Edit tour

Windows Analysis Report
https://ithelpdesk.automationanywhere.com/app/itdesk/ui/requests/27746000065200260/details

Overview

General Information

Sample URL:	https://ithelpdesk.automationanywhere.com/app/itdesk/ui/requests/27746000065200260/details
Analysis ID:	1543671
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5324 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4996 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 --field-trial-handle=2216,i,14187799758207872673,14442970336596630755,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4540 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ithelpdesk.automationanywhere.com/app/itdesk/ui/requests/27746000065200260/details" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://automationanywhere.okta.com/app/automationanywhere_ithelpdesk_1/exk3ez7zehmk8x48s2p7/sso/saml?SAMLRequest=fVLLbtswEPwVgXdLpCxbFmEZUGMUNZC2Ruz2kIvBSKuKsESqXMpx%2FPWlmCYwkMd1Zndmdsgliq7teTHYRt3B3wHQBueuVcg9kZPBKK4FSuRKdIDclnxXfL%2FlcUh5b7TVpW5JsFnn5JCy2Yxm85omGU2qmi4qqJL5dJY9sCSrU8bSKWWUkuA3GJRa5cSJuF3EATYKrVDWQTROJoxO4sWepnw655SFWRLfk%2BCrNiX4oDmpRYswrm4FojzBK7L9H%2BmLVJVUfz7P%2F%2FA8hPzbfr%2BdbH%2Fu9iQoEMFYl%2B5GKxw6MDswJ1nCr7vbnDTW9sijSJSlHpTF8KIbHZa6i8a2DGDvliASg9WdGEWEenpswMA4Q4K1a1cqT1xpvR3WRyu8quj7d%2FiDtA20fQV4PLAIzscpXNILNN1xcU4WGPdphKh9JF%2FISVZgfrjrc3Lv8pLVcqS4791cvfbnZYmXYsjq5epldCX0rNrz0Wiz3upWlk9B0bb68caAsM7cmgH8M7pzPvZiIfOIrCa1H%2BXQCdkWVeX6RRc%2BeuvzCl7%2F49U%2F&RelayState=aHR0cHM6Ly9pdGhlbHBkZXNrLmF1dG9tYXRpb25hbnl3aGVyZS5jb20vYXBwL2l0ZGVzay91aS9yZXF1ZXN0cy8yNzc0NjAwMDA2NTIwMDI2MC9kZXRhaWxzX19JQU1fX1NEUE9uRGVtYW5kX19JQU1fX19fSUFNX19mYWxzZV9fSUFNX18%3D

HTTP Parser: Number of links: 1

HTTP Parser: No <meta name="author".. found

HTTP Parser: No <meta name="copyright".. found

Source: unknown

HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.6:49730 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.6:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.6:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.6:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.6:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.223.42.213:443 -> 192.168.2.6:49773 version: TLS 1.2

Source: global traffic

TCP traffic: 192.168.2.6:49726 -> 1.1.1.1:53

Source: unknown

HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.6:49730 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60

