65 3a 7b 7d 7d 2c 68 69 73 74 6f 72 79 3a 7b 70 75 73 68 53 74 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 54 2e 69 73 48 69 73 74 6f 72 79 53 75 70 70 6f 72 74 65 64 28 29 26 26 75 2e 68 69 73 74 6f 72 79 2e 70 75 73 68 53 74 61 74 65 28 65 2c 6e 29 7d 2c 72 65 70 6c 61 63 65 53 74 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 54 2e 69 73 48 69 73 74 6f 72 79 53 75 70 70 6f 72 74 65 64 28 29 26 26 75 2e 68 69 73 74 6f 72 79 2e 72 65 70 6c 61 63 65 53 74 61 74 65 28 65 2c 6e 29 7d 7d 2c 61 64 64 45 76 65 6e 74 4c 69 73 Data Ascii: document.defaultView.getComputedStyle(e,null):e.currentStyle?e.currentStyle:{}},history:{pushState:function(e,n){T.isHistorySupported()&&u.history.pushState(e,n)},replaceState:function(e,n){T.isHistorySupported()&&u.history.replaceState(e,n)}},addEventLis
2024-10-24 15:35:22 UTC	3	IN	Data Raw: 74 50 72 Data Ascii: tPr
2024-10-24 15:35:22 UTC	16383	IN	Data Raw: 6f 70 65 72 74 79 4c 6f 67 4f 70 74 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 72 65 74 75 72 6e 28 6e 3d 6e 7c 7c 7b 7d 29 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 74 72 61 63 69 6e 67 50 72 6f 70 65 72 74 79 43 68 61 6e 67 65 22 29 7c 7c 28 6e 2e 74 72 61 63 69 6e 67 50 72 6f 70 65 72 74 79 43 68 61 6e 67 65 3d 21 30 29 2c 6e 2e 65 76 65 6e 74 4c 65 76 65 6c 3d 6e 2e 65 76 65 6e 74 4c 65 76 65 6c 7c 7c 69 2e 45 76 65 6e 74 4c 65 76 65 6c 2e 49 6e 66 6f 2c 7b 76 69 65 77 4d 6f 64 65 6c 3a 65 2c 74 72 61 63 69 6e 67 4f 70 74 69 6f 6e 73 3a 6e 7d 7d 2c 73 2e 67 65 74 44 65 66 61 75 6c 74 54 65 78 74 42 6f 78 50 72 6f 70 65 72 74 79 4c 6f 67 4f 70 74 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 72 65 74 75 72 6e 28 6e 3d 6e 7c Data Ascii: opertyLogOption=function(e,n){return(n=n\|\|{}).hasOwnProperty("tracingPropertyChange")\|\|(n.tracingPropertyChange=!0),n.eventLevel=n.eventLevel\|\|i.EventLevel.Info,{viewModel:e,tracingOptions:n}},s.getDefaultTextBoxPropertyLogOption=function(e,n){return(n=n\|
2024-10-24 15:35:22 UTC	16383	IN	Data Raw: 20 6e 3d 65 2e 75 73 65 72 6e 61 6d 65 7c 7c 22 22 2c 74 3d 65 2e 66 6c 6f 77 54 6f 6b 65 6e 7c 7c 22 22 2c 69 3d 65 2e 70 75 72 70 6f 73 65 7c 7c 63 2e 50 61 73 73 77 6f 72 64 2c 61 3d 65 2e 70 72 6f 6f 66 54 79 70 65 2c 6f 3d 65 2e 70 72 6f 6f 66 44 61 74 61 7c 7c 22 22 2c 72 3d 65 2e 69 73 45 6e 63 72 79 70 74 65 64 2c 73 3d 65 2e 75 69 4d 6f 64 65 2c 64 3d 65 2e 6c 63 69 64 2c 6c 3d 65 2e 70 68 6f 6e 65 43 6f 75 6e 74 72 79 7c 7c 22 22 2c 70 3d 65 2e 70 68 6f 6e 65 43 6f 75 6e 74 72 79 43 6f 64 65 7c 7c 22 22 2c 6d 3d 65 2e 75 6e 61 75 74 68 53 65 73 73 69 6f 6e 49 64 2c 62 3d 65 2e 70 72 6f 6f 66 43 6f 6e 66 69 72 6d 61 74 69 6f 6e 2c 76 3d 65 2e 63 61 6e 61 72 79 46 6c 6f 77 54 6f 6b 65 6e 3b 74 68 69 73 5b 75 2e 55 73 65 72 6e 61 6d 65 5d 3d 6e 2c Data Ascii: n=e.username\|\|"",t=e.flowToken\|\|"",i=e.purpose\|\|c.Password,a=e.proofType,o=e.proofData\|\|"",r=e.isEncrypted,s=e.uiMode,d=e.lcid,l=e.phoneCountry\|\|"",p=e.phoneCountryCode\|\|"",m=e.unauthSessionId,b=e.proofConfirmation,v=e.canaryFlowToken;this[u.Username]=n,
2024-10-24 15:35:22 UTC	16383	IN	Data Raw: 2e 72 65 6d 6f 76 65 28 74 2c 22 6c 6f 67 69 6e 5f 68 69 6e 74 22 29 3b 76 61 72 20 69 3d 70 65 3f 67 2e 63 6c 6f 6e 65 28 70 65 29 3a 6e 75 6c 6c 3b 72 65 74 75 72 6e 20 6e 26 26 28 6e 2e 49 66 45 78 69 73 74 73 52 65 73 75 6c 74 3d 3d 3d 53 2e 4e 6f 74 45 78 69 73 74 7c 7c 6e 2e 49 73 55 6e 6d 61 6e 61 67 65 64 26 26 6e 2e 49 66 45 78 69 73 74 73 52 65 73 75 6c 74 3d 3d 3d 53 2e 45 78 69 73 74 73 29 26 26 6f 6e 28 65 2c 6e 29 26 26 28 69 3f 69 2e 75 6e 73 61 66 65 5f 75 73 65 72 6e 61 6d 65 3d 65 3a 28 74 3d 70 2e 61 70 70 65 6e 64 4f 72 52 65 70 6c 61 63 65 28 74 2c 22 75 73 65 72 6e 61 6d 65 22 2c 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 29 29 2c 74 3d 70 2e 61 70 70 65 6e 64 4f 72 52 65 70 6c 61 63 65 28 74 2c 22 6c 6f 67 69 6e 5f Data Ascii: .remove(t,"login_hint");var i=pe?g.clone(pe):null;return n&&(n.IfExistsResult===S.NotExist\|\|n.IsUnmanaged&&n.IfExistsResult===S.Exists)&&on(e,n)&&(i?i.unsafe_username=e:(t=p.appendOrReplace(t,"username",encodeURIComponent(e)),t=p.appendOrReplace(t,"login_
2024-10-24 15:35:22 UTC	16383	IN	Data Raw: 65 72 74 69 66 69 63 61 74 65 49 6e 74 65 72 73 74 69 74 69 61 6c 56 69 65 77 2c 49 3d 74 2e 66 49 73 50 61 73 73 6b 65 79 53 75 70 70 6f 72 74 45 6e 61 62 6c 65 64 2c 41 3d 74 2e 66 49 73 56 65 72 69 66 69 61 62 6c 65 43 72 65 64 65 6e 74 69 61 6c 73 53 75 70 70 6f 72 74 45 6e 61 62 6c 65 64 2c 52 3d 74 2e 66 55 73 65 57 65 62 76 69 65 77 46 69 64 6f 43 75 73 74 6f 6d 50 72 6f 74 6f 63 6f 6c 2c 4c 3d 5b 5d 2c 42 3d 6e 75 6c 6c 2c 4f 3d 69 2e 6f 62 73 65 72 76 61 62 6c 65 28 29 3b 66 75 6e 63 74 69 6f 6e 20 46 28 65 29 7b 4e 28 65 29 2c 6e 2e 6f 6e 53 65 74 50 65 6e 64 69 6e 67 52 65 71 75 65 73 74 28 21 31 29 2c 6e 2e 6f 6e 53 77 69 74 63 68 56 69 65 77 28 67 2e 4f 6e 65 54 69 6d 65 43 6f 64 65 2c 21 31 2c 42 29 7d 66 75 6e 63 74 69 6f 6e 20 55 28 65 29 Data Ascii: ertificateInterstitialView,I=t.fIsPasskeySupportEnabled,A=t.fIsVerifiableCredentialsSupportEnabled,R=t.fUseWebviewFidoCustomProtocol,L=[],B=null,O=i.observable();function F(e){N(e),n.onSetPendingRequest(!1),n.onSwitchView(g.OneTimeCode,!1,B)}function U(e)
2024-10-24 15:35:22 UTC	16383	IN	Data Raw: 5d 3b 72 65 74 75 72 6e 20 6f 2e 66 6f 72 45 61 63 68 28 6e 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 61 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 66 6f 72 28 76 61 72 20 74 3d 30 3b 74 3c 6e 2e 6c 65 6e 67 74 68 3b 74 2b 2b 29 69 66 28 6e 5b 74 5d 2e 6e 61 6d 65 3d 3d 3d 65 2e 6e 61 6d 65 26 26 6e 5b 74 5d 2e 69 64 70 3d 3d 3d 65 2e 69 64 70 29 72 65 74 75 72 6e 20 74 3b 72 65 74 75 72 6e 2d 31 7d 28 6e 2c 65 29 3b 2d 31 3d 3d 3d 61 3f 28 6e 2e 69 73 57 69 6e 64 6f 77 73 53 73 6f 3f 65 2e 75 6e 73 68 69 66 74 28 6e 29 3a 65 2e 70 75 73 68 28 6e 29 2c 69 2e 70 75 73 68 28 6e 29 29 3a 6e 2e 69 73 57 69 6e 64 6f 77 73 53 73 6f 3f 28 65 2e 73 70 6c 69 63 65 28 61 2c 31 29 2c 65 2e 75 6e 73 68 69 66 74 28 6e 29 2c 69 2e 70 75 73 68 28 6e 29 29 Data Ascii: ];return o.forEach(n,(function(n){var a=function(e,n){for(var t=0;t<n.length;t++)if(n[t].name===e.name&&n[t].idp===e.idp)return t;return-1}(n,e);-1===a?(n.isWindowsSso?e.unshift(n):e.push(n),i.push(n)):n.isWindowsSso?(e.splice(a,1),e.unshift(n),i.push(n))
2024-10-24 15:35:22 UTC	16383	IN	Data Raw: 7b 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 65 29 7b 28 6e 65 77 20 49 6d 61 67 65 29 2e 73 72 63 3d 65 7d 7d 28 65 2e 75 72 6c 49 50 76 36 45 78 70 65 72 69 6d 65 6e 74 29 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 65 2e 66 55 70 67 72 61 64 65 45 56 43 65 72 74 26 26 6e 75 6c 6c 21 3d 3d 6e 65 77 20 52 65 67 45 78 70 28 22 57 69 6e 64 6f 77 73 20 4e 54 20 28 5b 30 2d 39 5d 7b 31 2c 7d 5b 2e 30 2d 39 5d 7b 30 2c 7d 29 22 29 2e 65 78 65 63 28 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 29 26 26 70 61 72 73 65 46 6c 6f 61 74 28 52 65 67 45 78 70 2e 24 31 29 3c 36 26 26 70 2e 67 65 74 49 45 56 65 72 73 69 6f 6e 28 29 3e 3d 37 29 74 72 79 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 65 76 22 29 2e 73 Data Ascii: {!function(e){if(e){(new Image).src=e}}(e.urlIPv6Experiment),function(e){if(e.fUpgradeEVCert&&null!==new RegExp("Windows NT ([0-9]{1,}[.0-9]{0,})").exec(navigator.userAgent)&&parseFloat(RegExp.$1)<6&&p.getIEVersion()>=7)try{document.getElementById("ev").s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.17	49732	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:22 UTC	427	OUT	GET /ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:22 UTC	812	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:22 GMT Content-Type: application/x-javascript Content-Length: 40454 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 26 Feb 2021 06:13:13 GMT ETag: 0x8D8DA1D997CA245 x-ms-request-id: aa589e04-601e-0052-4904-26bfbe000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153522Z-17fbfdc98bbh7l5skzh3rekksc00000000n0000000004xk9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:22 UTC	15572	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bc bd 7b 7b db c6 b5 37 fa ff 79 9e f3 1d 44 34 65 01 73 48 91 76 93 77 17 14 c2 c7 91 9d c4 6d ee 72 9a a4 14 93 07 26 87 12 62 0a 60 00 50 b2 22 72 7f f6 b3 7e 6b 2e 18 5c 28 a7 dd fb 3d 6e 23 e2 32 98 eb 9a 35 eb be 4e 9f f4 4e 7e fd 76 27 f3 fb 93 db 67 a3 0f 47 93 93 fd 89 bf 0c 4e fe 7e 71 f2 69 b6 4b 57 71 99 64 e9 49 9c ae 4e b2 f2 5a e6 27 cb 2c 2d f3 e4 cd ae cc f2 82 8a fe fa 1b 3e 1d 65 f9 d5 e9 26 59 ca b4 90 27 4f 4e ff df ff a7 b7 de a5 4b 7c e9 4b 51 06 0f de 8e 9e 17 f4 dd b2 f4 a6 5e f6 e6 57 49 17 51 54 de 6f 65 b6 3e b9 c9 56 bb 8d ec f7 8f bc 18 c9 77 db 2c 2f 8b 59 fd 36 92 a3 55 b6 dc dd c8 b4 9c 95 d4 4c 6f 1c 84 55 ab c1 43 b2 f6 7b 55 91 a0 bc ce b3 bb 93 54 de 9d bc cc f3 2c f7 3d 3d e8 5c fe b6 4b Data Ascii: {{7yD4esHvwmr&b`P"r~k.\(=n#25NN~v'gGN~qiKWqdINZ',->e&Y'ONK\|KQ^WIQToe>Vw,/Y6ULoUC{UT,==\K
2024-10-24 15:35:22 UTC	16384	IN	Data Raw: 80 b3 8b 66 36 d9 40 66 71 a7 f6 7e 7d 00 14 84 9b 6a 1d b2 83 5d d2 8d da ac bb b3 f2 bd 5f 19 87 ca 1d c8 fc 82 69 71 c0 49 8d 1e 0f 1e ba 8d 49 5b bc 03 11 00 0f 32 25 34 62 ec 48 9b 76 a5 6c df c9 61 61 5c 4f 16 6d 24 85 0d 90 a4 90 0a ba 89 4a bb de d5 f4 93 8f 7e de 7e 43 e8 ad 69 d7 7a 6c 7c 9a e7 7d cf 90 ee f2 a4 34 d7 8a e3 52 19 21 e0 4f da 1d 6b 64 6e cd 83 17 33 19 e2 a0 d0 33 c9 66 73 1a 23 84 0f b0 32 47 ba a8 4f 76 6f b4 55 ae 60 10 0e 1f 98 80 ec b0 a1 44 87 91 13 40 37 b4 d5 48 aa 34 21 34 e9 20 41 05 10 f7 96 c2 e8 33 e8 8e a3 2d aa ed 01 1e 4d 20 eb b9 66 38 fe ef b4 42 4d 8c 0f 95 18 bd c3 1a d4 e0 87 7f b3 11 7d 8a da 76 f6 7b 7e 1f f3 c9 fd 46 d2 fe 96 bb 54 4d ac 8b e5 ea 3d 30 88 5a 6a 6c 07 89 41 0d 86 d8 08 b6 f6 64 a4 fa c9 fa Data Ascii: f6@fq~}j]_iqII[2%4bHvlaa\Om$J~~Cizl\|}4R!Okdn33fs#2GOvoU`D@7H4!4 A3-M f8BM}v{~FTM=0ZjlAd
2024-10-24 15:35:22 UTC	8498	IN	Data Raw: 27 04 15 a8 2a 4f 3d 22 ae 4c 5d f9 d4 34 8c 4a 81 1e db 57 05 e0 ac a0 50 43 d2 44 ce f7 89 56 6d 0d 9b 69 97 3f aa 42 f7 b4 6e d7 ad b4 df b9 b7 e5 f3 cd ce e6 e0 e1 cd 32 29 b4 db de 85 65 06 2f 09 f8 19 f7 2b f1 a3 6b 0c cd a5 e2 67 54 0f 68 a1 69 00 12 9f c2 02 6b ee 4a 0d 61 0f d4 18 0c 16 31 06 cd 07 ba f5 30 5f 9a b7 d5 05 e0 ac d4 1c 1c 7a d5 26 bf 1c a0 ae d1 0c 13 8a 4b 75 ab f9 e8 4d 65 f5 de 34 c1 4a 05 24 f3 e2 99 3d b5 67 66 58 d2 9a bd 17 df 0d 1a cb af b2 a4 15 8e f4 5e 86 b4 1c a6 ea a8 7e a8 99 7e 15 a9 cf 73 11 a1 3a 27 dc 8d da 1f 47 73 dd 32 1d 07 fc b4 8a d2 ea 08 62 72 58 a4 e7 f4 6e 2f 87 e9 6c 9d 10 86 76 6b 7c ee 9e 0b 77 e3 a8 c0 68 83 95 3d 51 6b 2e 39 99 ee 01 3a 00 dc 2a af c4 f9 de 56 18 b3 b8 3b 3e 5f 41 a1 45 aa c0 4f 94 Data Ascii: 'O="L]4JWPCDVmi?Bn2)e/+kgThikJa10_z&KuMe4J$=gfX^~~s:'Gs2brXn/lvk\|wh=Qk.9:V;>_AEO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.17	49736	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:25 UTC	641	OUT	GET /ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:25 UTC	811	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:25 GMT Content-Type: application/x-javascript Content-Length: 4880 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 22 Oct 2020 20:43:21 GMT ETag: 0x8D876CB1D67B929 x-ms-request-id: 7c81620e-b01e-002b-45f2-253425000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153525Z-r197bdfb6b4gx6v9pg74w9f47s00000000wg00000000w3du x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 15:35:25 UTC	4880	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 5a 7b 73 db b6 96 ff 5f 9f 02 46 73 1d 32 a2 28 39 af b6 52 58 ad 1b 3b 5b df 6d e3 ac ed 4c 6f 57 52 32 b4 04 4a 4c 29 52 05 c1 d8 1e 4b df 7d 7f 07 00 45 52 56 da dc ee 6c 66 62 e1 79 70 de 0f 80 dd 27 07 ac f3 f5 ff d8 e5 d5 f1 c5 15 3b 7f c3 ae 7e 3a bb 38 61 ef d0 fb 8d bd 3d bf 3a 7b 7d fa f5 70 5a ad ab 45 9c b3 28 4e 04 c3 ef 75 98 8b 19 cb 52 96 49 16 a7 d3 4c ae 32 19 2a 91 b3 25 fe ca 38 4c 58 24 b3 25 53 0b c1 56 32 fb 24 a6 2a 67 49 9c 2b 6c ba 16 49 76 c3 1c 80 93 33 f6 2e 94 ea 8e 9d bd 73 7d 76 85 b5 99 8c e7 71 8a dd d3 6c 75 87 f6 42 b1 34 53 f1 54 b0 30 9d 69 68 09 3a 69 2e 58 91 ce 84 64 37 8b 78 ba 60 bf c4 53 99 e5 59 a4 98 14 53 11 7f c6 21 79 81 f1 e6 11 1e 0b a5 60 b9 50 2c ca a4 5a 18 3c 7c 76 49 Data Ascii: Z{s_Fs2(9RX;[mLoWR2JL)RK}ERVlfbyp';~:8a=:{}pZE(NuRIL2%8LX$%SV2$gI+lIv3.s}vqluB4ST0ih:i.Xd7x`SYS!y`P,Z<\|vI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.17	49735	152.199.21.175	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:25 UTC	412	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_QLF_8apNRJD3OCol8jwtxw2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:25 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 1867805 Cache-Control: public, max-age=31536000 Content-MD5: 0mJaO3qA+eD2v9j9vu2xZA== Content-Type: application/x-javascript Date: Thu, 24 Oct 2024 15:35:25 GMT Etag: 0x8DCE31CBFE0A3E9 Last-Modified: Wed, 02 Oct 2024 19:59:39 GMT Server: ECAcc (lhc/789E) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: c5df7839-701e-00c1-4e2d-15f32c000000 x-ms-version: 2009-09-19 Content-Length: 449728 Connection: close
2024-10-24 15:35:25 UTC	15652	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-10-24 15:35:26 UTC	16383	IN	Data Raw: 48 45 4e 54 49 43 41 54 45 44 3a 22 38 30 30 34 35 35 33 38 22 2c 50 50 5f 45 5f 48 49 50 5f 56 41 4c 49 44 41 54 49 4f 4e 5f 45 52 52 4f 52 5f 4f 54 48 45 52 3a 22 38 30 30 34 35 35 33 39 22 2c 50 50 5f 45 5f 53 51 5f 43 4f 4e 54 41 49 4e 53 5f 50 41 53 53 57 4f 52 44 3a 22 38 30 30 34 33 34 31 45 22 2c 50 50 5f 45 5f 53 41 5f 43 4f 4e 54 41 49 4e 53 5f 50 41 53 53 57 4f 52 44 3a 22 38 30 30 34 33 34 31 43 22 2c 50 50 5f 45 5f 53 41 5f 43 4f 4e 54 41 49 4e 45 44 5f 49 4e 5f 50 41 53 53 57 4f 52 44 3a 22 38 30 30 34 33 34 31 44 22 2c 50 50 5f 45 5f 4c 49 42 50 48 4f 4e 45 4e 55 4d 42 45 52 49 4e 54 45 52 4f 50 5f 4e 55 4d 42 45 52 50 41 52 53 45 5f 45 58 43 45 50 54 49 4f 4e 3a 22 38 30 30 34 33 35 31 30 22 2c 50 50 5f 45 5f 53 54 52 4f 4e 47 50 52 4f 43 Data Ascii: HENTICATED:"80045538",PP_E_HIP_VALIDATION_ERROR_OTHER:"80045539",PP_E_SQ_CONTAINS_PASSWORD:"8004341E",PP_E_SA_CONTAINS_PASSWORD:"8004341C",PP_E_SA_CONTAINED_IN_PASSWORD:"8004341D",PP_E_LIBPHONENUMBERINTEROP_NUMBERPARSE_EXCEPTION:"80043510",PP_E_STRONGPROC
2024-10-24 15:35:26 UTC	16383	IN	Data Raw: 28 29 29 7d 66 6f 72 28 76 61 72 20 61 3d 30 3b 61 3c 6e 2e 6c 65 6e 67 74 68 3b 61 2b 2b 29 7b 76 61 72 20 6f 3d 6e 5b 61 5d 2e 73 70 6c 69 74 28 22 2c 22 29 2e 6d 61 70 28 4e 75 6d 62 65 72 29 2c 72 3d 6f 5b 30 5d 2c 73 3d 6f 5b 31 5d 2c 63 3d 6f 5b 32 5d 3b 69 66 28 69 28 65 2c 72 2c 73 2c 63 29 29 72 65 74 75 72 6e 21 30 7d 72 65 74 75 72 6e 21 21 6c 2e 66 69 72 73 74 28 74 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 6e 3d 3d 3d 65 2e 74 72 69 6d 28 29 7d 29 29 7d 69 66 28 54 2e 69 73 48 69 67 68 43 6f 6e 74 72 61 73 74 28 29 29 7b 76 61 72 20 6e 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 62 6f 64 79 22 29 5b 30 5d 2c 74 3d 54 2e 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 Data Ascii: ())}for(var a=0;a<n.length;a++){var o=n[a].split(",").map(Number),r=o[0],s=o[1],c=o[2];if(i(e,r,s,c))return!0}return!!l.first(t,(function(n){return n===e.trim()}))}if(T.isHighContrast()){var n=document.getElementsByTagName("body")[0],t=T.getComputedStyle(
2024-10-24 15:35:26 UTC	16383	IN	Data Raw: 4a 53 4f 4e 2c 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 4a 53 4f 4e 7d 28 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 76 61 72 20 69 3d 74 28 38 29 2c 61 3d 74 28 32 33 29 2c 6f 3d 74 28 33 29 2c 72 3d 74 28 35 29 3b 66 75 6e 63 74 69 6f 6e 20 73 28 65 29 7b 76 61 72 20 6e 2c 73 3d 74 68 69 73 2c 63 3d 6f 2e 44 61 74 65 54 69 6d 65 2e 67 65 74 43 75 72 72 65 6e 74 54 69 6d 65 28 29 2c 64 3d 65 26 26 65 2e 66 45 6e 61 62 6c 65 43 6c 69 65 6e 74 54 65 6c 65 6d 65 74 72 79 26 26 65 2e 69 43 6c 69 65 6e 74 4c 6f 67 4c 65 76 65 6c 2c 6c 3d 6e 75 6c 6c 3b 66 75 6e 63 74 69 6f 6e 20 75 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6c 29 72 65 74 75 72 6e 20 6c 5b 65 5d 2e 61 70 70 6c 79 28 6c 2c 61 72 67 75 6d 65 6e Data Ascii: JSON,module.exports=JSON}()},function(e,n,t){var i=t(8),a=t(23),o=t(3),r=t(5);function s(e){var n,s=this,c=o.DateTime.getCurrentTime(),d=e&&e.fEnableClientTelemetry&&e.iClientLogLevel,l=null;function u(e){return function(){if(l)return l[e].apply(l,argumen
2024-10-24 15:35:26 UTC	16383	IN	Data Raw: 22 50 72 6f 6f 66 43 6f 6e 66 69 72 6d 61 74 69 6f 6e 22 7d 2c 70 3d 6e 2e 53 74 61 74 75 73 3d 7b 4e 6f 6e 65 3a 30 2c 45 72 72 6f 72 3a 32 30 30 2c 53 75 63 63 65 73 73 3a 32 30 31 2c 48 49 50 45 72 72 6f 72 3a 32 30 32 2c 46 54 45 72 72 6f 72 3a 32 30 33 2c 49 6e 70 75 74 45 72 72 6f 72 3a 32 30 34 2c 44 65 73 74 69 6e 61 74 69 6f 6e 45 72 72 6f 72 3a 32 30 35 2c 54 69 6d 65 6f 75 74 3a 33 30 30 7d 2c 66 3d 6e 2e 50 72 6f 6f 66 54 79 70 65 54 6f 43 68 61 6e 6e 65 6c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 6e 75 6c 6c 3b 73 77 69 74 63 68 28 65 29 7b 63 61 73 65 20 50 52 4f 4f 46 2e 54 79 70 65 2e 53 4d 53 3a 6e 3d 64 2e 4d 6f 62 69 6c 65 53 6d 73 3b 62 72 65 61 6b 3b 63 61 73 65 20 50 52 4f 4f 46 2e 54 79 70 65 2e 56 6f 69 63 65 3a 6e Data Ascii: "ProofConfirmation"},p=n.Status={None:0,Error:200,Success:201,HIPError:202,FTError:203,InputError:204,DestinationError:205,Timeout:300},f=n.ProofTypeToChannel=function(e){var n=null;switch(e){case PROOF.Type.SMS:n=d.MobileSms;break;case PROOF.Type.Voice:n
2024-10-24 15:35:26 UTC	16383	IN	Data Raw: 69 66 28 53 65 5b 50 52 4f 4f 46 2e 54 79 70 65 2e 45 6d 61 69 6c 5d 26 26 53 65 5b 50 52 4f 4f 46 2e 54 79 70 65 2e 53 4d 53 5d 26 26 53 65 5b 50 52 4f 4f 46 2e 54 79 70 65 2e 56 6f 69 63 65 5d 29 7b 76 61 72 20 66 3d 71 65 28 65 2c 21 30 2c 6e 29 3b 66 2e 6c 65 6e 67 74 68 3e 30 26 26 28 63 2e 41 72 72 61 79 2e 66 6f 72 45 61 63 68 28 66 2c 4b 65 29 2c 70 3d 70 2e 63 6f 6e 63 61 74 28 66 29 29 7d 72 65 74 75 72 6e 20 70 7d 66 75 6e 63 74 69 6f 6e 20 59 65 28 65 2c 6e 29 7b 76 61 72 20 74 3d 5b 5d 3b 69 66 28 53 65 5b 50 52 4f 4f 46 2e 54 79 70 65 2e 45 6d 61 69 6c 5d 26 26 53 65 5b 50 52 4f 4f 46 2e 54 79 70 65 2e 53 4d 53 5d 26 26 53 65 5b 50 52 4f 4f 46 2e 54 79 70 65 2e 56 6f 69 63 65 5d 29 7b 76 61 72 20 69 3d 71 65 28 65 2c 21 31 2c 6e 29 3b 69 2e Data Ascii: if(Se[PROOF.Type.Email]&&Se[PROOF.Type.SMS]&&Se[PROOF.Type.Voice]){var f=qe(e,!0,n);f.length>0&&(c.Array.forEach(f,Ke),p=p.concat(f))}return p}function Ye(e,n){var t=[];if(Se[PROOF.Type.Email]&&Se[PROOF.Type.SMS]&&Se[PROOF.Type.Voice]){var i=qe(e,!1,n);i.
2024-10-24 15:35:26 UTC	16383	IN	Data Raw: 6e 2e 74 72 61 63 69 6e 67 4f 70 74 69 6f 6e 73 29 2c 65 7d 2c 65 2e 65 78 74 65 6e 64 65 72 73 2e 6c 6f 61 64 49 6d 61 67 65 46 72 6f 6d 55 72 6c 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 65 2e 70 75 72 65 43 6f 6d 70 75 74 65 64 28 7b 72 65 61 64 3a 6e 2c 77 72 69 74 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 6e 28 29 21 3d 3d 65 29 69 66 28 65 29 7b 76 61 72 20 74 3d 6e 65 77 20 49 6d 61 67 65 3b 74 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 28 65 29 7d 2c 74 2e 73 72 63 3d 65 7d 65 6c 73 65 20 6e 28 65 29 7d 7d 29 2e 65 78 74 65 6e 64 28 7b 6e 6f 74 69 66 79 3a 22 61 6c 77 61 79 73 22 7d 29 7d 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 76 61 72 20 69 3d 74 28 32 29 2c 61 3d 74 28 31 29 2c 6f 3d Data Ascii: n.tracingOptions),e},e.extenders.loadImageFromUrl=function(n){return e.pureComputed({read:n,write:function(e){if(n()!==e)if(e){var t=new Image;t.onload=function(){n(e)},t.src=e}else n(e)}}).extend({notify:"always"})}}},function(e,n,t){var i=t(2),a=t(1),o=
2024-10-24 15:35:26 UTC	16383	IN	Data Raw: 6e 3a 20 46 6c 6f 77 20 49 44 73 20 6e 6f 74 20 6b 6e 6f 77 6e 2e 22 7d 28 29 3b 6f 2e 43 61 6e 61 72 79 3d 74 3b 76 61 72 20 76 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 66 29 72 65 74 75 72 6e 7b 61 63 74 69 6f 6e 3a 64 2e 52 65 64 69 72 65 63 74 2c 72 65 64 69 72 65 63 74 55 72 6c 3a 67 2c 72 65 64 69 72 65 63 74 50 6f 73 74 50 61 72 61 6d 73 3a 6d 2c 69 73 49 64 70 52 65 64 69 72 65 63 74 3a 21 31 7d 3b 72 65 74 75 72 6e 7b 61 63 74 69 6f 6e 3a 64 2e 53 77 69 74 63 68 56 69 65 77 7d 7d 28 29 3b 6e 65 77 20 69 28 7b 63 68 65 63 6b 41 70 69 43 61 6e 61 72 79 3a 21 31 2c 77 69 74 68 43 72 65 64 65 6e 74 69 61 6c 73 3a 21 30 7d 29 2e 4a 73 6f 6e 28 7b 75 72 6c 3a 75 2c 65 76 65 6e 74 49 64 3a 72 2e 45 76 65 6e 74 49 64 73 2e 41 70 69 5f 43 61 6e 61 72 Data Ascii: n: Flow IDs not known."}();o.Canary=t;var v=function(){if(f)return{action:d.Redirect,redirectUrl:g,redirectPostParams:m,isIdpRedirect:!1};return{action:d.SwitchView}}();new i({checkApiCanary:!1,withCredentials:!0}).Json({url:u,eventId:r.EventIds.Api_Canar
2024-10-24 15:35:26 UTC	16383	IN	Data Raw: 34 29 2c 72 3d 77 69 6e 64 6f 77 3b 66 75 6e 63 74 69 6f 6e 20 73 28 65 29 7b 76 61 72 20 6e 3d 65 2e 69 73 50 6c 61 74 66 6f 72 6d 41 75 74 68 65 6e 74 69 63 61 74 6f 72 41 76 61 69 6c 61 62 6c 65 3b 74 68 69 73 2e 69 73 50 6c 61 74 66 6f 72 6d 41 75 74 68 65 6e 74 69 63 61 74 6f 72 41 76 61 69 6c 61 62 6c 65 3d 6e 2c 74 68 69 73 2e 6f 6e 52 65 67 69 73 74 65 72 44 69 61 6c 6f 67 3d 6f 2e 63 72 65 61 74 65 28 29 2c 74 68 69 73 2e 6f 6e 55 6e 72 65 67 69 73 74 65 72 44 69 61 6c 6f 67 3d 6f 2e 63 72 65 61 74 65 28 29 7d 69 2e 63 6f 6d 70 6f 6e 65 6e 74 73 2e 72 65 67 69 73 74 65 72 28 22 66 69 64 6f 2d 68 65 6c 70 2d 64 69 61 6c 6f 67 2d 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 72 6f 6c 22 2c 7b 76 69 65 77 4d 6f 64 65 6c 3a 73 2c 74 65 6d 70 6c 61 74 65 3a 74 Data Ascii: 4),r=window;function s(e){var n=e.isPlatformAuthenticatorAvailable;this.isPlatformAuthenticatorAvailable=n,this.onRegisterDialog=o.create(),this.onUnregisterDialog=o.create()}i.components.register("fido-help-dialog-content-control",{viewModel:s,template:t
2024-10-24 15:35:26 UTC	16383	IN	Data Raw: 2e 75 6e 6d 65 6d 6f 69 7a 65 22 2c 43 2e 61 61 2e 62 64 29 2c 43 2e 62 28 22 6d 65 6d 6f 69 7a 61 74 69 6f 6e 2e 70 61 72 73 65 4d 65 6d 6f 54 65 78 74 22 2c 43 2e 61 61 2e 55 63 29 2c 43 2e 62 28 22 6d 65 6d 6f 69 7a 61 74 69 6f 6e 2e 75 6e 6d 65 6d 6f 69 7a 65 44 6f 6d 4e 6f 64 65 41 6e 64 44 65 73 63 65 6e 64 61 6e 74 73 22 2c 43 2e 61 61 2e 63 64 29 2c 43 2e 6e 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 69 66 28 69 29 66 6f 72 28 76 61 72 20 65 2c 6e 3d 69 2c 61 3d 30 3b 6f 3c 69 3b 29 69 66 28 65 3d 74 5b 6f 2b 2b 5d 29 7b 69 66 28 6f 3e 6e 29 7b 69 66 28 35 65 33 3c 3d 2b 2b 61 29 7b 6f 3d 69 2c 43 2e 61 2e 47 63 28 45 72 72 6f 72 28 22 27 54 6f 6f 20 6d 75 63 68 20 72 65 63 75 72 73 69 6f 6e 27 20 61 66 74 65 72 Data Ascii: .unmemoize",C.aa.bd),C.b("memoization.parseMemoText",C.aa.Uc),C.b("memoization.unmemoizeDomNodeAndDescendants",C.aa.cd),C.na=function(){function e(){if(i)for(var e,n=i,a=0;o<i;)if(e=t[o++]){if(o>n){if(5e3<=++a){o=i,C.a.Gc(Error("'Too much recursion' after