Source: global traffic	HTTP traffic detected: GET /app/itdesk/ui/requests/27746000065200260/details HTTP/1.1Host: ithelpdesk.automationanywhere.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Login.jsp?serviceurl=%2Fapp%2Fitdesk%2Fui%2Frequests%2F27746000065200260%2Fdetails HTTP/1.1Host: ithelpdesk.automationanywhere.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zalb_6bc9ae5955=8ffc757add8670d4be8660e2f5588b6e; sdpcscook=86188593-62bd-491c-b54e-1f56c1bcc4e6; _zcsr_tmp=86188593-62bd-491c-b54e-1f56c1bcc4e6
Source: global traffic	HTTP traffic detected: GET /samlauthrequest/630778920?serviceurl=https%3A%2F%2Fithelpdesk.automationanywhere.com%2Fapp%2Fitdesk%2Fui%2Frequests%2F27746000065200260%2Fdetails&servicename=SDPOnDemand&portal_id=630778920&hide_signup=false HTTP/1.1Host: accounts.zoho.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /app/automationanywhere_ithelpdesk_1/exk3ez7zehmk8x48s2p7/sso/saml?SAMLRequest=fVLLbtswEPwVgXdLpCxbFmEZUGMUNZC2Ruz2kIvBSKuKsESqXMpx%2FPWlmCYwkMd1Zndmdsgliq7teTHYRt3B3wHQBueuVcg9kZPBKK4FSuRKdIDclnxXfL%2FlcUh5b7TVpW5JsFnn5JCy2Yxm85omGU2qmi4qqJL5dJY9sCSrU8bSKWWUkuA3GJRa5cSJuF3EATYKrVDWQTROJoxO4sWepnw655SFWRLfk%2BCrNiX4oDmpRYswrm4FojzBK7L9H%2BmLVJVUfz7P%2F%2FA8hPzbfr%2BdbH%2Fu9iQoEMFYl%2B5GKxw6MDswJ1nCr7vbnDTW9sijSJSlHpTF8KIbHZa6i8a2DGDvliASg9WdGEWEenpswMA4Q4K1a1cqT1xpvR3WRyu8quj7d%2FiDtA20fQV4PLAIzscpXNILNN1xcU4WGPdphKh9JF%2FISVZgfrjrc3Lv8pLVcqS4791cvfbnZYmXYsjq5epldCX0rNrz0Wiz3upWlk9B0bb68caAsM7cmgH8M7pzPvZiIfOIrCa1H%2BXQCdkWVeX6RRc%2BeuvzCl7%2F49U%2F&RelayState=aHR0cHM6Ly9pdGhlbHBkZXNrLmF1dG9tYXRpb25hbnl3aGVyZS5jb20vYXBwL2l0ZGVzay91aS9yZXF1ZXN0cy8yNzc0NjAwMDA2NTIwMDI2MC9kZXRhaWxzX19JQU1fX1NEUE9uRGVtYW5kX19JQU1fX19fSUFNX19mYWxzZV9fSUFNX18%3D HTTP/1.1Host: automationanywhere.okta.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/internal/brand/theme/style-sheet?touch-point=SIGN_IN_PAGE&v=abc4780733b2999dc5536ea4bf18a7237d32beafe91e2f7611b8af3ecb8ae0d0dfb208992a3b1ecefd0c0f9333f4b59d HTTP/1.1Host: automationanywhere.okta.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://automationanywhere.okta.com/app/automationanywhere_ithelpdesk_1/exk3ez7zehmk8x48s2p7/sso/saml?SAMLRequest=fVLLbtswEPwVgXdLpCxbFmEZUGMUNZC2Ruz2kIvBSKuKsESqXMpx%2FPWlmCYwkMd1Zndmdsgliq7teTHYRt3B3wHQBueuVcg9kZPBKK4FSuRKdIDclnxXfL%2FlcUh5b7TVpW5JsFnn5JCy2Yxm85omGU2qmi4qqJL5dJY9sCSrU8bSKWWUkuA3GJRa5cSJuF3EATYKrVDWQTROJoxO4sWepnw655SFWRLfk%2BCrNiX4oDmpRYswrm4FojzBK7L9H%2BmLVJVUfz7P%2F%2FA8hPzbfr%2BdbH%2Fu9iQoEMFYl%2B5GKxw6MDswJ1nCr7vbnDTW9sijSJSlHpTF8KIbHZa6i8a2DGDvliASg9WdGEWEenpswMA4Q4K1a1cqT1xpvR3WRyu8quj7d%2FiDtA20fQV4PLAIzscpXNILNN1xcU4WGPdphKh9JF%2FISVZgfrjrc3Lv8pLVcqS4791cvfbnZYmXYsjq5epldCX0rNrz0Wiz3upWlk9B0bb68caAsM7cmgH8M7pzPvZiIfOIrCa1H%2BXQCdkWVeX6RRc%2BeuvzCl7%2F49U%2F&RelayState=aHR0cHM6Ly9pdGhlbHBkZXNrLmF1dG9tYXRpb25hbnl3aGVyZS5jb20vYXBwL2l0ZGVzay91aS9yZXF1ZXN0cy8yNzc0NjAwMDA2NTIwMDI2MC9kZXRhaWxzX19JQU1fX1NEUE9uRGVtYW5kX19JQU1fX19fSUFNX19mYWxzZV9fSUFNX18%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=FDA37EE175411A44AC964E71264A30E0; DT=DI1xilJgciFQtiXvrCZ_ut5jw
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: automationanywhere.okta.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://automationanywhere.okta.com/app/automationanywhere_ithelpdesk_1/exk3ez7zehmk8x48s2p7/sso/saml?SAMLRequest=fVLLbtswEPwVgXdLpCxbFmEZUGMUNZC2Ruz2kIvBSKuKsESqXMpx%2FPWlmCYwkMd1Zndmdsgliq7teTHYRt3B3wHQBueuVcg9kZPBKK4FSuRKdIDclnxXfL%2FlcUh5b7TVpW5JsFnn5JCy2Yxm85omGU2qmi4qqJL5dJY9sCSrU8bSKWWUkuA3GJRa5cSJuF3EATYKrVDWQTROJoxO4sWepnw655SFWRLfk%2BCrNiX4oDmpRYswrm4FojzBK7L9H%2BmLVJVUfz7P%2F%2FA8hPzbfr%2BdbH%2Fu9iQoEMFYl%2B5GKxw6MDswJ1nCr7vbnDTW9sijSJSlHpTF8KIbHZa6i8a2DGDvliASg9WdGEWEenpswMA4Q4K1a1cqT1xpvR3WRyu8quj7d%2FiDtA20fQV4PLAIzscpXNILNN1xcU4WGPdphKh9JF%2FISVZgfrjrc3Lv8pLVcqS4791cvfbnZYmXYsjq5epldCX0rNrz0Wiz3upWlk9B0bb68caAsM7cmgH8M7pzPvZiIfOIrCa1H%2BXQCdkWVeX6RRc%2BeuvzCl7%2F49U%2F&RelayState=aHR0cHM6Ly9pdGhlbHBkZXNrLmF1dG9tYXRpb25hbnl3aGVyZS5jb20vYXBwL2l0ZGVzay91aS9yZXF1ZXN0cy8yNzc0NjAwMDA2NTIwMDI2MC9kZXRhaWxzX19JQU1fX1NEUE9uRGVtYW5kX19JQU1fX19fSUFNX19mYWxzZV9fSUFNX18%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: DT=DI1xilJgciFQtiXvrCZ_ut5jw; JSESSIONID=A7CDE4AA7CA38E344464BACCD7A20BB9
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: global traffic	DNS traffic detected: DNS query: ithelpdesk.automationanywhere.com
Source: global traffic	DNS traffic detected: DNS query: accounts.zoho.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: automationanywhere.okta.com
Source: global traffic	DNS traffic detected: DNS query: ok6static.oktacdn.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.6:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.6:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.6:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.6:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.223.42.213:443 -> 192.168.2.6:49773 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@17/4@12/9

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 --field-trial-handle=2216,i,14187799758207872673,14442970336596630755,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ithelpdesk.automationanywhere.com/app/itdesk/ui/requests/27746000065200260/details"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 --field-trial-handle=2216,i,14187799758207872673,14442970336596630755,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
csdp.manageuser.com	204.141.42.199	true	false	unknown
dpxbp5vi8wz3w.cloudfront.net	52.222.214.58	true	false	unknown
www.google.com	142.251.116.105	true	false	unknown
ae52e19d4a7095f43.awsglobalaccelerator.com	13.248.165.67	true	false	unknown
accounts.zoho.com	204.141.42.100	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
ithelpdesk.automationanywhere.com	unknown	unknown	false	unknown
ok6static.oktacdn.com	unknown	unknown	false	unknown
automationanywhere.okta.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://ithelpdesk.automationanywhere.com/Login.jsp?serviceurl=%2Fapp%2Fitdesk%2Fui%2Frequests%2F27746000065200260%2Fdetails	false	unknown
https://accounts.zoho.com/samlauthrequest/630778920?serviceurl=https%3A%2F%2Fithelpdesk.automationanywhere.com%2Fapp%2Fitdesk%2Fui%2Frequests%2F27746000065200260%2Fdetails&servicename=SDPOnDemand&portal_id=630778920&hide_signup=false	false	unknown
https://automationanywhere.okta.com/api/internal/brand/theme/style-sheet?touch-point=SIGN_IN_PAGE&v=abc4780733b2999dc5536ea4bf18a7237d32beafe91e2f7611b8af3ecb8ae0d0dfb208992a3b1ecefd0c0f9333f4b59d	false	unknown
https://ithelpdesk.automationanywhere.com/app/itdesk/ui/requests/27746000065200260/details	false	unknown
https://automationanywhere.okta.com/favicon.ico	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.251.116.105	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
76.223.42.213	unknown	United States	16509	AMAZON-02US	false
204.141.42.199	csdp.manageuser.com	United States	2639	ZOHO-ASUS	false
204.141.42.100	accounts.zoho.com	United States	2639	ZOHO-ASUS	false
13.248.165.67	ae52e19d4a7095f43.awsglobalaccelerator.com	United States	16509	AMAZON-02US	false
52.222.214.58	dpxbp5vi8wz3w.cloudfront.net	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.4
192.168.2.6

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543671
Start date and time:	2024-10-28 08:35:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://ithelpdesk.automationanywhere.com/app/itdesk/ui/requests/27746000065200260/details
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@17/4@12/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.181.227, 216.58.212.142, 74.125.206.84, 34.104.35.123, 4.175.87.197, 192.229.221.95, 13.85.23.206, 199.232.214.172, 52.165.164.15, 93.184.221.240, 142.250.185.195
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, wu.azureedge.net, clients2.google.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, client.wns.windows.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://ithelpdesk.automationanywhere.com/app/itdesk/ui/requests/27746000065200260/details

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	556
Entropy (8bit):	4.81705343903535
Encrypted:	false
SSDEEP:	12:iK8p1+M8HTpT2ShHmlFc8r5WUFBfYH6TSb7y3F88r5WUFBaNtYeHi:iSLCS4UC5RFh66YG5RFIt4
MD5:	28D025743B8FC0765A7CFE4C08FDF2A9
SHA1:	80737E656DC7DBA19F122504A3A1D53A6A1C9FF2
SHA-256:	9AF30B5E4695010F9BE253F861784E638C81274CA0390214629886029CA9B509
SHA-512:	D9F693858B1AAFA379940B122382EC1CA0008A7A6405ADF674C729EB3577254AEEEABB29FB66BC88BFAAA8FF812E53399185CB4D5DDCB7D18F46D8332D93819B
Malicious:	false
Reputation:	low
URL:	https://automationanywhere.okta.com/api/internal/brand/theme/style-sheet?touch-point=SIGN_IN_PAGE&v=abc4780733b2999dc5536ea4bf18a7237d32beafe91e2f7611b8af3ecb8ae0d0dfb208992a3b1ecefd0c0f9333f4b59d
Preview:	.tb--background {. background-color: #ebebed !important;.}..tb--button,..button-primary {. background: #1662dd !important;. border-color: #1662dd !important;. color: #ffffff !important;.}..tb--button:hover,..button-primary:hover {. background-image: linear-gradient(hsla(0, 0%, 100%, 0.04) 0 0) !important;. }..tb--link {. color: #1662dd !important;.}..link-button-disabled,..link-button-disabled:hover {. background-image: linear-gradient(hsla(0, 0%, 100%, 0.5) 0 0) !important;. border-color: #ffffff !important;.}.

Chrome Cache Entry: 39

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	5430
Entropy (8bit):	2.7209270279774733
Encrypted:	false
SSDEEP:	24:E+As6X5OjYp4bEZVJkeZvwnDK4lBit6ubJdhlcolwptQutJt9LSWtF4alXlAXmBQ:Gs6XwjHbqkeKVlA9/zv3urGVu1gmykQ
MD5:	449C9DD651DB589388B721EB2496F5B0
SHA1:	64F3B213A89A00F7B0940271576ECC72280236F7
SHA-256:	F9E86FB363A05F75AB3B525439D46BF4911D4CD4AE94C656C0198206374002AA
SHA-512:	410C701B5050A6D039EE82C6D1B1B596983622E35256A2628A108B20E03D8B0CC85D2033292D5E13ACE0199FFFBB34DBFE9DF82EA4161285082837056A06F2DC
Malicious:	false
Reputation:	low
URL:	https://automationanywhere.okta.com/favicon.ico
Preview:	............ .h...&... .... .........(....... ..... .................................y)..y)..y).Lz)..z)..z)..z)..z)..z)..y(.Vx)..x)..........z+..y)..y)..y)..z)..z)..z)..z)..z)..z)..z)..z)..y)..y)..y)..z+..z..z..z)..z)..z)..z)..z)..z)..z)..z)..z)..z)..z)..z)..y)..{..z)..z)..z)..z)..z)..z)..z)..z)..z)..z)..z)..z)..z)..z)..z)..y(..y).Vz)..z)..z)..z)..z)..z(.Py)..x(..y).Pz)..z)..z)..z)..z)..z).Lz)..z)..z)..z)..z)..y)..v+..\|'..s'..\|..y). z)..z)..z)..z)..z)..z)..z)..z)..z)..y).Pz)..s'..........z'..z..z).Qz)..z)..z)..z)..z)..z)..z)..z)..y(..y)..................z)..z)..z)..z)..z)..z)..z)..z)..z)..z)..z)..z)..................z)..z)..z)..z)..z)..z)..z)..z)..z)..z)..z(.Lz)..y'..........s&..{)..y).Pz)..z)..z)..z)..z)..z)..z)..z)..z)..y)..\|..s'..w'..},..y)..z)..z)..z)..z)..z)..y).Lz)..z)..z)..z)..z)..y(.Px(..y)..y).Lz)..z)..z)..z)..z)..y).Vx)..z)..z)..z)..z)..z)..z)..z)..z)..z)..z)..z)..z)..z)..z)..w)..{*..y)..z)..z)..z)..z)..z)..z)..z)..z)..z)..z)..z)..z)..x(..y(..z+..z)..z)..z)..z)..z)..z)