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.17	49738	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:26 UTC	631	OUT	GET /ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:27 UTC	790	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:27 GMT Content-Type: application/x-javascript Content-Length: 3921 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Tue, 28 Jun 2022 20:27:38 GMT ETag: 0x8DA5944A4FF258E x-ms-request-id: 0545c548-201e-0040-7940-25fbc3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153527Z-r197bdfb6b46gt25anfa5gg2fw00000003eg000000007uk6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:27 UTC	3921	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ad 5a 6b 73 e3 36 b2 fd 3e bf 82 46 b9 64 32 82 39 f2 66 93 dd 95 86 a3 f5 2b 3b ce f5 2b e3 c9 ce 56 c9 2a 17 45 42 12 c7 14 a0 80 a4 6d 5d 4b ff 7d 4f 03 24 45 c9 9e ca 24 f7 a6 32 36 89 47 a3 d1 38 7d ba d1 f4 ce b8 90 51 9e 28 e9 7a cf d5 a3 23 f0 a2 45 5e 68 e9 3e f9 a9 8a 42 6a f5 e7 5a e5 2a 52 e9 72 c9 98 e7 47 4a a2 dd 65 6f df 32 de 18 34 55 59 2e c3 99 58 2e b7 1a bd 55 2d 5e bb c2 7b 4e c6 f4 33 d7 8b e7 87 50 3b 3a 78 5b 77 bb fe f3 01 5f 79 b7 ee 5b 2e 03 ed 8b 27 11 b9 82 d6 cb 72 5d 44 b9 d2 7e ae 6e 72 9d c8 89 eb 79 3d ab a7 23 5b 2d e9 a7 42 4e f2 e9 fb 83 be 1c 1c 0c bb 8c ad b0 7e 34 a5 75 56 2b 3b 0e 6d f5 3a d2 15 5c 73 69 55 69 b5 b4 f7 2c 97 4b 57 04 02 f2 cf d5 a3 d0 c7 61 26 68 89 b1 d2 2e 29 99 07 Data Ascii: Zks6>Fd29f+;+VEBm]K}O$E$26G8}Q(z#E^h>BjZRrGJeo24UY.X.U-^{N3P;:x[w_y[.'r]D~nry=#[-BN~4uV+;m:\siUi,KWa&h.)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.17	49739	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:26 UTC	416	OUT	GET /ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:27 UTC	811	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:26 GMT Content-Type: application/x-javascript Content-Length: 4880 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 22 Oct 2020 20:43:21 GMT ETag: 0x8D876CB1D67B929 x-ms-request-id: e83d9140-401e-006a-8095-231b7e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153526Z-17fbfdc98bbwj6cp6df5812g4s00000000u0000000003t2m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:27 UTC	4880	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 5a 7b 73 db b6 96 ff 5f 9f 02 46 73 1d 32 a2 28 39 af b6 52 58 ad 1b 3b 5b df 6d e3 ac ed 4c 6f 57 52 32 b4 04 4a 4c 29 52 05 c1 d8 1e 4b df 7d 7f 07 00 45 52 56 da dc ee 6c 66 62 e1 79 70 de 0f 80 dd 27 07 ac f3 f5 ff d8 e5 d5 f1 c5 15 3b 7f c3 ae 7e 3a bb 38 61 ef d0 fb 8d bd 3d bf 3a 7b 7d fa f5 70 5a ad ab 45 9c b3 28 4e 04 c3 ef 75 98 8b 19 cb 52 96 49 16 a7 d3 4c ae 32 19 2a 91 b3 25 fe ca 38 4c 58 24 b3 25 53 0b c1 56 32 fb 24 a6 2a 67 49 9c 2b 6c ba 16 49 76 c3 1c 80 93 33 f6 2e 94 ea 8e 9d bd 73 7d 76 85 b5 99 8c e7 71 8a dd d3 6c 75 87 f6 42 b1 34 53 f1 54 b0 30 9d 69 68 09 3a 69 2e 58 91 ce 84 64 37 8b 78 ba 60 bf c4 53 99 e5 59 a4 98 14 53 11 7f c6 21 79 81 f1 e6 11 1e 0b a5 60 b9 50 2c ca a4 5a 18 3c 7c 76 49 Data Ascii: Z{s_Fs2(9RX;[mLoWR2JL)RK}ERVlfbyp';~:8a=:{}pZE(NuRIL2%8LX$%SV2$gI+lIv3.s}vqluB4ST0ih:i.Xd7x`SYS!y`P,Z<\|vI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.17	49742	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:27 UTC	618	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:28 UTC	798	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:27 GMT Content-Type: application/x-javascript Content-Length: 116365 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 15 Aug 2024 17:52:54 GMT ETag: 0x8DCBD5317046A2F x-ms-request-id: a537f98f-f01e-0022-2db4-220649000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153527Z-r197bdfb6b4tq6ldv3s2dcykm800000001t0000000008qwu x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:28 UTC	15586	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ec bd 6b 5b db 48 b6 28 fc 7d ff 0a 5b bb c7 2d b5 0b 63 19 30 44 46 78 48 42 7a 98 49 02 07 c8 f4 f4 10 4f 1e 61 97 b1 12 23 79 74 e1 d2 d8 fb b7 bf 6b ad aa 92 4a b2 0c 26 dd fb 9c 0f ef f4 d3 c1 ba 94 ea 5e eb 7e d9 fc a9 fe 5f b5 9f 6a 1b eb ff 57 3b bf 38 3c bb a8 9d bc ab 5d fc e5 f8 ec 6d ed 14 ee 7e ad 7d 3c b9 38 7e 73 b4 7e 3d d8 28 fe bb 98 f8 71 6d ec 4f 79 0d 7e af bc 98 8f 6a 61 50 0b a3 9a 1f 0c c3 68 16 46 5e c2 e3 da 0d fc 8d 7c 6f 5a 1b 47 e1 4d 2d 99 f0 da 2c 0a bf f2 61 12 d7 a6 7e 9c c0 47 57 7c 1a de d5 4c a8 2e 1a d5 4e bd 28 79 a8 1d 9f 5a 2d a8 9f 43 6d fe b5 1f c0 d7 c3 70 f6 00 d7 93 a4 16 84 89 3f e4 35 2f 18 51 6d 53 b8 09 62 5e 4b 83 11 8f 6a 77 13 7f 38 a9 7d f0 87 51 18 87 e3 a4 16 f1 21 f7 6f Data Ascii: k[H(}[-c0DFxHBzIOa#ytkJ&^~_jW;8<]m~}<8~s~=(qmOy~jaPhF^\|oZGM-,a~GW\|L.N(yZ-Cmp?5/QmSb^Kjw8}Q!o
2024-10-24 15:35:28 UTC	16384	IN	Data Raw: 72 48 0c 1b 29 1f 49 83 69 74 84 3e 47 59 80 42 9b b2 59 ca d8 88 5e 36 a7 24 f7 af 17 38 0d 53 1c 3e 97 dc 17 24 8a 0d 4a a7 01 95 4d e2 5c ba e4 61 91 1d cc fc 76 23 bb 17 d9 47 55 e3 fb 1d 24 72 d5 75 be 53 62 b7 c3 d2 4d f8 e3 e1 9f 08 fe 94 d8 cb 4c b2 60 93 73 a2 08 7c dd c2 cc 73 9f 8e 83 c4 ee be 3e 32 f9 4f b1 b5 a0 9d 4a e3 1e bb 1b c2 d1 c8 77 a3 9e bf 9f 52 28 74 4a 36 90 30 df 82 5a d0 d6 7a 03 ab 1b c3 71 f0 37 c6 a2 a7 e2 09 4c c4 d8 f5 2d 06 8f 9b b6 66 12 5d 1b ff 14 d3 96 df 40 63 44 2c e6 6f b8 f8 2d c3 e6 72 5b e7 a8 e9 1d a4 c2 f9 71 c3 23 61 49 cf 47 27 27 7f 63 23 57 e2 4e 51 f5 3a 81 a7 93 7d af 37 d1 7a d7 44 92 9b fa 37 81 4e 4d 11 fd 88 ec b6 68 ac 96 e7 17 55 b3 97 4f d5 55 ce e4 46 ae d0 47 c2 99 47 5b 6a a1 db c9 ce 2d d0 71 Data Ascii: rH)Iit>GYBY^6$8S>$JM\av#GU$ruSbML`s\|s>2OJwR(tJ60Zzq7L-f]@cD,o-r[q#aIG''c#WNQ:}7zD7NMhUOUFGG[j-q
2024-10-24 15:35:28 UTC	16384	IN	Data Raw: 29 8c 92 ca 92 96 69 33 da 9c 35 38 fc d6 d6 60 90 eb 41 a0 12 7b 42 d2 a3 7c 11 42 9b 34 a2 89 fa ac 50 54 6d 90 84 ac 5a 8e c0 f6 f8 15 ad ba d6 15 90 17 54 c3 6f b0 8f f9 f7 1b 9e 4f e9 71 33 74 f5 c0 fd e6 30 a7 21 7d a1 5d 47 f8 42 c3 4d be f3 4f 41 ba 44 02 66 76 07 a0 26 a7 28 74 99 e0 3b c9 b0 c7 62 54 65 49 f7 30 01 73 38 73 93 6f be 83 38 82 66 ee ce ce 1e 6e 0d f8 b1 f5 0c 45 5a dc 2d bb 1e b9 c6 a8 1c a5 3d e7 d3 a7 01 cc 63 fd e7 fc 53 3e 06 6a 35 fc f4 09 4b f4 c5 6e dd 03 86 b1 25 2e c8 49 20 ba c1 d7 11 55 f4 05 62 8b c7 b5 5e f7 e2 9e ef 6c 35 b7 f6 9a 6d 87 5d 61 90 56 d2 75 a6 25 9c a5 be 73 39 49 2f c2 89 c3 06 e9 f4 2e 8b 2f c7 85 ef 7c bc 0d 9f ad 6c b6 da db eb 9b ad cd ed 95 17 51 82 39 5e a0 b7 cf f0 f1 eb 15 f7 97 49 1a 67 29 5a Data Ascii: )i358`A{B\|B4PTmZToOq3t0!}]GBMOADfv&(t;bTeI0s8so8fnEZ-=cS>j5Kn%.I Ub^l5m]aVu%s9I/./\|lQ9^Ig)Z
2024-10-24 15:35:28 UTC	16384	IN	Data Raw: 43 68 1e b4 61 d1 c2 e6 08 96 6a d0 1c 75 d2 c3 bc a3 a2 68 ef 40 82 32 1c 1c 7b 39 fa ab 83 34 35 ee 0e dd d2 bd c6 a3 e3 da f3 7c fa 79 15 5c ca 3e 2f 40 6c be 3a bc e8 78 20 98 f4 2e e0 1d e4 fd 56 63 77 ca ae d9 1d 3a bf 64 68 0d bf 86 7f 8c a4 17 fe f8 eb 7d 5b d4 06 df ab e2 2b 59 bc 90 fa 71 8c 6d 52 7e a4 58 f9 fa 23 e9 ab 86 4c d4 b9 ba f0 c4 a4 6a a5 37 fb c1 26 5b c5 f2 30 9b 42 1c ab 21 ec 3a 8a cc 58 07 52 57 12 27 53 82 ac c7 c9 ad f0 1a cb f1 c6 54 45 5c 89 e4 5c bd 7e 67 7a 48 3c 46 dc 1b 4a 50 ba e3 2e 79 86 a5 3e ca 8a 99 87 ca 6b 17 98 cf 6e 0f 3e 00 68 d3 f7 f1 5f 4f 3b 19 98 1a 87 7b c1 08 f8 63 17 4f 7f ce 0c e0 45 fb 8b 27 9e ee 44 80 27 ce ab 3e 29 12 46 c4 b8 b4 78 ad c9 f6 06 5c b6 37 22 bf 58 45 07 fb 68 b5 36 b5 cb 52 b6 2d b7 Data Ascii: Chajuh@2{945\|y\>/@l:x .Vcw:dh}[+YqmR~X#Lj7&[0B!:XRW'STE\\~gzH<FJP.y>kn>h_O;{cOE'D'>)Fx\7"XEh6R-
2024-10-24 15:35:28 UTC	16384	IN	Data Raw: 50 d0 d5 39 aa fa b8 ea f0 0c 5e b3 3c ed 39 82 c4 c7 f0 e9 f8 a9 11 fd ee 03 1a 02 ec ec bc 1e bd 0c cf 82 8f 18 b1 2f f9 88 f8 f5 23 27 ed f9 c8 49 92 e1 1d 56 8c 6e 6f f1 cf 94 ff 2c 77 76 ec 2f 77 7a 98 3c 16 d9 f0 ed 93 db db 13 5b d5 13 9e a8 98 80 40 5f 4f 91 e3 3d 11 94 39 fa 19 ba 7f ca ac ef 0d d6 09 1c 92 46 38 e2 5f c7 49 80 9e 8b 38 eb 6c 85 09 b4 62 9d 5b 1d 47 92 f1 80 12 5a 18 ff 2c 54 bd 88 98 d9 ee e6 6f 4b a0 df 82 eb 90 1a 8e 00 5a 51 5c b0 c2 e5 84 de 2e 50 30 f1 df 6e 0c 8b a6 ae c5 6b 1f 27 c6 89 07 4e c3 78 68 cd f9 b4 db 43 45 68 31 f4 4e bb b0 17 d0 fc 82 4d ac e3 d0 7d d5 09 af 3d bd d4 fe 19 1c c3 e9 22 e3 50 a5 b2 47 17 b0 3f bc 0a d5 2e 75 7a b8 4f b2 1e 67 34 d9 4e 63 97 9f 7b d6 02 d4 b7 02 3a c1 61 cd 3d bd 16 ca 31 da 5e Data Ascii: P9^<9/#'IVno,wv/wz<[@_O=9F8_I8lb[GZ,ToKZQ\.P0nk'NxhCEh1NM}="PG?.uzOg4Nc{:a=1^
2024-10-24 15:35:28 UTC	16384	IN	Data Raw: 74 72 fb 31 53 f0 93 bc 81 d3 83 bc d1 d3 83 6f 9c 02 6a e3 fb cf 03 ef f3 c6 93 51 af 57 f8 d0 5e 5b 41 b8 f6 c6 e1 d5 bf ff 20 b0 d5 6f 1c 43 7a 51 d7 1b c8 5f b4 24 71 d3 9b 0f a9 c9 b3 dd 0b f2 21 90 e4 43 24 09 25 4b 50 0d cf 8c 6f 62 e5 88 72 b3 63 51 46 52 e9 a5 cc 3b 9c 98 a6 0a 38 4d 85 3e df 95 f8 88 93 19 59 81 f6 42 13 0b 3c a8 2b 2c 2d 59 af b6 22 6e 07 b3 d5 11 28 e7 e0 30 d6 1d 1f c9 39 a8 6e 32 07 6f ac 59 1e 59 61 06 62 7c 2e 46 48 49 7c f6 91 70 d4 91 9b 81 f1 18 46 32 48 1c 20 d2 22 15 56 dd 08 24 98 bd d5 e8 1b 4f 8d 4c 62 15 e0 46 85 7d 25 72 e1 38 5e 7e 87 07 db e6 9f 6c e6 7d 32 ab ec c2 0d 57 35 d2 59 01 79 ee 6f 72 13 0d 85 da 8b c2 83 6c d0 0b 34 66 a5 dd 0c f0 9d ab f8 24 00 73 8c 07 b4 02 92 4b d5 b1 75 17 96 0e b3 72 50 0e 90 Data Ascii: tr1SojQW^[A oCzQ_$q!C$%KPobrcQFR;8M>YB<+,-Y"n(09n2oYYab\|.FHI\|pF2H "V$OLbF}%r8^~l}2W5Yyorl4f$sKurP
2024-10-24 15:35:28 UTC	16384	IN	Data Raw: 63 4d 91 32 d6 52 36 60 5b ac 09 30 f3 65 fb ce f6 e7 38 a2 0d 16 84 de c9 87 1f 4f 4a f8 36 33 60 db bc f3 8d 03 e9 66 d1 90 42 cf a6 8c fd 73 20 33 13 e0 aa f5 a5 40 6e 98 1e 23 65 91 c8 1f 22 65 95 88 25 a6 ed 09 b2 32 48 8d e5 00 61 76 8c 6d 19 c2 5e e8 e8 5e 3a 68 05 64 8e e3 55 ad b0 7d a3 83 90 da 2a 86 89 ff 9d c7 b5 4c 3e b3 9f 90 23 3f b5 f8 ac 9f a3 69 ac a8 c9 d7 f0 d0 a1 31 ea b0 ea 38 1e fd 81 54 43 6a 1c c9 64 bf 17 8b 88 be 28 f5 24 4f 23 ba 05 68 c1 47 42 db e7 a1 13 f6 2b fb 9b 6e 7b fe 7a ee ac 7b ca 26 59 1f ca 92 10 03 1c 99 6d 00 76 75 8c 2b c5 8d 05 8e f2 dd 2e 95 2d ec ca 58 d9 6b fb 4e 66 a6 cd 1d 6c b8 21 f1 95 ff f2 7e 8c bb ce 0d 00 36 ef 3f bd f7 5f 1e 44 1d cd 79 b1 33 af ad 20 dc 62 0c f8 da ff d2 10 b6 5d 8b f8 dd ff 09 a0 Data Ascii: cM2R6`[0e8OJ63`fBs 3@n#e"e%2Havm^^:hdU}*L>#?i18TCjd($O#hGB+n{z{&Ymvu+.-XkNfl!~6?_Dy3 b]
2024-10-24 15:35:28 UTC	2475	IN	Data Raw: de 2c 30 3f 34 26 15 78 3c 32 d3 c9 17 b6 63 68 f2 5e 3e ca 38 c7 fa da b4 a6 b7 c9 4e e7 6b eb eb 52 5a e4 a3 63 e0 52 22 d0 e9 eb e5 b4 39 64 8c cb 89 81 6f d5 ca 69 80 28 8f c7 e5 c4 31 24 e6 e5 c4 29 24 a6 e5 c4 89 0f 04 77 29 6d e6 03 81 5d 4a 1b f9 40 80 97 d2 6e 7c 20 c6 4b 69 97 3e 50 1b a5 b4 73 1f 48 9c 52 da 85 0f a4 51 29 ed cc b7 9e 94 d3 ae d0 e1 5d 29 ed da b7 be 2d a7 1d c9 68 79 e3 e3 b4 66 7d f1 b5 ed ac f7 28 1c df ed 02 dd 2b ec 9b 9f eb f4 dd eb 7d 2b 33 dc 1d af db 7d ff f8 89 03 39 df f8 eb ad c1 71 0a 93 ff b5 bd 0e 9f d7 dd 17 14 4f 10 e3 02 ae 47 0f d8 5e 7f 74 4f dd e7 ee a1 fb d6 fd d5 7d e5 be 73 0f 7e 87 46 f4 ed c2 7d 89 4a 7c 59 a6 83 dc bb ef fd 83 56 74 1e 03 cf f7 82 63 43 7f e7 bf 94 24 d3 33 bf ed be 46 3e eb 7b 14 3a Data Ascii: ,0?4&x<2ch^>8NkRZcR"9doi(1$)$w)m]J@n\| Ki>PsHRQ)])-hyf}(+}+3}9qOG^tO}s~F}J\|YVtcC$3F>{:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.17	49741	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:27 UTC	406	OUT	GET /ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:28 UTC	811	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:28 GMT Content-Type: application/x-javascript Content-Length: 3921 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Tue, 28 Jun 2022 20:27:38 GMT ETag: 0x8DA5944A4FF258E x-ms-request-id: b5bf2328-601e-0033-759c-20a350000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153527Z-r1755647c66xkk8sn093pbsnz80000000120000000003p0z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:28 UTC	3921	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ad 5a 6b 73 e3 36 b2 fd 3e bf 82 46 b9 64 32 82 39 f2 66 93 dd 95 86 a3 f5 2b 3b ce f5 2b e3 c9 ce 56 c9 2a 17 45 42 12 c7 14 a0 80 a4 6d 5d 4b ff 7d 4f 03 24 45 c9 9e ca 24 f7 a6 32 36 89 47 a3 d1 38 7d ba d1 f4 ce b8 90 51 9e 28 e9 7a cf d5 a3 23 f0 a2 45 5e 68 e9 3e f9 a9 8a 42 6a f5 e7 5a e5 2a 52 e9 72 c9 98 e7 47 4a a2 dd 65 6f df 32 de 18 34 55 59 2e c3 99 58 2e b7 1a bd 55 2d 5e bb c2 7b 4e c6 f4 33 d7 8b e7 87 50 3b 3a 78 5b 77 bb fe f3 01 5f 79 b7 ee 5b 2e 03 ed 8b 27 11 b9 82 d6 cb 72 5d 44 b9 d2 7e ae 6e 72 9d c8 89 eb 79 3d ab a7 23 5b 2d e9 a7 42 4e f2 e9 fb 83 be 1c 1c 0c bb 8c ad b0 7e 34 a5 75 56 2b 3b 0e 6d f5 3a d2 15 5c 73 69 55 69 b5 b4 f7 2c 97 4b 57 04 02 f2 cf d5 a3 d0 c7 61 26 68 89 b1 d2 2e 29 99 07 Data Ascii: Zks6>Fd29f+;+VEBm]K}O$E$26G8}Q(z#E^h>BjZRrGJeo24UY.X.U-^{N3P;:x[w_y[.'r]D~nry=#[-BN~4uV+;m:\siUi,KWa&h.)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.17	49740	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:28 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-24 15:35:28 UTC	465	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=4197 Date: Thu, 24 Oct 2024 15:35:28 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.17	49744	52.98.152.194	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:28 UTC	710	OUT	GET /owa/prefetch.aspx HTTP/1.1 Host: outlook.office365.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:28 UTC	1936	IN	HTTP/1.1 200 OK Cache-Control: private, no-store Content-Length: 2745 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 request-id: 66c36463-36cd-6246-baef-4e6509aa5a4d Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CalculatedFETarget: BE1P281CU023.internal.outlook.com X-BackEndHttpStatus: 200 Set-Cookie: ClientId=0C6D15CADB384F3688AA45313AB12D6B; expires=Fri, 24-Oct-2025 15:35:28 GMT; path=/;SameSite=None; secure Set-Cookie: ClientId=0C6D15CADB384F3688AA45313AB12D6B; expires=Fri, 24-Oct-2025 15:35:28 GMT; path=/;SameSite=None; secure Set-Cookie: OIDC=1; expires=Thu, 24-Apr-2025 15:35:28 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OWAPF=v:15.20.8069.28&l:mouse; path=/; secure; HttpOnly X-CalculatedBETarget: BEVP281MB3710.DEUP281.PROD.OUTLOOK.COM X-BackEndHttpStatus: 200 X-RUM-Validated: 1 X-RUM-NotUpdateQueriedPath: 1 X-RUM-NotUpdateQueriedDbCopy: 1 X-Content-Type-Options: nosniff X-BeSku: WCS7 X-OWA-Version: 15.20.8069.27 X-OWA-DiagnosticsInfo: 5;0;0; X-BackEnd-Begin: 2024-10-24T15:35:28.469 X-BackEnd-End: 2024-10-24T15:35:28.469 X-DiagInfo: BEVP281MB3710 X-BEServer: BEVP281MB3710 X-UA-Compatible: IE=EmulateIE7 X-ResponseOrigin: OwaAppPool X-Proxy-RoutingCorrectness: 1 X-Proxy-BackendServerStatus: 200 X-FEProxyInfo: FR0P281CA0004.DEUP281.PROD.OUTLOOK.COM X-FEEFZInfo: HHN X-FEServer: BE1P281CA0289 Report-To: {"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=HHN&RemoteIP=173.254.250.0&Environment=MT"}],"include_subdomains":true} NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-FirstHopCafeEFZ: HHN X-FEServer: FR0P281CA0004 Date: Thu, 24 Oct 2024 15:35:27 GMT Connection: close
2024-10-24 15:35:28 UTC	2745	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 72 65 66 65 74 63 68 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0d 0a 0d 0a 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 6f 66 66 69 63 65 33 36 35 69 63 6f 6e 73 27 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 72 63 3a 20 75 72 6c 28 27 68 74 74 70 73 3a 2f Data Ascii: <!DOCTYPE html><html><head> <title>Prefetch</title> <meta http-equiv="x-ua-compatible" content="IE=Edge"> <style> @font-face { font-family: 'office365icons'; src: url('https:/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.17	49745	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:29 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-24 15:35:29 UTC	513	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=4194 Date: Thu, 24 Oct 2024 15:35:29 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-24 15:35:29 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.17	49751	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:29 UTC	649	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:29 UTC	738	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:29 GMT Content-Type: image/x-icon Content-Length: 17174 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Sun, 18 Oct 2020 03:02:03 GMT ETag: 0x8D8731230C851A6 x-ms-request-id: 0ae22b8d-d01e-006b-4f3a-257b0f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153529Z-r197bdfb6b4lbgfqwkqbrm672s00000001q000000000anf5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:29 UTC	15646	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-10-24 15:35:29 UTC	1528	IN	Data Raw: 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 Data Ascii: ( @{L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.17	49748	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:29 UTC	433	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:29 UTC	792	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:29 GMT Content-Type: application/x-javascript Content-Length: 116365 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 15 Aug 2024 17:52:54 GMT ETag: 0x8DCBD5317046A2F x-ms-request-id: 1361c034-301e-0063-4e40-236100000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153529Z-17fbfdc98bbvwcxrk0yzwg4d5800000007kg0000000045nb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:29 UTC	15592	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ec bd 6b 5b db 48 b6 28 fc 7d ff 0a 5b bb c7 2d b5 0b 63 19 30 44 46 78 48 42 7a 98 49 02 07 c8 f4 f4 10 4f 1e 61 97 b1 12 23 79 74 e1 d2 d8 fb b7 bf 6b ad aa 92 4a b2 0c 26 dd fb 9c 0f ef f4 d3 c1 ba 94 ea 5e eb 7e d9 fc a9 fe 5f b5 9f 6a 1b eb ff 57 3b bf 38 3c bb a8 9d bc ab 5d fc e5 f8 ec 6d ed 14 ee 7e ad 7d 3c b9 38 7e 73 b4 7e 3d d8 28 fe bb 98 f8 71 6d ec 4f 79 0d 7e af bc 98 8f 6a 61 50 0b a3 9a 1f 0c c3 68 16 46 5e c2 e3 da 0d fc 8d 7c 6f 5a 1b 47 e1 4d 2d 99 f0 da 2c 0a bf f2 61 12 d7 a6 7e 9c c0 47 57 7c 1a de d5 4c a8 2e 1a d5 4e bd 28 79 a8 1d 9f 5a 2d a8 9f 43 6d fe b5 1f c0 d7 c3 70 f6 00 d7 93 a4 16 84 89 3f e4 35 2f 18 51 6d 53 b8 09 62 5e 4b 83 11 8f 6a 77 13 7f 38 a9 7d f0 87 51 18 87 e3 a4 16 f1 21 f7 6f Data Ascii: k[H(}[-c0DFxHBzIOa#ytkJ&^~_jW;8<]m~}<8~s~=(qmOy~jaPhF^\|oZGM-,a~GW\|L.N(yZ-Cmp?5/QmSb^Kjw8}Q!o
2024-10-24 15:35:30 UTC	16384	IN	Data Raw: 49 83 69 74 84 3e 47 59 80 42 9b b2 59 ca d8 88 5e 36 a7 24 f7 af 17 38 0d 53 1c 3e 97 dc 17 24 8a 0d 4a a7 01 95 4d e2 5c ba e4 61 91 1d cc fc 76 23 bb 17 d9 47 55 e3 fb 1d 24 72 d5 75 be 53 62 b7 c3 d2 4d f8 e3 e1 9f 08 fe 94 d8 cb 4c b2 60 93 73 a2 08 7c dd c2 cc 73 9f 8e 83 c4 ee be 3e 32 f9 4f b1 b5 a0 9d 4a e3 1e bb 1b c2 d1 c8 77 a3 9e bf 9f 52 28 74 4a 36 90 30 df 82 5a d0 d6 7a 03 ab 1b c3 71 f0 37 c6 a2 a7 e2 09 4c c4 d8 f5 2d 06 8f 9b b6 66 12 5d 1b ff 14 d3 96 df 40 63 44 2c e6 6f b8 f8 2d c3 e6 72 5b e7 a8 e9 1d a4 c2 f9 71 c3 23 61 49 cf 47 27 27 7f 63 23 57 e2 4e 51 f5 3a 81 a7 93 7d af 37 d1 7a d7 44 92 9b fa 37 81 4e 4d 11 fd 88 ec b6 68 ac 96 e7 17 55 b3 97 4f d5 55 ce e4 46 ae d0 47 c2 99 47 5b 6a a1 db c9 ce 2d d0 71 08 5a 64 11 58 a4 Data Ascii: Iit>GYBY^6$8S>$JM\av#GU$ruSbML`s\|s>2OJwR(tJ60Zzq7L-f]@cD,o-r[q#aIG''c#WNQ:}7zD7NMhUOUFGG[j-qZdX
2024-10-24 15:35:30 UTC	16384	IN	Data Raw: 69 33 da 9c 35 38 fc d6 d6 60 90 eb 41 a0 12 7b 42 d2 a3 7c 11 42 9b 34 a2 89 fa ac 50 54 6d 90 84 ac 5a 8e c0 f6 f8 15 ad ba d6 15 90 17 54 c3 6f b0 8f f9 f7 1b 9e 4f e9 71 33 74 f5 c0 fd e6 30 a7 21 7d a1 5d 47 f8 42 c3 4d be f3 4f 41 ba 44 02 66 76 07 a0 26 a7 28 74 99 e0 3b c9 b0 c7 62 54 65 49 f7 30 01 73 38 73 93 6f be 83 38 82 66 ee ce ce 1e 6e 0d f8 b1 f5 0c 45 5a dc 2d bb 1e b9 c6 a8 1c a5 3d e7 d3 a7 01 cc 63 fd e7 fc 53 3e 06 6a 35 fc f4 09 4b f4 c5 6e dd 03 86 b1 25 2e c8 49 20 ba c1 d7 11 55 f4 05 62 8b c7 b5 5e f7 e2 9e ef 6c 35 b7 f6 9a 6d 87 5d 61 90 56 d2 75 a6 25 9c a5 be 73 39 49 2f c2 89 c3 06 e9 f4 2e 8b 2f c7 85 ef 7c bc 0d 9f ad 6c b6 da db eb 9b ad cd ed 95 17 51 82 39 5e a0 b7 cf f0 f1 eb 15 f7 97 49 1a 67 29 5a 32 4a cf 61 c8 54 Data Ascii: i358`A{B\|B4PTmZToOq3t0!}]GBMOADfv&(t;bTeI0s8so8fnEZ-=cS>j5Kn%.I Ub^l5m]aVu%s9I/./\|lQ9^Ig)Z2JaT
2024-10-24 15:35:30 UTC	16384	IN	Data Raw: c2 e6 08 96 6a d0 1c 75 d2 c3 bc a3 a2 68 ef 40 82 32 1c 1c 7b 39 fa ab 83 34 35 ee 0e dd d2 bd c6 a3 e3 da f3 7c fa 79 15 5c ca 3e 2f 40 6c be 3a bc e8 78 20 98 f4 2e e0 1d e4 fd 56 63 77 ca ae d9 1d 3a bf 64 68 0d bf 86 7f 8c a4 17 fe f8 eb 7d 5b d4 06 df ab e2 2b 59 bc 90 fa 71 8c 6d 52 7e a4 58 f9 fa 23 e9 ab 86 4c d4 b9 ba f0 c4 a4 6a a5 37 fb c1 26 5b c5 f2 30 9b 42 1c ab 21 ec 3a 8a cc 58 07 52 57 12 27 53 82 ac c7 c9 ad f0 1a cb f1 c6 54 45 5c 89 e4 5c bd 7e 67 7a 48 3c 46 dc 1b 4a 50 ba e3 2e 79 86 a5 3e ca 8a 99 87 ca 6b 17 98 cf 6e 0f 3e 00 68 d3 f7 f1 5f 4f 3b 19 98 1a 87 7b c1 08 f8 63 17 4f 7f ce 0c e0 45 fb 8b 27 9e ee 44 80 27 ce ab 3e 29 12 46 c4 b8 b4 78 ad c9 f6 06 5c b6 37 22 bf 58 45 07 fb 68 b5 36 b5 cb 52 b6 2d b7 eb c7 d3 70 f8 10 Data Ascii: juh@2{945\|y\>/@l:x .Vcw:dh}[+YqmR~X#Lj7&[0B!:XRW'STE\\~gzH<FJP.y>kn>h_O;{cOE'D'>)Fx\7"XEh6R-p
2024-10-24 15:35:30 UTC	16384	IN	Data Raw: b8 ea f0 0c 5e b3 3c ed 39 82 c4 c7 f0 e9 f8 a9 11 fd ee 03 1a 02 ec ec bc 1e bd 0c cf 82 8f 18 b1 2f f9 88 f8 f5 23 27 ed f9 c8 49 92 e1 1d 56 8c 6e 6f f1 cf 94 ff 2c 77 76 ec 2f 77 7a 98 3c 16 d9 f0 ed 93 db db 13 5b d5 13 9e a8 98 80 40 5f 4f 91 e3 3d 11 94 39 fa 19 ba 7f ca ac ef 0d d6 09 1c 92 46 38 e2 5f c7 49 80 9e 8b 38 eb 6c 85 09 b4 62 9d 5b 1d 47 92 f1 80 12 5a 18 ff 2c 54 bd 88 98 d9 ee e6 6f 4b a0 df 82 eb 90 1a 8e 00 5a 51 5c b0 c2 e5 84 de 2e 50 30 f1 df 6e 0c 8b a6 ae c5 6b 1f 27 c6 89 07 4e c3 78 68 cd f9 b4 db 43 45 68 31 f4 4e bb b0 17 d0 fc 82 4d ac e3 d0 7d d5 09 af 3d bd d4 fe 19 1c c3 e9 22 e3 50 a5 b2 47 17 b0 3f bc 0a d5 2e 75 7a b8 4f b2 1e 67 34 d9 4e 63 97 9f 7b d6 02 d4 b7 02 3a c1 61 cd 3d bd 16 ca 31 da 5e 8c 95 df 45 cb 01 Data Ascii: ^<9/#'IVno,wv/wz<[@_O=9F8_I8lb[GZ,ToKZQ\.P0nk'NxhCEh1NM}="PG?.uzOg4Nc{:a=1^E
2024-10-24 15:35:30 UTC	16384	IN	Data Raw: 93 bc 81 d3 83 bc d1 d3 83 6f 9c 02 6a e3 fb cf 03 ef f3 c6 93 51 af 57 f8 d0 5e 5b 41 b8 f6 c6 e1 d5 bf ff 20 b0 d5 6f 1c 43 7a 51 d7 1b c8 5f b4 24 71 d3 9b 0f a9 c9 b3 dd 0b f2 21 90 e4 43 24 09 25 4b 50 0d cf 8c 6f 62 e5 88 72 b3 63 51 46 52 e9 a5 cc 3b 9c 98 a6 0a 38 4d 85 3e df 95 f8 88 93 19 59 81 f6 42 13 0b 3c a8 2b 2c 2d 59 af b6 22 6e 07 b3 d5 11 28 e7 e0 30 d6 1d 1f c9 39 a8 6e 32 07 6f ac 59 1e 59 61 06 62 7c 2e 46 48 49 7c f6 91 70 d4 91 9b 81 f1 18 46 32 48 1c 20 d2 22 15 56 dd 08 24 98 bd d5 e8 1b 4f 8d 4c 62 15 e0 46 85 7d 25 72 e1 38 5e 7e 87 07 db e6 9f 6c e6 7d 32 ab ec c2 0d 57 35 d2 59 01 79 ee 6f 72 13 0d 85 da 8b c2 83 6c d0 0b 34 66 a5 dd 0c f0 9d ab f8 24 00 73 8c 07 b4 02 92 4b d5 b1 75 17 96 0e b3 72 50 0e 90 16 c6 12 14 96 41 Data Ascii: ojQW^[A oCzQ_$q!C$%KPobrcQFR;8M>YB<+,-Y"n(09n2oYYab\|.FHI\|pF2H "V$OLbF}%r8^~l}2W5Yyorl4f$sKurPA
2024-10-24 15:35:30 UTC	16384	IN	Data Raw: 36 60 5b ac 09 30 f3 65 fb ce f6 e7 38 a2 0d 16 84 de c9 87 1f 4f 4a f8 36 33 60 db bc f3 8d 03 e9 66 d1 90 42 cf a6 8c fd 73 20 33 13 e0 aa f5 a5 40 6e 98 1e 23 65 91 c8 1f 22 65 95 88 25 a6 ed 09 b2 32 48 8d e5 00 61 76 8c 6d 19 c2 5e e8 e8 5e 3a 68 05 64 8e e3 55 ad b0 7d a3 83 90 da 2a 86 89 ff 9d c7 b5 4c 3e b3 9f 90 23 3f b5 f8 ac 9f a3 69 ac a8 c9 d7 f0 d0 a1 31 ea b0 ea 38 1e fd 81 54 43 6a 1c c9 64 bf 17 8b 88 be 28 f5 24 4f 23 ba 05 68 c1 47 42 db e7 a1 13 f6 2b fb 9b 6e 7b fe 7a ee ac 7b ca 26 59 1f ca 92 10 03 1c 99 6d 00 76 75 8c 2b c5 8d 05 8e f2 dd 2e 95 2d ec ca 58 d9 6b fb 4e 66 a6 cd 1d 6c b8 21 f1 95 ff f2 7e 8c bb ce 0d 00 36 ef 3f bd f7 5f 1e 44 1d cd 79 b1 33 af ad 20 dc 62 0c f8 da ff d2 10 b6 5d 8b f8 dd ff 09 a0 f2 fc 73 ab 3f de Data Ascii: 6`[0e8OJ63`fBs 3@n#e"e%2Havm^^:hdU}*L>#?i18TCjd($O#hGB+n{z{&Ymvu+.-XkNfl!~6?_Dy3 b]s?
2024-10-24 15:35:30 UTC	2469	IN	Data Raw: 15 78 3c 32 d3 c9 17 b6 63 68 f2 5e 3e ca 38 c7 fa da b4 a6 b7 c9 4e e7 6b eb eb 52 5a e4 a3 63 e0 52 22 d0 e9 eb e5 b4 39 64 8c cb 89 81 6f d5 ca 69 80 28 8f c7 e5 c4 31 24 e6 e5 c4 29 24 a6 e5 c4 89 0f 04 77 29 6d e6 03 81 5d 4a 1b f9 40 80 97 d2 6e 7c 20 c6 4b 69 97 3e 50 1b a5 b4 73 1f 48 9c 52 da 85 0f a4 51 29 ed cc b7 9e 94 d3 ae d0 e1 5d 29 ed da b7 be 2d a7 1d c9 68 79 e3 e3 b4 66 7d f1 b5 ed ac f7 28 1c df ed 02 dd 2b ec 9b 9f eb f4 dd eb 7d 2b 33 dc 1d af db 7d ff f8 89 03 39 df f8 eb ad c1 71 0a 93 ff b5 bd 0e 9f d7 dd 17 14 4f 10 e3 02 ae 47 0f d8 5e 7f 74 4f dd e7 ee a1 fb d6 fd d5 7d e5 be 73 0f 7e 87 46 f4 ed c2 7d 89 4a 7c 59 a6 83 dc bb ef fd 83 56 74 1e 03 cf f7 82 63 43 7f e7 bf 94 24 d3 33 bf ed be 46 3e eb 7b 14 3a 2b 1d a6 4f fa be Data Ascii: x<2ch^>8NkRZcR"9doi(1$)$w)m]J@n\| Ki>PsHRQ)])-hyf}(+}+3}9qOG^tO}s~F}J\|YVtcC$3F>{:+O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.17	49750	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:29 UTC	663	OUT	GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:29 UTC	778	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:29 GMT Content-Type: image/svg+xml Content-Length: 621 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:49 GMT ETag: 0x8DB5C3F49ED96E0 x-ms-request-id: cc24f95e-701e-000b-198a-214f82000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153529Z-16849878b78z5q7jpbgf6e9mcw00000007xg00000000pvgr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:29 UTC	621	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 7d 55 4d 6f 22 31 0c fd 2b a3 d9 ab 93 c9 f7 47 3b 20 cd 9e 38 6c af 1c b8 4d 0b 05 24 0a 55 19 41 57 ab fe f7 b5 93 a0 55 61 58 0d d8 60 27 ef 3d db 09 b4 c7 d3 ba fa 7c db ed 8f 93 7a 33 0c ef 0f 4d 73 3e 9f f9 59 f3 c3 c7 ba 51 42 88 06 57 d4 d5 79 bb 1c 36 93 da 84 ba da ac b6 eb cd 90 3f 9f b6 ab f3 cf c3 e7 a4 16 95 a8 4c c0 57 3d 6d 97 ab d7 e3 b4 3d 0e bf 77 ab 29 ef ff bc 6e 77 bb 87 fd 61 bf 7a fc e2 cf f9 db 0f 23 e8 79 fc 6a 9b bc ac 6d f2 a6 8f d5 cb 50 bd ec fa 23 ca e9 ef b1 36 d3 f6 bd 1f 36 97 75 cf 75 b5 9c d4 4f 46 80 56 dc fa 30 37 62 a6 d5 5c bb 99 0a 73 ad 66 ca cc 55 e0 de b9 4e 0a ee 42 84 e2 04 3e 12 64 04 2d 7a 0c a5 78 89 32 cb ad f1 4c 72 0b 52 72 29 dc c5 e5 ac e2 4a 46 cc 7a 19 3b 4c 68 af a1 b8 Data Ascii: }UMo"1+G; 8lM$UAWUaX`'=\|z3Ms>YQBWy6?LW=m=w)nwaz#yjmP#66uuOFV07b\sfUNB>d-zx2LrRr)JFz;Lh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.17	49749	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:29 UTC	672	OUT	GET /shared/1.0/content/images/appbackgrounds/49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:29 UTC	755	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:29 GMT Content-Type: image/jpeg Content-Length: 987 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:42 GMT ETag: 0x8DB5C3F457E15E1 x-ms-request-id: 0101a334-901e-0055-125b-25ec70000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153529Z-16849878b7842t5ke0k7mzbt3c00000007sg0000000094qq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:29 UTC	987	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 66 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 04 01 1a 00 05 00 00 00 01 00 00 00 3e 01 1b 00 05 00 00 00 01 00 00 00 46 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 10 00 00 00 4e 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 70 61 69 6e 74 2e 6e 65 74 20 34 2e 32 2e 39 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a Data Ascii: JFIFHHfExifMM*>F(1NHHpaint.net 4.2.9CC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.17	49752	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:29 UTC	666	OUT	GET /shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc2e13.jpg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:30 UTC	764	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:29 GMT Content-Type: image/jpeg Content-Length: 17453 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:42 GMT ETag: 0x8DB5C3F4584F323 x-ms-request-id: 8258d651-701e-0061-0f72-25e015000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153529Z-r197bdfb6b4ld6jc5asqwvvz0w00000001y0000000003qrh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-24 15:35:30 UTC	15620	IN	Data Raw: ff d8 ff e1 09 50 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e Data Ascii: Phttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syn
2024-10-24 15:35:30 UTC	1833	IN	Data Raw: 14 45 41 44 01 40 00 04 11 40 00 01 00 14 01 40 00 00 10 01 40 14 40 00 00 50 00 00 04 00 00 05 00 45 00 00 05 00 00 01 00 05 50 00 00 04 00 00 05 1f ff d3 db c0 6d cd 05 45 00 00 00 04 50 1c 8a 02 00 00 00 00 04 48 aa 0e 45 15 10 00 00 00 00 00 04 82 80 90 50 10 00 04 01 44 14 51 14 10 51 11 05 01 05 40 00 00 00 00 15 40 00 00 00 40 54 50 42 28 00 00 00 00 00 00 00 02 80 00 00 00 20 00 02 a2 8a 00 00 00 00 0a 02 00 00 00 02 28 00 8a 80 00 a0 02 0a 08 a8 28 08 a0 00 02 80 a8 22 80 88 a0 2a 28 00 02 00 28 20 a2 08 28 08 00 02 88 00 0a 82 80 8a 00 00 8a 00 00 08 00 00 02 00 00 00 0a 00 a8 a8 a0 82 a2 00 00 00 8a 00 a0 02 00 02 80 20 00 00 00 00 80 00 00 22 a0 a0 20 00 2a 2a 00 02 8a 80 8a 20 82 88 00 00 00 0a 00 a0 00 00 08 02 a8 8a 02 00 28 00 80 02 80 02 Data Ascii: EAD@@@@@PEPmEPHEPDQQ@@@TPB( (("(( ( " * (