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 08:35:51.576598883 CET	49674	443	192.168.2.6	173.222.162.64
Oct 28, 2024 08:35:51.723603010 CET	49673	443	192.168.2.6	173.222.162.64
Oct 28, 2024 08:35:51.810998917 CET	49672	443	192.168.2.6	173.222.162.64
Oct 28, 2024 08:35:58.365094900 CET	49717	443	192.168.2.6	40.115.3.253
Oct 28, 2024 08:35:58.365134001 CET	443	49717	40.115.3.253	192.168.2.6
Oct 28, 2024 08:35:58.365283012 CET	49717	443	192.168.2.6	40.115.3.253
Oct 28, 2024 08:35:58.366162062 CET	49717	443	192.168.2.6	40.115.3.253
Oct 28, 2024 08:35:58.366183043 CET	443	49717	40.115.3.253	192.168.2.6
Oct 28, 2024 08:35:59.642143965 CET	443	49717	40.115.3.253	192.168.2.6
Oct 28, 2024 08:35:59.642260075 CET	49717	443	192.168.2.6	40.115.3.253
Oct 28, 2024 08:35:59.652642965 CET	49717	443	192.168.2.6	40.115.3.253
Oct 28, 2024 08:35:59.652662992 CET	443	49717	40.115.3.253	192.168.2.6
Oct 28, 2024 08:35:59.926613092 CET	443	49717	40.115.3.253	192.168.2.6
Oct 28, 2024 08:35:59.929052114 CET	49717	443	192.168.2.6	40.115.3.253
Oct 28, 2024 08:35:59.929083109 CET	443	49717	40.115.3.253	192.168.2.6
Oct 28, 2024 08:35:59.929109097 CET	49717	443	192.168.2.6	40.115.3.253
Oct 28, 2024 08:35:59.929121017 CET	443	49717	40.115.3.253	192.168.2.6
Oct 28, 2024 08:35:59.929274082 CET	49717	443	192.168.2.6	40.115.3.253
Oct 28, 2024 08:35:59.929284096 CET	443	49717	40.115.3.253	192.168.2.6
Oct 28, 2024 08:35:59.943360090 CET	49721	443	192.168.2.6	204.141.42.199
Oct 28, 2024 08:35:59.943407059 CET	443	49721	204.141.42.199	192.168.2.6
Oct 28, 2024 08:35:59.943595886 CET	49721	443	192.168.2.6	204.141.42.199
Oct 28, 2024 08:35:59.944161892 CET	49722	443	192.168.2.6	204.141.42.199
Oct 28, 2024 08:35:59.944224119 CET	443	49722	204.141.42.199	192.168.2.6
Oct 28, 2024 08:35:59.944325924 CET	49722	443	192.168.2.6	204.141.42.199
Oct 28, 2024 08:35:59.944375038 CET	49721	443	192.168.2.6	204.141.42.199
Oct 28, 2024 08:35:59.944401979 CET	443	49721	204.141.42.199	192.168.2.6
Oct 28, 2024 08:35:59.944602013 CET	49722	443	192.168.2.6	204.141.42.199
Oct 28, 2024 08:35:59.944618940 CET	443	49722	204.141.42.199	192.168.2.6
Oct 28, 2024 08:36:00.177643061 CET	443	49717	40.115.3.253	192.168.2.6
Oct 28, 2024 08:36:00.233192921 CET	49717	443	192.168.2.6	40.115.3.253
Oct 28, 2024 08:36:00.233202934 CET	443	49717	40.115.3.253	192.168.2.6
Oct 28, 2024 08:36:00.241321087 CET	49717	443	192.168.2.6	40.115.3.253
Oct 28, 2024 08:36:00.241332054 CET	443	49717	40.115.3.253	192.168.2.6
Oct 28, 2024 08:36:00.489562035 CET	443	49717	40.115.3.253	192.168.2.6
Oct 28, 2024 08:36:00.543070078 CET	49717	443	192.168.2.6	40.115.3.253
Oct 28, 2024 08:36:00.638473988 CET	443	49722	204.141.42.199	192.168.2.6
Oct 28, 2024 08:36:00.640049934 CET	49722	443	192.168.2.6	204.141.42.199
Oct 28, 2024 08:36:00.640072107 CET	443	49722	204.141.42.199	192.168.2.6
Oct 28, 2024 08:36:00.640505075 CET	443	49722	204.141.42.199	192.168.2.6
Oct 28, 2024 08:36:00.640573978 CET	49722	443	192.168.2.6	204.141.42.199
Oct 28, 2024 08:36:00.641331911 CET	443	49722	204.141.42.199	192.168.2.6
Oct 28, 2024 08:36:00.641391039 CET	49722	443	192.168.2.6	204.141.42.199
Oct 28, 2024 08:36:00.642729044 CET	49722	443	192.168.2.6	204.141.42.199
Oct 28, 2024 08:36:00.642819881 CET	443	49722	204.141.42.199	192.168.2.6
Oct 28, 2024 08:36:00.642904043 CET	49722	443	192.168.2.6	204.141.42.199
Oct 28, 2024 08:36:00.642915964 CET	443	49722	204.141.42.199	192.168.2.6
Oct 28, 2024 08:36:00.684392929 CET	443	49721	204.141.42.199	192.168.2.6
Oct 28, 2024 08:36:00.684668064 CET	49721	443	192.168.2.6	204.141.42.199
Oct 28, 2024 08:36:00.684704065 CET	443	49721	204.141.42.199	192.168.2.6
Oct 28, 2024 08:36:00.685223103 CET	443	49721	204.141.42.199	192.168.2.6
Oct 28, 2024 08:36:00.685239077 CET	49722	443	192.168.2.6	204.141.42.199
Oct 28, 2024 08:36:00.685333014 CET	49721	443	192.168.2.6	204.141.42.199
Oct 28, 2024 08:36:00.686235905 CET	443	49721	204.141.42.199	192.168.2.6
Oct 28, 2024 08:36:00.686311960 CET	49721	443	192.168.2.6	204.141.42.199
Oct 28, 2024 08:36:00.693063021 CET	49721	443	192.168.2.6	204.141.42.199
Oct 28, 2024 08:36:00.693212032 CET	443	49721	204.141.42.199	192.168.2.6
Oct 28, 2024 08:36:00.736674070 CET	49721	443	192.168.2.6	204.141.42.199
Oct 28, 2024 08:36:00.736687899 CET	443	49721	204.141.42.199	192.168.2.6
Oct 28, 2024 08:36:00.782587051 CET	49721	443	192.168.2.6	204.141.42.199
Oct 28, 2024 08:36:00.823334932 CET	443	49722	204.141.42.199	192.168.2.6
Oct 28, 2024 08:36:00.823429108 CET	443	49722	204.141.42.199	192.168.2.6
Oct 28, 2024 08:36:00.823492050 CET	49722	443	192.168.2.6	204.141.42.199
Oct 28, 2024 08:36:00.825818062 CET	49722	443	192.168.2.6	204.141.42.199
Oct 28, 2024 08:36:00.825839996 CET	443	49722	204.141.42.199	192.168.2.6
Oct 28, 2024 08:36:00.830192089 CET	49721	443	192.168.2.6	204.141.42.199
Oct 28, 2024 08:36:00.871370077 CET	443	49721	204.141.42.199	192.168.2.6
Oct 28, 2024 08:36:01.026895046 CET	443	49721	204.141.42.199	192.168.2.6
Oct 28, 2024 08:36:01.027097940 CET	443	49721	204.141.42.199	192.168.2.6
Oct 28, 2024 08:36:01.027194977 CET	49721	443	192.168.2.6	204.141.42.199
Oct 28, 2024 08:36:01.027427912 CET	49721	443	192.168.2.6	204.141.42.199
Oct 28, 2024 08:36:01.027453899 CET	443	49721	204.141.42.199	192.168.2.6
Oct 28, 2024 08:36:01.027465105 CET	49721	443	192.168.2.6	204.141.42.199
Oct 28, 2024 08:36:01.027509928 CET	49721	443	192.168.2.6	204.141.42.199
Oct 28, 2024 08:36:01.138477087 CET	49725	443	192.168.2.6	204.141.42.100
Oct 28, 2024 08:36:01.138528109 CET	443	49725	204.141.42.100	192.168.2.6
Oct 28, 2024 08:36:01.138624907 CET	49725	443	192.168.2.6	204.141.42.100
Oct 28, 2024 08:36:01.138853073 CET	49725	443	192.168.2.6	204.141.42.100
Oct 28, 2024 08:36:01.138871908 CET	443	49725	204.141.42.100	192.168.2.6
Oct 28, 2024 08:36:01.184340000 CET	49674	443	192.168.2.6	173.222.162.64
Oct 28, 2024 08:36:01.324779987 CET	49673	443	192.168.2.6	173.222.162.64
Oct 28, 2024 08:36:01.412110090 CET	49672	443	192.168.2.6	173.222.162.64
Oct 28, 2024 08:36:01.513894081 CET	49726	53	192.168.2.6	1.1.1.1
Oct 28, 2024 08:36:01.519370079 CET	53	49726	1.1.1.1	192.168.2.6
Oct 28, 2024 08:36:01.519448042 CET	49726	53	192.168.2.6	1.1.1.1
Oct 28, 2024 08:36:01.519562960 CET	49726	53	192.168.2.6	1.1.1.1
Oct 28, 2024 08:36:01.519627094 CET	49726	53	192.168.2.6	1.1.1.1
Oct 28, 2024 08:36:01.524880886 CET	53	49726	1.1.1.1	192.168.2.6
Oct 28, 2024 08:36:01.525362015 CET	53	49726	1.1.1.1	192.168.2.6
Oct 28, 2024 08:36:01.841844082 CET	443	49725	204.141.42.100	192.168.2.6
Oct 28, 2024 08:36:01.846606016 CET	49725	443	192.168.2.6	204.141.42.100
Oct 28, 2024 08:36:01.846622944 CET	443	49725	204.141.42.100	192.168.2.6
Oct 28, 2024 08:36:01.848201036 CET	443	49725	204.141.42.100	192.168.2.6
Oct 28, 2024 08:36:01.848285913 CET	49725	443	192.168.2.6	204.141.42.100
Oct 28, 2024 08:36:01.851238012 CET	49725	443	192.168.2.6	204.141.42.100
Oct 28, 2024 08:36:01.851368904 CET	443	49725	204.141.42.100	192.168.2.6
Oct 28, 2024 08:36:01.851618052 CET	49725	443	192.168.2.6	204.141.42.100
Oct 28, 2024 08:36:01.851628065 CET	443	49725	204.141.42.100	192.168.2.6
Oct 28, 2024 08:36:01.903930902 CET	49725	443	192.168.2.6	204.141.42.100
Oct 28, 2024 08:36:02.027693033 CET	443	49725	204.141.42.100	192.168.2.6
Oct 28, 2024 08:36:02.027761936 CET	49725	443	192.168.2.6	204.141.42.100
Oct 28, 2024 08:36:02.027899981 CET	443	49725	204.141.42.100	192.168.2.6
Oct 28, 2024 08:36:02.027982950 CET	443	49725	204.141.42.100	192.168.2.6
Oct 28, 2024 08:36:02.028019905 CET	49725	443	192.168.2.6	204.141.42.100
Oct 28, 2024 08:36:02.031522036 CET	49725	443	192.168.2.6	204.141.42.100
Oct 28, 2024 08:36:02.031544924 CET	443	49725	204.141.42.100	192.168.2.6
Oct 28, 2024 08:36:02.031588078 CET	49725	443	192.168.2.6	204.141.42.100
Oct 28, 2024 08:36:02.031615019 CET	49725	443	192.168.2.6	204.141.42.100
Oct 28, 2024 08:36:02.113818884 CET	53	49726	1.1.1.1	192.168.2.6
Oct 28, 2024 08:36:02.115271091 CET	49726	53	192.168.2.6	1.1.1.1
Oct 28, 2024 08:36:02.117451906 CET	49727	443	192.168.2.6	142.251.116.105
Oct 28, 2024 08:36:02.117489100 CET	443	49727	142.251.116.105	192.168.2.6
Oct 28, 2024 08:36:02.117548943 CET	49727	443	192.168.2.6	142.251.116.105
Oct 28, 2024 08:36:02.118350029 CET	49727	443	192.168.2.6	142.251.116.105
Oct 28, 2024 08:36:02.118364096 CET	443	49727	142.251.116.105	192.168.2.6
Oct 28, 2024 08:36:02.121069908 CET	53	49726	1.1.1.1	192.168.2.6
Oct 28, 2024 08:36:02.121117115 CET	49726	53	192.168.2.6	1.1.1.1
Oct 28, 2024 08:36:02.292037010 CET	49728	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:02.292097092 CET	443	49728	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:02.292186022 CET	49728	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:02.292768955 CET	49728	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:02.292782068 CET	443	49728	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:02.346997023 CET	49729	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:02.347040892 CET	443	49729	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:02.347201109 CET	49729	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:02.348238945 CET	49729	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:02.348258972 CET	443	49729	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:02.359890938 CET	443	49729	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:02.364275932 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:02.364316940 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:02.364393950 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:02.365293980 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:02.365307093 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:02.677797079 CET	49731	443	192.168.2.6	184.28.90.27
Oct 28, 2024 08:36:02.677845955 CET	443	49731	184.28.90.27	192.168.2.6