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.17	49753	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:29 UTC	660	OUT	GET /shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:30 UTC	735	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:29 GMT Content-Type: image/png Content-Length: 5139 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:45 GMT ETag: 0x8DB5C3F475BAFC0 x-ms-request-id: 833c1d5f-301e-003e-5a2a-266b84000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153529Z-16849878b78bkvbz1ry47zvsas000000081000000000011m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-24 15:35:30 UTC	5139	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 56 00 00 00 48 08 06 00 00 00 ad 04 dd dc 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 25 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 38 20 37 39 2e 31 36 34 30 33 36 2c 20 32 30 31 39 2f 30 38 2f 31 33 2d 30 31 3a 30 36 3a 35 37 20 20 Data Ascii: PNGIHDRVHtEXtSoftwareAdobe ImageReadyqe<%iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.17	49754	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:29 UTC	663	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:29 UTC	779	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:29 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4911527F x-ms-request-id: 091d3d8e-001e-0078-235c-245f03000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153529Z-15b8d89586flzzks5bs37v2b9000000003c000000000qebb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:29 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.17	49756	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:30 UTC	624	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:30 UTC	791	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:30 GMT Content-Type: application/x-javascript Content-Length: 35168 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 15 Aug 2024 17:52:55 GMT ETag: 0x8DCBD5317AEB807 x-ms-request-id: c991da44-b01e-0004-1704-2239ee000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153530Z-16849878b7842t5ke0k7mzbt3c00000007ng00000000rw31 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:30 UTC	15593	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 c4 bd 6b 43 db 48 b2 30 fc fd f9 15 e0 9d 65 ac b5 00 df 30 18 70 58 06 92 49 76 33 93 9c 5c 66 cf 2e 30 59 59 96 6d 0d b2 65 24 99 4b 02 cf 6f 7f eb d2 97 6a c9 90 cc 9c 67 df 33 e7 6c 70 57 df aa ab ab ab ab aa ab 5b db 7f 59 ff 3f 6b 7f 59 db fc f6 ff d6 de 7f 38 7e f7 61 ed cd 8b b5 0f 2f 5f bd 3b 5d 7b 0b a9 7f ae fd fc e6 c3 ab 93 e7 df de 0e 76 8a ff fb 30 8d f3 b5 71 9c 44 6b f0 77 18 e4 d1 68 2d 9d af a5 d9 5a 3c 0f d3 6c 91 66 41 11 e5 6b 33 f8 37 8b 83 64 6d 9c a5 b3 b5 62 1a ad 2d b2 f4 b7 28 2c f2 b5 24 ce 0b a8 34 8c 92 f4 66 ad 0e cd 65 a3 b5 b7 41 56 dc ad bd 7a eb 6d 41 fb 11 b4 16 4f e2 39 d4 0e d3 c5 1d fc 9e 16 6b f3 b4 88 c3 68 2d 98 8f a8 b5 04 12 f3 3c 5a 5b ce 47 51 b6 76 33 8d c3 e9 da 4f 71 98 a5 79 Data Ascii: kCH0e0pXIv3\f.0YYme$Kojg3lpW[Y?kY8~a/_;]{v0qDkwh-Z<lfAk37dmb-(,$4feAVzmAO9kh-<Z[GQv3Oqy
2024-10-24 15:35:30 UTC	16384	IN	Data Raw: 0b fc b7 7d 4c 89 36 e5 f4 9a 94 e0 c7 fe 7a 3d 4e 40 b1 17 cf 5f e0 bf 2f 5e f4 37 e9 cf 0f 17 f7 e7 cb 53 30 14 ce e0 cf c9 0f a7 f8 ef c9 29 03 db 2f 08 78 8c 4d c1 9f 0e 43 3b 54 f4 74 b7 b3 49 7f 8e 09 fa 43 b7 49 65 9b 2d fc b7 cd 35 76 5f 5c 6c d3 a8 db 5f 23 2a cd c3 eb 78 7e f9 3a 18 46 09 d3 b1 83 c4 33 19 a7 51 5e c4 73 7a b4 81 b3 bb 4e f6 87 b8 48 22 ce d8 61 4a 77 7e bf 61 60 fd 83 c6 70 c7 3d 2a 24 65 3c ff 29 b8 05 65 8f 7e 92 28 a6 5f 03 b4 d0 e7 83 d6 01 a5 0e c3 03 62 c3 7e 07 64 3f 28 18 c0 de 59 28 e5 2a 95 c2 ad 0c bd 87 9b 9b 73 ef 0b 6e ef 4a 82 41 c5 98 db 07 16 9f 8d 40 26 e0 7b 08 5b f9 65 bc f8 90 5e 46 b8 dc fc 3e ee 76 a9 47 45 07 5c 78 b3 e5 cd 1b 0d e3 f9 ca 0c cb 13 7e 4b 7f b3 f5 a0 bd 18 b0 9c 02 ae 84 ce 0c ce 0e 98 ef Data Ascii: }L6z=N@_/^7S0)/xMC;TtICIe-5v_\l_#x~:F3Q^szNH"aJw~a`p=$e<)e~(_b~d?(Y(*snJA@&{[e^F>vGE\x~K
2024-10-24 15:35:30 UTC	3191	IN	Data Raw: 2d e9 61 bf de 76 31 e7 b5 b7 35 ec ae ac a0 fd 7a 5a e0 51 85 64 9c 71 86 da 05 75 05 e2 2f c1 e3 1b 2e e0 ac 2b f3 db b5 61 3f 28 3c f2 32 68 91 01 35 d9 bf 91 79 ee 76 ca 31 5d 87 e6 ce b3 68 e5 9d 9d 2e 03 be 71 96 2f 47 c1 de 90 b1 6d de b2 47 e1 bd a3 cd 0e 87 4e c4 50 4c ad 76 42 79 13 eb d1 84 ba 89 a8 ec 51 f8 46 ef 45 5e 59 6d ae 8d 02 82 52 f5 51 9c a3 01 35 fe 52 6d 5e eb b5 46 a5 5a 61 3a 08 21 bc 5e 6d 35 58 78 bd 56 2c 36 30 9c 5e 86 cf 75 f6 7b 81 77 02 f8 55 8d 84 b0 cc 45 ca d8 44 7f 89 74 f2 8a 88 52 95 62 2a a5 20 69 a9 dc a0 a0 52 ad a5 a2 81 21 b3 5b 2a a1 61 96 92 ca fe c5 54 63 90 d5 37 2a 4e bc 5d 53 05 b2 91 97 6a d4 5c e7 b2 d7 69 fe 72 6e 06 bd 93 76 bf 82 ed 7e 78 23 de 14 2a 36 0a d3 69 66 72 2e 59 04 99 e6 f2 d3 c0 28 c8 74 Data Ascii: -av15zZQdqu/.+a?(<2h5yv1]h.q/GmGNPLvByQFE^YmRQ5Rm^FZa:!^m5XxV,60^u{wUEDtRb* iR![aTc7N]Sj\irnv~x#*6ifr.Y(t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.17	49757	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:30 UTC	418	OUT	GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:30 UTC	799	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:30 GMT Content-Type: image/svg+xml Content-Length: 621 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:49 GMT ETag: 0x8DB5C3F49ED96E0 x-ms-request-id: 918c0175-001e-007b-3613-2681ca000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153530Z-17fbfdc98bbkw9phumvsc7yy8w00000007dg000000007pxn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 15:35:30 UTC	621	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 7d 55 4d 6f 22 31 0c fd 2b a3 d9 ab 93 c9 f7 47 3b 20 cd 9e 38 6c af 1c b8 4d 0b 05 24 0a 55 19 41 57 ab fe f7 b5 93 a0 55 61 58 0d d8 60 27 ef 3d db 09 b4 c7 d3 ba fa 7c db ed 8f 93 7a 33 0c ef 0f 4d 73 3e 9f f9 59 f3 c3 c7 ba 51 42 88 06 57 d4 d5 79 bb 1c 36 93 da 84 ba da ac b6 eb cd 90 3f 9f b6 ab f3 cf c3 e7 a4 16 95 a8 4c c0 57 3d 6d 97 ab d7 e3 b4 3d 0e bf 77 ab 29 ef ff bc 6e 77 bb 87 fd 61 bf 7a fc e2 cf f9 db 0f 23 e8 79 fc 6a 9b bc ac 6d f2 a6 8f d5 cb 50 bd ec fa 23 ca e9 ef b1 36 d3 f6 bd 1f 36 97 75 cf 75 b5 9c d4 4f 46 80 56 dc fa 30 37 62 a6 d5 5c bb 99 0a 73 ad 66 ca cc 55 e0 de b9 4e 0a ee 42 84 e2 04 3e 12 64 04 2d 7a 0c a5 78 89 32 cb ad f1 4c 72 0b 52 72 29 dc c5 e5 ac e2 4a 46 cc 7a 19 3b 4c 68 af a1 b8 Data Ascii: }UMo"1+G; 8lM$UAWUaX`'=\|z3Ms>YQBWy6?LW=m=w)nwaz#yjmP#66uuOFV07b\sfUNB>d-zx2LrRr)JFz;Lh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.17	49758	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:30 UTC	427	OUT	GET /shared/1.0/content/images/appbackgrounds/49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:30 UTC	755	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:30 GMT Content-Type: image/jpeg Content-Length: 987 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:42 GMT ETag: 0x8DB5C3F457E15E1 x-ms-request-id: 4775f065-901e-007a-18dc-25e1bb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153530Z-17fbfdc98bbndwgn5b4pg7s8bs00000007eg000000003uua x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:30 UTC	987	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 66 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 04 01 1a 00 05 00 00 00 01 00 00 00 3e 01 1b 00 05 00 00 00 01 00 00 00 46 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 10 00 00 00 4e 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 70 61 69 6e 74 2e 6e 65 74 20 34 2e 32 2e 39 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a Data Ascii: JFIFHHfExifMM*>F(1NHHpaint.net 4.2.9CC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.17	49760	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:30 UTC	418	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:30 UTC	800	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:30 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4911527F x-ms-request-id: f7e7a450-101e-0074-1f94-25c80b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153530Z-r1755647c66mgrw7zd8m1pn55000000008eg000000004u1k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:30 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.17	49759	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:30 UTC	404	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:30 UTC	738	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:30 GMT Content-Type: image/x-icon Content-Length: 17174 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Sun, 18 Oct 2020 03:02:03 GMT ETag: 0x8D8731230C851A6 x-ms-request-id: d812c704-401e-0018-7853-211c31000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153530Z-r1755647c66h2wzt2z0cr0zc740000000430000000004tcg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:30 UTC	15646	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-10-24 15:35:30 UTC	1528	IN	Data Raw: 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 Data Ascii: ( @{L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.17	49761	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:30 UTC	421	OUT	GET /shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc2e13.jpg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:31 UTC	764	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:31 GMT Content-Type: image/jpeg Content-Length: 17453 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:42 GMT ETag: 0x8DB5C3F4584F323 x-ms-request-id: d665c8b3-a01e-0072-02dc-25c419000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153531Z-r1755647c66wjht63r8k9qqnrs00000008bg000000008m4k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-24 15:35:31 UTC	15620	IN	Data Raw: ff d8 ff e1 09 50 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e Data Ascii: Phttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syn
2024-10-24 15:35:31 UTC	1833	IN	Data Raw: 14 45 41 44 01 40 00 04 11 40 00 01 00 14 01 40 00 00 10 01 40 14 40 00 00 50 00 00 04 00 00 05 00 45 00 00 05 00 00 01 00 05 50 00 00 04 00 00 05 1f ff d3 db c0 6d cd 05 45 00 00 00 04 50 1c 8a 02 00 00 00 00 04 48 aa 0e 45 15 10 00 00 00 00 00 04 82 80 90 50 10 00 04 01 44 14 51 14 10 51 11 05 01 05 40 00 00 00 00 15 40 00 00 00 40 54 50 42 28 00 00 00 00 00 00 00 02 80 00 00 00 20 00 02 a2 8a 00 00 00 00 0a 02 00 00 00 02 28 00 8a 80 00 a0 02 0a 08 a8 28 08 a0 00 02 80 a8 22 80 88 a0 2a 28 00 02 00 28 20 a2 08 28 08 00 02 88 00 0a 82 80 8a 00 00 8a 00 00 08 00 00 02 00 00 00 0a 00 a8 a8 a0 82 a2 00 00 00 8a 00 a0 02 00 02 80 20 00 00 00 00 80 00 00 22 a0 a0 20 00 2a 2a 00 02 8a 80 8a 20 82 88 00 00 00 0a 00 a0 00 00 08 02 a8 8a 02 00 28 00 80 02 80 02 Data Ascii: EAD@@@@@PEPmEPHEPDQQ@@@TPB( (("(( ( " * (

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.17	49762	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:31 UTC	415	OUT	GET /shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:31 UTC	755	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:31 GMT Content-Type: image/png Content-Length: 5139 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:45 GMT ETag: 0x8DB5C3F475BAFC0 x-ms-request-id: 78bff06f-001e-003e-6e47-232396000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153531Z-17fbfdc98bbh7l5skzh3rekksc00000000mg000000006nw2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:31 UTC	5139	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 56 00 00 00 48 08 06 00 00 00 ad 04 dd dc 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 25 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 38 20 37 39 2e 31 36 34 30 33 36 2c 20 32 30 31 39 2f 30 38 2f 31 33 2d 30 31 3a 30 36 3a 35 37 20 20 Data Ascii: PNGIHDRVHtEXtSoftwareAdobe ImageReadyqe<%iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.17	49763	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:31 UTC	439	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:32 UTC	812	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:31 GMT Content-Type: application/x-javascript Content-Length: 35168 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 15 Aug 2024 17:52:55 GMT ETag: 0x8DCBD5317AEB807 x-ms-request-id: 56cb9c74-701e-004d-51b3-233317000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153531Z-r1755647c66cdf7jx43n17haqc0000000arg0000000050rm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:32 UTC	15572	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 c4 bd 6b 43 db 48 b2 30 fc fd f9 15 e0 9d 65 ac b5 00 df 30 18 70 58 06 92 49 76 33 93 9c 5c 66 cf 2e 30 59 59 96 6d 0d b2 65 24 99 4b 02 cf 6f 7f eb d2 97 6a c9 90 cc 9c 67 df 33 e7 6c 70 57 df aa ab ab ab ab aa ab 5b db 7f 59 ff 3f 6b 7f 59 db fc f6 ff d6 de 7f 38 7e f7 61 ed cd 8b b5 0f 2f 5f bd 3b 5d 7b 0b a9 7f ae fd fc e6 c3 ab 93 e7 df de 0e 76 8a ff fb 30 8d f3 b5 71 9c 44 6b f0 77 18 e4 d1 68 2d 9d af a5 d9 5a 3c 0f d3 6c 91 66 41 11 e5 6b 33 f8 37 8b 83 64 6d 9c a5 b3 b5 62 1a ad 2d b2 f4 b7 28 2c f2 b5 24 ce 0b a8 34 8c 92 f4 66 ad 0e cd 65 a3 b5 b7 41 56 dc ad bd 7a eb 6d 41 fb 11 b4 16 4f e2 39 d4 0e d3 c5 1d fc 9e 16 6b f3 b4 88 c3 68 2d 98 8f a8 b5 04 12 f3 3c 5a 5b ce 47 51 b6 76 33 8d c3 e9 da 4f 71 98 a5 79 Data Ascii: kCH0e0pXIv3\f.0YYme$Kojg3lpW[Y?kY8~a/_;]{v0qDkwh-Z<lfAk37dmb-(,$4feAVzmAO9kh-<Z[GQv3Oqy
2024-10-24 15:35:32 UTC	16384	IN	Data Raw: 19 bb cd 17 f0 ef de f3 f6 f9 b2 b5 d7 7c 4e 0e b1 1f 36 e9 cf 0b fc b7 7d 4c 89 36 e5 f4 9a 94 e0 c7 fe 7a 3d 4e 40 b1 17 cf 5f e0 bf 2f 5e f4 37 e9 cf 0f 17 f7 e7 cb 53 30 14 ce e0 cf c9 0f a7 f8 ef c9 29 03 db 2f 08 78 8c 4d c1 9f 0e 43 3b 54 f4 74 b7 b3 49 7f 8e 09 fa 43 b7 49 65 9b 2d fc b7 cd 35 76 5f 5c 6c d3 a8 db 5f 23 2a cd c3 eb 78 7e f9 3a 18 46 09 d3 b1 83 c4 33 19 a7 51 5e c4 73 7a b4 81 b3 bb 4e f6 87 b8 48 22 ce d8 61 4a 77 7e bf 61 60 fd 83 c6 70 c7 3d 2a 24 65 3c ff 29 b8 05 65 8f 7e 92 28 a6 5f 03 b4 d0 e7 83 d6 01 a5 0e c3 03 62 c3 7e 07 64 3f 28 18 c0 de 59 28 e5 2a 95 c2 ad 0c bd 87 9b 9b 73 ef 0b 6e ef 4a 82 41 c5 98 db 07 16 9f 8d 40 26 e0 7b 08 5b f9 65 bc f8 90 5e 46 b8 dc fc 3e ee 76 a9 47 45 07 5c 78 b3 e5 cd 1b 0d e3 f9 ca 0c Data Ascii: \|N6}L6z=N@_/^7S0)/xMC;TtICIe-5v_\l_#x~:F3Q^szNH"aJw~a`p=$e<)e~(_b~d?(Y(*snJA@&{[e^F>vGE\x
2024-10-24 15:35:32 UTC	3212	IN	Data Raw: 38 5d 1d 96 55 52 b0 ee 65 51 a5 80 82 a6 5f a3 d8 a6 8c a4 8c 2d e9 61 bf de 76 31 e7 b5 b7 35 ec ae ac a0 fd 7a 5a e0 51 85 64 9c 71 86 da 05 75 05 e2 2f c1 e3 1b 2e e0 ac 2b f3 db b5 61 3f 28 3c f2 32 68 91 01 35 d9 bf 91 79 ee 76 ca 31 5d 87 e6 ce b3 68 e5 9d 9d 2e 03 be 71 96 2f 47 c1 de 90 b1 6d de b2 47 e1 bd a3 cd 0e 87 4e c4 50 4c ad 76 42 79 13 eb d1 84 ba 89 a8 ec 51 f8 46 ef 45 5e 59 6d ae 8d 02 82 52 f5 51 9c a3 01 35 fe 52 6d 5e eb b5 46 a5 5a 61 3a 08 21 bc 5e 6d 35 58 78 bd 56 2c 36 30 9c 5e 86 cf 75 f6 7b 81 77 02 f8 55 8d 84 b0 cc 45 ca d8 44 7f 89 74 f2 8a 88 52 95 62 2a a5 20 69 a9 dc a0 a0 52 ad a5 a2 81 21 b3 5b 2a a1 61 96 92 ca fe c5 54 63 90 d5 37 2a 4e bc 5d 53 05 b2 91 97 6a d4 5c e7 b2 d7 69 fe 72 6e 06 bd 93 76 bf 82 ed 7e 78 Data Ascii: 8]UReQ_-av15zZQdqu/.+a?(<2h5yv1]h.q/GmGNPLvByQFE^YmRQ5Rm^FZa:!^m5XxV,60^u{wUEDtRb* iR![aTc7N]Sj\irnv~x