Oct 28, 2024 08:36:02.677958965 CET	49731	443	192.168.2.6	184.28.90.27
Oct 28, 2024 08:36:02.687558889 CET	49731	443	192.168.2.6	184.28.90.27
Oct 28, 2024 08:36:02.687583923 CET	443	49731	184.28.90.27	192.168.2.6
Oct 28, 2024 08:36:02.700007915 CET	443	49731	184.28.90.27	192.168.2.6
Oct 28, 2024 08:36:02.700779915 CET	49732	443	192.168.2.6	184.28.90.27
Oct 28, 2024 08:36:02.700809956 CET	443	49732	184.28.90.27	192.168.2.6
Oct 28, 2024 08:36:02.700973034 CET	49732	443	192.168.2.6	184.28.90.27
Oct 28, 2024 08:36:02.702393055 CET	49732	443	192.168.2.6	184.28.90.27
Oct 28, 2024 08:36:02.702418089 CET	443	49732	184.28.90.27	192.168.2.6
Oct 28, 2024 08:36:02.714864016 CET	443	49732	184.28.90.27	192.168.2.6
Oct 28, 2024 08:36:02.715651035 CET	49733	443	192.168.2.6	184.28.90.27
Oct 28, 2024 08:36:02.715687037 CET	443	49733	184.28.90.27	192.168.2.6
Oct 28, 2024 08:36:02.715992928 CET	49733	443	192.168.2.6	184.28.90.27
Oct 28, 2024 08:36:02.717334986 CET	49733	443	192.168.2.6	184.28.90.27
Oct 28, 2024 08:36:02.717410088 CET	443	49733	184.28.90.27	192.168.2.6
Oct 28, 2024 08:36:02.718684912 CET	49733	443	192.168.2.6	184.28.90.27
Oct 28, 2024 08:36:02.742105961 CET	443	49727	142.251.116.105	192.168.2.6
Oct 28, 2024 08:36:02.742497921 CET	49727	443	192.168.2.6	142.251.116.105
Oct 28, 2024 08:36:02.742512941 CET	443	49727	142.251.116.105	192.168.2.6
Oct 28, 2024 08:36:02.744324923 CET	443	49727	142.251.116.105	192.168.2.6
Oct 28, 2024 08:36:02.744393110 CET	49727	443	192.168.2.6	142.251.116.105
Oct 28, 2024 08:36:03.067085028 CET	443	49728	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:03.067419052 CET	49728	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:03.067440033 CET	443	49728	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:03.069361925 CET	443	49728	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:03.069468021 CET	49728	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:03.111392021 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:03.111499071 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:03.115082979 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:03.115097046 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:03.115540028 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:03.130845070 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:03.163471937 CET	49727	443	192.168.2.6	142.251.116.105
Oct 28, 2024 08:36:03.163674116 CET	443	49727	142.251.116.105	192.168.2.6
Oct 28, 2024 08:36:03.164540052 CET	49728	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:03.164864063 CET	443	49728	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:03.165556908 CET	49728	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:03.165581942 CET	443	49728	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:03.175328970 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:03.176022053 CET	443	49705	173.222.162.64	192.168.2.6
Oct 28, 2024 08:36:03.176187992 CET	49705	443	192.168.2.6	173.222.162.64
Oct 28, 2024 08:36:03.219150066 CET	49727	443	192.168.2.6	142.251.116.105
Oct 28, 2024 08:36:03.219161034 CET	49728	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:03.219163895 CET	443	49727	142.251.116.105	192.168.2.6
Oct 28, 2024 08:36:03.262253046 CET	49727	443	192.168.2.6	142.251.116.105
Oct 28, 2024 08:36:03.417700052 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:03.417733908 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:03.417763948 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:03.417861938 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:03.417861938 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:03.417876959 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:03.417941093 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:03.536529064 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:03.536561966 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:03.536659002 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:03.536680937 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:03.536734104 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:03.536767960 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:03.555599928 CET	443	49728	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:03.555625916 CET	443	49728	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:03.555641890 CET	443	49728	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:03.555648088 CET	443	49728	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:03.555663109 CET	443	49728	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:03.555670977 CET	443	49728	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:03.555686951 CET	49728	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:03.555716991 CET	443	49728	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:03.555757999 CET	49728	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:03.555768967 CET	49728	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:03.655364990 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:03.655400038 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:03.655519962 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:03.655533075 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:03.655642986 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:03.655745029 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:03.661546946 CET	49734	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:03.661586046 CET	443	49734	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:03.661708117 CET	49734	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:03.662266970 CET	49734	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:03.662281990 CET	443	49734	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:03.670744896 CET	443	49728	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:03.670778036 CET	443	49728	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:03.670861006 CET	49728	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:03.670883894 CET	443	49728	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:03.670917988 CET	49728	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:03.670939922 CET	49728	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:03.671055079 CET	443	49728	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:03.671175003 CET	443	49728	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:03.671240091 CET	49728	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:03.671495914 CET	49728	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:03.671510935 CET	443	49728	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:03.681085110 CET	49735	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.681114912 CET	443	49735	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.681221008 CET	49735	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.681615114 CET	49736	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.681632042 CET	443	49736	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.681843996 CET	49736	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.682138920 CET	49737	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.682163954 CET	443	49737	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.682255030 CET	49737	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.682547092 CET	49738	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.682554007 CET	443	49738	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.682632923 CET	49738	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.682868004 CET	49739	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.682879925 CET	443	49739	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.682980061 CET	49739	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.683490038 CET	49739	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.683501959 CET	443	49739	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.683832884 CET	49738	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.683842897 CET	443	49738	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.684319973 CET	49737	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.684329033 CET	443	49737	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.684633017 CET	49736	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.684644938 CET	443	49736	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.684748888 CET	49735	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.684762955 CET	443	49735	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.696225882 CET	443	49737	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.696296930 CET	443	49736	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.696435928 CET	443	49735	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.697051048 CET	49740	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.697071075 CET	443	49740	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.697128057 CET	49740	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.697726965 CET	49741	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.697748899 CET	443	49741	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.697940111 CET	49741	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.698147058 CET	49741	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.698158026 CET	443	49741	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.698322058 CET	49740	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.698332071 CET	443	49740	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.698916912 CET	49742	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.698925018 CET	443	49742	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.699018955 CET	49742	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.699542999 CET	49742	