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.17	49768	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:41 UTC	668	OUT	GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:41 UTC	734	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:41 GMT Content-Type: image/gif Content-Length: 2672 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:47 GMT ETag: 0x8DB5C3F48EC4154 x-ms-request-id: afcb2bb6-d01e-0078-2e09-2560ae000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153541Z-r197bdfb6b4kkrkjudg185sarw00000001zg00000000ctk8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:41 UTC	2672	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e 69 18 14 00 21 Data Ascii: GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~i!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.17	49767	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:41 UTC	662	OUT	GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:41 UTC	734	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:41 GMT Content-Type: image/gif Content-Length: 3620 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4904824B x-ms-request-id: 9d0e55f8-301e-005c-4987-25a9a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153541Z-16849878b78jfqwd1dsrhqg3aw00000007yg00000000har5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:41 UTC	3620	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 0f Data Ascii: GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.17	49770	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:42 UTC	423	OUT	GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:42 UTC	734	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:42 GMT Content-Type: image/gif Content-Length: 2672 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:47 GMT ETag: 0x8DB5C3F48EC4154 x-ms-request-id: 0f3af603-301e-001a-6f88-25d536000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153542Z-17fbfdc98bbngfjxtncsq24exs00000000x00000000079ep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:42 UTC	2672	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e 69 18 14 00 21 Data Ascii: GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~i!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.17	49771	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:42 UTC	417	OUT	GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:42 UTC	734	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:42 GMT Content-Type: image/gif Content-Length: 3620 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4904824B x-ms-request-id: 8b5f0480-c01e-0031-554e-2355fa000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153542Z-17fbfdc98bbvvplhck7mbap4bw00000000wg000000005pf7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:42 UTC	3620	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 0f Data Ascii: GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.17	49774	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:44 UTC	616	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pidpdisambiguation_8e15caf4c90cec4857ee.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:44 UTC	811	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:44 GMT Content-Type: application/x-javascript Content-Length: 2419 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 15 Aug 2024 17:52:55 GMT ETag: 0x8DCBD53179165EC x-ms-request-id: 8f66c9fb-001e-006b-4a5e-2544a2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153544Z-16849878b78k8q5pxkgux3mbgg00000007w000000000au8k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:44 UTC	2419	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 dd 58 6d 6f db 38 12 fe de 5f 41 6b 81 44 da ca b2 9d f7 38 55 8b ac 93 6c b3 d7 26 39 db dd c5 a1 29 0c 5a a2 2d d6 12 29 90 94 1d 5f e2 ff 7e 43 bd d8 96 5f 92 b4 f7 e5 f6 0c 24 92 a8 e1 cc 70 e6 79 86 43 d5 7e ad bc 41 bf a2 ea eb 7f a8 d3 3d 6f 77 d1 ed 15 ea 7e bc 6e 5f a0 3b 78 fa 17 ba b9 ed 5e b7 2e 5f af 47 1b d5 7f dd 80 4a 34 a0 21 41 70 ed 63 49 7c c4 19 e2 02 51 e6 71 11 73 81 15 91 28 82 ff 82 e2 10 0d 04 8f 90 0a 08 8a 05 ff 4e 3c 25 51 48 a5 82 49 7d 12 f2 09 32 41 9d f0 d1 1d 16 6a 8a ae ef 2c 07 f4 13 d0 46 87 94 c1 6c 8f c7 53 b8 0f 14 62 5c 51 8f 20 cc fc 54 5b 08 0f 4c 12 94 30 9f 08 34 09 a8 17 a0 cf d4 13 5c f2 81 42 82 78 84 8e c1 88 4c 60 bc 6c c2 46 58 10 24 89 42 03 2e 54 90 f9 e1 a0 8e 96 cc b5 ca Data Ascii: Xmo8_AkD8Ul&9)Z-)_~C_$pyC~A=ow~n_;x^._GJ4!ApcI\|Qqs(N<%QHI}2Aj,FlSb\Q T[L04\BxL`lFX$B.T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.17	49776	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:45 UTC	431	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pidpdisambiguation_8e15caf4c90cec4857ee.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:45 UTC	818	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:45 GMT Content-Type: application/x-javascript Content-Length: 2419 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 15 Aug 2024 17:52:55 GMT ETag: 0x8DCBD53179165EC x-ms-request-id: 8f66c9fb-001e-006b-4a5e-2544a2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153545Z-r1755647c66tmf6g4720xfpwpn0000000as0000000004gmf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-24 15:35:45 UTC	2419	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 dd 58 6d 6f db 38 12 fe de 5f 41 6b 81 44 da ca b2 9d f7 38 55 8b ac 93 6c b3 d7 26 39 db dd c5 a1 29 0c 5a a2 2d d6 12 29 90 94 1d 5f e2 ff 7e 43 bd d8 96 5f 92 b4 f7 e5 f6 0c 24 92 a8 e1 cc 70 e6 79 86 43 d5 7e ad bc 41 bf a2 ea eb 7f a8 d3 3d 6f 77 d1 ed 15 ea 7e bc 6e 5f a0 3b 78 fa 17 ba b9 ed 5e b7 2e 5f af 47 1b d5 7f dd 80 4a 34 a0 21 41 70 ed 63 49 7c c4 19 e2 02 51 e6 71 11 73 81 15 91 28 82 ff 82 e2 10 0d 04 8f 90 0a 08 8a 05 ff 4e 3c 25 51 48 a5 82 49 7d 12 f2 09 32 41 9d f0 d1 1d 16 6a 8a ae ef 2c 07 f4 13 d0 46 87 94 c1 6c 8f c7 53 b8 0f 14 62 5c 51 8f 20 cc fc 54 5b 08 0f 4c 12 94 30 9f 08 34 09 a8 17 a0 cf d4 13 5c f2 81 42 82 78 84 8e c1 88 4c 60 bc 6c c2 46 58 10 24 89 42 03 2e 54 90 f9 e1 a0 8e 96 cc b5 ca Data Ascii: Xmo8_AkD8Ul&9)Z-)_~C_$pyC~A=ow~n_;x^._GJ4!ApcI\|Qqs(N<%QHI}2Aj,FlSb\Q T[L04\BxL`lFX$B.T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.17	49778	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:45 UTC	667	OUT	GET /shared/1.0/content/images/picker_account_aad_a8332c62695d74843a11daf39a74e552.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:45 UTC	778	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:45 GMT Content-Type: image/svg+xml Content-Length: 628 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4963155C x-ms-request-id: c8446706-c01e-003a-6c87-24e683000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153545Z-r197bdfb6b4lbgfqwkqbrm672s00000001hg00000000xcpr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:45 UTC	628	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 6d 94 4d 6f db 30 0c 86 ff 8a e1 5d 25 46 d4 97 a5 36 09 90 9d 72 58 af 3b f4 e6 26 69 1d c0 5d 8b 26 48 5a 0c fd ef 23 25 ba cb d6 42 f1 e3 98 34 c5 57 24 93 f9 e1 f4 d0 bc 3e 8e bf 0e 8b 76 38 1e 9f af 66 b3 f3 f9 0c 67 07 4f 2f 0f 33 6b 8c 99 d1 1b 6d 73 de 6f 8f c3 a2 f5 a9 6d 86 dd fe 61 38 d6 ef a7 fd ee fc fd e9 75 d1 9a c6 34 3e d1 a7 5d ce b7 bb fb c3 72 7e 38 be 8d bb 25 f4 bf ef f7 e3 78 f5 6d 17 79 5d bf c3 9d 18 bc e1 75 fd 3e 9f d5 37 e7 b3 1a b7 d9 bf 6c c6 5d b3 19 fb 03 69 ea db 66 43 db 5b 4f f7 b7 7a 7f 29 b7 d9 72 fe dc 1f 87 e9 bd bb b6 d9 2e da 1b 67 21 28 f4 2b 04 9f ad aa 34 b4 50 39 af 30 40 f8 e9 12 84 e2 f6 aa 52 dc 1c e8 cd a0 b1 fb c2 8b 5e 71 dc 49 5b f7 95 37 94 a4 83 87 d4 b9 51 3b 1d 07 0b 36 Data Ascii: mMo0]%F6rX;&i]&HZ#%B4W$>v8fgO/3kmsoma8u4>]r~8%xmy]u>7l]ifC[Oz)r.g!(+4P90@R^qI[7Q;6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.17	49779	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:45 UTC	667	OUT	GET /shared/1.0/content/images/picker_account_msa_3b879963b4f70829fd7a25cbc9519792.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:45 UTC	806	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:45 GMT Content-Type: image/svg+xml Content-Length: 254 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F496CFFA1 x-ms-request-id: b1fd3aff-101e-0015-2671-25d4e5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153545Z-r197bdfb6b4tq6ldv3s2dcykm800000001pg00000000ptww x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-24 15:35:45 UTC	254	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 6d 50 cb 6e c3 20 10 fc 15 44 af 78 59 30 06 5c d9 96 d2 7b 7f 20 37 cb a1 06 c9 79 c8 46 21 fd fb 9a 90 f6 54 0d 9a 59 98 59 ad 96 6e bb cf e4 71 5e 2e 5b 4f 7d 8c b7 77 ce 53 4a 90 6a b8 ae 33 97 88 c8 f7 04 25 29 9c a2 ef a9 b2 94 78 17 66 1f 4b 7d 0f 2e 7d 5c 1f 3d 45 82 44 d9 fd d0 a1 8b 21 2e 6e 18 b7 cd c5 ad e3 e5 d6 4d 61 9d 16 47 a6 3d 2b 15 25 d3 77 d1 b5 c8 57 58 96 9e be 39 9d 41 f9 d0 dd c6 e8 c9 a9 a7 9f a2 06 a5 58 ad bd 80 56 8e 16 b4 62 4f 42 26 32 0c 48 cb b0 98 02 a1 31 35 7b 09 66 54 1a 1a dd 56 2d 18 23 98 01 6d 0b e5 66 ac 0c b4 56 32 3c fc d3 c7 7e c7 1e cf 0a 6c 25 34 d4 f2 d0 80 d1 ec 49 65 b8 54 4c 36 39 96 df f4 8b b1 98 16 76 57 b4 fb b0 e3 df 76 0a 33 f2 76 f9 4f 87 1f 7d d7 81 14 7b 01 00 00 Data Ascii: mPn DxY0\{ 7yF!TYYnq^.[O}wSJj3%)xfK}.}\=ED!.nMaG=+%wWX9AXVbOB&2H15{fTV-#mfV2<~l%4IeTL69vWv3vO}{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.17	49780	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:46 UTC	422	OUT	GET /shared/1.0/content/images/picker_account_aad_a8332c62695d74843a11daf39a74e552.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:46 UTC	799	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:46 GMT Content-Type: image/svg+xml Content-Length: 628 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4963155C x-ms-request-id: 92fee445-101e-001d-3e2e-22b955000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153546Z-r1755647c66f4bf880huw27dwc00000000kg000000005y5m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 15:35:46 UTC	628	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 6d 94 4d 6f db 30 0c 86 ff 8a e1 5d 25 46 d4 97 a5 36 09 90 9d 72 58 af 3b f4 e6 26 69 1d c0 5d 8b 26 48 5a 0c fd ef 23 25 ba cb d6 42 f1 e3 98 34 c5 57 24 93 f9 e1 f4 d0 bc 3e 8e bf 0e 8b 76 38 1e 9f af 66 b3 f3 f9 0c 67 07 4f 2f 0f 33 6b 8c 99 d1 1b 6d 73 de 6f 8f c3 a2 f5 a9 6d 86 dd fe 61 38 d6 ef a7 fd ee fc fd e9 75 d1 9a c6 34 3e d1 a7 5d ce b7 bb fb c3 72 7e 38 be 8d bb 25 f4 bf ef f7 e3 78 f5 6d 17 79 5d bf c3 9d 18 bc e1 75 fd 3e 9f d5 37 e7 b3 1a b7 d9 bf 6c c6 5d b3 19 fb 03 69 ea db 66 43 db 5b 4f f7 b7 7a 7f 29 b7 d9 72 fe dc 1f 87 e9 bd bb b6 d9 2e da 1b 67 21 28 f4 2b 04 9f ad aa 34 b4 50 39 af 30 40 f8 e9 12 84 e2 f6 aa 52 dc 1c e8 cd a0 b1 fb c2 8b 5e 71 dc 49 5b f7 95 37 94 a4 83 87 d4 b9 51 3b 1d 07 0b 36 Data Ascii: mMo0]%F6rX;&i]&HZ#%B4W$>v8fgO/3kmsoma8u4>]r~8%xmy]u>7l]ifC[Oz)r.g!(+4P90@R^qI[7Q;6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.17	49781	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:46 UTC	422	OUT	GET /shared/1.0/content/images/picker_account_msa_3b879963b4f70829fd7a25cbc9519792.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:46 UTC	806	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:46 GMT Content-Type: image/svg+xml Content-Length: 254 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F496CFFA1 x-ms-request-id: 421052fe-001e-0057-6a21-2652c8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153546Z-17fbfdc98bbczcjda6v8hpct4c0000000130000000007uwa x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-24 15:35:46 UTC	254	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 6d 50 cb 6e c3 20 10 fc 15 44 af 78 59 30 06 5c d9 96 d2 7b 7f 20 37 cb a1 06 c9 79 c8 46 21 fd fb 9a 90 f6 54 0d 9a 59 98 59 ad 96 6e bb cf e4 71 5e 2e 5b 4f 7d 8c b7 77 ce 53 4a 90 6a b8 ae 33 97 88 c8 f7 04 25 29 9c a2 ef a9 b2 94 78 17 66 1f 4b 7d 0f 2e 7d 5c 1f 3d 45 82 44 d9 fd d0 a1 8b 21 2e 6e 18 b7 cd c5 ad e3 e5 d6 4d 61 9d 16 47 a6 3d 2b 15 25 d3 77 d1 b5 c8 57 58 96 9e be 39 9d 41 f9 d0 dd c6 e8 c9 a9 a7 9f a2 06 a5 58 ad bd 80 56 8e 16 b4 62 4f 42 26 32 0c 48 cb b0 98 02 a1 31 35 7b 09 66 54 1a 1a dd 56 2d 18 23 98 01 6d 0b e5 66 ac 0c b4 56 32 3c fc d3 c7 7e c7 1e cf 0a 6c 25 34 d4 f2 d0 80 d1 ec 49 65 b8 54 4c 36 39 96 df f4 8b b1 98 16 76 57 b4 fb b0 e3 df 76 0a 33 f2 76 f9 4f 87 1f 7d d7 81 14 7b 01 00 00 Data Ascii: mPn DxY0\{ 7yF!TYYnq^.[O}wSJj3%)xfK}.}\=ED!.nMaG=+%wWX9AXVbOB&2H15{fTV-#mfV2<~l%4IeTL69vWv3vO}{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.17	49784	13.107.253.67	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:49 UTC	593	OUT	GET /shared/5/js/login_en_-dc6Oo3iAoBIzmNJ3pErjQ2.js HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.live.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:49 UTC	792	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:49 GMT Content-Type: application/x-javascript Content-Length: 240155 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Tue, 15 Oct 2024 15:10:46 GMT ETag: 0x8DCED2B8BC94977 x-ms-request-id: 32f21793-201e-0039-61be-234ff5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153549Z-r1755647c66n5bjpba5s4mu9d000000009wg000000009863 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:49 UTC	15592	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 dc bd 6b 77 db b8 b2 20 fa fd fe 0a 5b 37 4b 8b 3c 86 15 c9 ce 93 0a 5b 93 c4 71 27 dd 79 75 1e 9d a4 bd 3d 5e b4 04 5b 4c 24 52 21 29 3b 8e ad ff 7e eb 81 27 49 39 c9 3e 73 66 ce 9d ac 15 0b 04 41 a0 50 28 00 55 85 aa c2 cd ff d8 dc d8 cf 8b 8d 59 3a 96 59 29 37 d2 ec 24 2f e6 49 95 e6 d9 c6 62 26 13 c8 2a a5 dc 98 e5 a7 69 76 24 b3 de e7 b2 f7 fc d9 e3 27 2f df 3e e9 55 df aa 8d ff b8 f9 ff 6c 9e 2c b3 31 96 0f c2 cb b3 a4 d8 90 a2 12 99 28 44 2e d2 f8 f2 f6 60 f7 76 64 0a d0 ab f0 b2 b3 c4 5a ab 22 1d 57 9d 21 7e 52 c4 59 b0 73 ff f6 20 14 79 7c 39 9e a6 b3 c9 e3 3c ab e4 b7 ea dd c5 42 96 d1 66 5f 8c ed 73 ed 91 5e 4f e4 49 b2 9c 55 af 8b 7c c1 cf 69 b9 98 25 17 2f 93 39 15 3f 95 d5 5e ad 04 65 15 e9 99 9c bc ad 92 4a ee Data Ascii: kw [7K<[q'yu=^[L$R!);~'I9>sfAP(UY:Y)7$/Ib&*iv$'/>Ul,1(D.`vdZ"W!~RYs y\|9<Bf_s^OIU\|i%/9?^eJ
2024-10-24 15:35:49 UTC	16384	IN	Data Raw: ec 29 da de 8b dd 5b 9c 66 34 ec de c6 16 81 19 db 85 f6 9e e6 73 fc e6 ae 87 d9 dd 7b 0e 66 77 ef fb 68 bd d5 f7 90 7a 0b 6a 7b 96 95 12 6d 2d 6e dd b1 f8 1d 60 1f f7 07 98 00 48 f6 77 30 01 60 ec ef 62 02 be d9 bf 85 09 f8 60 ff 36 26 00 80 fd 3b 98 80 a6 f7 ef 62 02 9a dd bf 87 a8 82 f6 f6 ef 63 62 80 15 f6 31 45 55 63 dd 3b 58 f7 00 2b bf 05 95 bf 5c ce 19 1f 03 84 ca 1d aa 9d 1d 78 8d 2a 42 18 96 c4 9b 09 40 dd 75 2d 0e 91 bc a6 ff 3c 3f a0 67 f4 64 c1 5f e2 f8 bc 81 f6 ee 7a 51 cb 84 3d a4 b4 4a 1c 8e b0 2a 63 9a 5d e1 48 8d 7a d4 76 9c 28 6b 47 ea 5a 9f 6b 75 fb 5c 65 aa 80 c3 8f 0e e9 0e 79 07 ae a8 03 9d d5 2e 94 ff be 3e b0 00 a6 2b 51 1a 1f 3e a8 5c af 27 d4 8b 40 db da d5 82 11 c2 04 4c 7e a1 ba b0 e6 b3 1f a2 c1 e0 00 eb a2 83 d8 5f 02 e0 97 Data Ascii: )[f4s{fwhzj{m-n`Hw0`b`6&;bcb1EUc;X+\xB@u-<?gd_zQ=Jc]Hzv(kGZku\ey.>+Q>\'@L~_
2024-10-24 15:35:49 UTC	16384	IN	Data Raw: fb a7 c6 cb 3f 14 d4 a7 53 ff 98 ef 2f 6a 15 23 00 1a 8a 14 01 dc 18 2a 9c bc 4b fd ad 67 c2 5e df da 8a b5 85 6c d4 38 57 bb c6 8f 47 33 56 ae 34 66 ff 10 ae 5d 8c f4 d1 1c 24 27 7b d8 b6 4c 61 a3 0f c6 b1 a3 09 a8 25 d4 57 1f 78 e1 2d 49 a8 e4 8f 2b 1b 25 1d 59 9d 91 2d 52 76 80 c1 49 7b e2 b0 ee 57 52 1f cb a1 c4 68 70 42 51 91 e0 ce e8 6f a9 d2 75 af d2 41 28 c9 d3 16 57 29 d2 b5 5d 56 b5 e3 18 ea 19 c9 fe 9c cc 4b 0a 4a 2d c4 d5 1d ef 9e 51 d1 fa 7f 83 cd 46 2c d3 74 f6 65 6e 74 d8 cf cc 57 c3 77 6d 69 61 2e 8a e7 6d 1a d4 b1 6c eb dc 6c 6b b8 cc b4 16 f6 03 ea b9 d9 8b 81 78 b7 a3 e2 c9 c0 37 a3 31 3a 52 8d 08 2c b5 69 df 6a 69 a9 a9 0c ce 30 f7 a8 96 b4 54 3f c1 a9 0c df 58 2e 1d 88 1e ac 60 93 b1 92 6c 6d dc e0 65 4b 90 03 d9 86 1d 44 14 c0 8d a0 Data Ascii: ?S/j#*Kg^l8WG3V4f]$'{La%Wx-I+%Y-RvI{WRhpBQouA(W)]VKJ-QF,tentWwmia.mllkx71:R,iji0T?X.`lmeKD
2024-10-24 15:35:49 UTC	16384	IN	Data Raw: db d3 8c 32 95 ad 61 f5 83 a7 bd 2a 2e 2b 90 0e a3 55 ec de a6 b4 fc 6e ee 49 ab 21 c6 80 2e 31 6c b5 ea 8a da ec c1 b6 fa e4 61 c5 ec 36 9f f1 c7 b7 b7 79 7a db 52 de da 5c c2 ee 71 c2 1a e9 c2 9c d2 0e 50 9a a8 0b 2c e7 01 ff 72 c2 f4 54 45 98 ce 54 d6 e7 69 98 9e cc 4e 47 05 19 dd e6 73 e0 d7 51 f9 88 97 68 f4 9a 0a d8 53 f8 b5 d2 cc 8a 46 a6 5c 22 19 1a ea 0e 8f 75 47 ca 86 5b db ec d8 75 82 91 93 19 d0 bc 9a 62 fc 63 7c 91 22 fb 2b ba f9 5d f6 0b ad b1 ad 14 51 ba 40 e4 16 d1 5e 8c be e4 30 2f 0d 24 e3 12 4d 30 f8 20 58 a5 a1 d9 96 0b ba b3 e5 cb 61 78 9a 01 b0 dd 23 48 00 6d a5 50 18 23 53 ba 23 d3 a6 ff 18 b3 d2 3c 42 3d a4 4c ff 43 5e a2 6d e0 33 13 ac a1 75 78 41 4b b5 2d 23 37 60 a9 50 97 b8 6c af 75 14 00 d9 f2 31 2b 36 ec af 0c 3f ce d8 57 0d Data Ascii: 2a*.+UnI!.1la6yzR\qP,rTETiNGsQhSF\"uG[ubc\|"+]Q@^0/$M0 Xax#HmP#S#<B=LC^m3uxAK-#7`Plu1+6?W
2024-10-24 15:35:49 UTC	16384	IN	Data Raw: 04 16 fc c4 10 b4 b6 e6 8e 41 d5 0b 63 d0 6a 9d 37 86 d9 cc 7d 85 b3 b4 f2 b4 a1 ab 5b 9f fe b5 5f c0 f7 be cc 0b f8 e9 bd 5e c0 3f 7e e5 17 f0 d3 ff d0 0b f8 c7 ff a8 04 67 1b 0f f9 1c 6e 75 39 a9 4a 91 a0 9d 1e 61 91 ec da cb 10 10 36 b7 e2 1a 92 98 9d 11 c3 32 21 17 85 ec b7 f6 48 bc 4e 05 79 32 1a 15 57 0d a1 50 9d 19 c5 b2 bd 8e 7a e1 4b 40 08 9b 40 e5 5c bf 9c e4 39 9c d6 28 55 57 11 6f 09 b9 3a f2 0e c3 45 2b 85 50 9d 1e 27 33 1e 5f 26 d7 82 8d bd 0b 74 1a 63 2a 3c e6 f6 28 aa 12 65 51 44 8c fe 13 96 13 bf 8d 04 52 d6 41 71 f5 a7 2a 83 88 e3 19 a1 f2 ad 61 92 85 bb f1 4b 94 e8 4f fd 67 98 b5 18 cb 32 9f 24 83 c1 90 f9 bc 21 c5 bf 26 ce 4a 21 52 b6 ff 2d 20 b1 71 d0 53 36 76 21 75 32 84 42 5c 1a 72 4e 3a 9c 70 6f f0 84 7b a3 9d 70 af e1 bb 17 65 b8 Data Ascii: Acj7}[_^?~gnu9Ja62!HNy2WPzK@@\9(UWo:E+P'3_&tc<(eQDRAqaKOg2$!&J!R- qS6v!u2B\rN:po{pe
2024-10-24 15:35:49 UTC	16384	IN	Data Raw: d9 d6 83 f6 7a aa 1b 6e 67 4d 7b cb 6c 6c e6 4e e7 92 e7 ed 74 b3 83 69 7f a9 6d e4 d9 bb 22 6b 02 ed 85 98 6e ab 61 63 db 0f 36 33 8c f5 ba dc 00 34 dd a1 1e 60 a7 63 71 61 5a f6 89 5d e3 bf 8e 43 22 d5 e3 16 ec d9 70 c2 6f fd e7 67 ac e9 9b ec 2d 1e d8 59 4e e7 e2 b1 65 7e 8b 60 ac de d9 b8 80 84 d5 9c 5d 49 78 1d 8f ef 4c 44 bb e3 82 82 d4 fa 40 21 69 5c 1e d2 c5 10 9a 18 ad ae c8 71 eb 74 7c 63 11 1f e6 c5 54 bb a1 e9 74 fc ec 98 2c a6 da b3 27 37 1e 69 ab e1 3e f9 fc 19 fe 01 be 36 e2 97 03 be 00 4b b6 e3 12 c6 f5 e3 44 57 ae 74 bf 4b f4 e8 d9 a6 bc a1 76 58 96 c7 93 5f 7e 39 3d 3d 1d 9f da e3 bc 38 f8 c5 32 0c e3 97 e5 07 0c 57 c6 7f 47 a2 cc b3 97 f7 80 b0 4a fd 21 69 3f b1 d4 5d fd 50 4b b2 0f 60 5a 96 eb 23 c6 94 5f 1b 3e 56 fc fd d7 4a 18 2c 32 Data Ascii: zngM{llNtim"knac634`cqaZ]C"pog-YNe~`]IxLD@!i\qt\|cTt,'7i>6KDWtKvX_~9==82WGJ!i?]PK`Z#_>VJ,2
2024-10-24 15:35:49 UTC	16384	IN	Data Raw: 9d e4 eb 9c 2f 71 c5 2c 52 8d 0d c1 18 a4 c2 e8 cc 5c f6 c5 39 a8 a0 8d 76 f8 c1 34 64 12 93 59 c3 16 6b 37 da 7e 1d 40 e6 32 2c b5 19 1c c2 23 26 50 47 90 fa f0 08 0f 65 aa 51 11 62 d0 ad ab 53 54 7b b3 d3 01 8f 35 73 7e 25 2a 01 73 8b ef f3 4a 18 39 28 f8 d5 32 22 6b 50 16 ad dc e6 b9 7d 36 8e fa 41 23 c0 4e e3 f7 ff d8 83 46 ba 26 53 a1 fa 7e 51 7f 9e d8 7c d8 b9 e8 05 3d 84 c4 37 26 84 e1 37 3b e8 b8 ce 71 5d e2 58 3c 87 21 5c d5 5b a0 d9 e3 19 ab ee 17 83 1a f3 fe 9f f5 d2 12 23 ee 24 fb 30 78 93 25 ff 98 9e ce 97 c7 40 dd 62 61 bc e5 2f 93 95 89 d6 d8 40 53 98 56 df ce 98 44 d2 8d 17 37 64 19 7f e7 fb 96 f1 cf bf 8d 8c bf b3 93 8c 7f 77 c1 32 fe ce 25 c9 f8 77 97 20 e3 f7 bf 91 8c 7f f0 95 65 3c 16 de 7a c4 12 53 f7 d8 2b 5c aa b7 75 47 15 e0 f9 d7 Data Ascii: /q,R\9v4dYk7~@2,#&PGeQbST{5s~%*sJ9(2"kP}6A#NF&S~Q\|=7&7;q]X<!\[#$0x%@ba/@SVD7dw2%w e<zS+\uG
2024-10-24 15:35:49 UTC	16384	IN	Data Raw: bb a1 e4 cd 47 6b c8 66 ab dd 94 d8 1a 6b 65 71 86 4a 6b 55 99 b5 a8 d2 8b 63 1c 74 18 a0 5f 2e 4e 20 c5 c1 71 b6 b3 6a 48 28 8f a5 d2 30 69 41 f9 6a d7 9e 9c 9e 1f 9c 1c b7 dc 5a 5d a2 53 90 46 2b e7 f4 f0 e2 6c fb 50 49 b3 bf df da 3b bf 86 4e bc 00 b4 96 65 61 b3 12 ea 23 33 bb c8 15 65 90 1e 2f b3 a0 25 f4 fb e4 cc ad ad 16 37 97 27 9a d9 5e 59 d2 5a 71 5b 8d 25 15 55 77 bd 7f b6 fd 92 4c ce da fa e3 c8 89 d4 73 61 a9 94 bd f1 38 ba 99 b2 8b 7a 5d 76 c1 e6 8c b1 d1 fb 60 f7 e2 f4 f0 60 07 c9 bd b0 b4 3a 4e 8c c7 d3 65 cb 2b 1c ea 7a 4d 2b 6f f6 68 1f 1d b4 08 93 3d 39 7f 05 73 79 e7 70 fb a2 b5 e7 d6 71 6e 98 62 f4 fe 39 df 7e e9 d6 97 95 ae 00 40 2e c5 f5 f1 f6 11 94 b8 aa 27 23 50 3e e7 8f b6 cf 77 5e c1 74 e6 0c 9f 94 bb 46 26 ba 21 2a c3 29 48 e2 Data Ascii: GkfkeqJkUct_.N qjH(0iAjZ]SF+lPI;Nea#3e/%7'^YZq[%UwLsa8z]v``:Ne+zM+oh=9sypqnb9~@.'#P>w^tF&!*)H
2024-10-24 15:35:49 UTC	16384	IN	Data Raw: 60 84 53 7b bb 41 6a 8a b8 45 31 4e 17 d1 e5 70 66 b6 ab 8e 5d 45 8a 25 40 da 0c 96 d3 45 cc 87 31 9c b8 fe 71 24 9d 16 6f a3 0a 70 ea d2 24 a9 ed 63 c5 b5 fd d4 34 60 8a 0d 85 76 bc 1e f9 f4 4a be c7 f6 9c 87 07 d1 b9 3a ef 1c 7c 8b 5f d5 9a 82 84 21 4c 05 e3 35 54 3e cd 7d 32 0b 2c cc 20 b9 67 91 23 45 76 6e e1 6e 90 0b b0 e0 cb 96 f5 de 52 8c b9 23 e7 82 07 bd aa be 66 cf 80 70 ad 74 95 a2 70 90 d3 54 17 ae af b5 94 3a 92 90 84 c6 2a a7 ce 9c ca 3c 3c 54 fa 1e 2f 2e bb c3 f7 c9 28 0a 67 02 e7 55 5a f2 c8 8b 22 5f fd cf 6a d3 ba f4 1f 3a 35 a0 2e 9a d6 eb 87 c6 d7 0f cf f7 6a f0 b3 3d 75 66 73 cf ad 35 a9 92 2f be aa e3 1b 1e 8f 5f 76 a8 85 19 43 5e b3 d1 59 31 bf b4 90 e1 34 9b 93 5b 62 d7 e3 a3 41 37 15 41 18 3c a3 0d c6 d9 1b e2 d5 fa 1f 41 07 e3 d7 Data Ascii: `S{AjE1Npf]E%@E1q$op$c4`vJ:\|_!L5T>}2, g#EvnnR#fptpT:*<<T/.(gUZ"_j:5.j=ufs5/_vC^Y14[bA7A<A
2024-10-24 15:35:49 UTC	16384	IN	Data Raw: fa b4 ad dc ef ae ed 2d 00 40 05 36 bb 7e df 58 ef cf 9d 64 62 df ef ad f7 bd e5 1c d9 18 f6 fd f3 f5 fd 8b f5 fd cb 35 ca 88 10 c5 ad 06 88 e3 00 2f fc 7e d5 46 69 b5 6b d6 db c4 46 95 8a 9d 7e 13 e6 8c 0f b2 7c 11 b4 05 d8 0f 77 76 16 f4 4d de 88 4f a1 3b 80 cf 97 f0 73 21 d6 e5 d9 9e b0 43 02 e4 6d 0f bf 5c d4 7f 0c fd 80 97 dd 2e eb 0f a9 1e 57 70 5d 92 5a 1f 89 ba 50 bc e0 48 db 19 56 a4 12 2a f3 d4 6b c4 94 c8 56 98 0c e0 8d 5d 03 84 50 d9 a9 b0 8a 5d a9 59 09 8c 22 82 b5 93 73 a3 b6 47 54 23 39 8b 1d 42 a6 98 cd 74 eb 50 de dc f6 f9 2e 19 a1 ff 65 6d f5 f7 63 24 f9 2b 01 ee 63 14 29 65 5d c1 ea 5b 5d d5 e8 d4 2c d8 30 db db 81 54 ea ca ae a8 58 c3 c6 1a 96 91 af 5e 85 f4 97 16 6c 04 eb 22 d4 bc a5 25 e3 cc 7e e1 3d 7f 26 f5 bf 9e 49 ce c1 b3 06 bc Data Ascii: -@6~Xdb5/~FikF~\|wvMO;s!Cm\.Wp]ZPHV*kV]P]Y"sGT#9BtP.emc$+c)e][],0TX^l"%~=&I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.17	49787	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:50 UTC	390	OUT	GET /shared/5/js/login_en_-dc6Oo3iAoBIzmNJ3pErjQ2.js HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:51 UTC	813	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:50 GMT Content-Type: application/x-javascript Content-Length: 240155 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Tue, 15 Oct 2024 15:10:46 GMT ETag: 0x8DCED2B8BC94977 x-ms-request-id: 72c4825b-201e-001e-80c3-252f8e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153550Z-15b8d89586fvk4kmwqg9fgbkn800000003dg00000000ha4c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:51 UTC	15571	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 dc bd 6b 77 db b8 b2 20 fa fd fe 0a 5b 37 4b 8b 3c 86 15 c9 ce 93 0a 5b 93 c4 71 27 dd 79 75 1e 9d a4 bd 3d 5e b4 04 5b 4c 24 52 21 29 3b 8e ad ff 7e eb 81 27 49 39 c9 3e 73 66 ce 9d ac 15 0b 04 41 a0 50 28 00 55 85 aa c2 cd ff d8 dc d8 cf 8b 8d 59 3a 96 59 29 37 d2 ec 24 2f e6 49 95 e6 d9 c6 62 26 13 c8 2a a5 dc 98 e5 a7 69 76 24 b3 de e7 b2 f7 fc d9 e3 27 2f df 3e e9 55 df aa 8d ff b8 f9 ff 6c 9e 2c b3 31 96 0f c2 cb b3 a4 d8 90 a2 12 99 28 44 2e d2 f8 f2 f6 60 f7 76 64 0a d0 ab f0 b2 b3 c4 5a ab 22 1d 57 9d 21 7e 52 c4 59 b0 73 ff f6 20 14 79 7c 39 9e a6 b3 c9 e3 3c ab e4 b7 ea dd c5 42 96 d1 66 5f 8c ed 73 ed 91 5e 4f e4 49 b2 9c 55 af 8b 7c c1 cf 69 b9 98 25 17 2f 93 39 15 3f 95 d5 5e ad 04 65 15 e9 99 9c bc ad 92 4a ee Data Ascii: kw [7K<[q'yu=^[L$R!);~'I9>sfAP(UY:Y)7$/Ib&*iv$'/>Ul,1(D.`vdZ"W!~RYs y\|9<Bf_s^OIU\|i%/9?^eJ
2024-10-24 15:35:51 UTC	16384	IN	Data Raw: a7 8e d8 e9 47 18 84 ab 64 48 76 ee 5a a4 ed ee 10 ba 76 77 b1 ec 29 da de 8b dd 5b 9c 66 34 ec de c6 16 81 19 db 85 f6 9e e6 73 fc e6 ae 87 d9 dd 7b 0e 66 77 ef fb 68 bd d5 f7 90 7a 0b 6a 7b 96 95 12 6d 2d 6e dd b1 f8 1d 60 1f f7 07 98 00 48 f6 77 30 01 60 ec ef 62 02 be d9 bf 85 09 f8 60 ff 36 26 00 80 fd 3b 98 80 a6 f7 ef 62 02 9a dd bf 87 a8 82 f6 f6 ef 63 62 80 15 f6 31 45 55 63 dd 3b 58 f7 00 2b bf 05 95 bf 5c ce 19 1f 03 84 ca 1d aa 9d 1d 78 8d 2a 42 18 96 c4 9b 09 40 dd 75 2d 0e 91 bc a6 ff 3c 3f a0 67 f4 64 c1 5f e2 f8 bc 81 f6 ee 7a 51 cb 84 3d a4 b4 4a 1c 8e b0 2a 63 9a 5d e1 48 8d 7a d4 76 9c 28 6b 47 ea 5a 9f 6b 75 fb 5c 65 aa 80 c3 8f 0e e9 0e 79 07 ae a8 03 9d d5 2e 94 ff be 3e b0 00 a6 2b 51 1a 1f 3e a8 5c af 27 d4 8b 40 db da d5 82 11 c2 Data Ascii: GdHvZvw)[f4s{fwhzj{m-n`Hw0`b`6&;bcb1EUc;X+\xB@u-<?gd_zQ=Jc]Hzv(kGZku\ey.>+Q>\'@
2024-10-24 15:35:51 UTC	16384	IN	Data Raw: 47 0f e7 ae fd d3 ce bb 52 ef d4 89 72 70 ba 86 cd 78 6e 6f 57 fb a7 c6 cb 3f 14 d4 a7 53 ff 98 ef 2f 6a 15 23 00 1a 8a 14 01 dc 18 2a 9c bc 4b fd ad 67 c2 5e df da 8a b5 85 6c d4 38 57 bb c6 8f 47 33 56 ae 34 66 ff 10 ae 5d 8c f4 d1 1c 24 27 7b d8 b6 4c 61 a3 0f c6 b1 a3 09 a8 25 d4 57 1f 78 e1 2d 49 a8 e4 8f 2b 1b 25 1d 59 9d 91 2d 52 76 80 c1 49 7b e2 b0 ee 57 52 1f cb a1 c4 68 70 42 51 91 e0 ce e8 6f a9 d2 75 af d2 41 28 c9 d3 16 57 29 d2 b5 5d 56 b5 e3 18 ea 19 c9 fe 9c cc 4b 0a 4a 2d c4 d5 1d ef 9e 51 d1 fa 7f 83 cd 46 2c d3 74 f6 65 6e 74 d8 cf cc 57 c3 77 6d 69 61 2e 8a e7 6d 1a d4 b1 6c eb dc 6c 6b b8 cc b4 16 f6 03 ea b9 d9 8b 81 78 b7 a3 e2 c9 c0 37 a3 31 3a 52 8d 08 2c b5 69 df 6a 69 a9 a9 0c ce 30 f7 a8 96 b4 54 3f c1 a9 0c df 58 2e 1d 88 1e Data Ascii: GRrpxnoW?S/j#*Kg^l8WG3V4f]$'{La%Wx-I+%Y-RvI{WRhpBQouA(W)]VKJ-QF,tentWwmia.mllkx71:R,iji0T?X.
2024-10-24 15:35:51 UTC	16384	IN	Data Raw: 5c e4 1a d7 c2 f9 8e 50 a6 0e e1 16 5b ac 34 14 da 26 d4 08 10 db d3 8c 32 95 ad 61 f5 83 a7 bd 2a 2e 2b 90 0e a3 55 ec de a6 b4 fc 6e ee 49 ab 21 c6 80 2e 31 6c b5 ea 8a da ec c1 b6 fa e4 61 c5 ec 36 9f f1 c7 b7 b7 79 7a db 52 de da 5c c2 ee 71 c2 1a e9 c2 9c d2 0e 50 9a a8 0b 2c e7 01 ff 72 c2 f4 54 45 98 ce 54 d6 e7 69 98 9e cc 4e 47 05 19 dd e6 73 e0 d7 51 f9 88 97 68 f4 9a 0a d8 53 f8 b5 d2 cc 8a 46 a6 5c 22 19 1a ea 0e 8f 75 47 ca 86 5b db ec d8 75 82 91 93 19 d0 bc 9a 62 fc 63 7c 91 22 fb 2b ba f9 5d f6 0b ad b1 ad 14 51 ba 40 e4 16 d1 5e 8c be e4 30 2f 0d 24 e3 12 4d 30 f8 20 58 a5 a1 d9 96 0b ba b3 e5 cb 61 78 9a 01 b0 dd 23 48 00 6d a5 50 18 23 53 ba 23 d3 a6 ff 18 b3 d2 3c 42 3d a4 4c ff 43 5e a2 6d e0 33 13 ac a1 75 78 41 4b b5 2d 23 37 60 a9 Data Ascii: \P[4&2a*.+UnI!.1la6yzR\qP,rTETiNGsQhSF\"uG[ubc\|"+]Q@^0/$M0 Xax#HmP#S#<B=LC^m3uxAK-#7`
2024-10-24 15:35:51 UTC	16384	IN	Data Raw: f3 8e e3 42 e7 f9 42 dc 8e 82 01 b5 7a df 21 8c 42 c0 00 5d 39 04 16 fc c4 10 b4 b6 e6 8e 41 d5 0b 63 d0 6a 9d 37 86 d9 cc 7d 85 b3 b4 f2 b4 a1 ab 5b 9f fe b5 5f c0 f7 be cc 0b f8 e9 bd 5e c0 3f 7e e5 17 f0 d3 ff d0 0b f8 c7 ff a8 04 67 1b 0f f9 1c 6e 75 39 a9 4a 91 a0 9d 1e 61 91 ec da cb 10 10 36 b7 e2 1a 92 98 9d 11 c3 32 21 17 85 ec b7 f6 48 bc 4e 05 79 32 1a 15 57 0d a1 50 9d 19 c5 b2 bd 8e 7a e1 4b 40 08 9b 40 e5 5c bf 9c e4 39 9c d6 28 55 57 11 6f 09 b9 3a f2 0e c3 45 2b 85 50 9d 1e 27 33 1e 5f 26 d7 82 8d bd 0b 74 1a 63 2a 3c e6 f6 28 aa 12 65 51 44 8c fe 13 96 13 bf 8d 04 52 d6 41 71 f5 a7 2a 83 88 e3 19 a1 f2 ad 61 92 85 bb f1 4b 94 e8 4f fd 67 98 b5 18 cb 32 9f 24 83 c1 90 f9 bc 21 c5 bf 26 ce 4a 21 52 b6 ff 2d 20 b1 71 d0 53 36 76 21 75 32 84 Data Ascii: BBz!B]9Acj7}[_^?~gnu9Ja62!HNy2WPzK@@\9(UWo:E+P'3_&tc<(eQDRAqaKOg2$!&J!R- qS6v!u2
2024-10-24 15:35:51 UTC	16384	IN	Data Raw: aa 7f 33 d4 74 97 9a 36 f6 e3 ee 46 7a e7 bd d8 bc 26 a6 db 6b d9 d6 83 f6 7a aa 1b 6e 67 4d 7b cb 6c 6c e6 4e e7 92 e7 ed 74 b3 83 69 7f a9 6d e4 d9 bb 22 6b 02 ed 85 98 6e ab 61 63 db 0f 36 33 8c f5 ba dc 00 34 dd a1 1e 60 a7 63 71 61 5a f6 89 5d e3 bf 8e 43 22 d5 e3 16 ec d9 70 c2 6f fd e7 67 ac e9 9b ec 2d 1e d8 59 4e e7 e2 b1 65 7e 8b 60 ac de d9 b8 80 84 d5 9c 5d 49 78 1d 8f ef 4c 44 bb e3 82 82 d4 fa 40 21 69 5c 1e d2 c5 10 9a 18 ad ae c8 71 eb 74 7c 63 11 1f e6 c5 54 bb a1 e9 74 fc ec 98 2c a6 da b3 27 37 1e 69 ab e1 3e f9 fc 19 fe 01 be 36 e2 97 03 be 00 4b b6 e3 12 c6 f5 e3 44 57 ae 74 bf 4b f4 e8 d9 a6 bc a1 76 58 96 c7 93 5f 7e 39 3d 3d 1d 9f da e3 bc 38 f8 c5 32 0c e3 97 e5 07 0c 57 c6 7f 47 a2 cc b3 97 f7 80 b0 4a fd 21 69 3f b1 d4 5d fd 50 Data Ascii: 3t6Fz&kzngM{llNtim"knac634`cqaZ]C"pog-YNe~`]IxLD@!i\qt\|cTt,'7i>6KDWtKvX_~9==82WGJ!i?]P
2024-10-24 15:35:51 UTC	16384	IN	Data Raw: 38 63 a7 1c a9 68 5e 54 3f d2 6f 08 b6 90 1d df aa 1e a2 7f 08 9d e4 eb 9c 2f 71 c5 2c 52 8d 0d c1 18 a4 c2 e8 cc 5c f6 c5 39 a8 a0 8d 76 f8 c1 34 64 12 93 59 c3 16 6b 37 da 7e 1d 40 e6 32 2c b5 19 1c c2 23 26 50 47 90 fa f0 08 0f 65 aa 51 11 62 d0 ad ab 53 54 7b b3 d3 01 8f 35 73 7e 25 2a 01 73 8b ef f3 4a 18 39 28 f8 d5 32 22 6b 50 16 ad dc e6 b9 7d 36 8e fa 41 23 c0 4e e3 f7 ff d8 83 46 ba 26 53 a1 fa 7e 51 7f 9e d8 7c d8 b9 e8 05 3d 84 c4 37 26 84 e1 37 3b e8 b8 ce 71 5d e2 58 3c 87 21 5c d5 5b a0 d9 e3 19 ab ee 17 83 1a f3 fe 9f f5 d2 12 23 ee 24 fb 30 78 93 25 ff 98 9e ce 97 c7 40 dd 62 61 bc e5 2f 93 95 89 d6 d8 40 53 98 56 df ce 98 44 d2 8d 17 37 64 19 7f e7 fb 96 f1 cf bf 8d 8c bf b3 93 8c 7f 77 c1 32 fe ce 25 c9 f8 77 97 20 e3 f7 bf 91 8c 7f f0 Data Ascii: 8ch^T?o/q,R\9v4dYk7~@2,#&PGeQbST{5s~%*sJ9(2"kP}6A#NF&S~Q\|=7&7;q]X<!\[#$0x%@ba/@SVD7dw2%w
2024-10-24 15:35:51 UTC	16384	IN	Data Raw: 9d 9f 1c bb eb 4a 5d 99 38 3d e3 ee f6 f9 de f5 f9 c1 d1 9e cc bb a1 e4 cd 47 6b c8 66 ab dd 94 d8 1a 6b 65 71 86 4a 6b 55 99 b5 a8 d2 8b 63 1c 74 18 a0 5f 2e 4e 20 c5 c1 71 b6 b3 6a 48 28 8f a5 d2 30 69 41 f9 6a d7 9e 9c 9e 1f 9c 1c b7 dc 5a 5d a2 53 90 46 2b e7 f4 f0 e2 6c fb 50 49 b3 bf df da 3b bf 86 4e bc 00 b4 96 65 61 b3 12 ea 23 33 bb c8 15 65 90 1e 2f b3 a0 25 f4 fb e4 cc ad ad 16 37 97 27 9a d9 5e 59 d2 5a 71 5b 8d 25 15 55 77 bd 7f b6 fd 92 4c ce da fa e3 c8 89 d4 73 61 a9 94 bd f1 38 ba 99 b2 8b 7a 5d 76 c1 e6 8c b1 d1 fb 60 f7 e2 f4 f0 60 07 c9 bd b0 b4 3a 4e 8c c7 d3 65 cb 2b 1c ea 7a 4d 2b 6f f6 68 1f 1d b4 08 93 3d 39 7f 05 73 79 e7 70 fb a2 b5 e7 d6 71 6e 98 62 f4 fe 39 df 7e e9 d6 97 95 ae 00 40 2e c5 f5 f1 f6 11 94 b8 aa 27 23 50 3e e7 Data Ascii: J]8=GkfkeqJkUct_.N qjH(0iAjZ]SF+lPI;Nea#3e/%7'^YZq[%UwLsa8z]v``:Ne+zM+oh=9sypqnb9~@.'#P>
2024-10-24 15:35:51 UTC	16384	IN	Data Raw: 95 ff f1 3f e4 77 85 2c f1 79 7d 81 68 99 53 5d e8 00 9f 8b 1d 60 84 53 7b bb 41 6a 8a b8 45 31 4e 17 d1 e5 70 66 b6 ab 8e 5d 45 8a 25 40 da 0c 96 d3 45 cc 87 31 9c b8 fe 71 24 9d 16 6f a3 0a 70 ea d2 24 a9 ed 63 c5 b5 fd d4 34 60 8a 0d 85 76 bc 1e f9 f4 4a be c7 f6 9c 87 07 d1 b9 3a ef 1c 7c 8b 5f d5 9a 82 84 21 4c 05 e3 35 54 3e cd 7d 32 0b 2c cc 20 b9 67 91 23 45 76 6e e1 6e 90 0b b0 e0 cb 96 f5 de 52 8c b9 23 e7 82 07 bd aa be 66 cf 80 70 ad 74 95 a2 70 90 d3 54 17 ae af b5 94 3a 92 90 84 c6 2a a7 ce 9c ca 3c 3c 54 fa 1e 2f 2e bb c3 f7 c9 28 0a 67 02 e7 55 5a f2 c8 8b 22 5f fd cf 6a d3 ba f4 1f 3a 35 a0 2e 9a d6 eb 87 c6 d7 0f cf f7 6a f0 b3 3d 75 66 73 cf ad 35 a9 92 2f be aa e3 1b 1e 8f 5f 76 a8 85 19 43 5e b3 d1 59 31 bf b4 90 e1 34 9b 93 5b 62 d7 Data Ascii: ?w,y}hS]`S{AjE1Npf]E%@E1q$op$c4`vJ:\|_!L5T>}2, g#EvnnR#fptpT:*<<T/.(gUZ"_j:5.j=ufs5/_vC^Y14[b
2024-10-24 15:35:51 UTC	16384	IN	Data Raw: c3 08 62 f4 7c 48 5d 87 03 7c 37 a8 c6 b5 7d 55 66 48 06 11 76 fa b4 ad dc ef ae ed 2d 00 40 05 36 bb 7e df 58 ef cf 9d 64 62 df ef ad f7 bd e5 1c d9 18 f6 fd f3 f5 fd 8b f5 fd cb 35 ca 88 10 c5 ad 06 88 e3 00 2f fc 7e d5 46 69 b5 6b d6 db c4 46 95 8a 9d 7e 13 e6 8c 0f b2 7c 11 b4 05 d8 0f 77 76 16 f4 4d de 88 4f a1 3b 80 cf 97 f0 73 21 d6 e5 d9 9e b0 43 02 e4 6d 0f bf 5c d4 7f 0c fd 80 97 dd 2e eb 0f a9 1e 57 70 5d 92 5a 1f 89 ba 50 bc e0 48 db 19 56 a4 12 2a f3 d4 6b c4 94 c8 56 98 0c e0 8d 5d 03 84 50 d9 a9 b0 8a 5d a9 59 09 8c 22 82 b5 93 73 a3 b6 47 54 23 39 8b 1d 42 a6 98 cd 74 eb 50 de dc f6 f9 2e 19 a1 ff 65 6d f5 f7 63 24 f9 2b 01 ee 63 14 29 65 5d c1 ea 5b 5d d5 e8 d4 2c d8 30 db db 81 54 ea ca ae a8 58 c3 c6 1a 96 91 af 5e 85 f4 97 16 6c 04 eb Data Ascii: b\|H]\|7}UfHv-@6~Xdb5/~FikF~\|wvMO;s!Cm\.Wp]ZPHV*kV]P]Y"sGT#9BtP.emc$+c)e][],0TX^l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.17	49788	13.107.253.67	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:50 UTC	604	OUT	GET /shared/5/chunks/oneds-analytics-js_077217740c853b5d4fe8.js HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.live.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:51 UTC	819	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:51 GMT Content-Type: application/x-javascript Content-Length: 32811 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 09 Aug 2024 21:16:17 GMT ETag: 0x8DCB8B881BE95D6 x-ms-request-id: 105b730a-b01e-0076-1f22-263ea1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153550Z-r1755647c66l72xfkr6ug378ks00000008v0000000004u75 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-24 15:35:51 UTC	15565	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 dc bd 69 77 db 38 b3 3f f8 7e 3e 85 c4 e9 f1 25 db b0 22 39 4b 27 52 18 9d c4 71 3a ce 66 77 ec 2c dd 6e 5f 1f 5a 82 6c b6 65 52 4d 52 5e 62 e9 bb 4f fd 0a 0b 41 8a 4e f2 9c ff 9d 79 71 fb 74 2c 62 21 08 14 0a 85 aa 42 55 e1 de af ed d6 ab 34 6b 4d e3 91 4c 72 d9 8a 93 49 9a 5d 44 45 9c 26 ad d9 54 46 94 95 4b d9 4a 13 39 ce 37 a2 24 9a de 14 f1 28 df f8 27 3f ee fe f6 db 66 ef b7 df 1e 74 47 8f 1f de 3f 79 38 7e 30 91 8f 3b ff e4 9d 77 3b 5b db 1f f6 b7 3b c5 75 d1 fa f5 de ff e5 cd d1 44 91 c5 a3 c2 1b f8 b9 9c 4e 3a 57 f2 64 16 8d ce b7 ce e6 c9 f9 f1 45 1e 8f 65 52 c4 c5 cd 71 1e e7 73 4a 47 e1 4f d5 5a 2c 0e 8f 82 ce 6c 9e 9f f9 87 87 0f 7e eb 1d 89 db cd cd df 1e f7 27 f3 64 84 ee fb 89 90 a2 08 6e 8b 4e e6 cb 40 14 9d Data Ascii: iw8?~>%"9K'Rq:fw,n_ZleRMR^bOANyqt,b!BU4kMLrI]DE&TFKJ97$('?ftG?y8~0;w;[;uDN:WdEeRqsJGOZ,l~'dnN@
2024-10-24 15:35:51 UTC	16384	IN	Data Raw: 7d ed 52 dc 70 af e6 f3 3f e8 25 f5 f0 ff d7 fe 25 ce 31 b8 06 af 71 1f 5f ed 9d 5c f7 74 ef 4c df cc 9e 34 fc 2b 3e c4 89 e7 91 7d e8 e3 6f a5 79 ea 98 eb ae 62 e3 88 d0 00 9e 6d f4 86 f4 db 77 72 8f 75 ee b1 a7 4e 0a 98 cd 48 c3 1a 17 45 db 40 3a 9b 4f 89 80 ef ce 60 76 4b 44 73 ff 26 27 f9 61 27 99 a4 06 ce bc e1 15 a1 09 a7 cf 1c a8 8d 8a 02 53 37 27 e1 79 30 3f 2d 73 10 b0 b4 52 45 65 a8 eb 33 32 c3 fd b8 bd aa 5e aa 26 53 f7 52 35 33 8b 70 46 e5 49 eb 30 03 ab 00 4d 09 1b 6a a3 e8 a4 ea ee e6 4e 5e 5e 4d a2 41 43 79 95 7a ee 8c 66 55 5e 8b c4 48 e5 6a 9c 92 9c 77 89 58 7b 29 6d ba 29 84 e3 84 b7 7a f5 8b e6 53 15 a3 24 ee 10 6e 15 b8 43 93 e3 c6 aa b7 9d 4c 92 18 23 22 8c f6 6a 3a e7 3e ba f2 ec 5e 9d 56 13 3f a4 2c 6b d3 1f 73 27 dd 3b 38 13 6d 43 Data Ascii: }Rp?%%1q_\tL4+>}oybmwruNHE@:O`vKDs&'a'S7'y0?-sREe32^&SR53pFI0MjN^^MACyzfU^HjwX{)m)zS$nCL#"j:>^V?,ks';8mC
2024-10-24 15:35:51 UTC	862	IN	Data Raw: 0b 1f 65 9b 96 67 0f 20 14 80 06 f7 e2 b5 db d6 c5 b4 c6 5f e1 7b 76 1b 9d a4 e9 6e 9a 5c c9 36 df 14 3a a1 47 d0 e6 00 88 d8 cb a3 30 41 78 cf 37 25 ca 2b 3e 60 ed a5 aa 8d 3e b1 ad 34 e9 15 75 67 50 a0 46 bb a6 5f ba e2 9b cb 04 07 93 40 5c 16 9d 00 ca 3e 80 25 94 2b 0d 7d a7 b8 f2 7b 9c 0f 81 b6 e6 a4 42 2b 4d 67 df ad 1c c2 6a 6a 2b c5 1d da d0 1a 13 bc 76 0c 6f b0 01 2d cd 69 36 32 b3 b1 61 89 73 7e d1 48 48 ae 58 07 06 be 0e 9a 29 24 b4 42 eb b3 33 30 e3 ac 59 a7 95 73 92 ac 5a 37 c8 01 f1 6e 70 24 b9 ea 6b 78 a5 f0 eb 4e 72 99 1e 24 a7 f4 2b 86 71 68 49 38 c1 ae 39 36 72 95 d6 c2 f6 d1 b0 ea 68 19 8e 93 78 3c 86 7b db cf e2 31 10 22 e1 00 a7 32 cd 00 81 da 73 9d 15 11 a1 5b 69 f1 d5 88 84 a3 8d 18 bd ae f9 f2 f9 75 df ea be c5 3e cb 14 48 d9 af 37 Data Ascii: eg _{vn\6:G0Ax7%+>`>4ugPF_@\>%+}{B+Mgjj+vo-i62as~HHX)$B30YsZ7np$kxNr$+qhI896rhx<{1"2s[iu>H7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.17	49789	13.107.253.67	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:50 UTC	632	OUT	GET /shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:51 UTC	800	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:51 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Tue, 27 Jun 2023 15:44:25 GMT ETag: 0x8DB772562988611 x-ms-request-id: b0f804d6-501e-0017-7014-2655f0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153550Z-17fbfdc98bbl89flqtm21qm6rn00000007m0000000005h60 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:51 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.17	49790	13.107.253.67	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:50 UTC	619	OUT	GET /shared/5/images/2_bc3d32a696895f78c19d.svg HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:51 UTC	806	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:51 GMT Content-Type: image/svg+xml Content-Length: 673 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Tue, 27 Jun 2023 15:44:22 GMT ETag: 0x8DB7725611C3E0C x-ms-request-id: 0bb4814b-601e-0075-7925-26dfc5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153551Z-r1755647c66n5bjpba5s4mu9d000000009y0000000007bqp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-24 15:35:51 UTC	673	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 21 02 39 81 41 Data Ascii: Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9!9A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.17	49794	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:51 UTC	398	OUT	GET /shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:52 UTC	807	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:51 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Tue, 27 Jun 2023 15:44:25 GMT ETag: 0x8DB772562988611 x-ms-request-id: d0a8b9f4-d01e-007b-145d-25be67000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153551Z-r197bdfb6b4sn8wg20e97vn7ps0000000prg00000000110x x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-24 15:35:52 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.17	49795	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:51 UTC	385	OUT	GET /shared/5/images/2_bc3d32a696895f78c19d.svg HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:52 UTC	799	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:51 GMT Content-Type: image/svg+xml Content-Length: 673 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Tue, 27 Jun 2023 15:44:22 GMT ETag: 0x8DB7725611C3E0C x-ms-request-id: 3e46d6c2-001e-000a-6f22-24584c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153551Z-r197bdfb6b4k6h5j1g5mvtmsmn0000000ccg000000001kgw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:52 UTC	673	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 21 02 39 81 41 Data Ascii: Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9!9A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.17	49796	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:52 UTC	401	OUT	GET /shared/5/chunks/oneds-analytics-js_077217740c853b5d4fe8.js HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:52 UTC	791	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:52 GMT Content-Type: application/x-javascript Content-Length: 32811 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 09 Aug 2024 21:16:17 GMT ETag: 0x8DCB8B881BE95D6 x-ms-request-id: d9417a1c-a01e-006a-7160-256cc1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153552Z-r197bdfb6b4kq4j5t834fh90qn0000000b1g0000000087f0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:52 UTC	15593	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 dc bd 69 77 db 38 b3 3f f8 7e 3e 85 c4 e9 f1 25 db b0 22 39 4b 27 52 18 9d c4 71 3a ce 66 77 ec 2c dd 6e 5f 1f 5a 82 6c b6 65 52 4d 52 5e 62 e9 bb 4f fd 0a 0b 41 8a 4e f2 9c ff 9d 79 71 fb 74 2c 62 21 08 14 0a 85 aa 42 55 e1 de af ed d6 ab 34 6b 4d e3 91 4c 72 d9 8a 93 49 9a 5d 44 45 9c 26 ad d9 54 46 94 95 4b d9 4a 13 39 ce 37 a2 24 9a de 14 f1 28 df f8 27 3f ee fe f6 db 66 ef b7 df 1e 74 47 8f 1f de 3f 79 38 7e 30 91 8f 3b ff e4 9d 77 3b 5b db 1f f6 b7 3b c5 75 d1 fa f5 de ff e5 cd d1 44 91 c5 a3 c2 1b f8 b9 9c 4e 3a 57 f2 64 16 8d ce b7 ce e6 c9 f9 f1 45 1e 8f 65 52 c4 c5 cd 71 1e e7 73 4a 47 e1 4f d5 5a 2c 0e 8f 82 ce 6c 9e 9f f9 87 87 0f 7e eb 1d 89 db cd cd df 1e f7 27 f3 64 84 ee fb 89 90 a2 08 6e 8b 4e e6 cb 40 14 9d Data Ascii: iw8?~>%"9K'Rq:fw,n_ZleRMR^bOANyqt,b!BU4kMLrI]DE&TFKJ97$('?ftG?y8~0;w;[;uDN:WdEeRqsJGOZ,l~'dnN@
2024-10-24 15:35:52 UTC	16384	IN	Data Raw: f7 74 ef 4c df cc 9e 34 fc 2b 3e c4 89 e7 91 7d e8 e3 6f a5 79 ea 98 eb ae 62 e3 88 d0 00 9e 6d f4 86 f4 db 77 72 8f 75 ee b1 a7 4e 0a 98 cd 48 c3 1a 17 45 db 40 3a 9b 4f 89 80 ef ce 60 76 4b 44 73 ff 26 27 f9 61 27 99 a4 06 ce bc e1 15 a1 09 a7 cf 1c a8 8d 8a 02 53 37 27 e1 79 30 3f 2d 73 10 b0 b4 52 45 65 a8 eb 33 32 c3 fd b8 bd aa 5e aa 26 53 f7 52 35 33 8b 70 46 e5 49 eb 30 03 ab 00 4d 09 1b 6a a3 e8 a4 ea ee e6 4e 5e 5e 4d a2 41 43 79 95 7a ee 8c 66 55 5e 8b c4 48 e5 6a 9c 92 9c 77 89 58 7b 29 6d ba 29 84 e3 84 b7 7a f5 8b e6 53 15 a3 24 ee 10 6e 15 b8 43 93 e3 c6 aa b7 9d 4c 92 18 23 22 8c f6 6a 3a e7 3e ba f2 ec 5e 9d 56 13 3f a4 2c 6b d3 1f 73 27 dd 3b 38 13 6d 43 d7 31 d7 d3 eb 53 9c 5d 1a 0b 2e de 1d 80 53 f9 37 cc 70 05 10 ce 2a 11 30 aa dd 73 Data Ascii: tL4+>}oybmwruNHE@:O`vKDs&'a'S7'y0?-sREe32^&SR53pFI0MjN^^MACyzfU^HjwX{)m)zS$nCL#"j:>^V?,ks';8mC1S].S7p*0s
2024-10-24 15:35:52 UTC	834	IN	Data Raw: 9a 5c c9 36 df 14 3a a1 47 d0 e6 00 88 d8 cb a3 30 41 78 cf 37 25 ca 2b 3e 60 ed a5 aa 8d 3e b1 ad 34 e9 15 75 67 50 a0 46 bb a6 5f ba e2 9b cb 04 07 93 40 5c 16 9d 00 ca 3e 80 25 94 2b 0d 7d a7 b8 f2 7b 9c 0f 81 b6 e6 a4 42 2b 4d 67 df ad 1c c2 6a 6a 2b c5 1d da d0 1a 13 bc 76 0c 6f b0 01 2d cd 69 36 32 b3 b1 61 89 73 7e d1 48 48 ae 58 07 06 be 0e 9a 29 24 b4 42 eb b3 33 30 e3 ac 59 a7 95 73 92 ac 5a 37 c8 01 f1 6e 70 24 b9 ea 6b 78 a5 f0 eb 4e 72 99 1e 24 a7 f4 2b 86 71 68 49 38 c1 ae 39 36 72 95 d6 c2 f6 d1 b0 ea 68 19 8e 93 78 3c 86 7b db cf e2 31 10 22 e1 00 a7 32 cd 00 81 da 73 9d 15 11 a1 5b 69 f1 d5 88 84 a3 8d 18 bd ae f9 f2 f9 75 df ea be c5 3e cb 14 48 d9 af 37 0a d8 03 eb b8 41 d4 97 0d e3 fc ba 75 ed 19 13 6f 01 39 9f de 6e 73 7a 33 b5 30 3a Data Ascii: \6:G0Ax7%+>`>4ugPF_@\>%+}{B+Mgjj+vo-i62as~HHX)$B30YsZ7np$kxNr$+qhI896rhx<{1"2s[iu>H7Auo9nsz30:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.17	49797	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:53 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=73s5fwxgyy7g2cX&MD=3SepasZF HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-24 15:35:53 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: bfef6545-697f-452b-871f-0f59f9d8f94c MS-RequestId: 4a4b94f3-9964-4953-9413-f7bf85901854 MS-CV: Z+dpOH6CRkm1jVjZ.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 24 Oct 2024 15:35:52 GMT Connection: close Content-Length: 30005
2024-10-24 15:35:53 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-24 15:35:53 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.17	49799	13.107.253.67	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:53 UTC	610	OUT	GET /16.000.30389.5/images/favicon.ico HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:54 UTC	738	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:53 GMT Content-Type: image/x-icon Content-Length: 17174 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Thu, 03 Oct 2024 02:20:19 GMT ETag: 0x8DCE351EDAFAA74 x-ms-request-id: 73252a6c-d01e-0009-7635-24b928000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153553Z-r1755647c66tmf6g4720xfpwpn0000000arg0000000050n3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:35:54 UTC	15646	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-10-24 15:35:54 UTC	1528	IN	Data Raw: 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 Data Ascii: ( @{L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.17	49805	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:35:55 UTC	376	OUT	GET /16.000.30389.5/images/favicon.ico HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:35:55 UTC	759	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:35:55 GMT Content-Type: image/x-icon Content-Length: 17174 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Thu, 03 Oct 2024 02:20:19 GMT ETag: 0x8DCE351EDAFAA74 x-ms-request-id: dd3e000b-101e-0074-0d3b-22c80b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153555Z-16849878b78ngdnlw4w0762cms00000007y000000000mq54 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 15:35:55 UTC	15625	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-10-24 15:35:55 UTC	1549	IN	Data Raw: 80 00 00 00 00 00 00 01 80 00 00 00 00 00 00 01 80 00 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 Data Ascii: ( @{L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333""

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.17	49820	13.107.5.88	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:36:05 UTC	537	OUT	GET /ab HTTP/1.1 Host: evoke-windowsservices-tas.msedge.net Cache-Control: no-store, no-cache X-PHOTOS-CALLERID: 9NMPJ99VJBWV X-EVOKE-RING: X-WINNEXT-RING: Public X-WINNEXT-TELEMETRYLEVEL: Basic X-WINNEXT-OSVERSION: 10.0.19045.0 X-WINNEXT-APPVERSION: 1.23082.131.0 X-WINNEXT-PLATFORM: Desktop X-WINNEXT-CANTAILOR: False X-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd} X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI= If-None-Match: 2056388360_-1434155563 Accept-Encoding: gzip, deflate, br
2024-10-24 15:36:05 UTC	209	IN	HTTP/1.1 400 Bad Request X-MSEdge-Ref: Ref A: 6EF4F479BF074B60B6B7C0A6A98E0ECF Ref B: DFW311000104011 Ref C: 2024-10-24T15:36:05Z Date: Thu, 24 Oct 2024 15:36:04 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.17	49821	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:36:05 UTC	635	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_QLF_8apNRJD3OCol8jwtxw2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:36:05 UTC	792	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:36:05 GMT Content-Type: application/x-javascript Content-Length: 122269 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 02 Oct 2024 20:05:25 GMT ETag: 0x8DCE31D8E25C262 x-ms-request-id: 5cf67778-601e-0042-6fb6-217ad6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153605Z-r197bdfb6b4cz6xrsdncwtgzd40000000px00000000070g3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:36:05 UTC	15592	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e4 bd 7b 77 e3 38 8e 38 fa ff fd 14 8e 66 6e da ee 28 2e cb af d8 4a ab b3 2e 27 a9 ca 76 12 67 62 a7 ba 77 53 99 1c 59 a2 1d 75 64 c9 2b c9 79 8c e3 fd ec 3f 00 24 25 ca 96 53 55 bd 7b ee 3d f7 dc 79 a4 2c 12 7c 81 20 08 80 20 f8 e1 e7 9d ff ab f4 73 69 ff fb ff 53 1a 8e 7a d7 a3 d2 e0 b4 34 fa 7c 76 7d 5c ba 82 af ff 28 5d 0e 46 67 fd 93 ef af 07 1b c5 ff 8f 1e bc b8 34 f1 7c 56 82 7f c7 76 cc dc 52 18 94 c2 a8 e4 05 4e 18 cd c3 c8 4e 58 5c 9a c1 df c8 b3 fd d2 24 0a 67 a5 e4 81 95 e6 51 f8 27 73 92 b8 e4 7b 71 02 85 c6 cc 0f 9f 4b 65 a8 2e 72 4b 57 76 94 bc 96 ce ae 2a 55 a8 9f 41 6d de d4 0b a0 b4 13 ce 5f e1 f7 43 52 0a c2 c4 73 58 c9 0e 5c aa cd 87 8f 20 66 a5 45 e0 b2 a8 f4 fc e0 39 0f a5 0b cf 89 c2 38 9c 24 a5 88 39 Data Ascii: {w88fn(.J.'vgbwSYud+y?$%SU{=y,\| siSz4\|v}\(]Fg4\|VvRNNX\$gQ's{qKe.rKWv*UAm_CRsX\ fE98$9
2024-10-24 15:36:05 UTC	16384	IN	Data Raw: 00 4b 69 b0 f5 a5 f6 21 6b b3 cb 4a f1 ed d6 0e 54 22 01 7b 7c 8b b0 36 c4 03 58 73 20 ac a4 4a b5 ad d4 6e ed d4 74 bb ca d0 d3 02 23 db 7c a7 2a 08 1a 89 14 bc b3 b2 96 07 5a 02 70 e0 27 3c bc 28 57 84 d4 5d 5e 06 3c 94 80 66 fb cf f6 6b ac ad 2a d0 20 ee 06 30 de c1 1c 3b 14 03 5e 6c e2 32 4e e4 8d f3 fd 57 ea cf 20 ca 99 40 0b 28 00 e9 a7 cc cf bf 13 ee c2 50 56 0b cd 19 7b 2c 73 e5 15 27 0c 2d 64 b3 39 5e c9 e1 ee 25 56 d1 9e 03 3c 05 00 07 d9 60 58 56 61 e5 1b 26 a7 c3 cc be e1 49 f7 eb f7 a6 4d 47 13 80 81 26 00 a1 f2 83 f4 2d 6e 79 67 33 16 af 95 43 fd 1d 3d 50 40 61 3a b6 a3 c7 2c 1e c3 a1 b7 e6 57 f7 11 bd bd c8 53 11 af 99 ac e7 fe 8e 5e 5f 4a ee 46 7d 96 8d 62 13 fa 31 d3 dd 9c 4b bc c7 0e 7b 48 d5 05 a8 2c 25 d1 15 ba 85 35 1e 6d 71 ee 63 56 Data Ascii: Ki!kJT"{\|6Xs Jnt#\|Zp'<(W]^<fk 0;^l2NW @(PV{,s'-d9^%V<`XVa&IMG&-nyg3C=P@a:,WS^_JF}b1K{H,%5mqcV
2024-10-24 15:36:05 UTC	16384	IN	Data Raw: ad dd f2 d7 de 0d 2c dc 7e cf 3d 81 cf 09 ba a1 13 41 89 a7 53 fa e6 c2 22 48 b1 7b a6 17 12 43 33 0a 6a b1 88 dd 7d 2e 8c ee da 00 eb 9b dc b9 6f 20 21 6c b5 1e d1 f2 31 1d df 45 54 ea 80 4b bd 03 d4 1b c0 52 72 d0 1b b9 3b 38 32 b6 1e 3b 8c ef 61 09 22 bc 51 c5 a6 7e 64 ee d1 23 d0 b1 b7 9d 04 ee b2 3a 1a e4 03 de 46 ab 50 a6 0a 90 a0 ea 0e c3 e4 d6 42 5a b3 5c 50 07 20 98 7b 5a da ce 4a be d2 8c 31 73 ca c7 a0 14 69 7b 61 80 85 06 00 7b 33 69 64 5d 89 c5 2d 7d 4d 3d 25 68 33 fa 08 f4 ff f0 4b f8 98 59 33 d9 be 88 a6 de 05 ac 1a 4e 4e 34 88 13 b4 2e ef 42 ae 8c a6 7e 4f 6c 9c c4 08 a1 7e 23 d2 8a b8 e9 7d f2 66 70 9e 44 ec cf e0 ca 99 4e bf 78 1f 8e 77 0f 0e df 90 79 15 f7 73 75 86 15 a0 a2 1e 3a bd 54 75 6f 4e 55 79 62 13 2d 24 fb 29 50 82 45 6b 94 f4 Data Ascii: ,~=AS"H{C3j}.o !l1ETKRr;82;a"Q~d#:FPBZ\P {ZJ1si{a{3id]-}M=%h3KY3NN4.B~Ol~#}fpDNxwysu:TuoNUyb-$)PEk
2024-10-24 15:36:06 UTC	16384	IN	Data Raw: ff d4 42 ef 2d 89 e3 f7 80 26 48 13 82 38 19 9a 47 0b 33 a8 38 69 54 06 c5 32 1a cb f9 9a 09 c8 b2 ed c4 ab b6 1e 18 c3 ab c9 17 91 ab 4a 6a 62 c6 ed 43 cd 2a e1 9b cc a6 60 4a e5 c2 25 57 35 f3 94 a8 22 52 8c fa a3 56 7f 2d 46 e4 21 09 3d b5 9b d8 2b c0 0d 38 a8 41 e4 02 e5 0f fd 92 2f 31 a3 b2 1d 2d 07 e1 72 ec fc 10 a4 40 ad bd 46 3f 2f 39 b9 5e 64 1f 5f e3 28 23 46 f1 59 84 9c f6 6b bf f2 0e c7 cb a9 d2 53 36 4e 1c 92 8a a7 e8 f9 4c 01 0c 3c d9 74 05 93 50 4f 51 03 e6 2c ef 8f ae 91 3b 9e 24 6f c2 f1 f0 51 e4 9e d2 dd 3d 0b 03 52 22 cb f3 61 54 96 45 7b 32 e3 0d 8a 4d d8 d6 38 91 be 97 d1 cf 92 a2 91 bf b3 9f 70 33 e1 11 f8 32 8e 73 ad a1 f8 2b 6c f3 0c 6d 2b c4 d7 49 01 0e fd 9e 8c 31 d4 54 7c 17 97 75 e7 68 08 6e ea 8e db 56 32 b9 eb 46 63 5d dc 0b Data Ascii: B-&H8G38iT2JjbC*`J%W5"RV-F!=+8A/1-r@F?/9^d_(#FYkS6NL<tPOQ,;$oQ=R"aTE{2M8p32s+lm+I1T\|uhnV2Fc]
2024-10-24 15:36:06 UTC	16384	IN	Data Raw: 76 ee cd 10 74 06 af 55 36 cf 36 43 c9 70 3c 69 9f 3e 15 f1 f4 36 21 a2 6a 0a d0 8e 6e bf 85 9d 70 41 1b ab e6 06 cb 6b e6 30 72 6c ac bb f6 06 88 8d 47 15 c0 d1 07 5d ae c1 95 4f 34 31 08 0c 54 7d c1 3f b5 43 79 b7 23 f9 57 f9 06 c3 f8 5c 33 f6 16 34 ba 63 a7 44 f8 b8 0c f3 75 60 41 d3 d6 e1 a6 c6 80 e2 f0 aa d7 7b 7c 16 6d 29 23 98 9e 95 eb 3e c3 85 5c cb 21 5c 58 1e 22 51 4d aa a9 e2 d4 3a 0d c1 2d d3 51 97 42 b7 24 5a c4 61 fb 09 b1 0f ae 89 b4 a8 d0 ad e4 80 e4 a7 2c 24 2b ac 1c 06 a6 87 09 16 93 55 03 bc 81 9f 96 7a 6b 45 d6 85 e5 9b 45 ad 4d 52 40 7e a6 cf b3 51 11 e7 37 9c 6f 83 47 a1 ff 4c fb a1 c1 2f 1e 99 90 e8 80 af e8 83 64 b8 d2 9c 3e 82 46 8d 7f ce 2f 23 a7 26 0d 25 12 42 4f 63 6c 6b 86 a5 d9 8e ca aa 2b 18 21 eb 2f 9d 8e 2c 41 9a 03 69 9c Data Ascii: vtU66Cp<i>6!jnpAk0rlG]O41T}?Cy#W\34cDu`A{\|m)#>\!\X"QM:-QB$Za,$+UzkEEMR@~Q7oGL/d>F/#&%BOclk+!/,Ai
2024-10-24 15:36:06 UTC	16384	IN	Data Raw: 3e 34 94 2c 0f ed c0 03 6b 92 d2 e5 61 98 b1 2c 72 e3 08 9a 5c bc 9f ce d2 dc b3 59 2c 82 38 f3 65 96 e4 99 cc 58 ec 7b 76 2c 83 8c e5 5e ee c9 bd 74 63 96 89 8b c8 cd 23 d8 c7 81 cf 81 0b 41 12 26 7e e4 86 71 e8 30 80 51 cb ff 9d 3b 4b 59 14 b8 7e 16 47 5e 2c 6d 29 92 84 45 b9 cc 04 8b e2 1c 26 16 cf ef 66 39 af 76 53 73 d0 94 01 e9 60 a3 03 df c0 a9 12 d8 d1 92 f1 44 e0 0d 04 2c 66 72 3f 68 ee a5 c0 32 01 d2 cc 3d 1e c8 04 73 e8 38 b9 2d b3 c0 15 79 ec e5 a1 b7 1f dc ab 39 7e ea 27 d2 f5 9d 84 bb 8c c5 d2 73 7c 69 db 3c c9 02 27 10 b1 8d 79 dd 0f 39 f9 a9 93 80 dd 04 be 2f f2 24 8a 83 20 c1 84 65 49 14 26 49 92 07 1c 5c 62 2f dd d4 12 2a b5 41 42 b9 e3 0a 50 6c ee 25 b6 9f b8 81 87 e1 04 89 c8 03 9b 65 77 f3 3e ad 75 96 c6 0e 67 91 cb 03 57 fd eb 7b 8c Data Ascii: >4,ka,r\Y,8eX{v,^tc#A&~q0Q;KY~G^,m)E&f9vSs`D,fr?h2=s8-y9~'s\|i<'y9/$ eI&I\b/*ABPl%ew>ugW{
2024-10-24 15:36:06 UTC	16384	IN	Data Raw: f5 17 f9 94 65 bf c5 a6 df a6 08 d3 fd 03 0b 2d 3d ba b5 db 1f 36 af c4 d3 65 a9 c6 3e ed 2e cb 7a 89 2d 36 03 95 22 54 30 68 ff 44 56 bc d3 e0 a6 42 7b 65 bf 75 c8 d2 df 2e aa 42 1f 2e 50 e2 bd 78 a2 5f ab 2d e9 fa 8e 8a 83 c9 64 72 40 04 1f 8d c6 ad f7 e3 17 b0 1c 28 ca e3 f9 4f 4f 1e f4 11 5b 3d 7b f3 97 9d 6b 4d d6 30 ba fb 79 23 cd 55 fa f4 66 67 9e ea 97 1b bd 16 53 72 d8 33 1d 63 d0 aa d7 fe b0 a9 bf 3a d3 e6 0f 8c 76 d1 97 eb 6a 4c ef 2e 1c 9f 28 bc 69 dd ca f9 59 b9 30 3c 73 cd c1 b0 fe f9 cb f1 76 7c 3e 8f ce 97 e9 47 d1 b6 fa b7 4b 42 db 64 97 7f fb 09 aa d3 29 75 d5 86 56 af 0c 5f 7e de bf 47 47 e5 ef 7d de 04 08 b4 5d b2 f5 cb 7f 34 13 b4 2c b8 59 25 f9 86 f1 37 5a 19 57 92 ac bd 97 b0 94 f9 9d 22 bf 9a 7a f3 69 33 e6 a4 fa fb fc 71 29 e4 f3 Data Ascii: e-=6e>.z-6"T0hDVB{eu.B.Px_-dr@(OO[={kM0y#UfgSr3c:vjL.(iY0<sv\|>GKBd)uV_~GG}]4,Y%7ZW"zi3q)
2024-10-24 15:36:06 UTC	8373	IN	Data Raw: f5 d8 52 bc bd 82 fd 1e 27 73 02 ea 57 ee e1 49 b0 58 26 c6 8f 69 c9 b3 8f b0 52 08 2f d0 6e fc c0 f8 0d 5f 1c 61 34 30 71 17 4d da 45 5e b0 83 2b e3 1f 53 66 6c 63 a3 7d 0b 9b d7 e7 30 72 8d df f9 c3 1f 69 72 1a 50 0c 7c 8c a8 64 fc c4 9f 9e 7d f4 17 ff 4e 5c e3 ef 38 c8 a3 e4 8b f1 4f 36 5a 80 9c 93 bf 07 69 fc 0b 5e f8 25 4c 32 fe 8d e5 df 51 0c d8 73 14 82 4e e0 24 22 05 ab 41 a9 f2 8a 27 ea 5a 18 81 f2 10 0a be 0a 79 88 75 50 a9 e0 79 c4 1e b3 a9 a2 cb 8a 7f 69 f8 f8 18 57 ed 1d a8 39 78 1b 93 21 bc 78 49 68 0a a7 23 24 be b9 11 d2 e9 ce 0e 93 be 5e f8 6e 98 9a d2 8d 88 a6 80 03 7a 82 c2 24 ba 31 62 ca 41 80 0b 07 53 c2 90 54 86 23 9e fd e8 27 2f 97 36 3e 71 e5 93 30 bc 9c 53 7c 32 17 4f 5e 10 87 da 30 1e 7c b6 14 cf 4e 05 0a 73 4c 35 40 bd 69 b1 e1 Data Ascii: R'sWIX&iR/n_a40qME^+Sflc}0rirP\|d}N\8O6Zi^%L2QsN$"A'ZyuPyiW9x!xIh#$^nz$1bAST#'/6>q0S\|2O^0\|NsL5@i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.17	49823	2.23.209.177	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:36:06 UTC	2569	OUT	GET /client/config?cc=CH&setlang=en-CH HTTP/1.1 X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-UserAgeClass: Unknown X-BM-Market: CH X-BM-DateFormat: dd/MM/yyyy X-Device-OSSKU: 48 X-BM-DTZ: -240 X-DeviceID: 01000A41090080B6 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDoAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAARNP6WICFWQ2dz8Am%2BFFwugI99GhmRQUxNmmaiBtCXOSVhF4I9Gr17YCgE2faFnAw0puC%2Bf23qaO2OeyKPnLhOW6GEkaYDCM%2BqR3YdCibnQy1X8VxPE642r9t4uDjQXiuh3dHw0viEvx5DXO4u4twZDhCyrgeWcX/8Mh2kaHwn2t501EYdyLm2td3JLRDJ3z6ixmCo443IyS2rXA7o5dqKdxIWPRP0NMiZugCYInQVOhEbkd3QHXYeVmzqm7kUT1WM%2BENilDTfkv1Qv8PXDNLmFeACCY7sitrMKfwYkQ61DVFEWqVN/qADveBIjh2PasuHW0P/djIFkjK5BiD7wWalQQZgAAEDiVLv9PDWDHUvWpNgGjbe2wAfVXp/1ZuTlQmxUAxa3uenMZbBfHMJVH1WMJRSzxtui30DDNk3JAZT2BUafUlW8h49ntpQfNKhc2N0g/3hgBTNVC6KSfKa0aeFapQyBfC/GfC/hDp4zQPjfMq2SiLSw2njmmS8jH1RtFii9BgxbKmQhLL0LffYHVBkq2F3X7KFMFHZ1UDHMY0QFwinAVYSnRuLcN5zzru5PsC1JVOLMStpHVXJpckpLKti7DUEz2yf9URtC5Y2ejDwNhPORLxSMOzdgDZecjNOafanutlGis082WRxDA4m7ncX9VBA8rwPcKwEet6afxJxT7r%2BXEsb4iYLD8ESzpXNQ7Lg31gjghFDLJxFA3rDQd3fkG8sGBwLeuFn%2BZ38xLYU2tSL2N/Grn9n1cK5E5oEYPrhqSyLoZ6hzTIFHnHkzwW3bBZ9yr/wc93RNsUGP/88CBL5oOd7vXqaRw0XVfVyUAEUPvhWFriGibJaKUYtsOPw4KLqUTtSKvpZjnEpkJy/TC5RpSCSOYMZ3xFa2ZJXh9qGkcJjPVbd4jBD6Kw8DxsFfxbx7MeLqYfchjbZHAdKJUtF89raJdl [TRUNCATED] X-Agent-DeviceId: 01000A41090080B6 X-BM-CBT: 1729784162 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 X-Device-isOptin: false Accept-language: en-GB, en, en-US X-Device-Touch: false X-Device-ClientSession: A23938E08D0145AE838779E8D90F3F5A X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI Host: www.bing.com Connection: Keep-Alive Cookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
2024-10-24 15:36:06 UTC	1148	IN	HTTP/1.1 200 OK Content-Length: 2215 Content-Type: application/json; charset=utf-8 Cache-Control: private X-EventID: 671a69669c784f7db767e97685b02104 X-AS-SetSessionMarket: de-ch UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Thu, 24 Oct 2024 15:36:06 GMT Connection: close Set-Cookie: _EDGE_S=SID=2168DCC3AF666A5827CAC9E1AE5B6B45&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: ANON=A=84BEA1DAAAB85FA790252CDAFFFFFFFF; domain=.bing.com; expires=Tue, 18-Nov-2025 15:36:06 GMT; path=/; secure; SameSite=None Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/; secure; SameSite=None Set-Cookie: _SS=SID=2168DCC3AF666A5827CAC9E1AE5B6B45; domain=.bing.com; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.35d01702.1729784166.26dcf6cb
2024-10-24 15:36:06 UTC	2215	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65 Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.17	49824	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:36:07 UTC	410	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_QLF_8apNRJD3OCol8jwtxw2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:36:07 UTC	792	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:36:07 GMT Content-Type: application/x-javascript Content-Length: 122269 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 02 Oct 2024 20:05:25 GMT ETag: 0x8DCE31D8E25C262 x-ms-request-id: 14db37b8-b01e-003b-6842-23f14d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153607Z-r1755647c66lljn2k9s29ch9ts00000009x00000000094y2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:36:07 UTC	15592	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e4 bd 7b 77 e3 38 8e 38 fa ff fd 14 8e 66 6e da ee 28 2e cb af d8 4a ab b3 2e 27 a9 ca 76 12 67 62 a7 ba 77 53 99 1c 59 a2 1d 75 64 c9 2b c9 79 8c e3 fd ec 3f 00 24 25 ca 96 53 55 bd 7b ee 3d f7 dc 79 a4 2c 12 7c 81 20 08 80 20 f8 e1 e7 9d ff ab f4 73 69 ff fb ff 53 1a 8e 7a d7 a3 d2 e0 b4 34 fa 7c 76 7d 5c ba 82 af ff 28 5d 0e 46 67 fd 93 ef af 07 1b c5 ff 8f 1e bc b8 34 f1 7c 56 82 7f c7 76 cc dc 52 18 94 c2 a8 e4 05 4e 18 cd c3 c8 4e 58 5c 9a c1 df c8 b3 fd d2 24 0a 67 a5 e4 81 95 e6 51 f8 27 73 92 b8 e4 7b 71 02 85 c6 cc 0f 9f 4b 65 a8 2e 72 4b 57 76 94 bc 96 ce ae 2a 55 a8 9f 41 6d de d4 0b a0 b4 13 ce 5f e1 f7 43 52 0a c2 c4 73 58 c9 0e 5c aa cd 87 8f 20 66 a5 45 e0 b2 a8 f4 fc e0 39 0f a5 0b cf 89 c2 38 9c 24 a5 88 39 Data Ascii: {w88fn(.J.'vgbwSYud+y?$%SU{=y,\| siSz4\|v}\(]Fg4\|VvRNNX\$gQ's{qKe.rKWv*UAm_CRsX\ fE98$9
2024-10-24 15:36:07 UTC	16384	IN	Data Raw: 00 4b 69 b0 f5 a5 f6 21 6b b3 cb 4a f1 ed d6 0e 54 22 01 7b 7c 8b b0 36 c4 03 58 73 20 ac a4 4a b5 ad d4 6e ed d4 74 bb ca d0 d3 02 23 db 7c a7 2a 08 1a 89 14 bc b3 b2 96 07 5a 02 70 e0 27 3c bc 28 57 84 d4 5d 5e 06 3c 94 80 66 fb cf f6 6b ac ad 2a d0 20 ee 06 30 de c1 1c 3b 14 03 5e 6c e2 32 4e e4 8d f3 fd 57 ea cf 20 ca 99 40 0b 28 00 e9 a7 cc cf bf 13 ee c2 50 56 0b cd 19 7b 2c 73 e5 15 27 0c 2d 64 b3 39 5e c9 e1 ee 25 56 d1 9e 03 3c 05 00 07 d9 60 58 56 61 e5 1b 26 a7 c3 cc be e1 49 f7 eb f7 a6 4d 47 13 80 81 26 00 a1 f2 83 f4 2d 6e 79 67 33 16 af 95 43 fd 1d 3d 50 40 61 3a b6 a3 c7 2c 1e c3 a1 b7 e6 57 f7 11 bd bd c8 53 11 af 99 ac e7 fe 8e 5e 5f 4a ee 46 7d 96 8d 62 13 fa 31 d3 dd 9c 4b bc c7 0e 7b 48 d5 05 a8 2c 25 d1 15 ba 85 35 1e 6d 71 ee 63 56 Data Ascii: Ki!kJT"{\|6Xs Jnt#\|Zp'<(W]^<fk 0;^l2NW @(PV{,s'-d9^%V<`XVa&IMG&-nyg3C=P@a:,WS^_JF}b1K{H,%5mqcV
2024-10-24 15:36:07 UTC	16384	IN	Data Raw: ad dd f2 d7 de 0d 2c dc 7e cf 3d 81 cf 09 ba a1 13 41 89 a7 53 fa e6 c2 22 48 b1 7b a6 17 12 43 33 0a 6a b1 88 dd 7d 2e 8c ee da 00 eb 9b dc b9 6f 20 21 6c b5 1e d1 f2 31 1d df 45 54 ea 80 4b bd 03 d4 1b c0 52 72 d0 1b b9 3b 38 32 b6 1e 3b 8c ef 61 09 22 bc 51 c5 a6 7e 64 ee d1 23 d0 b1 b7 9d 04 ee b2 3a 1a e4 03 de 46 ab 50 a6 0a 90 a0 ea 0e c3 e4 d6 42 5a b3 5c 50 07 20 98 7b 5a da ce 4a be d2 8c 31 73 ca c7 a0 14 69 7b 61 80 85 06 00 7b 33 69 64 5d 89 c5 2d 7d 4d 3d 25 68 33 fa 08 f4 ff f0 4b f8 98 59 33 d9 be 88 a6 de 05 ac 1a 4e 4e 34 88 13 b4 2e ef 42 ae 8c a6 7e 4f 6c 9c c4 08 a1 7e 23 d2 8a b8 e9 7d f2 66 70 9e 44 ec cf e0 ca 99 4e bf 78 1f 8e 77 0f 0e df 90 79 15 f7 73 75 86 15 a0 a2 1e 3a bd 54 75 6f 4e 55 79 62 13 2d 24 fb 29 50 82 45 6b 94 f4 Data Ascii: ,~=AS"H{C3j}.o !l1ETKRr;82;a"Q~d#:FPBZ\P {ZJ1si{a{3id]-}M=%h3KY3NN4.B~Ol~#}fpDNxwysu:TuoNUyb-$)PEk
2024-10-24 15:36:07 UTC	16384	IN	Data Raw: ff d4 42 ef 2d 89 e3 f7 80 26 48 13 82 38 19 9a 47 0b 33 a8 38 69 54 06 c5 32 1a cb f9 9a 09 c8 b2 ed c4 ab b6 1e 18 c3 ab c9 17 91 ab 4a 6a 62 c6 ed 43 cd 2a e1 9b cc a6 60 4a e5 c2 25 57 35 f3 94 a8 22 52 8c fa a3 56 7f 2d 46 e4 21 09 3d b5 9b d8 2b c0 0d 38 a8 41 e4 02 e5 0f fd 92 2f 31 a3 b2 1d 2d 07 e1 72 ec fc 10 a4 40 ad bd 46 3f 2f 39 b9 5e 64 1f 5f e3 28 23 46 f1 59 84 9c f6 6b bf f2 0e c7 cb a9 d2 53 36 4e 1c 92 8a a7 e8 f9 4c 01 0c 3c d9 74 05 93 50 4f 51 03 e6 2c ef 8f ae 91 3b 9e 24 6f c2 f1 f0 51 e4 9e d2 dd 3d 0b 03 52 22 cb f3 61 54 96 45 7b 32 e3 0d 8a 4d d8 d6 38 91 be 97 d1 cf 92 a2 91 bf b3 9f 70 33 e1 11 f8 32 8e 73 ad a1 f8 2b 6c f3 0c 6d 2b c4 d7 49 01 0e fd 9e 8c 31 d4 54 7c 17 97 75 e7 68 08 6e ea 8e db 56 32 b9 eb 46 63 5d dc 0b Data Ascii: B-&H8G38iT2JjbC*`J%W5"RV-F!=+8A/1-r@F?/9^d_(#FYkS6NL<tPOQ,;$oQ=R"aTE{2M8p32s+lm+I1T\|uhnV2Fc]
2024-10-24 15:36:07 UTC	16384	IN	Data Raw: 76 ee cd 10 74 06 af 55 36 cf 36 43 c9 70 3c 69 9f 3e 15 f1 f4 36 21 a2 6a 0a d0 8e 6e bf 85 9d 70 41 1b ab e6 06 cb 6b e6 30 72 6c ac bb f6 06 88 8d 47 15 c0 d1 07 5d ae c1 95 4f 34 31 08 0c 54 7d c1 3f b5 43 79 b7 23 f9 57 f9 06 c3 f8 5c 33 f6 16 34 ba 63 a7 44 f8 b8 0c f3 75 60 41 d3 d6 e1 a6 c6 80 e2 f0 aa d7 7b 7c 16 6d 29 23 98 9e 95 eb 3e c3 85 5c cb 21 5c 58 1e 22 51 4d aa a9 e2 d4 3a 0d c1 2d d3 51 97 42 b7 24 5a c4 61 fb 09 b1 0f ae 89 b4 a8 d0 ad e4 80 e4 a7 2c 24 2b ac 1c 06 a6 87 09 16 93 55 03 bc 81 9f 96 7a 6b 45 d6 85 e5 9b 45 ad 4d 52 40 7e a6 cf b3 51 11 e7 37 9c 6f 83 47 a1 ff 4c fb a1 c1 2f 1e 99 90 e8 80 af e8 83 64 b8 d2 9c 3e 82 46 8d 7f ce 2f 23 a7 26 0d 25 12 42 4f 63 6c 6b 86 a5 d9 8e ca aa 2b 18 21 eb 2f 9d 8e 2c 41 9a 03 69 9c Data Ascii: vtU66Cp<i>6!jnpAk0rlG]O41T}?Cy#W\34cDu`A{\|m)#>\!\X"QM:-QB$Za,$+UzkEEMR@~Q7oGL/d>F/#&%BOclk+!/,Ai
2024-10-24 15:36:07 UTC	16384	IN	Data Raw: 3e 34 94 2c 0f ed c0 03 6b 92 d2 e5 61 98 b1 2c 72 e3 08 9a 5c bc 9f ce d2 dc b3 59 2c 82 38 f3 65 96 e4 99 cc 58 ec 7b 76 2c 83 8c e5 5e ee c9 bd 74 63 96 89 8b c8 cd 23 d8 c7 81 cf 81 0b 41 12 26 7e e4 86 71 e8 30 80 51 cb ff 9d 3b 4b 59 14 b8 7e 16 47 5e 2c 6d 29 92 84 45 b9 cc 04 8b e2 1c 26 16 cf ef 66 39 af 76 53 73 d0 94 01 e9 60 a3 03 df c0 a9 12 d8 d1 92 f1 44 e0 0d 04 2c 66 72 3f 68 ee a5 c0 32 01 d2 cc 3d 1e c8 04 73 e8 38 b9 2d b3 c0 15 79 ec e5 a1 b7 1f dc ab 39 7e ea 27 d2 f5 9d 84 bb 8c c5 d2 73 7c 69 db 3c c9 02 27 10 b1 8d 79 dd 0f 39 f9 a9 93 80 dd 04 be 2f f2 24 8a 83 20 c1 84 65 49 14 26 49 92 07 1c 5c 62 2f dd d4 12 2a b5 41 42 b9 e3 0a 50 6c ee 25 b6 9f b8 81 87 e1 04 89 c8 03 9b 65 77 f3 3e ad 75 96 c6 0e 67 91 cb 03 57 fd eb 7b 8c Data Ascii: >4,ka,r\Y,8eX{v,^tc#A&~q0Q;KY~G^,m)E&f9vSs`D,fr?h2=s8-y9~'s\|i<'y9/$ eI&I\b/*ABPl%ew>ugW{
2024-10-24 15:36:07 UTC	16384	IN	Data Raw: f5 17 f9 94 65 bf c5 a6 df a6 08 d3 fd 03 0b 2d 3d ba b5 db 1f 36 af c4 d3 65 a9 c6 3e ed 2e cb 7a 89 2d 36 03 95 22 54 30 68 ff 44 56 bc d3 e0 a6 42 7b 65 bf 75 c8 d2 df 2e aa 42 1f 2e 50 e2 bd 78 a2 5f ab 2d e9 fa 8e 8a 83 c9 64 72 40 04 1f 8d c6 ad f7 e3 17 b0 1c 28 ca e3 f9 4f 4f 1e f4 11 5b 3d 7b f3 97 9d 6b 4d d6 30 ba fb 79 23 cd 55 fa f4 66 67 9e ea 97 1b bd 16 53 72 d8 33 1d 63 d0 aa d7 fe b0 a9 bf 3a d3 e6 0f 8c 76 d1 97 eb 6a 4c ef 2e 1c 9f 28 bc 69 dd ca f9 59 b9 30 3c 73 cd c1 b0 fe f9 cb f1 76 7c 3e 8f ce 97 e9 47 d1 b6 fa b7 4b 42 db 64 97 7f fb 09 aa d3 29 75 d5 86 56 af 0c 5f 7e de bf 47 47 e5 ef 7d de 04 08 b4 5d b2 f5 cb 7f 34 13 b4 2c b8 59 25 f9 86 f1 37 5a 19 57 92 ac bd 97 b0 94 f9 9d 22 bf 9a 7a f3 69 33 e6 a4 fa fb fc 71 29 e4 f3 Data Ascii: e-=6e>.z-6"T0hDVB{eu.B.Px_-dr@(OO[={kM0y#UfgSr3c:vjL.(iY0<sv\|>GKBd)uV_~GG}]4,Y%7ZW"zi3q)
2024-10-24 15:36:08 UTC	8373	IN	Data Raw: f5 d8 52 bc bd 82 fd 1e 27 73 02 ea 57 ee e1 49 b0 58 26 c6 8f 69 c9 b3 8f b0 52 08 2f d0 6e fc c0 f8 0d 5f 1c 61 34 30 71 17 4d da 45 5e b0 83 2b e3 1f 53 66 6c 63 a3 7d 0b 9b d7 e7 30 72 8d df f9 c3 1f 69 72 1a 50 0c 7c 8c a8 64 fc c4 9f 9e 7d f4 17 ff 4e 5c e3 ef 38 c8 a3 e4 8b f1 4f 36 5a 80 9c 93 bf 07 69 fc 0b 5e f8 25 4c 32 fe 8d e5 df 51 0c d8 73 14 82 4e e0 24 22 05 ab 41 a9 f2 8a 27 ea 5a 18 81 f2 10 0a be 0a 79 88 75 50 a9 e0 79 c4 1e b3 a9 a2 cb 8a 7f 69 f8 f8 18 57 ed 1d a8 39 78 1b 93 21 bc 78 49 68 0a a7 23 24 be b9 11 d2 e9 ce 0e 93 be 5e f8 6e 98 9a d2 8d 88 a6 80 03 7a 82 c2 24 ba 31 62 ca 41 80 0b 07 53 c2 90 54 86 23 9e fd e8 27 2f 97 36 3e 71 e5 93 30 bc 9c 53 7c 32 17 4f 5e 10 87 da 30 1e 7c b6 14 cf 4e 05 0a 73 4c 35 40 bd 69 b1 e1 Data Ascii: R'sWIX&iR/n_a40qME^+Sflc}0rirP\|d}N\8O6Zi^%L2QsN$"A'ZyuPyiW9x!xIh#$^nz$1bAST#'/6>q0S\|2O^0\|NsL5@i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.17	49825	52.98.152.194	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:36:07 UTC	769	OUT	GET /owa/prefetch.aspx HTTP/1.1 Host: outlook.office365.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ClientId=0C6D15CADB384F3688AA45313AB12D6B; OIDC=1
2024-10-24 15:36:07 UTC	1589	IN	HTTP/1.1 200 OK Cache-Control: private, no-store Content-Length: 2745 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 request-id: 1a275eb9-a108-a927-e9da-1dad664e5e49 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CalculatedFETarget: FR4P281CU004.internal.outlook.com X-BackEndHttpStatus: 200 Set-Cookie: OWAPF=v:15.20.8093.17&l:mouse; path=/; secure; HttpOnly X-CalculatedBETarget: FR4P281MB3621.DEUP281.PROD.OUTLOOK.COM X-BackEndHttpStatus: 200 X-RUM-Validated: 1 X-RUM-NotUpdateQueriedPath: 1 X-RUM-NotUpdateQueriedDbCopy: 1 X-Content-Type-Options: nosniff X-BeSku: WCS7 X-OWA-Version: 15.20.8093.14 X-OWA-DiagnosticsInfo: 6;0;0; X-BackEnd-Begin: 2024-10-24T15:36:07.571 X-BackEnd-End: 2024-10-24T15:36:07.571 X-DiagInfo: FR4P281MB3621 X-BEServer: FR4P281MB3621 X-UA-Compatible: IE=EmulateIE7 X-ResponseOrigin: OwaAppPool X-Proxy-RoutingCorrectness: 1 X-Proxy-BackendServerStatus: 200 X-FEProxyInfo: FR0P281CA0012.DEUP281.PROD.OUTLOOK.COM X-FEEFZInfo: HHN X-FEServer: FR4P281CA0055 Report-To: {"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=HHN&RemoteIP=173.254.250.0&Environment=MT"}],"include_subdomains":true} NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-FirstHopCafeEFZ: HHN X-FEServer: FR0P281CA0012 Date: Thu, 24 Oct 2024 15:36:07 GMT Connection: close
2024-10-24 15:36:07 UTC	2745	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 72 65 66 65 74 63 68 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0d 0a 0d 0a 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 6f 66 66 69 63 65 33 36 35 69 63 6f 6e 73 27 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 72 63 3a 20 75 72 6c 28 27 68 74 74 70 73 3a 2f Data Ascii: <!DOCTYPE html><html><head> <title>Prefetch</title> <meta http-equiv="x-ua-compatible" content="IE=Edge"> <style> @font-face { font-family: 'office365icons'; src: url('https:/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.17	49832	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:36:16 UTC	607	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_89db715e3340a2e8ecd8.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:36:16 UTC	790	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:36:16 GMT Content-Type: application/x-javascript Content-Length: 7396 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 15 Aug 2024 17:52:55 GMT ETag: 0x8DCBD53179C7D04 x-ms-request-id: 6ea2ae42-d01e-0070-7b94-250d1e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153616Z-16849878b78j5kdg3dndgqw0vg00000000xg00000000eckq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:36:16 UTC	7396	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 5d 6d 77 db 36 b2 fe be bf 82 d6 ee 71 c8 2d cc d8 49 9b 9b d2 65 7d fc 1a ab 71 6c ad a5 24 db 26 39 3a 14 09 49 8c 29 82 25 21 cb aa ad ff 7e 67 00 be 13 b4 e5 24 dd db 7b cf 55 4f 2d 11 04 06 83 c1 cc e0 99 01 c8 3c fd e7 c6 df b4 7f 6a 5b eb 7f b4 fe 60 ff 72 a0 5d 9c 68 83 d3 ee e5 91 d6 83 ab 5f b5 f3 8b 41 f7 f0 78 7d 3a d8 29 fe 3f 98 fa 89 36 f6 03 aa c1 f7 c8 49 a8 a7 b1 50 63 b1 e6 87 2e 8b 23 16 3b 9c 26 da 0c fe c6 be 13 68 e3 98 cd 34 3e a5 5a 14 b3 cf d4 e5 89 16 f8 09 87 46 23 1a b0 85 a6 03 b9 d8 d3 7a 4e cc 97 5a b7 67 98 40 9f 02 35 7f e2 87 d0 da 65 d1 12 7e 4f b9 16 32 ee bb 54 73 42 4f 50 0b e0 22 4c a8 36 0f 3d 1a 6b 8b a9 ef 4e b5 37 be 1b b3 84 8d b9 16 53 97 fa d7 d0 49 32 87 f2 6a 17 44 73 62 aa Data Ascii: ]mw6q-Ie}ql$&9:I)%!~g${UO-<j[`r]h_Ax}:)?6IPc.#;&h4>ZF#zNZg@5e~O2TsBOP"L6=kN7SI2jDsb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.17	49833	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:36:17 UTC	422	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_89db715e3340a2e8ecd8.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:36:17 UTC	811	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:36:17 GMT Content-Type: application/x-javascript Content-Length: 7396 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 15 Aug 2024 17:52:55 GMT ETag: 0x8DCBD53179C7D04 x-ms-request-id: 6ea2ae42-d01e-0070-7b94-250d1e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153617Z-r1755647c66kv68zfmyfrbcqzg00000008fg000000003pak x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:36:17 UTC	7396	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 5d 6d 77 db 36 b2 fe be bf 82 d6 ee 71 c8 2d cc d8 49 9b 9b d2 65 7d fc 1a ab 71 6c ad a5 24 db 26 39 3a 14 09 49 8c 29 82 25 21 cb aa ad ff 7e 67 00 be 13 b4 e5 24 dd db 7b cf 55 4f 2d 11 04 06 83 c1 cc e0 99 01 c8 3c fd e7 c6 df b4 7f 6a 5b eb 7f b4 fe 60 ff 72 a0 5d 9c 68 83 d3 ee e5 91 d6 83 ab 5f b5 f3 8b 41 f7 f0 78 7d 3a d8 29 fe 3f 98 fa 89 36 f6 03 aa c1 f7 c8 49 a8 a7 b1 50 63 b1 e6 87 2e 8b 23 16 3b 9c 26 da 0c fe c6 be 13 68 e3 98 cd 34 3e a5 5a 14 b3 cf d4 e5 89 16 f8 09 87 46 23 1a b0 85 a6 03 b9 d8 d3 7a 4e cc 97 5a b7 67 98 40 9f 02 35 7f e2 87 d0 da 65 d1 12 7e 4f b9 16 32 ee bb 54 73 42 4f 50 0b e0 22 4c a8 36 0f 3d 1a 6b 8b a9 ef 4e b5 37 be 1b b3 84 8d b9 16 53 97 fa d7 d0 49 32 87 f2 6a 17 44 73 62 aa Data Ascii: ]mw6q-Ie}ql$&9:I)%!~g${UO-<j[`r]h_Ax}:)?6IPc.#;&h4>ZF#zNZg@5e~O2TsBOP"L6=kN7SI2jDsb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.17	49834	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:36:17 UTC	659	OUT	GET /shared/1.0/content/images/arrow_left_43280e0ba671a1d8b5e34f1931c4fe4b.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:36:17 UTC	778	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:36:17 GMT Content-Type: image/svg+xml Content-Length: 276 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:45 GMT ETag: 0x8DB5C3F47A00633 x-ms-request-id: c3bc8b8e-e01e-0070-2702-26450c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153617Z-16849878b78wx8xv81xhtuunw800000000r000000000bcup x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:36:17 UTC	276	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 95 51 3d 6f c3 20 10 fd 2b 88 ae e6 e0 08 d8 b8 b2 3d 74 ca 90 ae 1d ba 45 8a 6b 5b 22 1f aa 91 c9 cf 2f 67 3b 6e 87 2c 15 f0 80 bb 7b ef 9e a0 1a a7 8e dd cf fe 32 d6 bc 0f e1 f6 2a 65 8c 11 e2 0e ae df 9d d4 4a 29 99 2a 38 8b c3 29 f4 35 d7 86 b3 be 1d ba 3e 2c e7 69 68 e3 db f5 5e 73 c5 14 d3 26 4d de 54 61 08 be 6d 8e e3 d8 86 b1 92 cb ad ba 1d 43 cf 4e 35 7f 47 97 21 82 2d dc 04 ce 98 7d 01 39 16 7e 07 a5 c6 8c d0 09 b0 a5 a1 75 c8 33 d4 de 40 69 8c 98 71 4b cc 9c 55 e5 93 b3 af c1 fb 9a bf 18 45 83 cb bf bd 14 f1 b2 02 94 cd fd 53 fa 1e ff ef e3 ac 04 a0 41 01 aa c0 b4 0e 36 95 97 a4 47 9b 05 67 1d 11 d6 2c 66 33 67 c1 35 46 1b b1 49 9d da d8 47 40 3c 0e 98 4c 2e 3a 60 b5 4e 26 01 3f 52 03 93 0c cf 89 64 b4 b0 28 08 37 Data Ascii: Q=o +=tEk["/g;n,{2eJ)8)5>,ih^s&MTamCN5G!-}9~u3@iqKUESA6Gg,f3g5FIG@<L.:`N&?Rd(7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.17	49835	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:36:18 UTC	414	OUT	GET /shared/1.0/content/images/arrow_left_43280e0ba671a1d8b5e34f1931c4fe4b.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:36:18 UTC	778	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:36:18 GMT Content-Type: image/svg+xml Content-Length: 276 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:45 GMT ETag: 0x8DB5C3F47A00633 x-ms-request-id: 3626a57a-a01e-005e-4e65-23171b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153618Z-17fbfdc98bblptj7fr9s141cpc00000007eg000000007216 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:36:18 UTC	276	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 95 51 3d 6f c3 20 10 fd 2b 88 ae e6 e0 08 d8 b8 b2 3d 74 ca 90 ae 1d ba 45 8a 6b 5b 22 1f aa 91 c9 cf 2f 67 3b 6e 87 2c 15 f0 80 bb 7b ef 9e a0 1a a7 8e dd cf fe 32 d6 bc 0f e1 f6 2a 65 8c 11 e2 0e ae df 9d d4 4a 29 99 2a 38 8b c3 29 f4 35 d7 86 b3 be 1d ba 3e 2c e7 69 68 e3 db f5 5e 73 c5 14 d3 26 4d de 54 61 08 be 6d 8e e3 d8 86 b1 92 cb ad ba 1d 43 cf 4e 35 7f 47 97 21 82 2d dc 04 ce 98 7d 01 39 16 7e 07 a5 c6 8c d0 09 b0 a5 a1 75 c8 33 d4 de 40 69 8c 98 71 4b cc 9c 55 e5 93 b3 af c1 fb 9a bf 18 45 83 cb bf bd 14 f1 b2 02 94 cd fd 53 fa 1e ff ef e3 ac 04 a0 41 01 aa c0 b4 0e 36 95 97 a4 47 9b 05 67 1d 11 d6 2c 66 33 67 c1 35 46 1b b1 49 9d da d8 47 40 3c 0e 98 4c 2e 3a 60 b5 4e 26 01 3f 52 03 93 0c cf 89 64 b4 b0 28 08 37 Data Ascii: Q=o +=tEk["/g;n,{2eJ)8)5>,ih^s&MTamCN5G!-}9~u3@iqKUESA6Gg,f3g5FIG@<L.:`N&?Rd(7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.17	49842	52.98.152.194	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:36:23 UTC	769	OUT	GET /owa/prefetch.aspx HTTP/1.1 Host: outlook.office365.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ClientId=0C6D15CADB384F3688AA45313AB12D6B; OIDC=1