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.699549913 CET	443	49742	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.706485987 CET	443	49738	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.706593990 CET	443	49739	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.706679106 CET	49739	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.706700087 CET	49738	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.706813097 CET	49739	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.706826925 CET	443	49739	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.707845926 CET	49743	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.707865953 CET	443	49743	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.707954884 CET	49743	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.708230019 CET	49738	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.708239079 CET	443	49738	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.710993052 CET	49744	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.711011887 CET	443	49744	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.711111069 CET	49744	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.711112022 CET	49743	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.711124897 CET	443	49743	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.711594105 CET	49744	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.711606026 CET	443	49744	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.712412119 CET	443	49740	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.712613106 CET	443	49742	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.725097895 CET	443	49741	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.725476980 CET	49741	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.725677013 CET	443	49743	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.726183891 CET	443	49744	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.740264893 CET	49741	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:03.740277052 CET	443	49741	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:03.774333000 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:03.774369001 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:03.774413109 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:03.774509907 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:03.774517059 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:03.774631977 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:03.892616987 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:03.892651081 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:03.892738104 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:03.892755985 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:03.892776966 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:03.892819881 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.011694908 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.011727095 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.011775970 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.011784077 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.011822939 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.011833906 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.135685921 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.135718107 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.135910988 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.135910988 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.135925055 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.136920929 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.198117018 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.198151112 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.198191881 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.198204994 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.198277950 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.299215078 CET	443	49734	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:04.301647902 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.301673889 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.301774025 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.301774025 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.301784039 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.301987886 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.333780050 CET	49734	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:04.333820105 CET	443	49734	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:04.334357977 CET	443	49734	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:04.348226070 CET	49734	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:04.348366976 CET	443	49734	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:04.348747015 CET	49734	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:04.348768950 CET	443	49734	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:04.373543978 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.373573065 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.373780012 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.373780012 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.373800039 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.374156952 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.608488083 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.608503103 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.608578920 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.608603954 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.608624935 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.608715057 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.608715057 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.608932018 CET	443	49734	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:04.609002113 CET	49734	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:04.609023094 CET	443	49734	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:04.609040976 CET	443	49734	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:04.609091043 CET	49734	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:04.609092951 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.609119892 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.609220982 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.609220982 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.609231949 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.609354973 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.610881090 CET	49734	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:04.610905886 CET	443	49734	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:04.698890924 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.698925018 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.699002981 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.699018955 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.699090004 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.705790997 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.705873966 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.705894947 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.705941916 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.706091881 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.706104994 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.706132889 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.706139088 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.762942076 CET	49745	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.762989998 CET	443	49745	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.763170958 CET	49746	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.763202906 CET	443	49746	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.763261080 CET	49746	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.763338089 CET	49745	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.764134884 CET	49745	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.764147043 CET	443	49745	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.764349937 CET	49746	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.764360905 CET	443	49746	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.766330957 CET	49747	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.766345024 CET	443	49747	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.766418934 CET	49747	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.766765118 CET	49747	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.766767979 CET	443	49747	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.767344952 CET	49748	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.767394066 CET	443	49748	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.767465115 CET	49748	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.768033981 CET	49748	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.768043995 CET	443	49748	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.768944025 CET	49749	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.768978119 CET	443	49749	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.769061089 CET	49749	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.769371033 CET	49749	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.769383907 CET	443	49749	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.776211977 CET	443	49745	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.776336908 CET	443	49746	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.776640892 CET	49751	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.776645899 CET	49750	