2024-10-24 15:36:23 UTC	1589	IN	HTTP/1.1 200 OK Cache-Control: private, no-store Content-Length: 2745 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 request-id: 30a7927e-32f4-15fe-ca0e-df984afe5ab1 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CalculatedFETarget: FRYP281CU001.internal.outlook.com X-BackEndHttpStatus: 200 Set-Cookie: OWAPF=v:15.20.8093.17&l:mouse; path=/; secure; HttpOnly X-CalculatedBETarget: FR6P281MB3418.DEUP281.PROD.OUTLOOK.COM X-BackEndHttpStatus: 200 X-RUM-Validated: 1 X-RUM-NotUpdateQueriedPath: 1 X-RUM-NotUpdateQueriedDbCopy: 1 X-Content-Type-Options: nosniff X-BeSku: WCS7 X-OWA-Version: 15.20.8093.14 X-OWA-DiagnosticsInfo: 4;0;0; X-BackEnd-Begin: 2024-10-24T15:36:23.650 X-BackEnd-End: 2024-10-24T15:36:23.650 X-DiagInfo: FR6P281MB3418 X-BEServer: FR6P281MB3418 X-UA-Compatible: IE=EmulateIE7 X-ResponseOrigin: OwaAppPool X-Proxy-RoutingCorrectness: 1 X-Proxy-BackendServerStatus: 200 X-FEProxyInfo: FR0P281CA0015.DEUP281.PROD.OUTLOOK.COM X-FEEFZInfo: HHN X-FEServer: FRYP281CA0017 Report-To: {"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=HHN&RemoteIP=173.254.250.0&Environment=MT"}],"include_subdomains":true} NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-FirstHopCafeEFZ: HHN X-FEServer: FR0P281CA0015 Date: Thu, 24 Oct 2024 15:36:23 GMT Connection: close
2024-10-24 15:36:23 UTC	2745	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 72 65 66 65 74 63 68 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0d 0a 0d 0a 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 6f 66 66 69 63 65 33 36 35 69 63 6f 6e 73 27 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 72 63 3a 20 75 72 6c 28 27 68 74 74 70 73 3a 2f Data Ascii: <!DOCTYPE html><html><head> <title>Prefetch</title> <meta http-equiv="x-ua-compatible" content="IE=Edge"> <style> @font-face { font-family: 'office365icons'; src: url('https:/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.17	49841	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:36:27 UTC	635	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_DQTmGfOEMmPUR-Vehc8U6Q2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:36:27 UTC	792	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:36:27 GMT Content-Type: application/x-javascript Content-Length: 122065 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 18 Sep 2024 23:43:27 GMT ETag: 0x8DCD83BB1CF3887 x-ms-request-id: 843aa679-f01e-0048-1e94-20a9de000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153627Z-16849878b787sbpl0sv29sm89s00000007x000000000q787 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:36:27 UTC	15592	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e4 bd 7b 57 e3 48 92 38 fa ff fd 14 46 33 97 b6 1b 61 2c bf b0 45 ab 59 63 a0 8a 69 c0 0c 86 ea 9e a5 18 8e 2c a5 8d 1a 59 f2 4a 32 8f 31 de cf fe 8b 88 cc 94 52 b6 4c 55 cd ee b9 f7 dc 73 e7 41 59 99 91 af c8 c8 c8 88 c8 c8 c8 bd 9f b7 fe af d2 cf a5 dd ef ff 4f 69 78 d3 bb be 29 0d 4e 4b 37 9f cf ae 8f 4b 57 f0 f5 8f d2 e5 e0 e6 ac 7f f2 fd f5 60 a3 f8 ff 9b 47 2f 2e 8d 3d 9f 95 e0 df 91 1d 33 b7 14 06 a5 30 2a 79 81 13 46 b3 30 b2 13 16 97 a6 f0 37 f2 6c bf 34 8e c2 69 29 79 64 a5 59 14 fe c9 9c 24 2e f9 5e 9c 40 a1 11 f3 c3 97 52 19 aa 8b dc d2 95 1d 25 6f a5 b3 ab 4a 15 ea 67 50 9b 37 f1 02 28 ed 84 b3 37 f8 fd 98 94 82 30 f1 1c 56 b2 03 97 6a f3 e1 23 88 59 69 1e b8 2c 2a bd 3c 7a ce 63 e9 c2 73 a2 30 0e c7 49 29 62 0e Data Ascii: {WH8F3a,EYci,YJ21RLUsAYOix)NK7KW`G/.=30yF07l4i)ydY$.^@R%oJgP7(70Vj#Yi,<zcs0I)b
2024-10-24 15:36:27 UTC	16384	IN	Data Raw: e9 a7 cc cf bf 13 ee c2 50 56 0b cd 18 7b 2a 73 e5 15 27 0c 2d 64 d3 19 de ce e0 ee 25 56 d1 9e 03 3c 05 00 07 d9 60 58 56 61 e5 1b 26 a7 83 cc be e1 49 4f dc 8f a6 4d 47 13 80 81 26 00 a1 f2 83 f4 2d 2e fc 66 33 16 af 94 43 fd 1d 3d 50 40 61 3a b6 a3 a7 ec 6a 3e fa 7e e6 bc e3 8e d0 67 8b fc 0d f1 c6 c1 6a ee ef e8 bb a5 e4 ae d5 67 d9 28 36 a1 3f 2b 5d d3 b8 c4 2b cd b0 87 54 5d 80 ca 52 12 5d a1 5b 58 e3 d1 06 17 3d 66 45 d5 22 57 c8 72 e5 a3 7e 0b bf 33 dc 46 3f 1a 80 70 44 43 b0 25 1a 95 bc aa 23 67 3a 86 45 87 01 e3 60 9b d6 6c 0a 22 81 e1 1c 77 3d 1c 00 f7 f1 0c 7d 4d 5f 3c 7b ec 05 6d 83 be b9 e0 2b e9 4b 9a 50 b4 ba bd 75 9e 89 7a 9e 08 7b 81 88 89 0b 6f 5e 70 d5 24 80 7c f4 b8 5e 66 17 2c 90 d1 e0 4c 27 e4 a3 88 96 43 a0 35 59 9f 99 94 1b ad 46 Data Ascii: PV{*s'-d%V<`XVa&IOMG&-.f3C=P@a:j>~gjg(6?+]+T]R][X=fE"Wr~3F?pDC%#g:E`l"w=}M_<{m+KPuz{o^p$\|^f,L'C5YF
2024-10-24 15:36:27 UTC	16384	IN	Data Raw: 38 39 d1 20 4e d0 1a bc 0b b9 32 bc f9 3d b1 71 12 23 a6 f9 8d 48 2b 02 99 f7 c9 fb c0 79 12 b1 ff 81 2b 67 3a fd ea 7d 38 de 3d 38 7c 43 e6 50 dc cf d5 19 56 80 8a 7a 2c f3 52 d5 bd 39 55 e5 89 4d b4 18 e9 a7 40 09 16 ad 51 d2 c3 74 7a 26 e6 46 41 dd 43 dc 4d 99 80 37 30 18 8b c9 88 a9 4f 44 26 9c 90 c3 b8 17 21 11 70 4b 28 8d b6 f0 23 a4 33 e4 79 a3 6e f6 11 61 29 9d b9 e0 0d 16 c3 66 e0 f7 01 f6 52 be b2 c1 35 a4 d6 5d d9 e0 ce 9c c6 55 9a f0 51 d2 59 cb 76 cf 2b 16 41 2b 4c 28 98 5a 94 79 55 cf d2 89 5e 8c 03 6e e8 73 9a 57 b1 b8 68 a5 0a d4 44 c6 ce 1b b3 ba da e6 e1 b6 31 cc 5d f4 1e ce 34 80 c8 83 ec 03 eb 9f 53 23 e5 95 9c 37 94 1d ad 5c 4d 35 6a eb 4e dc 85 ba 36 76 00 d3 67 3a 47 db 5d a6 2b 17 aa f7 cd 76 ea ef 6f ed e5 44 0e 59 e9 36 22 23 41 Data Ascii: 89 N2=q#H+y+g:}8=8\|CPVz,R9UM@Qtz&FACM70OD&!pK(#3yna)fR5]UQYv+A+L(ZyU^nsWhD1]4S#7\M5jN6vg:G]+voDY6"#A
2024-10-24 15:36:27 UTC	16384	IN	Data Raw: f7 2c 0c 48 89 2c cf 87 51 59 16 ed c9 8c 37 28 36 61 5b e3 44 fa 5e 46 3f 4b 8a 46 fe c1 7e c2 cd 84 47 e0 eb 38 ce b5 86 e2 6f b0 cd 33 b4 ad 10 5f 27 05 38 f4 7b 32 c6 50 53 f1 5d 5c d6 9d a3 21 b8 a9 3b 6e 5b c9 e4 ae 1b 8d 75 71 2f 8c cd 47 5c 9f 42 ca a2 67 ff 34 48 84 d4 0a 69 ea f7 e8 5a 02 9e 88 1a 6c 39 ed c0 cb 9f a4 79 3c 78 fc 7c 13 25 6c 06 98 9d e6 e9 08 ca a4 9d d0 8f 31 a2 4d d7 ae 51 6a c0 d8 23 ae 50 26 99 b9 64 74 06 d8 7a 8d 0a 57 93 3c e0 55 74 93 7e 94 55 7e 6c b0 44 02 95 db 10 a5 0a 7b e8 f8 3c 6b 00 11 da 20 e1 55 e3 47 f4 1b f4 a3 0b 78 42 2f 9c e0 53 9b 37 e2 ac 81 12 5c e5 f3 1f 11 2f b6 15 a7 56 c3 61 23 1d c0 f4 50 be 2a cc c9 3d 52 fc 79 df 25 7b d0 f7 c2 ea db 98 9a 5a e6 18 5d 71 54 99 c8 38 99 18 21 67 82 4a 35 e4 59 4f Data Ascii: ,H,QY7(6a[D^F?KF~G8o3_'8{2PS]\!;n[uq/G\Bg4HiZl9y<x\|%l1MQj#P&dtzW<Ut~U~lD{<k UGxB/S7\/Va#P*=Ry%{Z]qT8!gJ5YO
2024-10-24 15:36:27 UTC	16384	IN	Data Raw: 91 75 61 f9 66 51 6b 93 14 90 9f e9 f3 6c 54 c4 f9 0d e7 db e0 51 e8 3f d3 7e 68 f0 8b 47 26 24 3a e0 2b fa 20 19 ae 34 a7 8f a0 51 e3 9f f3 eb c8 a9 49 43 89 84 d0 d3 18 db 9a 61 69 b6 a3 b2 ea 0a 46 c8 fa 4b a7 23 4b 90 e6 40 1a a7 ce a6 66 cf 2b aa af 16 9e 81 12 34 0f 94 f0 b7 72 1b 02 51 90 d3 d0 c1 67 de 6e ef 92 c6 fd 27 51 14 8d 80 df 01 bb 1c 24 62 06 6e ce bc 93 06 c6 a1 79 08 33 09 1c a1 cd 52 48 89 15 66 90 a1 d8 43 38 8c 4a 94 61 56 d3 29 6e 32 62 39 51 75 09 93 31 45 b4 89 a7 cf f7 a5 cc 6a 26 8f 36 38 8f 8b 10 09 05 77 16 80 6e 03 6d 15 98 75 ea 11 af 2d e4 7b 0c 5d bf 1c 3a 48 bf c1 88 c7 d5 47 ba bd 02 24 4c 16 54 34 ed 88 93 4d db 84 b4 f3 54 14 84 21 3a 6c a8 51 9c fb 52 d2 11 4b 04 52 18 24 9e 93 d6 d4 00 85 db ed 81 9f f6 0b f4 49 22 Data Ascii: uafQklTQ?~hG&$:+ 4QICaiFK#K@f+4rQgn'Q$bny3RHfC8JaV)n2b9Qu1Ej&68wnmu-{]:HG$LT4MT!:lQRKR$I"
2024-10-24 15:36:28 UTC	16384	IN	Data Raw: 86 9c fc d4 49 c0 6e 02 df 17 79 12 c5 41 90 60 c2 b2 24 0a 93 24 c9 03 0e 2e b1 93 6e 6a 09 95 da 20 a1 dc 71 05 28 36 f7 12 db 4f dc c0 c3 70 82 44 e4 81 cd b2 db 79 9f d6 3a 4b 63 87 b3 c8 e5 81 ab fe f5 3d c6 41 54 49 9c fb 36 90 c2 71 6f e7 b0 5b ed 26 34 3c 22 8b c0 b5 f3 0c 5c 55 da a1 0d 4e 21 63 2f 10 21 b3 99 f0 79 bc 1b e2 0d d3 84 87 c2 06 17 b5 85 4c 32 70 54 b0 a1 1c ac 1d 8b 17 fa 91 08 76 d3 4d 64 70 cf 0d 44 e4 b1 cc 8d 5d 48 29 28 80 52 84 60 b5 79 c4 02 60 63 b0 9b 09 8c 52 6e 47 61 94 b9 99 eb db b9 4c ec 50 e4 1c 26 6c 00 6e 2e 92 c8 f1 77 83 0e b1 f1 7c 66 42 46 1c dc 2f 73 9c 50 46 49 c8 59 1e b8 0c d6 1c 0f 02 2f dc 0d 3d c5 29 f7 a4 e3 e7 59 1e 63 02 9d 0c eb 93 f0 c8 16 b1 2f 49 bc c7 d1 6e c6 54 2b 62 a9 e3 04 d2 b7 5d f0 f0 8c Data Ascii: InyA`$$.nj q(6OpDy:Kc=ATI6qo[&4<"\UN!c/!yL2pTvMdpD]H)(R`y`cRnGaLP&ln.w\|fBF/sPFIY/=)Yc/InT+b]
2024-10-24 15:36:28 UTC	16384	IN	Data Raw: 36 d9 e5 4f 3e 43 75 3a a5 ae da d0 ea 95 e1 cb cf bb f7 e8 a8 fc bd cf 9b 00 81 b6 4b b6 7e f9 63 33 41 cb 82 9b 55 92 ef 18 7f ab 95 71 25 c9 da 7b 09 4b 99 df 29 f2 9b a9 37 9f 37 63 8e aa 7f ce 1f 96 42 3e 2f 30 e9 f5 ae d8 56 e6 4b d3 dc ef a4 fc fc 8b 22 21 84 dc a7 eb cf be 2e fd e7 5f 6a 66 1e ad 72 e1 e5 eb 2f 2c 3b be ac 17 77 6b 8a be 15 25 fd f6 ba bd f6 ec 13 57 f8 4d 11 5c 4b 2f a5 da 7f 65 68 7d 2b b5 7e 56 b1 5c a6 b7 d1 ee eb aa b7 57 f2 b7 55 a2 6f a7 66 16 d5 4b 76 4e 12 77 ae 34 e4 9f aa a2 53 7d fd f3 2d 48 f0 eb 91 ce bb 94 8a 5f 95 bf e0 96 2e 3d 49 f1 63 cf e6 27 6c 56 fb 57 3a bc 43 8b 4c 72 ee 1d cd 6e e7 d5 ab 54 07 fb 65 ab 87 5d 71 89 3f ba 87 e7 96 1e 1c ba 5c 4d 9d 1d 98 9f ad 2f d8 15 cc fe fa 1a 0b f5 40 01 58 4d 17 5f 98 Data Ascii: 6O>Cu:K~c3AUq%{K)77cB>/0VK"!._jfr/,;wk%WM\K/eh}+~V\WUofKvNw4S}-H_.=Ic'lVW:CLrnTe]q?\M/@XM_
2024-10-24 15:36:28 UTC	8169	IN	Data Raw: 18 66 2f ae 5c 7c e2 cb 27 71 7c 3e a7 f8 64 2e 9e 3c 27 1e 75 61 3c f8 ec 4a 3c 3b 11 28 cc 31 d5 00 f5 a6 c3 86 c3 90 fc 69 02 ff 26 06 3c 78 03 84 40 93 83 34 8d bd 10 69 1f 40 02 8b c0 01 fe 9a 99 b9 02 6c 30 7c 23 22 21 89 68 59 8c 6c cf f1 0d 70 50 cd 3b 4e 15 97 02 08 78 98 cc 91 0c cf 0f f9 8c 4e a2 f9 f5 49 84 e5 df 80 36 02 83 71 b5 85 11 7a 27 91 44 2e a4 e7 47 8f 38 5c 11 ab 3e 52 79 4a 21 62 e0 1a 9f 94 56 4e 82 00 8f 24 05 e1 bc a4 24 89 d0 27 c0 b8 60 2b ff 3e 22 57 d9 85 cc 2c fe cc 98 b1 79 8a b0 e8 2f 0f e1 c9 21 87 d9 0b b4 7f 95 9a 7a 4d 3f 33 1f 78 c1 d8 92 5e fc 23 a7 49 9c 3a e7 62 c0 6c c5 42 e0 5c de 2f 8c 2f e2 e7 01 f1 c5 92 7c 96 ab 17 27 e7 71 96 9b 91 af d9 e8 de c1 9e 7a ec 1b 1f d9 0f 81 b3 be f1 86 fd 84 0a 9f 49 e2 03 b4 Data Ascii: f/\\|'q\|>d.<'ua<J<;(1i&<x@4i@l0\|#"!hYlpP;NxNI6qz'D.G8\>RyJ!bVN$$'`+>"W,y/!zM?3x^#I:blB\//\|'qzI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.17	49847	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:36:29 UTC	410	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_DQTmGfOEMmPUR-Vehc8U6Q2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:36:29 UTC	792	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:36:29 GMT Content-Type: application/x-javascript Content-Length: 122065 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 18 Sep 2024 23:43:27 GMT ETag: 0x8DCD83BB1CF3887 x-ms-request-id: 843aa679-f01e-0048-1e94-20a9de000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153629Z-r1755647c66mgrw7zd8m1pn55000000008d0000000007hdd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:36:29 UTC	15592	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e4 bd 7b 57 e3 48 92 38 fa ff fd 14 46 33 97 b6 1b 61 2c bf b0 45 ab 59 63 a0 8a 69 c0 0c 86 ea 9e a5 18 8e 2c a5 8d 1a 59 f2 4a 32 8f 31 de cf fe 8b 88 cc 94 52 b6 4c 55 cd ee b9 f7 dc 73 e7 41 59 99 91 af c8 c8 c8 88 c8 c8 c8 bd 9f b7 fe af d2 cf a5 dd ef ff 4f 69 78 d3 bb be 29 0d 4e 4b 37 9f cf ae 8f 4b 57 f0 f5 8f d2 e5 e0 e6 ac 7f f2 fd f5 60 a3 f8 ff 9b 47 2f 2e 8d 3d 9f 95 e0 df 91 1d 33 b7 14 06 a5 30 2a 79 81 13 46 b3 30 b2 13 16 97 a6 f0 37 f2 6c bf 34 8e c2 69 29 79 64 a5 59 14 fe c9 9c 24 2e f9 5e 9c 40 a1 11 f3 c3 97 52 19 aa 8b dc d2 95 1d 25 6f a5 b3 ab 4a 15 ea 67 50 9b 37 f1 02 28 ed 84 b3 37 f8 fd 98 94 82 30 f1 1c 56 b2 03 97 6a f3 e1 23 88 59 69 1e b8 2c 2a bd 3c 7a ce 63 e9 c2 73 a2 30 0e c7 49 29 62 0e Data Ascii: {WH8F3a,EYci,YJ21RLUsAYOix)NK7KW`G/.=30yF07l4i)ydY$.^@R%oJgP7(70Vj#Yi,<zcs0I)b
2024-10-24 15:36:29 UTC	16384	IN	Data Raw: e9 a7 cc cf bf 13 ee c2 50 56 0b cd 18 7b 2a 73 e5 15 27 0c 2d 64 d3 19 de ce e0 ee 25 56 d1 9e 03 3c 05 00 07 d9 60 58 56 61 e5 1b 26 a7 83 cc be e1 49 4f dc 8f a6 4d 47 13 80 81 26 00 a1 f2 83 f4 2d 2e fc 66 33 16 af 94 43 fd 1d 3d 50 40 61 3a b6 a3 a7 ec 6a 3e fa 7e e6 bc e3 8e d0 67 8b fc 0d f1 c6 c1 6a ee ef e8 bb a5 e4 ae d5 67 d9 28 36 a1 3f 2b 5d d3 b8 c4 2b cd b0 87 54 5d 80 ca 52 12 5d a1 5b 58 e3 d1 06 17 3d 66 45 d5 22 57 c8 72 e5 a3 7e 0b bf 33 dc 46 3f 1a 80 70 44 43 b0 25 1a 95 bc aa 23 67 3a 86 45 87 01 e3 60 9b d6 6c 0a 22 81 e1 1c 77 3d 1c 00 f7 f1 0c 7d 4d 5f 3c 7b ec 05 6d 83 be b9 e0 2b e9 4b 9a 50 b4 ba bd 75 9e 89 7a 9e 08 7b 81 88 89 0b 6f 5e 70 d5 24 80 7c f4 b8 5e 66 17 2c 90 d1 e0 4c 27 e4 a3 88 96 43 a0 35 59 9f 99 94 1b ad 46 Data Ascii: PV{*s'-d%V<`XVa&IOMG&-.f3C=P@a:j>~gjg(6?+]+T]R][X=fE"Wr~3F?pDC%#g:E`l"w=}M_<{m+KPuz{o^p$\|^f,L'C5YF
2024-10-24 15:36:29 UTC	16384	IN	Data Raw: 38 39 d1 20 4e d0 1a bc 0b b9 32 bc f9 3d b1 71 12 23 a6 f9 8d 48 2b 02 99 f7 c9 fb c0 79 12 b1 ff 81 2b 67 3a fd ea 7d 38 de 3d 38 7c 43 e6 50 dc cf d5 19 56 80 8a 7a 2c f3 52 d5 bd 39 55 e5 89 4d b4 18 e9 a7 40 09 16 ad 51 d2 c3 74 7a 26 e6 46 41 dd 43 dc 4d 99 80 37 30 18 8b c9 88 a9 4f 44 26 9c 90 c3 b8 17 21 11 70 4b 28 8d b6 f0 23 a4 33 e4 79 a3 6e f6 11 61 29 9d b9 e0 0d 16 c3 66 e0 f7 01 f6 52 be b2 c1 35 a4 d6 5d d9 e0 ce 9c c6 55 9a f0 51 d2 59 cb 76 cf 2b 16 41 2b 4c 28 98 5a 94 79 55 cf d2 89 5e 8c 03 6e e8 73 9a 57 b1 b8 68 a5 0a d4 44 c6 ce 1b b3 ba da e6 e1 b6 31 cc 5d f4 1e ce 34 80 c8 83 ec 03 eb 9f 53 23 e5 95 9c 37 94 1d ad 5c 4d 35 6a eb 4e dc 85 ba 36 76 00 d3 67 3a 47 db 5d a6 2b 17 aa f7 cd 76 ea ef 6f ed e5 44 0e 59 e9 36 22 23 41 Data Ascii: 89 N2=q#H+y+g:}8=8\|CPVz,R9UM@Qtz&FACM70OD&!pK(#3yna)fR5]UQYv+A+L(ZyU^nsWhD1]4S#7\M5jN6vg:G]+voDY6"#A
2024-10-24 15:36:29 UTC	16384	IN	Data Raw: f7 2c 0c 48 89 2c cf 87 51 59 16 ed c9 8c 37 28 36 61 5b e3 44 fa 5e 46 3f 4b 8a 46 fe c1 7e c2 cd 84 47 e0 eb 38 ce b5 86 e2 6f b0 cd 33 b4 ad 10 5f 27 05 38 f4 7b 32 c6 50 53 f1 5d 5c d6 9d a3 21 b8 a9 3b 6e 5b c9 e4 ae 1b 8d 75 71 2f 8c cd 47 5c 9f 42 ca a2 67 ff 34 48 84 d4 0a 69 ea f7 e8 5a 02 9e 88 1a 6c 39 ed c0 cb 9f a4 79 3c 78 fc 7c 13 25 6c 06 98 9d e6 e9 08 ca a4 9d d0 8f 31 a2 4d d7 ae 51 6a c0 d8 23 ae 50 26 99 b9 64 74 06 d8 7a 8d 0a 57 93 3c e0 55 74 93 7e 94 55 7e 6c b0 44 02 95 db 10 a5 0a 7b e8 f8 3c 6b 00 11 da 20 e1 55 e3 47 f4 1b f4 a3 0b 78 42 2f 9c e0 53 9b 37 e2 ac 81 12 5c e5 f3 1f 11 2f b6 15 a7 56 c3 61 23 1d c0 f4 50 be 2a cc c9 3d 52 fc 79 df 25 7b d0 f7 c2 ea db 98 9a 5a e6 18 5d 71 54 99 c8 38 99 18 21 67 82 4a 35 e4 59 4f Data Ascii: ,H,QY7(6a[D^F?KF~G8o3_'8{2PS]\!;n[uq/G\Bg4HiZl9y<x\|%l1MQj#P&dtzW<Ut~U~lD{<k UGxB/S7\/Va#P*=Ry%{Z]qT8!gJ5YO
2024-10-24 15:36:29 UTC	16384	IN	Data Raw: 91 75 61 f9 66 51 6b 93 14 90 9f e9 f3 6c 54 c4 f9 0d e7 db e0 51 e8 3f d3 7e 68 f0 8b 47 26 24 3a e0 2b fa 20 19 ae 34 a7 8f a0 51 e3 9f f3 eb c8 a9 49 43 89 84 d0 d3 18 db 9a 61 69 b6 a3 b2 ea 0a 46 c8 fa 4b a7 23 4b 90 e6 40 1a a7 ce a6 66 cf 2b aa af 16 9e 81 12 34 0f 94 f0 b7 72 1b 02 51 90 d3 d0 c1 67 de 6e ef 92 c6 fd 27 51 14 8d 80 df 01 bb 1c 24 62 06 6e ce bc 93 06 c6 a1 79 08 33 09 1c a1 cd 52 48 89 15 66 90 a1 d8 43 38 8c 4a 94 61 56 d3 29 6e 32 62 39 51 75 09 93 31 45 b4 89 a7 cf f7 a5 cc 6a 26 8f 36 38 8f 8b 10 09 05 77 16 80 6e 03 6d 15 98 75 ea 11 af 2d e4 7b 0c 5d bf 1c 3a 48 bf c1 88 c7 d5 47 ba bd 02 24 4c 16 54 34 ed 88 93 4d db 84 b4 f3 54 14 84 21 3a 6c a8 51 9c fb 52 d2 11 4b 04 52 18 24 9e 93 d6 d4 00 85 db ed 81 9f f6 0b f4 49 22 Data Ascii: uafQklTQ?~hG&$:+ 4QICaiFK#K@f+4rQgn'Q$bny3RHfC8JaV)n2b9Qu1Ej&68wnmu-{]:HG$LT4MT!:lQRKR$I"
2024-10-24 15:36:29 UTC	16384	IN	Data Raw: 86 9c fc d4 49 c0 6e 02 df 17 79 12 c5 41 90 60 c2 b2 24 0a 93 24 c9 03 0e 2e b1 93 6e 6a 09 95 da 20 a1 dc 71 05 28 36 f7 12 db 4f dc c0 c3 70 82 44 e4 81 cd b2 db 79 9f d6 3a 4b 63 87 b3 c8 e5 81 ab fe f5 3d c6 41 54 49 9c fb 36 90 c2 71 6f e7 b0 5b ed 26 34 3c 22 8b c0 b5 f3 0c 5c 55 da a1 0d 4e 21 63 2f 10 21 b3 99 f0 79 bc 1b e2 0d d3 84 87 c2 06 17 b5 85 4c 32 70 54 b0 a1 1c ac 1d 8b 17 fa 91 08 76 d3 4d 64 70 cf 0d 44 e4 b1 cc 8d 5d 48 29 28 80 52 84 60 b5 79 c4 02 60 63 b0 9b 09 8c 52 6e 47 61 94 b9 99 eb db b9 4c ec 50 e4 1c 26 6c 00 6e 2e 92 c8 f1 77 83 0e b1 f1 7c 66 42 46 1c dc 2f 73 9c 50 46 49 c8 59 1e b8 0c d6 1c 0f 02 2f dc 0d 3d c5 29 f7 a4 e3 e7 59 1e 63 02 9d 0c eb 93 f0 c8 16 b1 2f 49 bc c7 d1 6e c6 54 2b 62 a9 e3 04 d2 b7 5d f0 f0 8c Data Ascii: InyA`$$.nj q(6OpDy:Kc=ATI6qo[&4<"\UN!c/!yL2pTvMdpD]H)(R`y`cRnGaLP&ln.w\|fBF/sPFIY/=)Yc/InT+b]
2024-10-24 15:36:29 UTC	16384	IN	Data Raw: 36 d9 e5 4f 3e 43 75 3a a5 ae da d0 ea 95 e1 cb cf bb f7 e8 a8 fc bd cf 9b 00 81 b6 4b b6 7e f9 63 33 41 cb 82 9b 55 92 ef 18 7f ab 95 71 25 c9 da 7b 09 4b 99 df 29 f2 9b a9 37 9f 37 63 8e aa 7f ce 1f 96 42 3e 2f 30 e9 f5 ae d8 56 e6 4b d3 dc ef a4 fc fc 8b 22 21 84 dc a7 eb cf be 2e fd e7 5f 6a 66 1e ad 72 e1 e5 eb 2f 2c 3b be ac 17 77 6b 8a be 15 25 fd f6 ba bd f6 ec 13 57 f8 4d 11 5c 4b 2f a5 da 7f 65 68 7d 2b b5 7e 56 b1 5c a6 b7 d1 ee eb aa b7 57 f2 b7 55 a2 6f a7 66 16 d5 4b 76 4e 12 77 ae 34 e4 9f aa a2 53 7d fd f3 2d 48 f0 eb 91 ce bb 94 8a 5f 95 bf e0 96 2e 3d 49 f1 63 cf e6 27 6c 56 fb 57 3a bc 43 8b 4c 72 ee 1d cd 6e e7 d5 ab 54 07 fb 65 ab 87 5d 71 89 3f ba 87 e7 96 1e 1c ba 5c 4d 9d 1d 98 9f ad 2f d8 15 cc fe fa 1a 0b f5 40 01 58 4d 17 5f 98 Data Ascii: 6O>Cu:K~c3AUq%{K)77cB>/0VK"!._jfr/,;wk%WM\K/eh}+~V\WUofKvNw4S}-H_.=Ic'lVW:CLrnTe]q?\M/@XM_
2024-10-24 15:36:30 UTC	8169	IN	Data Raw: 18 66 2f ae 5c 7c e2 cb 27 71 7c 3e a7 f8 64 2e 9e 3c 27 1e 75 61 3c f8 ec 4a 3c 3b 11 28 cc 31 d5 00 f5 a6 c3 86 c3 90 fc 69 02 ff 26 06 3c 78 03 84 40 93 83 34 8d bd 10 69 1f 40 02 8b c0 01 fe 9a 99 b9 02 6c 30 7c 23 22 21 89 68 59 8c 6c cf f1 0d 70 50 cd 3b 4e 15 97 02 08 78 98 cc 91 0c cf 0f f9 8c 4e a2 f9 f5 49 84 e5 df 80 36 02 83 71 b5 85 11 7a 27 91 44 2e a4 e7 47 8f 38 5c 11 ab 3e 52 79 4a 21 62 e0 1a 9f 94 56 4e 82 00 8f 24 05 e1 bc a4 24 89 d0 27 c0 b8 60 2b ff 3e 22 57 d9 85 cc 2c fe cc 98 b1 79 8a b0 e8 2f 0f e1 c9 21 87 d9 0b b4 7f 95 9a 7a 4d 3f 33 1f 78 c1 d8 92 5e fc 23 a7 49 9c 3a e7 62 c0 6c c5 42 e0 5c de 2f 8c 2f e2 e7 01 f1 c5 92 7c 96 ab 17 27 e7 71 96 9b 91 af d9 e8 de c1 9e 7a ec 1b 1f d9 0f 81 b3 be f1 86 fd 84 0a 9f 49 e2 03 b4 Data Ascii: f/\\|'q\|>d.<'ua<J<;(1i&<x@4i@l0\|#"!hYlpP;NxNI6qz'D.G8\>RyJ!bVN$$'`+>"W,y/!zM?3x^#I:blB\//\|'qzI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.17	49848	52.98.152.242	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:36:29 UTC	769	OUT	GET /owa/prefetch.aspx HTTP/1.1 Host: outlook.office365.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ClientId=0C6D15CADB384F3688AA45313AB12D6B; OIDC=1
2024-10-24 15:36:29 UTC	1590	IN	HTTP/1.1 200 OK Cache-Control: private, no-store Content-Length: 2745 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 request-id: 5f8effa3-b6a7-f6fb-da11-403fb10e5388 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CalculatedFETarget: BE1P281CU022.internal.outlook.com X-BackEndHttpStatus: 200 Set-Cookie: OWAPF=v:15.20.8069.27&l:mouse; path=/; secure; HttpOnly X-CalculatedBETarget: BE1P281MB3333.DEUP281.PROD.OUTLOOK.COM X-BackEndHttpStatus: 200 X-RUM-Validated: 1 X-RUM-NotUpdateQueriedPath: 1 X-RUM-NotUpdateQueriedDbCopy: 1 X-Content-Type-Options: nosniff X-BeSku: WCS7 X-OWA-Version: 15.20.8069.24 X-OWA-DiagnosticsInfo: 10;0;0; X-BackEnd-Begin: 2024-10-24T15:36:29.642 X-BackEnd-End: 2024-10-24T15:36:29.657 X-DiagInfo: BE1P281MB3333 X-BEServer: BE1P281MB3333 X-UA-Compatible: IE=EmulateIE7 X-ResponseOrigin: OwaAppPool X-Proxy-RoutingCorrectness: 1 X-Proxy-BackendServerStatus: 200 X-FEProxyInfo: FR0P281CA0089.DEUP281.PROD.OUTLOOK.COM X-FEEFZInfo: HHN X-FEServer: BE1P281CA0282 Report-To: {"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=HHN&RemoteIP=173.254.250.0&Environment=MT"}],"include_subdomains":true} NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-FirstHopCafeEFZ: HHN X-FEServer: FR0P281CA0089 Date: Thu, 24 Oct 2024 15:36:29 GMT Connection: close
2024-10-24 15:36:29 UTC	2745	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 72 65 66 65 74 63 68 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0d 0a 0d 0a 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 6f 66 66 69 63 65 33 36 35 69 63 6f 6e 73 27 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 72 63 3a 20 75 72 6c 28 27 68 74 74 70 73 3a 2f Data Ascii: <!DOCTYPE html><html><head> <title>Prefetch</title> <meta http-equiv="x-ua-compatible" content="IE=Edge"> <style> @font-face { font-family: 'office365icons'; src: url('https:/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.17	49853	52.98.152.242	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:36:34 UTC	769	OUT	GET /owa/prefetch.aspx HTTP/1.1 Host: outlook.office365.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ClientId=0C6D15CADB384F3688AA45313AB12D6B; OIDC=1
2024-10-24 15:36:34 UTC	1589	IN	HTTP/1.1 200 OK Cache-Control: private, no-store Content-Length: 2745 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 request-id: 08ce7e14-408b-b881-28d3-f62552c539c6 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CalculatedFETarget: BE1P281CU017.internal.outlook.com X-BackEndHttpStatus: 200 Set-Cookie: OWAPF=v:15.20.8069.28&l:mouse; path=/; secure; HttpOnly X-CalculatedBETarget: BEVP281MB3711.DEUP281.PROD.OUTLOOK.COM X-BackEndHttpStatus: 200 X-RUM-Validated: 1 X-RUM-NotUpdateQueriedPath: 1 X-RUM-NotUpdateQueriedDbCopy: 1 X-Content-Type-Options: nosniff X-BeSku: WCS7 X-OWA-Version: 15.20.8069.27 X-OWA-DiagnosticsInfo: 8;0;0; X-BackEnd-Begin: 2024-10-24T15:36:34.568 X-BackEnd-End: 2024-10-24T15:36:34.568 X-DiagInfo: BEVP281MB3711 X-BEServer: BEVP281MB3711 X-UA-Compatible: IE=EmulateIE7 X-ResponseOrigin: OwaAppPool X-Proxy-RoutingCorrectness: 1 X-Proxy-BackendServerStatus: 200 X-FEProxyInfo: FR0P281CA0085.DEUP281.PROD.OUTLOOK.COM X-FEEFZInfo: HHN X-FEServer: BE1P281CA0205 Report-To: {"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=HHN&RemoteIP=173.254.250.0&Environment=MT"}],"include_subdomains":true} NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-FirstHopCafeEFZ: HHN X-FEServer: FR0P281CA0085 Date: Thu, 24 Oct 2024 15:36:34 GMT Connection: close
2024-10-24 15:36:34 UTC	2745	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 72 65 66 65 74 63 68 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0d 0a 0d 0a 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 6f 66 66 69 63 65 33 36 35 69 63 6f 6e 73 27 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 72 63 3a 20 75 72 6c 28 27 68 74 74 70 73 3a 2f Data Ascii: <!DOCTYPE html><html><head> <title>Prefetch</title> <meta http-equiv="x-ua-compatible" content="IE=Edge"> <style> @font-face { font-family: 'office365icons'; src: url('https:/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.17	49859	52.98.152.242	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:36:41 UTC	769	OUT	GET /owa/prefetch.aspx HTTP/1.1 Host: outlook.office365.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ClientId=0C6D15CADB384F3688AA45313AB12D6B; OIDC=1
2024-10-24 15:36:42 UTC	1589	IN	HTTP/1.1 200 OK Cache-Control: private, no-store Content-Length: 2745 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 request-id: d58db2d6-aa7d-305b-5f53-96bdb048ba10 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CalculatedFETarget: FR2P281CU004.internal.outlook.com X-BackEndHttpStatus: 200 Set-Cookie: OWAPF=v:15.20.8093.20&l:mouse; path=/; secure; HttpOnly X-CalculatedBETarget: FR2P281MB3104.DEUP281.PROD.OUTLOOK.COM X-BackEndHttpStatus: 200 X-RUM-Validated: 1 X-RUM-NotUpdateQueriedPath: 1 X-RUM-NotUpdateQueriedDbCopy: 1 X-Content-Type-Options: nosniff X-BeSku: WCS7 X-OWA-Version: 15.20.8093.20 X-OWA-DiagnosticsInfo: 8;0;0; X-BackEnd-Begin: 2024-10-24T15:36:41.988 X-BackEnd-End: 2024-10-24T15:36:42.003 X-DiagInfo: FR2P281MB3104 X-BEServer: FR2P281MB3104 X-UA-Compatible: IE=EmulateIE7 X-ResponseOrigin: OwaAppPool X-Proxy-RoutingCorrectness: 1 X-Proxy-BackendServerStatus: 200 X-FEProxyInfo: FR0P281CA0089.DEUP281.PROD.OUTLOOK.COM X-FEEFZInfo: HHN X-FEServer: FR2P281CA0058 Report-To: {"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=HHN&RemoteIP=173.254.250.0&Environment=MT"}],"include_subdomains":true} NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-FirstHopCafeEFZ: HHN X-FEServer: FR0P281CA0089 Date: Thu, 24 Oct 2024 15:36:41 GMT Connection: close
2024-10-24 15:36:42 UTC	2745	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 72 65 66 65 74 63 68 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0d 0a 0d 0a 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 6f 66 66 69 63 65 33 36 35 69 63 6f 6e 73 27 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 72 63 3a 20 75 72 6c 28 27 68 74 74 70 73 3a 2f Data Ascii: <!DOCTYPE html><html><head> <title>Prefetch</title> <meta http-equiv="x-ua-compatible" content="IE=Edge"> <style> @font-face { font-family: 'office365icons'; src: url('https:/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.17	49867	52.98.152.242	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:36:54 UTC	769	OUT	GET /owa/prefetch.aspx HTTP/1.1 Host: outlook.office365.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ClientId=0C6D15CADB384F3688AA45313AB12D6B; OIDC=1
2024-10-24 15:36:54 UTC	1479	IN	HTTP/1.1 200 OK Cache-Control: private, no-store Content-Length: 2745 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 request-id: 5e0b0059-437b-44ab-25cd-13ba3b2779da Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CalculatedBETarget: FR5P281MB3970.DEUP281.PROD.OUTLOOK.COM X-BackEndHttpStatus: 200 Set-Cookie: OWAPF=v:15.20.8093.20&l:mouse; path=/; secure; HttpOnly X-RUM-Validated: 1 X-RUM-NotUpdateQueriedPath: 1 X-RUM-NotUpdateQueriedDbCopy: 1 X-Content-Type-Options: nosniff X-BeSku: WCS7 X-OWA-Version: 15.20.8093.20 X-OWA-DiagnosticsInfo: 5;0;0; X-BackEnd-Begin: 2024-10-24T15:36:54.178 X-BackEnd-End: 2024-10-24T15:36:54.178 X-DiagInfo: FR5P281MB3970 X-BEServer: FR5P281MB3970 X-UA-Compatible: IE=EmulateIE7 X-ResponseOrigin: OwaAppPool X-Proxy-RoutingCorrectness: 1 Report-To: {"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=HHN&RemoteIP=173.254.250.0&Environment=MT"}],"include_subdomains":true} NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-Proxy-BackendServerStatus: 200 X-FirstHopCafeEFZ: HHN X-FEProxyInfo: FR0P281CA0079.DEUP281.PROD.OUTLOOK.COM X-FEEFZInfo: HHN X-FEServer: FR0P281CA0079 Date: Thu, 24 Oct 2024 15:36:53 GMT Connection: close
2024-10-24 15:36:54 UTC	2745	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 72 65 66 65 74 63 68 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0d 0a 0d 0a 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 6f 66 66 69 63 65 33 36 35 69 63 6f 6e 73 27 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 72 63 3a 20 75 72 6c 28 27 68 74 74 70 73 3a 2f Data Ascii: <!DOCTYPE html><html><head> <title>Prefetch</title> <meta http-equiv="x-ua-compatible" content="IE=Edge"> <style> @font-face { font-family: 'office365icons'; src: url('https:/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.17	49873	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:36:59 UTC	634	OUT	GET /shared/1.0/content/js/ConvergedError_Core_e44ULT7v2HGQHqHgp6vqIA2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:36:59 UTC	791	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:36:59 GMT Content-Type: application/x-javascript Content-Length: 98380 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 18 Sep 2024 23:43:27 GMT ETag: 0x8DCD83BB179FE65 x-ms-request-id: 75d3c1a6-a01e-0071-4539-241ad0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153659Z-r197bdfb6b4r9fwfbdwymmgex800000001kg00000000nvz6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:36:59 UTC	15593	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e4 bd 7b 57 eb 38 b2 38 fa ff fd 14 c1 33 97 8e 1b 93 1d e7 c1 c3 b4 9b 13 20 ec 9d 69 20 0c 81 ee 9e 03 0c cb b1 95 e0 26 d8 39 b6 c3 63 92 fc 3e fb ad 2a 49 b6 ec 38 ec bd 7b 66 dd 75 ee ba f3 d8 c4 52 e9 55 2a 95 aa 4a a5 d2 a7 1f 37 fe af ca 8f 95 ed 6f ff 4f 65 70 dd b9 ba ae f4 4f 2b d7 5f 7a 57 27 95 4b f8 fa 47 e5 a2 7f dd 3b ee 7e 7b 3d d8 28 fe ff fa d1 8f 2b 23 7f c2 2a f0 77 e8 c4 cc ab 84 41 25 8c 2a 7e e0 86 d1 34 8c 9c 84 c5 95 67 f8 37 f2 9d 49 65 14 85 cf 95 e4 91 55 a6 51 f8 07 73 93 b8 32 f1 e3 04 0a 0d d9 24 7c ad 54 a1 ba c8 ab 5c 3a 51 f2 5e e9 5d ea 35 a8 9f 41 6d fe d8 0f a0 b4 1b 4e df e1 f7 63 52 09 c2 c4 77 59 c5 09 3c aa 6d 02 1f 41 cc 2a b3 c0 63 51 e5 f5 d1 77 1f 2b e7 be 1b 85 71 38 4a 2a 11 73 Data Ascii: {W883 i &9c>I8{fuRUJ7oOepO+_zW'KG;~{=(+#wA%~4g7IeUQs2$\|T\:Q^]5AmNcRwY<mAcQw+q8Js
2024-10-24 15:36:59 UTC	16384	IN	Data Raw: 5a 1c 60 66 a5 14 07 70 e5 a4 c8 4b 50 75 e7 a0 7d db 1b 2f 8b c5 c6 23 3d e6 51 41 e5 05 ed f4 c5 76 49 47 fa d9 ae 2f 16 6a 16 8e b2 3c 47 8c 34 00 e5 d0 67 81 37 79 17 e7 cc ba be b6 6a 81 cd 95 e1 7a d5 51 fa b6 44 ed d3 bc be ac fd 31 1d 63 18 ac b2 7a 80 1e 66 b5 e2 cb ef 55 2d 03 45 11 4e e3 2f af c5 cf ce 64 b2 be 99 6d ca ff b8 31 22 bf 72 7c 14 86 23 09 64 b2 32 9a 69 50 68 20 ad 05 ab 97 b4 b1 82 5c c8 29 e0 d6 5e c1 b6 3a a7 41 6d 16 4d f8 f1 ef 51 ae 29 bd ac 9b 6b a1 d3 2a 5f 36 37 1f 53 ca 7d ae 95 1f 17 a7 d0 09 60 44 be a1 46 13 f4 32 ee 3d 8f 95 b7 45 0f 4a e7 de 5d c1 d6 dc 5c 6a f8 38 cd a1 16 bf 8c 35 4b c3 e9 01 34 6d f8 9b 9b 7f 72 e2 57 da 50 27 3e e1 73 50 c6 06 ec f4 61 e0 4a 48 fc e4 9c 45 e4 36 5d ca 51 d2 27 e4 c8 08 af fb 76 Data Ascii: Z`fpKPu}/#=QAvIG/j<G4g7yjzQD1czfU-EN/dm1"r\|#d2iPh \)^:AmMQ)k*_67S}`DF2=EJ]\j85K4mrWP'>sPaJHE6]Q'v
2024-10-24 15:36:59 UTC	16384	IN	Data Raw: 66 80 e0 d3 25 82 f5 bb 83 ec 0f dc 0b 23 91 5b 93 30 6d 9d 5b b4 c4 23 6c 7a 62 ab 32 1a ca 8a e1 55 e9 fd 78 86 7f 5c 6f 02 dc 94 a9 ca 15 71 7b 5b de bf 4f ed 5d ba c0 d2 9d 96 21 9d 56 78 39 c5 dd 53 ba 1b b2 93 f1 14 01 e6 2d e0 33 ce 07 82 4f 51 ab cb 70 af 66 f0 62 00 0d fc 1c c8 34 36 e6 0a 6e 10 b2 26 21 de cf c7 c8 fb 88 63 6f 03 ac 60 dd d1 53 15 d5 de 8e 7e f7 f8 8d 32 b6 f7 62 09 d8 57 14 4f c2 56 df b9 27 55 70 c9 d8 2e 6c 74 61 d4 15 ff d7 41 95 ba 5a 5b ac 27 d7 97 8a d9 d9 fa 4f 7b ce 75 26 06 ec 8e f7 6e 6f f7 55 1e ed 7d db aa f8 4e e8 dd cf 2d ff 11 1a 45 75 f2 60 2d 41 91 33 36 cc 96 8e 24 ac ba 4e 9b da ac c7 fb a3 73 04 dd de 0e df 57 3e e7 5a 09 d1 5f f4 ce 5c 4c d9 23 89 9f 5e 38 5b 1d 2e b7 c3 7e dc 8e 8e 7c d7 41 0c b7 dc fa df Data Ascii: f%#[0m[#lzb2Ux\oq{[O]!Vx9S-3OQpfb46n&!co`S~2bWOV'Up.ltaAZ['O{u&noU}N-Eu`-A36$NsW>Z_\L#^8[.~\|A
2024-10-24 15:36:59 UTC	16384	IN	Data Raw: c3 b8 b0 ea 0b eb fc 13 a8 d1 cd d1 c4 ee 50 43 9c 5d 19 82 b5 ce b4 76 03 0e d8 c2 e3 ed 1f 5a b1 43 4a b8 86 31 c3 37 61 73 0a e3 65 5e d3 36 ca 70 32 45 8d 96 07 2f fc b8 e4 17 ec 40 51 7f 50 70 41 e1 73 3a 90 98 6b 56 87 f1 ef 93 c8 bf 37 d1 e9 8f 00 a2 d7 51 31 fb 75 8b 31 83 64 d1 ec 7a 21 59 4a ce b4 65 09 fa 15 de 3c 89 90 bc 69 49 47 4c 1d b9 47 b4 ef b6 fe 47 59 70 b4 4e e8 24 7c a2 7f b4 b2 9b e2 d5 4b 80 e9 1e 21 e6 27 58 2f c1 7e de bf ff de bc 89 7b 5c 9d 1e cc 93 e0 77 98 a7 3f f6 ab db 18 73 7f ea 69 1b 6a 1d 32 e3 a0 4d a7 f5 61 31 ad a9 32 71 96 ca e7 f5 82 6a 6b 25 49 4a d9 8d 8c 9f 3c 61 2c f9 ed 00 5f 8e 74 e4 f6 aa 64 25 1d 08 b3 6f 6b 9d d8 f1 d6 bf 50 d9 c7 34 bf 97 d3 68 84 7b 97 fe 47 2c 9f 6b 6a de 11 fd 77 8e 1f cf f0 cf 15 fe Data Ascii: PC]vZCJ17ase^6p2E/@QPpAs:kV7Q1u1dz!YJe<iIGLGGYpN$\|K!'X/~{\w?sij2Ma12qjk%IJ<a,_td%okP4h{G,kjw
2024-10-24 15:36:59 UTC	16384	IN	Data Raw: a5 75 96 2a c2 75 26 12 49 31 60 63 a1 b3 42 30 92 d8 fb df c8 be b9 e7 34 31 02 3a f7 d6 63 72 18 2e 3c 8d 01 22 19 a1 19 cd 32 de f7 98 51 f9 76 9e 28 a6 68 c2 93 34 35 d6 38 a5 1c 81 82 b7 a0 66 51 e7 ee 1d 03 60 5f 9f 5e c0 80 98 d1 98 69 82 69 97 61 a4 47 65 a5 c9 8c 2d 0a 6a f5 97 18 67 c4 70 22 19 33 d2 69 8c 70 24 31 eb 8a 55 2a b1 a0 a7 7b cc 23 cf 7b 9f db 4d cf be a0 44 15 2e b1 d6 1a 6d 1c e5 98 0c 14 e4 41 81 b1 a2 54 56 f4 3c 66 5b da 32 56 63 82 e5 c4 09 c4 70 ea 24 e5 85 96 3e 4d 34 20 5f c8 ec de 01 e6 6e e8 b6 20 18 30 47 83 ba 27 9c 4a 1c b3 52 19 95 c9 d4 fa 22 65 26 49 be d0 68 cb 49 a6 c0 21 98 f1 19 2f 12 aa 25 cb 4c 61 29 73 9e 17 0c 73 0b df 3b e2 c1 ad 3a f7 a9 10 9a 80 f2 61 55 16 52 ac 08 ce d2 4c c0 54 63 42 0a d7 37 df f2 c1 Data Ascii: uu&I1`cB041:cr.<"2Qv(h458fQ`_^iiaGe-jgp"3ip$1U{#{MD.mATV<f[2Vcp$>M4 _n 0G'JR"e&IhI!/%La)ss;:aURLTcB7
2024-10-24 15:36:59 UTC	16384	IN	Data Raw: 2b a5 10 72 0d a6 49 11 66 b4 62 73 2d 49 c6 26 4f d1 8f 24 21 f3 4f b9 b6 37 97 8e 79 f0 10 77 5a 52 f5 96 df c7 e5 92 07 0c 2b a1 32 1f 91 5d be d1 b6 5f dc 2c f2 9a 14 e0 ed fc 02 23 51 54 6d ac cd cc f5 ec fd 4c 38 0a 73 c5 0a 7a 6b e7 f7 fe 70 9d f3 c6 42 0c 9f c3 dd 8e 39 e1 6f f6 3b 78 1b da 10 44 a5 2e 89 71 6f 77 77 59 02 63 91 f6 f0 5f 2c 89 37 e3 99 e7 03 c1 c7 a4 28 95 00 59 b6 c8 82 a8 26 c6 50 f3 2b 95 22 88 89 cc 8e a6 a0 61 32 7f 49 29 5a 58 35 c5 46 75 9c 45 4a 88 0d 11 86 0b c6 9a 87 dc c5 3e 6b 02 a7 29 c9 24 36 52 0c d3 b5 19 cf b3 cd 88 27 cd 90 df e8 e1 8d 4d 1f 85 51 cd 37 47 51 dd 27 d8 0f 86 43 31 f6 c3 a3 0c 1a fb 31 7f c3 63 8d e5 9b a1 24 b1 5a 25 33 b5 8c 25 2a 62 66 95 53 53 cb 3f 43 8a 6a f9 87 94 e1 2c 9c 32 b4 7b d1 26 ce Data Ascii: +rIfbs-I&O$!O7ywZR+2]_,#QTmL8szkpB9o;xD.qowwYc_,7(Y&P+"a2I)ZX5FuEJ>k)$6R'MQ7GQ'C11c$Z%3%*bfSS?Cj,2{&
2024-10-24 15:36:59 UTC	867	IN	Data Raw: 89 dd 3b ee 66 86 17 9b 32 47 5c 54 27 bc 1a ca 2c 85 94 95 ec ef 2c 73 c2 94 08 0a e6 ce 96 99 a2 3b ac ef 48 4b 01 4f b1 48 7c a6 53 4a 4f 3a bc 75 4a c9 49 87 a7 b2 8d a2 84 67 bb 04 aa c7 e5 ba 66 5c 4a 8e 48 3c 4b 8c aa 86 80 a7 26 2e 08 19 d4 75 6a 88 77 1d e1 51 28 f7 a5 4e b9 cb 01 1f a6 3f dc e5 f3 b1 2d 2e a7 dc 97 f5 34 a9 6f 0b 3a b2 17 95 97 4d 53 d0 b2 d6 98 c7 2e 96 72 75 ab 90 13 09 dd dc a1 01 a2 30 00 2a 19 cc e3 16 74 70 dd c4 54 b9 e8 9e 03 ec 01 40 1d d0 22 c5 3a b8 f1 cb 4c c9 df b3 d9 e1 0e 94 1b 8e 75 69 21 91 dc 10 be 9c 05 b1 e2 8e a6 fa 27 1b 2f c2 17 16 7e 67 ed 25 6e 33 71 93 22 03 72 73 7f f8 25 f9 12 dd 7f 49 ee bf 44 f6 cb 4b 67 03 eb 55 3a dd b0 ed fc 1b cf e1 61 6b 42 14 81 de 9d 7d 78 ef 26 0f 8f 49 c0 d9 19 88 28 17 75 Data Ascii: ;f2G\T',,s;HKOH\|SJO:uJIgf\JH<K&.ujwQ(N?-.4o:MS.ru0*tpT@":Lui!'/~g%n3q"rs%IDKgU:akB}x&I(u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.17	49874	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:36:59 UTC	654	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.error.strings-en.min_v1eniakvll_1x20aakd_sg2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:36:59 UTC	791	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:36:59 GMT Content-Type: application/x-javascript Content-Length: 10932 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Tue, 27 Aug 2024 00:48:37 GMT ETag: 0x8DCC631FC6EAF1F x-ms-request-id: 8fa99d46-f01e-006c-3428-24176c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153659Z-15b8d89586fwzdd8urmg0p1ebs00000009ag00000000nxxz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:36:59 UTC	10932	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 c5 7d db 72 e3 38 b2 e0 af 68 38 1b dd f6 36 ed d6 d5 96 59 ad e9 a5 25 d9 d6 94 2c a9 25 b9 dc 1d 35 bd 0a 5a 84 64 8e 29 52 c3 4b b9 34 9e 8a 98 f7 7d dd 97 fd bd f3 25 9b 17 80 04 75 71 b9 7a 36 62 eb c1 45 02 89 04 90 c8 4c 64 26 12 d4 9f 16 69 30 4f bc 30 38 12 c7 2f ea b9 14 1e 25 c7 2f de e2 28 f8 98 fc 7e 1c 89 24 8d 82 12 3e 9f 8a cf eb 30 4a e2 77 9f 9c a8 e4 b5 b0 a8 f5 22 cb ac 97 2f a6 e7 5a 89 e9 87 8e 2b 5c eb 4f 95 2f ef 64 53 81 4d e7 8e ef 1f 79 0a 83 e9 99 f9 73 78 0c 2f dc ac f5 a7 72 5e f1 05 bb 09 5a 2f 19 a2 f0 74 d5 12 66 78 3a 6f 05 f0 77 dd 32 0c 33 3c 2a 1f 7f 39 fa 98 4f c3 0c cd e0 f8 25 38 aa 1e d3 28 93 56 70 54 01 fc f0 5f fd d8 8c e0 bf c6 b1 e9 b4 bc d3 6e 14 85 51 47 c4 73 33 56 6f 53 2f f1 Data Ascii: }r8h86Y%,%5Zd)RK4}%uqz6bELd&i0O08/%/(~$>0Jw"/Z+\O/dSMysx/r^Z/tfx:ow23<*9O%8(VpT_nQGs3VoS/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.17	49871	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:36:59 UTC	617	OUT	GET /shared/1.0/content/js/asyncchunk/convergederror_customizationloader_7e45d168059bd2885d00.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:36:59 UTC	792	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:36:59 GMT Content-Type: application/x-javascript Content-Length: 116257 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 15 Aug 2024 17:52:53 GMT ETag: 0x8DCBD53169C0B8E x-ms-request-id: dfc867af-b01e-0004-6df8-2539ee000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153659Z-r197bdfb6b429k2s6br3k49qn4000000053g00000000c3gp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:36:59 UTC	15592	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ec bd 6b 5b db 48 b6 28 fc 7d ff 0a 5b bb c7 2d b5 0b 63 19 30 20 23 3c 24 21 3d cc 24 81 03 64 7a 7a 88 27 8f b0 cb 58 89 91 3c ba 40 68 ec fd db df b5 56 55 49 25 59 06 93 ee 7d ce 87 77 fa e9 60 5d 4a 75 af 75 bf 6c fe 54 ff af da 4f b5 8d f5 ff ab 5d 5c 1e 9d 5f d6 4e df d6 2e ff 72 72 fe a6 76 06 77 bf d6 3e 9c 5e 9e bc 3e 5e bf 1e 6c 14 ff 5d 4e fc b8 36 f6 a7 bc 06 bf d7 5e cc 47 b5 30 a8 85 51 cd 0f 86 61 34 0b 23 2f e1 71 ed 16 fe 46 be 37 ad 8d a3 f0 b6 96 4c 78 6d 16 85 5f f8 30 89 6b 53 3f 4e e0 a3 6b 3e 0d ef 6b 26 54 17 8d 6a 67 5e 94 3c d4 4e ce ac 16 d4 cf a1 36 ff c6 0f e0 eb 61 38 7b 80 eb 49 52 0b c2 c4 1f f2 9a 17 8c a8 b6 29 dc 04 31 af a5 c1 88 47 b5 fb 89 3f 9c d4 de fb c3 28 8c c3 71 52 8b f8 90 fb 77 Data Ascii: k[H(}[-c0 #<$!=$dzz'X<@hVUI%Y}w`]JuulTO]\_N.rrvw>^>^l]N6^G0Qa4#/qF7Lxm_0kS?Nk>k&Tjg^<N6a8{IR)1G?(qRw
2024-10-24 15:36:59 UTC	16384	IN	Data Raw: 0d 53 1c 3e 97 dc 16 24 8a 0d 4a a7 01 b5 4c e2 5c ba e4 59 91 1d cc fc 76 23 bb 17 29 47 55 e3 07 1d 24 72 d5 75 be 53 62 b7 c3 d2 4d f8 e3 e1 9f 08 fe 94 d8 cb 4c b2 60 93 53 a2 88 76 dd c2 74 73 1f 4f 82 c4 ee be 3a 36 f9 4f b1 b5 a0 9d 4a e3 1e bb 1b c2 c1 c8 77 a3 9e 7f 90 52 fc 73 ca 30 90 30 df 82 5a d0 c6 7a 03 ab 1b c3 71 f0 37 c6 a2 a7 e2 09 4c c4 d8 f5 2d 06 8f 9b b6 66 0a 5d 1b ff 14 d3 96 df 40 2b 44 2c e6 6f b8 f8 2d c3 e6 72 1b e7 a8 e9 1d a6 c2 e9 71 c3 23 59 49 cf 47 e7 26 7f 63 23 d7 de 4e 51 e7 3a 81 a7 93 03 af 37 d1 7a d7 44 92 9b fa 37 81 4e 4d 11 fd 88 94 b6 68 a5 96 27 15 55 b3 97 4f d5 75 ce e4 46 ae 50 44 c2 99 47 1b 6a a1 d4 c9 ce 2d d0 71 08 5a 64 11 58 a4 c3 90 02 bd 85 c8 4b 86 22 be 72 61 9b f8 7f ea d4 dd 76 35 28 55 12 19 Data Ascii: S>$JL\Yv#)GU$ruSbML`SvtsO:6OJwRs00Zzq7L-f]@+D,o-rq#YIG&c#NQ:7zD7NMh'UOuFPDGj-qZdXK"rav5(U
2024-10-24 15:37:00 UTC	16384	IN	Data Raw: ae 80 bc a0 1a 7e 8b 7d cc bf de f2 7c 4a 7a 9b a1 a3 07 ee 37 87 39 0d e9 09 ed 3a c2 13 1a 1a f9 ce 3f 03 e9 12 09 98 39 1c 80 9a 5c a2 d0 61 82 ef 24 c3 1e 8b b1 92 25 b5 61 5a e5 70 ee 26 bf f8 0e e2 08 9a b9 bb ed 16 6e 8d cc dd 79 d1 41 91 16 76 cb 4e cb 23 c7 18 95 79 b4 ef 7c fa 34 84 75 6c fe 98 7f ca 27 40 ad 46 9f 3e 61 e1 bd d8 ad bb c1 30 b2 c4 05 39 09 44 37 78 3b a2 8a be 40 6c f1 b8 d6 eb 41 b4 f9 ce 76 73 7b bf d9 76 d8 35 86 68 25 3d 67 56 c2 59 ea 3b 57 d3 f4 32 9c 3a 6c 98 ce ee b3 f8 6a 52 f8 ce c7 bb f0 c5 5a a7 d5 de d9 ec b4 3a 3b 6b af a2 04 33 b7 c0 68 9f e1 e5 37 6b ee 4f d3 34 ce 52 b4 64 94 9e c3 90 a9 00 99 d4 77 26 45 31 cb fd ad ad ab b8 98 94 97 88 11 5b b2 e7 96 98 ff d6 25 bc 6d eb 86 4f 65 eb db 37 27 a7 df 5d 9c 3a 32 Data Ascii: ~}\|Jz79:?9\a$%aZp&nyAvN#y\|4ul'@F>a09D7x;@lAvs{v5h%=gVY;W2:ljRZ:;k3h7kO4Rdw&E1[%mOe7']:2
2024-10-24 15:37:00 UTC	16384	IN	Data Raw: 7d c9 d0 16 7e 03 ff 18 19 2f fc c9 3f e0 d9 22 8d 59 9d 17 55 7c 45 83 17 52 3f 8e b1 4d ca 8d 14 2b 47 7f 24 7d d5 78 89 3a 47 17 9e 94 54 7d e9 ce 20 e8 b0 75 ac 0b d3 11 e2 58 0d 61 d7 21 64 c6 77 20 75 25 71 32 25 c8 7a 9c dc 0a 9f b1 1c 1b 66 2a dc 4a 24 e6 ea 0f ba b3 23 e2 31 e2 fe 48 82 d2 9d f4 c8 2f 2c f5 51 56 cc 3c 54 5e bb c0 7c f6 fa f0 02 40 9b 81 8f ff 7a da c5 c0 d4 38 3c 08 46 c0 9f b8 78 fa 73 66 00 2f da 5f 3c f1 f4 20 02 3c 71 5e f5 48 91 30 22 c6 a5 c5 2b 4c b6 b7 e0 b2 bd 15 f9 c5 3a 7a d7 47 eb b5 79 5d 56 32 6d b9 3d 3f 9e 85 a3 c7 78 36 49 93 08 fe a4 23 af f9 35 aa 2c a2 db e8 f2 73 5c 6c c5 cf 31 78 31 9d 75 47 9c 1c a4 4f 47 9f 84 b1 d4 4e 90 07 42 7b cf 23 4d 02 f9 cb ee 0a 1f f7 fd 1d e1 2f fb 02 03 48 ee e9 c7 3e 6a 1d b8 Data Ascii: }~/?"YU\|ER?M+G$}x:GT} uXa!dw u%q2%zf*J$#1H/,QV<T^\|@z8<Fxsf/_< <q^H0"+L:zGy]V2m=?x6I#5,s\l1x1uGOGNB{#M/H>j
2024-10-24 15:37:00 UTC	16384	IN	Data Raw: 6c f0 e6 f9 c3 c3 79 59 d5 e2 9f ab 98 7c 40 5b 8f 91 e3 3c 17 74 39 f8 05 ba 7f c1 ac e7 3d d6 f1 2c 92 06 58 e2 df c6 49 78 ce 44 9c 74 b5 c4 04 56 a1 ce 6d 8e 23 49 78 40 11 2d 8c 7b e5 ab 5e 44 cc 5b ee e6 1f 0b a0 dd bc 3b 9f 1a 0e 00 5a 91 5d 5f e2 72 42 6f 37 28 18 f8 4f 3b 84 45 53 57 e2 9d 8b 13 e3 c0 ff 97 7e d8 2f cd f9 b2 dd 45 45 64 d6 77 2e 81 79 77 a1 f9 0d 9b 38 87 be fd a6 e5 df 39 7a a9 dd 2b 38 85 e3 59 c2 a1 42 65 8f 6e 60 7f 78 15 8a 5d 6a 75 71 9f 64 3d ae 68 b2 ad da 2e 9f 39 a5 05 a8 6e 05 74 82 c3 9a 3a 7a 2d 94 63 72 79 31 96 6e 1b 35 f7 a5 f9 92 c9 c2 99 83 32 87 d2 90 dd 50 c3 ab e3 d6 47 bd 5b 1f f5 6e 7d d4 da fe fb e3 26 8d 1a ff 4c 1f 1e 10 5e 4c 5b 00 01 16 4c 28 5e 01 16 35 61 de 71 05 90 30 cf 37 c3 b3 91 5b 86 22 04 e5 Data Ascii: lyY\|@[<t9=,XIxDtVm#Ix@-{^D[;Z]_rBo7(O;ESW~/EEdw.yw89z+8YBen`x]juqd=h.9nt:z-cry1n52PG[n}&L^L[L(^5aq07["
2024-10-24 15:37:00 UTC	16384	IN	Data Raw: 45 19 49 a5 97 b2 ee 70 62 9a 2a e0 34 15 fa 53 57 e2 23 4e a6 3a 05 da 0b 2d 2c f0 a0 ae b0 b4 60 bd da 8a b8 19 cc 56 47 60 3c 07 4d 39 07 35 49 54 1d 6c 32 07 ef ac 59 1e 59 61 06 62 7c 2e 06 1f 49 fc e1 91 70 d4 91 9b 81 f1 18 46 32 48 1c 20 d2 22 15 56 dd 08 24 98 bd d5 e8 0f 9e 1b 99 c4 2a c0 8d 0a f3 4a 64 c2 71 bc fc 0e 0f b6 cd 3f 59 cf fb 64 56 d7 85 1b 0e 8e b1 14 e7 c0 93 6a 93 0f 66 28 b4 5e 14 7a 63 83 5e 1c 35 e4 6e ae e5 eb 3d 09 c0 1c e3 11 8d 80 e4 52 75 6c dd 85 a5 c3 84 17 94 5e a3 85 61 fa 84 61 50 60 3c c2 fe 65 1a 69 79 35 32 00 da f8 a8 68 1e 62 7c 89 fe 24 1a d8 41 46 45 f8 3c 76 91 b3 e5 e4 30 7d bb f1 99 22 9b d6 c5 9c c9 fb ef 88 8b 02 e0 1c 44 ab 5b 1c 95 75 b9 05 f9 44 50 dc 31 3e 7c f4 08 88 60 53 00 00 8a 72 dc 91 bb bb 51 Data Ascii: EIpb4SW#N:-,`VG`<M95ITl2YYab\|.IpF2H "V$Jdq?YdVjf(^zc^5n=Rul^aaP`<eiy52hb\|$AFE<v0}"D[uDP1>\|`SrQ
2024-10-24 15:37:00 UTC	16384	IN	Data Raw: 5a 61 fb 46 07 21 b5 55 0c 13 ff 3b 8f 6b 99 7c 66 3f 23 47 7e 6e f1 59 3f 47 d3 58 51 93 af e1 a1 43 63 d4 31 32 a2 83 71 44 48 35 a4 c6 91 4c f6 7b b1 88 e8 8b 52 4f f2 34 a2 5b 80 16 7c 24 b4 7d 11 3a 01 b3 ef 6e b6 ed f9 eb b9 b3 ee 29 9b 64 7d 28 4b 42 0c 70 64 b6 01 d8 35 2a 12 ec 6a fb f9 6e 97 ca 16 76 65 ac ec b5 7d 27 33 d3 e6 0e 36 dc 90 f8 ca 7f 79 3f c6 5d e7 06 00 9b f7 9f de fb 6f 23 15 38 a5 68 10 6f ad 20 dc 62 0c f8 da ff d2 10 b6 5d 8b f8 dd ff 09 a0 f2 fc 73 ab 3f de 74 18 fc 2d 2d eb d8 fc e7 f6 bc d1 04 2e 12 e3 09 d3 18 56 7a 77 15 5a a1 d3 4f fa 88 11 41 30 1c 51 a3 86 c6 f8 1b cf 0e e0 d4 38 bc c3 86 d3 13 7b 11 fe 97 17 98 0f 81 ac f6 36 1e 01 bd f5 df 1a 40 1c 82 b0 92 51 07 d2 d8 28 d9 8a 34 1e e3 06 d6 4e e2 12 85 9e 6d c4 5c Data Ascii: ZaF!U;k\|f?#G~nY?GXQCc12qDH5L{RO4[\|$}:n)d}(KBpd5*jnve}'36y?]o#8ho b]s?t--.VzwZOA0Q8{6@Q(4Nm\
2024-10-24 15:37:00 UTC	2361	IN	Data Raw: a3 52 da 99 6f 3d 29 a7 5d a1 c3 bb 52 da b5 6f 7d 5b 4e 3b 92 d1 f2 c6 c7 69 cd fa e2 6b db 59 ef 51 38 be db 05 ba 57 38 30 3f d7 e9 bb d7 fb 56 66 b8 3b 5e b7 fb fe f1 13 07 72 be f6 d7 5b 83 e3 14 80 ff b5 bd 0e 9f d7 dd e7 14 4f 10 e3 02 ae 47 0f d8 5e 7f 74 4f dd 67 ee 1b f7 ad fb ab fb d2 7d e7 1e fe 0e 8d e8 db 85 fb 02 95 f8 b2 4c 07 b9 77 df fb 87 ad e8 3c 06 9e ef 39 c7 86 fe ce 7f 21 49 a6 a7 7e db 7d 85 7c d6 f7 28 74 56 3a 4c 9f f4 7d ed 53 ad 77 f6 83 ad b7 e4 12 b2 b3 1a a1 fb d4 d0 6a fc 59 57 81 9c c7 f7 ea 24 7a ba ef 7f a7 b3 7d 10 02 03 f9 5d 32 49 df 0b b2 84 34 a7 b0 88 c3 10 3b f4 eb 75 94 bf 88 11 c9 e6 7b 82 0c 0f 61 68 c6 24 3f 75 84 03 fe 39 c7 a4 08 f8 67 cc 3f 53 fe 19 7a a9 ff b4 37 4a 6e e1 9c 42 6d eb 42 0d a9 b3 b8 9a 20 Data Ascii: Ro=)]Ro}[N;ikYQ8W80?Vf;^r[OG^tOg}Lw<9!I~}\|(tV:L}SwjYW$z}]2I4;u{ah$?u9g?Sz7JnBmB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.17	49875	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:37:00 UTC	429	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.error.strings-en.min_v1eniakvll_1x20aakd_sg2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:37:00 UTC	812	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:37:00 GMT Content-Type: application/x-javascript Content-Length: 10932 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Tue, 27 Aug 2024 00:48:37 GMT ETag: 0x8DCC631FC6EAF1F x-ms-request-id: b849a5a5-501e-0038-08c7-25583b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153700Z-17fbfdc98bblfj7gw4f18guu2800000000ng000000007hbx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:37:00 UTC	10932	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 c5 7d db 72 e3 38 b2 e0 af 68 38 1b dd f6 36 ed d6 d5 96 59 ad e9 a5 25 d9 d6 94 2c a9 25 b9 dc 1d 35 bd 0a 5a 84 64 8e 29 52 c3 4b b9 34 9e 8a 98 f7 7d dd 97 fd bd f3 25 9b 17 80 04 75 71 b9 7a 36 62 eb c1 45 02 89 04 90 c8 4c 64 26 12 d4 9f 16 69 30 4f bc 30 38 12 c7 2f ea b9 14 1e 25 c7 2f de e2 28 f8 98 fc 7e 1c 89 24 8d 82 12 3e 9f 8a cf eb 30 4a e2 77 9f 9c a8 e4 b5 b0 a8 f5 22 cb ac 97 2f a6 e7 5a 89 e9 87 8e 2b 5c eb 4f 95 2f ef 64 53 81 4d e7 8e ef 1f 79 0a 83 e9 99 f9 73 78 0c 2f dc ac f5 a7 72 5e f1 05 bb 09 5a 2f 19 a2 f0 74 d5 12 66 78 3a 6f 05 f0 77 dd 32 0c 33 3c 2a 1f 7f 39 fa 98 4f c3 0c cd e0 f8 25 38 aa 1e d3 28 93 56 70 54 01 fc f0 5f fd d8 8c e0 bf c6 b1 e9 b4 bc d3 6e 14 85 51 47 c4 73 33 56 6f 53 2f f1 Data Ascii: }r8h86Y%,%5Zd)RK4}%uqz6bELd&i0O08/%/(~$>0Jw"/Z+\O/dSMysx/r^Z/tfx:ow23<*9O%8(VpT_nQGs3VoS/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.17	49876	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:37:00 UTC	409	OUT	GET /shared/1.0/content/js/ConvergedError_Core_e44ULT7v2HGQHqHgp6vqIA2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:37:00 UTC	812	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:37:00 GMT Content-Type: application/x-javascript Content-Length: 98380 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 18 Sep 2024 23:43:27 GMT ETag: 0x8DCD83BB179FE65 x-ms-request-id: da620dd8-901e-005e-7476-235f09000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153700Z-r1755647c66ldfgxa3qp9d53us00000009v000000000aq9v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:37:00 UTC	15572	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e4 bd 7b 57 eb 38 b2 38 fa ff fd 14 c1 33 97 8e 1b 93 1d e7 c1 c3 b4 9b 13 20 ec 9d 69 20 0c 81 ee 9e 03 0c cb b1 95 e0 26 d8 39 b6 c3 63 92 fc 3e fb ad 2a 49 b6 ec 38 ec bd 7b 66 dd 75 ee ba f3 d8 c4 52 e9 55 2a 95 aa 4a a5 d2 a7 1f 37 fe af ca 8f 95 ed 6f ff 4f 65 70 dd b9 ba ae f4 4f 2b d7 5f 7a 57 27 95 4b f8 fa 47 e5 a2 7f dd 3b ee 7e 7b 3d d8 28 fe ff fa d1 8f 2b 23 7f c2 2a f0 77 e8 c4 cc ab 84 41 25 8c 2a 7e e0 86 d1 34 8c 9c 84 c5 95 67 f8 37 f2 9d 49 65 14 85 cf 95 e4 91 55 a6 51 f8 07 73 93 b8 32 f1 e3 04 0a 0d d9 24 7c ad 54 a1 ba c8 ab 5c 3a 51 f2 5e e9 5d ea 35 a8 9f 41 6d fe d8 0f a0 b4 1b 4e df e1 f7 63 52 09 c2 c4 77 59 c5 09 3c aa 6d 02 1f 41 cc 2a b3 c0 63 51 e5 f5 d1 77 1f 2b e7 be 1b 85 71 38 4a 2a 11 73 Data Ascii: {W883 i &9c>I8{fuRUJ7oOepO+_zW'KG;~{=(+#wA%~4g7IeUQs2$\|T\:Q^]5AmNcRwY<mAcQw+q8Js
2024-10-24 15:37:00 UTC	16384	IN	Data Raw: 56 53 69 49 d7 51 f8 c2 57 79 57 40 8d 50 79 c8 93 24 48 de 86 5a 1c 60 66 a5 14 07 70 e5 a4 c8 4b 50 75 e7 a0 7d db 1b 2f 8b c5 c6 23 3d e6 51 41 e5 05 ed f4 c5 76 49 47 fa d9 ae 2f 16 6a 16 8e b2 3c 47 8c 34 00 e5 d0 67 81 37 79 17 e7 cc ba be b6 6a 81 cd 95 e1 7a d5 51 fa b6 44 ed d3 bc be ac fd 31 1d 63 18 ac b2 7a 80 1e 66 b5 e2 cb ef 55 2d 03 45 11 4e e3 2f af c5 cf ce 64 b2 be 99 6d ca ff b8 31 22 bf 72 7c 14 86 23 09 64 b2 32 9a 69 50 68 20 ad 05 ab 97 b4 b1 82 5c c8 29 e0 d6 5e c1 b6 3a a7 41 6d 16 4d f8 f1 ef 51 ae 29 bd ac 9b 6b a1 d3 2a 5f 36 37 1f 53 ca 7d ae 95 1f 17 a7 d0 09 60 44 be a1 46 13 f4 32 ee 3d 8f 95 b7 45 0f 4a e7 de 5d c1 d6 dc 5c 6a f8 38 cd a1 16 bf 8c 35 4b c3 e9 01 34 6d f8 9b 9b 7f 72 e2 57 da 50 27 3e e1 73 50 c6 06 ec f4 Data Ascii: VSiIQWyW@Py$HZ`fpKPu}/#=QAvIG/j<G4g7yjzQD1czfU-EN/dm1"r\|#d2iPh \)^:AmMQ)k*_67S}`DF2=EJ]\j85K4mrWP'>sP
2024-10-24 15:37:00 UTC	16384	IN	Data Raw: a6 bd 16 98 4b 51 a8 58 a5 2f 81 fb 7e 1c c2 1f b1 f2 a6 88 e6 66 80 e0 d3 25 82 f5 bb 83 ec 0f dc 0b 23 91 5b 93 30 6d 9d 5b b4 c4 23 6c 7a 62 ab 32 1a ca 8a e1 55 e9 fd 78 86 7f 5c 6f 02 dc 94 a9 ca 15 71 7b 5b de bf 4f ed 5d ba c0 d2 9d 96 21 9d 56 78 39 c5 dd 53 ba 1b b2 93 f1 14 01 e6 2d e0 33 ce 07 82 4f 51 ab cb 70 af 66 f0 62 00 0d fc 1c c8 34 36 e6 0a 6e 10 b2 26 21 de cf c7 c8 fb 88 63 6f 03 ac 60 dd d1 53 15 d5 de 8e 7e f7 f8 8d 32 b6 f7 62 09 d8 57 14 4f c2 56 df b9 27 55 70 c9 d8 2e 6c 74 61 d4 15 ff d7 41 95 ba 5a 5b ac 27 d7 97 8a d9 d9 fa 4f 7b ce 75 26 06 ec 8e f7 6e 6f f7 55 1e ed 7d db aa f8 4e e8 dd cf 2d ff 11 1a 45 75 f2 60 2d 41 91 33 36 cc 96 8e 24 ac ba 4e 9b da ac c7 fb a3 73 04 dd de 0e df 57 3e e7 5a 09 d1 5f f4 ce 5c 4c d9 23 Data Ascii: KQX/~f%#[0m[#lzb2Ux\oq{[O]!Vx9S-3OQpfb46n&!co`S~2bWOV'Up.ltaAZ['O{u&noU}N-Eu`-A36$NsW>Z_\L#
2024-10-24 15:37:00 UTC	16384	IN	Data Raw: f6 8c 23 97 5b b7 74 a1 c2 6b 34 ec 9b 3a 5b 55 8c ce 44 27 33 c3 b8 b0 ea 0b eb fc 13 a8 d1 cd d1 c4 ee 50 43 9c 5d 19 82 b5 ce b4 76 03 0e d8 c2 e3 ed 1f 5a b1 43 4a b8 86 31 c3 37 61 73 0a e3 65 5e d3 36 ca 70 32 45 8d 96 07 2f fc b8 e4 17 ec 40 51 7f 50 70 41 e1 73 3a 90 98 6b 56 87 f1 ef 93 c8 bf 37 d1 e9 8f 00 a2 d7 51 31 fb 75 8b 31 83 64 d1 ec 7a 21 59 4a ce b4 65 09 fa 15 de 3c 89 90 bc 69 49 47 4c 1d b9 47 b4 ef b6 fe 47 59 70 b4 4e e8 24 7c a2 7f b4 b2 9b e2 d5 4b 80 e9 1e 21 e6 27 58 2f c1 7e de bf ff de bc 89 7b 5c 9d 1e cc 93 e0 77 98 a7 3f f6 ab db 18 73 7f ea 69 1b 6a 1d 32 e3 a0 4d a7 f5 61 31 ad a9 32 71 96 ca e7 f5 82 6a 6b 25 49 4a d9 8d 8c 9f 3c 61 2c f9 ed 00 5f 8e 74 e4 f6 aa 64 25 1d 08 b3 6f 6b 9d d8 f1 d6 bf 50 d9 c7 34 bf 97 d3 Data Ascii: #[tk4:[UD'3PC]vZCJ17ase^6p2E/@QPpAs:kV7Q1u1dz!YJe<iIGLGGYpN$\|K!'X/~{\w?sij2Ma12qjk%IJ<a,_td%okP4