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.776678085 CET	443	49751	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.776690960 CET	443	49750	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.776757002 CET	49751	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.776907921 CET	49750	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.777024031 CET	49750	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.777035952 CET	443	49750	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.777200937 CET	49751	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.777208090 CET	443	49751	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.787857056 CET	443	49747	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.788243055 CET	49752	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.788289070 CET	443	49752	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.788418055 CET	49752	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.788697004 CET	49752	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.788712978 CET	443	49752	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.799511909 CET	443	49749	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.799621105 CET	49749	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.801150084 CET	443	49752	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.802299976 CET	443	49750	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.802387953 CET	49750	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.802659035 CET	443	49751	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.802731037 CET	49751	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.808423996 CET	49751	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.808446884 CET	443	49751	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.808609009 CET	49749	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.808614969 CET	443	49749	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.808967113 CET	49753	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.808998108 CET	443	49753	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.809273958 CET	49753	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.841036081 CET	49750	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.841084957 CET	443	49750	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.856528997 CET	49753	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.856548071 CET	443	49753	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.883308887 CET	49756	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:04.883378983 CET	443	49756	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:04.883553982 CET	49756	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:04.884443045 CET	49757	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:04.884506941 CET	443	49757	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:04.885286093 CET	49757	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:04.961014032 CET	49757	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:04.961050987 CET	443	49757	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:04.961577892 CET	49756	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:04.961604118 CET	443	49756	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:04.965353012 CET	49759	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.965399981 CET	443	49759	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.965548992 CET	49759	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.966175079 CET	49759	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.966197014 CET	443	49759	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.968772888 CET	49760	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.968810081 CET	443	49760	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.968915939 CET	49760	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.972323895 CET	49761	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.972366095 CET	443	49761	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.972564936 CET	49761	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.972748995 CET	49760	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.972768068 CET	443	49760	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.972970009 CET	443	49757	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:04.973234892 CET	443	49756	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:04.976022959 CET	49762	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:04.976046085 CET	443	49762	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:04.976118088 CET	49762	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:04.976547956 CET	49763	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:04.976586103 CET	443	49763	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:04.976613045 CET	49762	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:04.976628065 CET	443	49762	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:04.976691961 CET	49763	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:04.976849079 CET	49763	443	192.168.2.6	52.222.214.58
Oct 28, 2024 08:36:04.976869106 CET	443	49763	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:04.977440119 CET	49761	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.977463007 CET	443	49761	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.990272045 CET	443	49762	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:04.991363049 CET	443	49763	52.222.214.58	192.168.2.6
Oct 28, 2024 08:36:04.991564989 CET	443	49761	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.991764069 CET	443	49759	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.991816998 CET	49759	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.995399952 CET	49764	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.995444059 CET	443	49764	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:04.995541096 CET	49764	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.995779037 CET	49759	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:04.995806932 CET	443	49759	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.012614965 CET	49765	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.012687922 CET	443	49765	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.012945890 CET	49765	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.019570112 CET	49766	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:05.019610882 CET	443	49766	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:05.019674063 CET	49766	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:05.020406961 CET	49766	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:05.020427942 CET	443	49766	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:05.021405935 CET	49764	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.021435022 CET	443	49764	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.021794081 CET	49765	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.021826982 CET	443	49765	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.033370018 CET	443	49764	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.041322947 CET	49767	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.041378021 CET	443	49767	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.041459084 CET	49767	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.042309046 CET	49767	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.042325020 CET	443	49767	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.054399967 CET	443	49767	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.055512905 CET	49768	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.055576086 CET	443	49768	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.055650949 CET	49768	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.056809902 CET	49768	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.056834936 CET	443	49768	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.068603992 CET	443	49768	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.073733091 CET	49769	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.073772907 CET	443	49769	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.074018002 CET	49769	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.074455976 CET	49769	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.074470997 CET	443	49769	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.386007071 CET	443	49748	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.387111902 CET	443	49748	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.387170076 CET	49748	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.413923979 CET	49748	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.413964987 CET	443	49748	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.415730953 CET	49770	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.415779114 CET	443	49770	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.415846109 CET	49770	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.449783087 CET	49770	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.449815989 CET	443	49770	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.589864016 CET	443	49753	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.589950085 CET	49753	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.634130955 CET	443	49765	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.635970116 CET	443	49765	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.636033058 CET	49765	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.730029106 CET	443	49760	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.730134964 CET	49760	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.771333933 CET	49753	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.771351099 CET	443	49753	