2024-10-24 15:37:00 UTC	16384	IN	Data Raw: 29 34 27 30 c9 05 57 ce 4b ea 08 09 73 da 73 9f 81 58 72 2a 53 a5 75 96 2a c2 75 26 12 49 31 60 63 a1 b3 42 30 92 d8 fb df c8 be b9 e7 34 31 02 3a f7 d6 63 72 18 2e 3c 8d 01 22 19 a1 19 cd 32 de f7 98 51 f9 76 9e 28 a6 68 c2 93 34 35 d6 38 a5 1c 81 82 b7 a0 66 51 e7 ee 1d 03 60 5f 9f 5e c0 80 98 d1 98 69 82 69 97 61 a4 47 65 a5 c9 8c 2d 0a 6a f5 97 18 67 c4 70 22 19 33 d2 69 8c 70 24 31 eb 8a 55 2a b1 a0 a7 7b cc 23 cf 7b 9f db 4d cf be a0 44 15 2e b1 d6 1a 6d 1c e5 98 0c 14 e4 41 81 b1 a2 54 56 f4 3c 66 5b da 32 56 63 82 e5 c4 09 c4 70 ea 24 e5 85 96 3e 4d 34 20 5f c8 ec de 01 e6 6e e8 b6 20 18 30 47 83 ba 27 9c 4a 1c b3 52 19 95 c9 d4 fa 22 65 26 49 be d0 68 cb 49 a6 c0 21 98 f1 19 2f 12 aa 25 cb 4c 61 29 73 9e 17 0c 73 0b df 3b e2 c1 ad 3a f7 a9 10 9a Data Ascii: )4'0WKssXrSuu&I1`cB041:cr.<"2Qv(h458fQ`_^iiaGe-jgp"3ip$1U*{#{MD.mATV<f[2Vcp$>M4 _n 0G'JR"e&IhI!/%La)ss;:
2024-10-24 15:37:00 UTC	16384	IN	Data Raw: e0 75 ee dc 0a b8 92 b9 ba 83 6f 73 81 46 45 6b c4 a5 5b 43 65 2b a5 10 72 0d a6 49 11 66 b4 62 73 2d 49 c6 26 4f d1 8f 24 21 f3 4f b9 b6 37 97 8e 79 f0 10 77 5a 52 f5 96 df c7 e5 92 07 0c 2b a1 32 1f 91 5d be d1 b6 5f dc 2c f2 9a 14 e0 ed fc 02 23 51 54 6d ac cd cc f5 ec fd 4c 38 0a 73 c5 0a 7a 6b e7 f7 fe 70 9d f3 c6 42 0c 9f c3 dd 8e 39 e1 6f f6 3b 78 1b da 10 44 a5 2e 89 71 6f 77 77 59 02 63 91 f6 f0 5f 2c 89 37 e3 99 e7 03 c1 c7 a4 28 95 00 59 b6 c8 82 a8 26 c6 50 f3 2b 95 22 88 89 cc 8e a6 a0 61 32 7f 49 29 5a 58 35 c5 46 75 9c 45 4a 88 0d 11 86 0b c6 9a 87 dc c5 3e 6b 02 a7 29 c9 24 36 52 0c d3 b5 19 cf b3 cd 88 27 cd 90 df e8 e1 8d 4d 1f 85 51 cd 37 47 51 dd 27 d8 0f 86 43 31 f6 c3 a3 0c 1a fb 31 7f c3 63 8d e5 9b a1 24 b1 5a 25 33 b5 8c 25 2a 62 Data Ascii: uosFEk[Ce+rIfbs-I&O$!O7ywZR+2]_,#QTmL8szkpB9o;xD.qowwYc_,7(Y&P+"a2I)ZX5FuEJ>k)$6R'MQ7GQ'C11c$Z%3%*b
2024-10-24 15:37:00 UTC	888	IN	Data Raw: 1d b0 09 c9 ef 6f b8 f4 ce 6c 5b 84 4e c8 5c 6d bd f6 83 e1 d4 89 dd 3b ee 66 86 17 9b 32 47 5c 54 27 bc 1a ca 2c 85 94 95 ec ef 2c 73 c2 94 08 0a e6 ce 96 99 a2 3b ac ef 48 4b 01 4f b1 48 7c a6 53 4a 4f 3a bc 75 4a c9 49 87 a7 b2 8d a2 84 67 bb 04 aa c7 e5 ba 66 5c 4a 8e 48 3c 4b 8c aa 86 80 a7 26 2e 08 19 d4 75 6a 88 77 1d e1 51 28 f7 a5 4e b9 cb 01 1f a6 3f dc e5 f3 b1 2d 2e a7 dc 97 f5 34 a9 6f 0b 3a b2 17 95 97 4d 53 d0 b2 d6 98 c7 2e 96 72 75 ab 90 13 09 dd dc a1 01 a2 30 00 2a 19 cc e3 16 74 70 dd c4 54 b9 e8 9e 03 ec 01 40 1d d0 22 c5 3a b8 f1 cb 4c c9 df b3 d9 e1 0e 94 1b 8e 75 69 21 91 dc 10 be 9c 05 b1 e2 8e a6 fa 27 1b 2f c2 17 16 7e 67 ed 25 6e 33 71 93 22 03 72 73 7f f8 25 f9 12 dd 7f 49 ee bf 44 f6 cb 4b 67 03 eb 55 3a dd b0 ed fc 1b cf e1 Data Ascii: ol[N\m;f2G\T',,s;HKOH\|SJO:uJIgf\JH<K&.ujwQ(N?-.4o:MS.ru0*tpT@":Lui!'/~g%n3q"rs%IDKgU:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.17	49877	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:37:00 UTC	662	OUT	GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:37:00 UTC	778	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:37:00 GMT Content-Type: image/svg+xml Content-Length: 673 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:46 GMT ETag: 0x8DB5C3F47E260FD x-ms-request-id: 5a2ef381-401e-0045-2537-2316b5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153700Z-15b8d89586f2hk28h0h6zye26c00000001rg000000006gph x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:37:00 UTC	673	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 21 02 39 81 41 Data Ascii: Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9!9A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.17	49878	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:37:00 UTC	660	OUT	GET /shared/1.0/content/images/check_small_48540c930333871c385fcba2c659ccdb.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:37:00 UTC	800	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:37:00 GMT Content-Type: image/svg+xml Content-Length: 1009 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:46 GMT ETag: 0x8DB5C3F48118378 x-ms-request-id: a974bb83-201e-006c-3c78-2528c1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153700Z-16849878b78c5zx4gw8tcga1b400000007qg00000000q0ef x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:37:00 UTC	1009	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 5d 96 c1 8e dc 36 0c 86 ef 05 fa 0e c6 f4 ae 21 29 51 12 8b 4c 0e f5 75 f2 02 b9 15 c8 76 67 81 cd 6e d0 0c 32 79 fc 90 32 45 bb 3d d9 92 65 91 ff c7 9f b2 3f 7c ff f1 bc 3c 5e be dc 6f 97 13 e6 d3 72 7b 7a 79 be dd b7 fb 1f 2f 4f 8f bf de 7f 5e 4e b0 c0 82 79 b1 b9 7f 5e 5e 5f 2f a7 b7 f7 b7 a7 d3 f2 f3 eb eb db f7 cb e9 76 bf 7f fb f3 7c 7e 3c 1e e9 91 d3 fb bf cf 67 02 80 b3 6e 7c fa f8 fb 6f 1f be fd 7d bf 2d 5f 2e a7 4f 92 4a 2d b9 2e 39 b5 56 7b bd 22 24 c8 5c 97 92 72 e9 58 ae 9c a8 23 f1 22 09 81 b8 5c 29 c9 58 5f 53 eb 5c cb 35 27 d6 e5 45 c7 84 3a 1f eb 5b 12 16 a9 d7 ff ed ff f9 53 4d bc c0 da 12 48 ad 5d 25 b4 54 1b d1 a2 61 5b a7 de fa d2 13 51 d5 0c 20 91 a6 50 f3 da 35 14 88 2d c9 bd 11 34 cd 85 44 b2 4d 54 60 Data Ascii: ]6!)QLuvgn2y2E=e?\|<^or{zy/O^Ny^^_/v\|~<gn\|o}-_.OJ-.9V{"$\rX#"\)X_S\5'E:[SMH]%Ta[Q P5-4DMT`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.17	49880	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:37:01 UTC	432	OUT	GET /shared/1.0/content/js/asyncchunk/convergederror_customizationloader_7e45d168059bd2885d00.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:37:01 UTC	792	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:37:01 GMT Content-Type: application/x-javascript Content-Length: 116257 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 15 Aug 2024 17:52:53 GMT ETag: 0x8DCBD53169C0B8E x-ms-request-id: 6a0f9fa6-101e-001d-3a35-23b955000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153701Z-r1755647c66gb86l6k27ha2m1c00000008fg000000003kap x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:37:01 UTC	15592	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ec bd 6b 5b db 48 b6 28 fc 7d ff 0a 5b bb c7 2d b5 0b 63 19 30 20 23 3c 24 21 3d cc 24 81 03 64 7a 7a 88 27 8f b0 cb 58 89 91 3c ba 40 68 ec fd db df b5 56 55 49 25 59 06 93 ee 7d ce 87 77 fa e9 60 5d 4a 75 af 75 bf 6c fe 54 ff af da 4f b5 8d f5 ff ab 5d 5c 1e 9d 5f d6 4e df d6 2e ff 72 72 fe a6 76 06 77 bf d6 3e 9c 5e 9e bc 3e 5e bf 1e 6c 14 ff 5d 4e fc b8 36 f6 a7 bc 06 bf d7 5e cc 47 b5 30 a8 85 51 cd 0f 86 61 34 0b 23 2f e1 71 ed 16 fe 46 be 37 ad 8d a3 f0 b6 96 4c 78 6d 16 85 5f f8 30 89 6b 53 3f 4e e0 a3 6b 3e 0d ef 6b 26 54 17 8d 6a 67 5e 94 3c d4 4e ce ac 16 d4 cf a1 36 ff c6 0f e0 eb 61 38 7b 80 eb 49 52 0b c2 c4 1f f2 9a 17 8c a8 b6 29 dc 04 31 af a5 c1 88 47 b5 fb 89 3f 9c d4 de fb c3 28 8c c3 71 52 8b f8 90 fb 77 Data Ascii: k[H(}[-c0 #<$!=$dzz'X<@hVUI%Y}w`]JuulTO]\_N.rrvw>^>^l]N6^G0Qa4#/qF7Lxm_0kS?Nk>k&Tjg^<N6a8{IR)1G?(qRw
2024-10-24 15:37:01 UTC	16384	IN	Data Raw: 0d 53 1c 3e 97 dc 16 24 8a 0d 4a a7 01 b5 4c e2 5c ba e4 59 91 1d cc fc 76 23 bb 17 29 47 55 e3 07 1d 24 72 d5 75 be 53 62 b7 c3 d2 4d f8 e3 e1 9f 08 fe 94 d8 cb 4c b2 60 93 53 a2 88 76 dd c2 74 73 1f 4f 82 c4 ee be 3a 36 f9 4f b1 b5 a0 9d 4a e3 1e bb 1b c2 c1 c8 77 a3 9e 7f 90 52 fc 73 ca 30 90 30 df 82 5a d0 c6 7a 03 ab 1b c3 71 f0 37 c6 a2 a7 e2 09 4c c4 d8 f5 2d 06 8f 9b b6 66 0a 5d 1b ff 14 d3 96 df 40 2b 44 2c e6 6f b8 f8 2d c3 e6 72 1b e7 a8 e9 1d a6 c2 e9 71 c3 23 59 49 cf 47 e7 26 7f 63 23 d7 de 4e 51 e7 3a 81 a7 93 03 af 37 d1 7a d7 44 92 9b fa 37 81 4e 4d 11 fd 88 94 b6 68 a5 96 27 15 55 b3 97 4f d5 75 ce e4 46 ae 50 44 c2 99 47 1b 6a a1 d4 c9 ce 2d d0 71 08 5a 64 11 58 a4 c3 90 02 bd 85 c8 4b 86 22 be 72 61 9b f8 7f ea d4 dd 76 35 28 55 12 19 Data Ascii: S>$JL\Yv#)GU$ruSbML`SvtsO:6OJwRs00Zzq7L-f]@+D,o-rq#YIG&c#NQ:7zD7NMh'UOuFPDGj-qZdXK"rav5(U
2024-10-24 15:37:01 UTC	16384	IN	Data Raw: ae 80 bc a0 1a 7e 8b 7d cc bf de f2 7c 4a 7a 9b a1 a3 07 ee 37 87 39 0d e9 09 ed 3a c2 13 1a 1a f9 ce 3f 03 e9 12 09 98 39 1c 80 9a 5c a2 d0 61 82 ef 24 c3 1e 8b b1 92 25 b5 61 5a e5 70 ee 26 bf f8 0e e2 08 9a b9 bb ed 16 6e 8d cc dd 79 d1 41 91 16 76 cb 4e cb 23 c7 18 95 79 b4 ef 7c fa 34 84 75 6c fe 98 7f ca 27 40 ad 46 9f 3e 61 e1 bd d8 ad bb c1 30 b2 c4 05 39 09 44 37 78 3b a2 8a be 40 6c f1 b8 d6 eb 41 b4 f9 ce 76 73 7b bf d9 76 d8 35 86 68 25 3d 67 56 c2 59 ea 3b 57 d3 f4 32 9c 3a 6c 98 ce ee b3 f8 6a 52 f8 ce c7 bb f0 c5 5a a7 d5 de d9 ec b4 3a 3b 6b af a2 04 33 b7 c0 68 9f e1 e5 37 6b ee 4f d3 34 ce 52 b4 64 94 9e c3 90 a9 00 99 d4 77 26 45 31 cb fd ad ad ab b8 98 94 97 88 11 5b b2 e7 96 98 ff d6 25 bc 6d eb 86 4f 65 eb db 37 27 a7 df 5d 9c 3a 32 Data Ascii: ~}\|Jz79:?9\a$%aZp&nyAvN#y\|4ul'@F>a09D7x;@lAvs{v5h%=gVY;W2:ljRZ:;k3h7kO4Rdw&E1[%mOe7']:2
2024-10-24 15:37:01 UTC	16384	IN	Data Raw: 7d c9 d0 16 7e 03 ff 18 19 2f fc c9 3f e0 d9 22 8d 59 9d 17 55 7c 45 83 17 52 3f 8e b1 4d ca 8d 14 2b 47 7f 24 7d d5 78 89 3a 47 17 9e 94 54 7d e9 ce 20 e8 b0 75 ac 0b d3 11 e2 58 0d 61 d7 21 64 c6 77 20 75 25 71 32 25 c8 7a 9c dc 0a 9f b1 1c 1b 66 2a dc 4a 24 e6 ea 0f ba b3 23 e2 31 e2 fe 48 82 d2 9d f4 c8 2f 2c f5 51 56 cc 3c 54 5e bb c0 7c f6 fa f0 02 40 9b 81 8f ff 7a da c5 c0 d4 38 3c 08 46 c0 9f b8 78 fa 73 66 00 2f da 5f 3c f1 f4 20 02 3c 71 5e f5 48 91 30 22 c6 a5 c5 2b 4c b6 b7 e0 b2 bd 15 f9 c5 3a 7a d7 47 eb b5 79 5d 56 32 6d b9 3d 3f 9e 85 a3 c7 78 36 49 93 08 fe a4 23 af f9 35 aa 2c a2 db e8 f2 73 5c 6c c5 cf 31 78 31 9d 75 47 9c 1c a4 4f 47 9f 84 b1 d4 4e 90 07 42 7b cf 23 4d 02 f9 cb ee 0a 1f f7 fd 1d e1 2f fb 02 03 48 ee e9 c7 3e 6a 1d b8 Data Ascii: }~/?"YU\|ER?M+G$}x:GT} uXa!dw u%q2%zf*J$#1H/,QV<T^\|@z8<Fxsf/_< <q^H0"+L:zGy]V2m=?x6I#5,s\l1x1uGOGNB{#M/H>j
2024-10-24 15:37:01 UTC	16384	IN	Data Raw: 6c f0 e6 f9 c3 c3 79 59 d5 e2 9f ab 98 7c 40 5b 8f 91 e3 3c 17 74 39 f8 05 ba 7f c1 ac e7 3d d6 f1 2c 92 06 58 e2 df c6 49 78 ce 44 9c 74 b5 c4 04 56 a1 ce 6d 8e 23 49 78 40 11 2d 8c 7b e5 ab 5e 44 cc 5b ee e6 1f 0b a0 dd bc 3b 9f 1a 0e 00 5a 91 5d 5f e2 72 42 6f 37 28 18 f8 4f 3b 84 45 53 57 e2 9d 8b 13 e3 c0 ff 97 7e d8 2f cd f9 b2 dd 45 45 64 d6 77 2e 81 79 77 a1 f9 0d 9b 38 87 be fd a6 e5 df 39 7a a9 dd 2b 38 85 e3 59 c2 a1 42 65 8f 6e 60 7f 78 15 8a 5d 6a 75 71 9f 64 3d ae 68 b2 ad da 2e 9f 39 a5 05 a8 6e 05 74 82 c3 9a 3a 7a 2d 94 63 72 79 31 96 6e 1b 35 f7 a5 f9 92 c9 c2 99 83 32 87 d2 90 dd 50 c3 ab e3 d6 47 bd 5b 1f f5 6e 7d d4 da fe fb e3 26 8d 1a ff 4c 1f 1e 10 5e 4c 5b 00 01 16 4c 28 5e 01 16 35 61 de 71 05 90 30 cf 37 c3 b3 91 5b 86 22 04 e5 Data Ascii: lyY\|@[<t9=,XIxDtVm#Ix@-{^D[;Z]_rBo7(O;ESW~/EEdw.yw89z+8YBen`x]juqd=h.9nt:z-cry1n52PG[n}&L^L[L(^5aq07["
2024-10-24 15:37:01 UTC	16384	IN	Data Raw: 45 19 49 a5 97 b2 ee 70 62 9a 2a e0 34 15 fa 53 57 e2 23 4e a6 3a 05 da 0b 2d 2c f0 a0 ae b0 b4 60 bd da 8a b8 19 cc 56 47 60 3c 07 4d 39 07 35 49 54 1d 6c 32 07 ef ac 59 1e 59 61 06 62 7c 2e 06 1f 49 fc e1 91 70 d4 91 9b 81 f1 18 46 32 48 1c 20 d2 22 15 56 dd 08 24 98 bd d5 e8 0f 9e 1b 99 c4 2a c0 8d 0a f3 4a 64 c2 71 bc fc 0e 0f b6 cd 3f 59 cf fb 64 56 d7 85 1b 0e 8e b1 14 e7 c0 93 6a 93 0f 66 28 b4 5e 14 7a 63 83 5e 1c 35 e4 6e ae e5 eb 3d 09 c0 1c e3 11 8d 80 e4 52 75 6c dd 85 a5 c3 84 17 94 5e a3 85 61 fa 84 61 50 60 3c c2 fe 65 1a 69 79 35 32 00 da f8 a8 68 1e 62 7c 89 fe 24 1a d8 41 46 45 f8 3c 76 91 b3 e5 e4 30 7d bb f1 99 22 9b d6 c5 9c c9 fb ef 88 8b 02 e0 1c 44 ab 5b 1c 95 75 b9 05 f9 44 50 dc 31 3e 7c f4 08 88 60 53 00 00 8a 72 dc 91 bb bb 51 Data Ascii: EIpb4SW#N:-,`VG`<M95ITl2YYab\|.IpF2H "V$Jdq?YdVjf(^zc^5n=Rul^aaP`<eiy52hb\|$AFE<v0}"D[uDP1>\|`SrQ
2024-10-24 15:37:01 UTC	16384	IN	Data Raw: 5a 61 fb 46 07 21 b5 55 0c 13 ff 3b 8f 6b 99 7c 66 3f 23 47 7e 6e f1 59 3f 47 d3 58 51 93 af e1 a1 43 63 d4 31 32 a2 83 71 44 48 35 a4 c6 91 4c f6 7b b1 88 e8 8b 52 4f f2 34 a2 5b 80 16 7c 24 b4 7d 11 3a 01 b3 ef 6e b6 ed f9 eb b9 b3 ee 29 9b 64 7d 28 4b 42 0c 70 64 b6 01 d8 35 2a 12 ec 6a fb f9 6e 97 ca 16 76 65 ac ec b5 7d 27 33 d3 e6 0e 36 dc 90 f8 ca 7f 79 3f c6 5d e7 06 00 9b f7 9f de fb 6f 23 15 38 a5 68 10 6f ad 20 dc 62 0c f8 da ff d2 10 b6 5d 8b f8 dd ff 09 a0 f2 fc 73 ab 3f de 74 18 fc 2d 2d eb d8 fc e7 f6 bc d1 04 2e 12 e3 09 d3 18 56 7a 77 15 5a a1 d3 4f fa 88 11 41 30 1c 51 a3 86 c6 f8 1b cf 0e e0 d4 38 bc c3 86 d3 13 7b 11 fe 97 17 98 0f 81 ac f6 36 1e 01 bd f5 df 1a 40 1c 82 b0 92 51 07 d2 d8 28 d9 8a 34 1e e3 06 d6 4e e2 12 85 9e 6d c4 5c Data Ascii: ZaF!U;k\|f?#G~nY?GXQCc12qDH5L{RO4[\|$}:n)d}(KBpd5*jnve}'36y?]o#8ho b]s?t--.VzwZOA0Q8{6@Q(4Nm\
2024-10-24 15:37:01 UTC	2361	IN	Data Raw: a3 52 da 99 6f 3d 29 a7 5d a1 c3 bb 52 da b5 6f 7d 5b 4e 3b 92 d1 f2 c6 c7 69 cd fa e2 6b db 59 ef 51 38 be db 05 ba 57 38 30 3f d7 e9 bb d7 fb 56 66 b8 3b 5e b7 fb fe f1 13 07 72 be f6 d7 5b 83 e3 14 80 ff b5 bd 0e 9f d7 dd e7 14 4f 10 e3 02 ae 47 0f d8 5e 7f 74 4f dd 67 ee 1b f7 ad fb ab fb d2 7d e7 1e fe 0e 8d e8 db 85 fb 02 95 f8 b2 4c 07 b9 77 df fb 87 ad e8 3c 06 9e ef 39 c7 86 fe ce 7f 21 49 a6 a7 7e db 7d 85 7c d6 f7 28 74 56 3a 4c 9f f4 7d ed 53 ad 77 f6 83 ad b7 e4 12 b2 b3 1a a1 fb d4 d0 6a fc 59 57 81 9c c7 f7 ea 24 7a ba ef 7f a7 b3 7d 10 02 03 f9 5d 32 49 df 0b b2 84 34 a7 b0 88 c3 10 3b f4 eb 75 94 bf 88 11 c9 e6 7b 82 0c 0f 61 68 c6 24 3f 75 84 03 fe 39 c7 a4 08 f8 67 cc 3f 53 fe 19 7a a9 ff b4 37 4a 6e e1 9c 42 6d eb 42 0d a9 b3 b8 9a 20 Data Ascii: Ro=)]Ro}[N;ikYQ8W80?Vf;^r[OG^tOg}Lw<9!I~}\|(tV:L}SwjYW$z}]2I4;u{ah$?u9g?Sz7JnBmB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.17	49881	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:37:01 UTC	654	OUT	GET /shared/1.0/content/images/close_790189870c9543725dc3f5a15fb25e46.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:37:01 UTC	799	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:37:01 GMT Content-Type: image/svg+xml Content-Length: 190 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:46 GMT ETag: 0x8DB5C3F4823AA6E x-ms-request-id: ab0c7e16-701e-0071-7241-22257d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153701Z-16849878b786vsxz21496wc2qn000000082g000000002b6w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:37:01 UTC	190	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 75 8f c1 0e 82 30 0c 86 5f 65 a9 57 b2 75 23 62 30 1b 07 ef be 80 37 a2 93 2d 41 20 ac 61 3c be 9b 88 37 d3 26 ed df ef 4f 9b ea b0 74 6c 7d f5 43 30 e0 88 a6 b3 10 31 46 1e 4b 3e ce 9d 50 88 28 92 03 58 f4 0f 72 06 a4 02 e6 ac ef 1c 6d fd e2 6d bc 8c ab 01 64 c8 a4 4a 09 8d 26 4f bd 6d da 10 2c 05 2d 36 a5 67 7b a7 7f 5b 9e be ef 0d 0c e3 60 41 34 7a 6a c9 b1 87 81 6b c5 4f 45 55 48 55 48 c9 4b ac 7f 45 a5 69 62 bc aa 65 16 b8 83 23 2f 13 c1 22 83 0f c4 24 f3 f0 cb 31 bb 33 b8 ed 27 0f aa ca 91 af e6 37 9b 37 22 dd b4 90 0e 01 00 00 Data Ascii: u0_eWu#b07-A a<7&Otl}C01FK>P(XrmmdJ&Om,-6g{[`A4zjkOEUHUHKEibe#/"$13'77"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.17	49882	13.107.246.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:37:01 UTC	623	OUT	GET /shared/1.0/content/js/asyncchunk/convergederror_stringcustomizationhelper_a7fa53f8687b4e38205f.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:37:01 UTC	819	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:37:01 GMT Content-Type: application/x-javascript Content-Length: 35170 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 15 Aug 2024 17:52:53 GMT ETag: 0x8DCBD53168EFAC9 x-ms-request-id: 28c489e3-201e-0053-441d-26e062000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153701Z-15b8d89586fst84k5f3z220tec0000000ehg00000000cbsf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-24 15:37:01 UTC	15565	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 c4 bd 6b 43 db 48 b2 30 fc fd f9 15 e0 9d 65 ac b5 00 df 30 18 70 58 06 92 49 76 33 93 9c 5c 66 cf 2e 30 59 59 96 6d 0d b2 65 24 99 4b 02 cf 6f 7f eb d2 97 6a c9 90 cc 9c 67 df 33 e7 6c 70 57 df aa ab ab ab ab aa ab 5b db 7f 59 ff 3f 6b 7f 59 db fc f6 ff d6 de 7f 38 7e f7 61 ed cd 8b b5 0f 2f 5f bd 3b 5d 7b 0b a9 7f ae fd fc e6 c3 ab 93 e7 df de 0e 76 8a ff fb 30 8d f3 b5 71 9c 44 6b f0 77 18 e4 d1 68 2d 9d af a5 d9 5a 3c 0f d3 6c 91 66 41 11 e5 6b 33 f8 37 8b 83 64 6d 9c a5 b3 b5 62 1a ad 2d b2 f4 b7 28 2c f2 b5 24 ce 0b a8 34 8c 92 f4 66 ad 0e cd 65 a3 b5 b7 41 56 dc ad bd 7a eb 6d 41 fb 11 b4 16 4f e2 39 d4 0e d3 c5 1d fc 9e 16 6b f3 b4 88 c3 68 2d 98 8f a8 b5 04 12 f3 3c 5a 5b ce 47 51 b6 76 33 8d c3 e9 da 4f 71 98 a5 79 Data Ascii: kCH0e0pXIv3\f.0YYme$Kojg3lpW[Y?kY8~a/_;]{v0qDkwh-Z<lfAk37dmb-(,$4feAVzmAO9kh-<Z[GQv3Oqy
2024-10-24 15:37:01 UTC	16384	IN	Data Raw: f8 ef 29 66 ec 36 5f c0 bf 7b cf db e7 cb d6 5e f3 39 39 c4 7e d8 a4 3f 2f f0 df f6 31 25 da 94 d3 6b 52 82 1f fb eb f5 38 01 c5 5e 3c 7f 81 ff be 78 d1 df a4 3f 3f 5c dc 9f 2f 4f c1 50 38 83 3f 27 3f 9c e2 bf 27 a7 0c 6c bf 20 e0 31 36 05 7f 3a 0c ed 50 d1 d3 dd ce 26 fd 39 26 e8 0f dd 26 95 6d b6 f0 df 36 d7 d8 7d 71 b1 4d a3 ee 7d 8d a8 34 0f af e3 f9 e5 eb 60 18 25 4c c7 5d 24 9e c9 38 8d f2 22 9e d3 a3 0d 9c bd e7 64 7f 88 8b 24 e2 8c 3e 53 7a f7 f7 1b 06 d6 3f 68 0c 77 dc a3 42 52 c6 f3 9f 82 5b 50 f6 e8 27 89 62 fa 35 40 0b 7d 3e 68 1d 50 ea 30 3c 20 36 ec 77 40 f6 83 82 01 ec 9d 85 52 ae 52 29 dc ca d0 7b b8 b9 39 f7 be e0 f6 ae 24 18 54 8c b9 7d 60 f1 d9 08 64 02 be 87 b0 95 5f c6 8b 0f e9 65 84 cb cd ef e3 6e 97 7a 54 74 c0 85 37 5b de bc d1 30 Data Ascii: )f6_{^99~?/1%kR8^<x??\/OP8?'?'l 16:P&9&&m6}qM}4`%L]$8"d$>Sz?hwBR[P'b5@}>hP0< 6w@RR){9$T}`d_enzTt7[0
2024-10-24 15:37:01 UTC	3221	IN	Data Raw: 07 2a a1 14 1f 96 f0 76 75 58 56 49 bf ba 97 45 8d 02 0a 5a 7e 8d 62 9b 32 92 32 b6 a4 86 fd 7a d7 c5 9c d7 de ce b0 bb b2 7e f6 eb 69 81 47 15 92 71 c6 19 2a 17 d4 15 88 bf 04 8f 6f b8 80 b3 ae cc 6f 37 86 7d af f0 c8 cb a0 45 06 d4 64 ff 4e d6 b9 db 29 a7 74 1d 9a 3b cf a2 95 77 76 ba 0c f8 c6 59 3e 9f 04 7b 43 b6 b6 79 cb 9e 84 f7 8e 36 3b 1e 3b 11 3b 31 b5 e2 bb ec 68 25 b4 4d 44 45 8f c2 27 7a 2f f2 c8 6a 73 65 14 10 94 aa 8e e2 1c ed a7 f1 87 6a f3 5a af 35 2a d5 0a 53 41 08 e1 f5 6a ab c1 c2 eb b5 62 b1 81 e1 f4 30 7c ae b3 df 0b bc 12 c0 af 6a 24 84 65 2e 52 c6 26 fa 4b a4 92 57 44 94 aa 14 53 29 05 49 4b e5 06 05 95 6a 2d 15 ed 0b 99 dd 12 1c 7b e1 4f 65 ff 62 9a 31 c8 e8 1b 15 27 9e ae a9 02 d9 c8 43 35 2a ae 73 d9 e3 34 7f 38 37 83 de 49 bb 5e Data Ascii: vuXVIEZ~b22z~iGqoo7}EdN)t;wvY>{Cy6;;;1h%MDE'z/jsejZ5SAjb0\|j$e.R&KWDS)IKj-{Oeb1'C5s487I^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.17	49883	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:37:01 UTC	417	OUT	GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:37:01 UTC	799	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:37:01 GMT Content-Type: image/svg+xml Content-Length: 673 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:46 GMT ETag: 0x8DB5C3F47E260FD x-ms-request-id: 51a6e408-101e-0032-6a76-21b49e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153701Z-r1755647c66fnxpdavnqahfp1w000000087g000000002q2w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:37:01 UTC	673	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 21 02 39 81 41 Data Ascii: Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9!9A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.17	49884	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:37:01 UTC	415	OUT	GET /shared/1.0/content/images/check_small_48540c930333871c385fcba2c659ccdb.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:37:01 UTC	779	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:37:01 GMT Content-Type: image/svg+xml Content-Length: 1009 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:46 GMT ETag: 0x8DB5C3F48118378 x-ms-request-id: 51cf971f-901e-0079-6c35-233f72000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153701Z-17fbfdc98bbwfg2nvhsr4h37pn00000007g00000000077ex x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:37:01 UTC	1009	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 5d 96 c1 8e dc 36 0c 86 ef 05 fa 0e c6 f4 ae 21 29 51 12 8b 4c 0e f5 75 f2 02 b9 15 c8 76 67 81 cd 6e d0 0c 32 79 fc 90 32 45 bb 3d d9 92 65 91 ff c7 9f b2 3f 7c ff f1 bc 3c 5e be dc 6f 97 13 e6 d3 72 7b 7a 79 be dd b7 fb 1f 2f 4f 8f bf de 7f 5e 4e b0 c0 82 79 b1 b9 7f 5e 5e 5f 2f a7 b7 f7 b7 a7 d3 f2 f3 eb eb db f7 cb e9 76 bf 7f fb f3 7c 7e 3c 1e e9 91 d3 fb bf cf 67 02 80 b3 6e 7c fa f8 fb 6f 1f be fd 7d bf 2d 5f 2e a7 4f 92 4a 2d b9 2e 39 b5 56 7b bd 22 24 c8 5c 97 92 72 e9 58 ae 9c a8 23 f1 22 09 81 b8 5c 29 c9 58 5f 53 eb 5c cb 35 27 d6 e5 45 c7 84 3a 1f eb 5b 12 16 a9 d7 ff ed ff f9 53 4d bc c0 da 12 48 ad 5d 25 b4 54 1b d1 a2 61 5b a7 de fa d2 13 51 d5 0c 20 91 a6 50 f3 da 35 14 88 2d c9 bd 11 34 cd 85 44 b2 4d 54 60 Data Ascii: ]6!)QLuvgn2y2E=e?\|<^or{zy/O^Ny^^_/v\|~<gn\|o}-_.OJ-.9V{"$\rX#"\)X_S\5'E:[SMH]%Ta[Q P5-4DMT`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.17	49885	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:37:01 UTC	409	OUT	GET /shared/1.0/content/images/close_790189870c9543725dc3f5a15fb25e46.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:37:02 UTC	778	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:37:02 GMT Content-Type: image/svg+xml Content-Length: 190 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:46 GMT ETag: 0x8DB5C3F4823AA6E x-ms-request-id: 0467a535-701e-0061-6e69-21e015000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153702Z-r1755647c66sn7s9kfw6gzvyp000000009w00000000093tx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 15:37:02 UTC	190	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 75 8f c1 0e 82 30 0c 86 5f 65 a9 57 b2 75 23 62 30 1b 07 ef be 80 37 a2 93 2d 41 20 ac 61 3c be 9b 88 37 d3 26 ed df ef 4f 9b ea b0 74 6c 7d f5 43 30 e0 88 a6 b3 10 31 46 1e 4b 3e ce 9d 50 88 28 92 03 58 f4 0f 72 06 a4 02 e6 ac ef 1c 6d fd e2 6d bc 8c ab 01 64 c8 a4 4a 09 8d 26 4f bd 6d da 10 2c 05 2d 36 a5 67 7b a7 7f 5b 9e be ef 0d 0c e3 60 41 34 7a 6a c9 b1 87 81 6b c5 4f 45 55 48 55 48 c9 4b ac 7f 45 a5 69 62 bc aa 65 16 b8 83 23 2f 13 c1 22 83 0f c4 24 f3 f0 cb 31 bb 33 b8 ed 27 0f aa ca 91 af e6 37 9b 37 22 dd b4 90 0e 01 00 00 Data Ascii: u0_eWu#b07-A a<7&Otl}C01FK>P(XrmmdJ&Om,-6g{[`A4zjkOEUHUHKEibe#/"$13'77"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.17	49886	13.107.253.45	443	7096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:37:02 UTC	438	OUT	GET /shared/1.0/content/js/asyncchunk/convergederror_stringcustomizationhelper_a7fa53f8687b4e38205f.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 15:37:02 UTC	819	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:37:02 GMT Content-Type: application/x-javascript Content-Length: 35170 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 15 Aug 2024 17:52:53 GMT ETag: 0x8DCBD53168EFAC9 x-ms-request-id: 28c489e3-201e-0053-441d-26e062000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241024T153702Z-r1755647c66hbclz9tgqkaxg2w00000000ug000000004xyh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-24 15:37:02 UTC	15565	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 c4 bd 6b 43 db 48 b2 30 fc fd f9 15 e0 9d 65 ac b5 00 df 30 18 70 58 06 92 49 76 33 93 9c 5c 66 cf 2e 30 59 59 96 6d 0d b2 65 24 99 4b 02 cf 6f 7f eb d2 97 6a c9 90 cc 9c 67 df 33 e7 6c 70 57 df aa ab ab ab ab aa ab 5b db 7f 59 ff 3f 6b 7f 59 db fc f6 ff d6 de 7f 38 7e f7 61 ed cd 8b b5 0f 2f 5f bd 3b 5d 7b 0b a9 7f ae fd fc e6 c3 ab 93 e7 df de 0e 76 8a ff fb 30 8d f3 b5 71 9c 44 6b f0 77 18 e4 d1 68 2d 9d af a5 d9 5a 3c 0f d3 6c 91 66 41 11 e5 6b 33 f8 37 8b 83 64 6d 9c a5 b3 b5 62 1a ad 2d b2 f4 b7 28 2c f2 b5 24 ce 0b a8 34 8c 92 f4 66 ad 0e cd 65 a3 b5 b7 41 56 dc ad bd 7a eb 6d 41 fb 11 b4 16 4f e2 39 d4 0e d3 c5 1d fc 9e 16 6b f3 b4 88 c3 68 2d 98 8f a8 b5 04 12 f3 3c 5a 5b ce 47 51 b6 76 33 8d c3 e9 da 4f 71 98 a5 79 Data Ascii: kCH0e0pXIv3\f.0YYme$Kojg3lpW[Y?kY8~a/_;]{v0qDkwh-Z<lfAk37dmb-(,$4feAVzmAO9kh-<Z[GQv3Oqy
2024-10-24 15:37:02 UTC	16384	IN	Data Raw: f8 ef 29 66 ec 36 5f c0 bf 7b cf db e7 cb d6 5e f3 39 39 c4 7e d8 a4 3f 2f f0 df f6 31 25 da 94 d3 6b 52 82 1f fb eb f5 38 01 c5 5e 3c 7f 81 ff be 78 d1 df a4 3f 3f 5c dc 9f 2f 4f c1 50 38 83 3f 27 3f 9c e2 bf 27 a7 0c 6c bf 20 e0 31 36 05 7f 3a 0c ed 50 d1 d3 dd ce 26 fd 39 26 e8 0f dd 26 95 6d b6 f0 df 36 d7 d8 7d 71 b1 4d a3 ee 7d 8d a8 34 0f af e3 f9 e5 eb 60 18 25 4c c7 5d 24 9e c9 38 8d f2 22 9e d3 a3 0d 9c bd e7 64 7f 88 8b 24 e2 8c 3e 53 7a f7 f7 1b 06 d6 3f 68 0c 77 dc a3 42 52 c6 f3 9f 82 5b 50 f6 e8 27 89 62 fa 35 40 0b 7d 3e 68 1d 50 ea 30 3c 20 36 ec 77 40 f6 83 82 01 ec 9d 85 52 ae 52 29 dc ca d0 7b b8 b9 39 f7 be e0 f6 ae 24 18 54 8c b9 7d 60 f1 d9 08 64 02 be 87 b0 95 5f c6 8b 0f e9 65 84 cb cd ef e3 6e 97 7a 54 74 c0 85 37 5b de bc d1 30 Data Ascii: )f6_{^99~?/1%kR8^<x??\/OP8?'?'l 16:P&9&&m6}qM}4`%L]$8"d$>Sz?hwBR[P'b5@}>hP0< 6w@RR){9$T}`d_enzTt7[0
2024-10-24 15:37:02 UTC	3221	IN	Data Raw: 07 2a a1 14 1f 96 f0 76 75 58 56 49 bf ba 97 45 8d 02 0a 5a 7e 8d 62 9b 32 92 32 b6 a4 86 fd 7a d7 c5 9c d7 de ce b0 bb b2 7e f6 eb 69 81 47 15 92 71 c6 19 2a 17 d4 15 88 bf 04 8f 6f b8 80 b3 ae cc 6f 37 86 7d af f0 c8 cb a0 45 06 d4 64 ff 4e d6 b9 db 29 a7 74 1d 9a 3b cf a2 95 77 76 ba 0c f8 c6 59 3e 9f 04 7b 43 b6 b6 79 cb 9e 84 f7 8e 36 3b 1e 3b 11 3b 31 b5 e2 bb ec 68 25 b4 4d 44 45 8f c2 27 7a 2f f2 c8 6a 73 65 14 10 94 aa 8e e2 1c ed a7 f1 87 6a f3 5a af 35 2a d5 0a 53 41 08 e1 f5 6a ab c1 c2 eb b5 62 b1 81 e1 f4 30 7c ae b3 df 0b bc 12 c0 af 6a 24 84 65 2e 52 c6 26 fa 4b a4 92 57 44 94 aa 14 53 29 05 49 4b e5 06 05 95 6a 2d 15 ed 0b 99 dd 12 1c 7b e1 4f 65 ff 62 9a 31 c8 e8 1b 15 27 9e ae a9 02 d9 c8 43 35 2a ae 73 d9 e3 34 7f 38 37 83 de 49 bb 5e Data Ascii: vuXVIEZ~b22z~iGqoo7}EdN)t;wvY>{Cy6;;;1h%MDE'z/jsejZ5SAjb0\|j$e.R&KWDS)IKj-{Oeb1'C5s487I^

Target ID:	0
Start time:	11:35:04
Start date:	24/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	11:35:05
Start date:	24/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=2040,i,5767944486962329334,844409809218667319,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	11:35:06
Start date:	24/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com"
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.Some data encoding systems may also result in data compression, such as gzip.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Tactics:	Exfiltration
Data Sources:	Application Log: Application Log Content, Cloud Storage: Cloud Storage Access, Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 137

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 142

Chrome Cache Entry: 143

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Chrome Cache Entry: 146

Chrome Cache Entry: 147

Chrome Cache Entry: 148

Chrome Cache Entry: 149

Chrome Cache Entry: 150

Chrome Cache Entry: 151

Chrome Cache Entry: 152

Chrome Cache Entry: 153

Chrome Cache Entry: 154

Windows Analysis Report
http://3a2828d86d86bc5d064a6136459935d8.fp.measure.office.com