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.771770000 CET	443	49753	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.796495914 CET	443	49766	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:05.812062979 CET	443	49769	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.812150955 CET	49769	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.824656010 CET	49753	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.840044022 CET	49766	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:05.906699896 CET	49766	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:05.906714916 CET	443	49766	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:05.907124996 CET	49753	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.908219099 CET	443	49766	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:05.924331903 CET	49766	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:05.924405098 CET	49769	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.924423933 CET	443	49769	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.924673080 CET	443	49766	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:05.924766064 CET	443	49769	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.927438021 CET	49766	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:05.927489042 CET	443	49766	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:05.935122967 CET	49769	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.936414003 CET	49765	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:05.936441898 CET	443	49765	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.951322079 CET	443	49753	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:05.979322910 CET	443	49769	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:06.007421970 CET	49760	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:06.007463932 CET	443	49760	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:06.007807016 CET	443	49760	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:06.009047031 CET	49760	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:06.033564091 CET	443	49753	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:06.033740044 CET	443	49753	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:06.033819914 CET	49753	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:06.051227093 CET	49753	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:06.051244974 CET	443	49753	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:06.051515102 CET	49753	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:06.051532030 CET	443	49753	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:06.055324078 CET	443	49760	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:06.062500000 CET	443	49769	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:06.062712908 CET	443	49769	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:06.062875986 CET	49769	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:06.064186096 CET	49769	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:06.064196110 CET	443	49769	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:06.079516888 CET	443	49766	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:06.079540968 CET	443	49766	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:06.079617977 CET	49766	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:06.079631090 CET	443	49766	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:06.079785109 CET	443	49766	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:06.079839945 CET	49766	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:06.106128931 CET	49766	443	192.168.2.6	13.248.165.67
Oct 28, 2024 08:36:06.106149912 CET	443	49766	13.248.165.67	192.168.2.6
Oct 28, 2024 08:36:06.136557102 CET	443	49760	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:06.136723995 CET	443	49760	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:06.136800051 CET	49760	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:06.142081022 CET	49760	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:06.142095089 CET	443	49760	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:06.196934938 CET	443	49770	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:06.197031975 CET	49770	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:06.214641094 CET	49770	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:06.214673996 CET	443	49770	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:06.214921951 CET	443	49770	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:06.220135927 CET	49770	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:06.263335943 CET	443	49770	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:06.355954885 CET	443	49770	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:06.355982065 CET	443	49770	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:06.356092930 CET	49770	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:06.356112003 CET	443	49770	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:06.356168985 CET	443	49770	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:06.356175900 CET	49770	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:06.356213093 CET	49770	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:06.356600046 CET	49771	443	192.168.2.6	76.223.42.213
Oct 28, 2024 08:36:06.356625080 CET	443	49771	76.223.42.213	192.168.2.6
Oct 28, 2024 08:36:06.356693029 CET	49771	443	192.168.2.6	76.223.42.213
Oct 28, 2024 08:36:06.356908083 CET	49771	443	192.168.2.6	76.223.42.213
Oct 28, 2024 08:36:06.356924057 CET	443	49771	76.223.42.213	192.168.2.6
Oct 28, 2024 08:36:06.357242107 CET	49770	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:06.357254028 CET	443	49770	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:06.357269049 CET	49770	443	192.168.2.6	13.107.246.60
Oct 28, 2024 08:36:06.357274055 CET	443	49770	13.107.246.60	192.168.2.6
Oct 28, 2024 08:36:06.368488073 CET	443	49771	76.223.42.213	192.168.2.6
Oct 28, 2024 08:36:06.368988037 CET	49772	443	192.168.2.6	76.223.42.213
Oct 28, 2024 08:36:06.369019985 CET	443	49772	76.223.42.213	192.168.2.6
Oct 28, 2024 08:36:06.369081974 CET	49772	443	192.168.2.6	76.223.42.213
Oct 28, 2024 08:36:06.369334936 CET	49773	443	192.168.2.6	76.223.42.213
Oct 28, 2024 08:36:06.369373083 CET	443	49773	76.223.42.213	192.168.2.6
Oct 28, 2024 08:36:06.369445086 CET	49773	443	192.168.2.6	76.223.42.213
Oct 28, 2024 08:36:06.369564056 CET	49772	443	192.168.2.6	76.223.42.213
Oct 28, 2024 08:36:06.369582891 CET	443	49772	76.223.42.213	192.168.2.6
Oct 28, 2024 08:36:06.369802952 CET	49773	443	192.168.2.6	76.223.42.213
Oct 28, 2024 08:36:06.369820118 CET	443	49773	76.223.42.213	192.168.2.6
Oct 28, 2024 08:36:06.381412029 CET	443	49772	76.223.42.213	192.168.2.6
Oct 28, 2024 08:36:07.004205942 CET	443	49773	76.223.42.213	192.168.2.6
Oct 28, 2024 08:36:07.004287004 CET	49773	443	192.168.2.6	76.223.42.213
Oct 28, 2024 08:36:07.004307032 CET	443	49773	76.223.42.213	192.168.2.6
Oct 28, 2024 08:36:07.006309032 CET	49773	443	192.168.2.6	76.223.42.213
Oct 28, 2024 08:36:07.006324053 CET	443	49773	76.223.42.213	192.168.2.6
Oct 28, 2024 08:36:07.152652025 CET	443	49773	76.223.42.213	192.168.2.6
Oct 28, 2024 08:36:07.200288057 CET	49773	443	192.168.2.6	76.223.42.213
Oct 28, 2024 08:36:12.635607958 CET	443	49727	142.251.116.105	192.168.2.6
Oct 28, 2024 08:36:12.635678053 CET	443	49727	142.251.116.105	192.168.2.6
Oct 28, 2024 08:36:12.635763884 CET	49727	443	192.168.2.6	142.251.116.105
Oct 28, 2024 08:36:14.005114079 CET	49727	443	192.168.2.6	142.251.116.105
Oct 28, 2024 08:36:14.005127907 CET	443	49727	142.251.116.105	192.168.2.6
Oct 28, 2024 08:36:52.154102087 CET	49773	443	192.168.2.6	76.223.42.213
Oct 28, 2024 08:36:52.154135942 CET	443	49773	76.223.42.213	192.168.2.6
Oct 28, 2024 08:37:01.534348011 CET	49780	443	192.168.2.6	142.251.116.105
Oct 28, 2024 08:37:01.534390926 CET	443	49780	142.251.116.105	192.168.2.6
Oct 28, 2024 08:37:01.534486055 CET	49780	443	192.168.2.6	142.251.116.105
Oct 28, 2024 08:37:01.534815073 CET	49780	443	192.168.2.6	142.251.116.105
Oct 28, 2024 08:37:01.534828901 CET	443	49780	142.251.116.105	192.168.2.6
Oct 28, 2024 08:37:02.622020006 CET	443	49780	142.251.116.105	192.168.2.6
Oct 28, 2024 08:37:02.622381926 CET	49780	443	192.168.2.6	142.251.116.105
Oct 28, 2024 08:37:02.622400045 CET	443	49780	142.251.116.105	192.168.2.6
Oct 28, 2024 08:37:02.622757912 CET	443	49780	142.251.116.105	192.168.2.6
Oct 28, 2024 08:37:02.623265982 CET	49780	443	192.168.2.6	142.251.116.105
Oct 28, 2024 08:37:02.623330116 CET	443	49780	142.251.116.105	192.168.2.6
Oct 28, 2024 08:37:02.669373989 CET	49780	443	192.168.2.6	142.251.116.105
Oct 28, 2024 08:37:07.986939907 CET	49773	443	192.168.2.6	76.223.42.213
Oct 28, 2024 08:37:07.987098932 CET	443	49773	76.223.42.213	192.168.2.6
Oct 28, 2024 08:37:07.987179041 CET	49773	443	192.168.2.6	76.223.42.213
Oct 28, 2024 08:37:12.228231907 CET	443	49780	142.251.116.105	192.168.2.6
Oct 28, 2024 08:37:12.228317976 CET	443	49780	142.251.116.105	192.168.2.6
Oct 28, 2024 08:37:12.228375912 CET	49780	443	192.168.2.6	142.251.116.105
Oct 28, 2024 08:37:12.254990101 CET	49780	443	192.168.2.6	142.251.116.105
Oct 28, 2024 08:37:12.255017042 CET	443	49780	142.251.116.105	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 08:35:57.543003082 CET	53	50089	1.1.1.1	192.168.2.6
Oct 28, 2024 08:35:57.732573032 CET	53	59121	1.1.1.1	192.168.2.6
Oct 28, 2024 08:35:59.130273104 CET	52895	53	192.168.2.6	1.1.1.1
Oct 28, 2024 08:35:59.130446911 CET	59673	53	192.168.2.6	1.1.1.1
Oct 28, 2024 08:35:59.672713995 CET	53	59673	1.1.1.1	192.168.2.6
Oct 28, 2024 08:35:59.942277908 CET	53	52895	1.1.1.1	192.168.2.6
Oct 28, 2024 08:36:00.997539043 CET	53	53858	1.1.1.1	192.168.2.6
Oct 28, 2024 08:36:01.128758907 CET	49657	53	192.168.2.6	1.1.1.1
Oct 28, 2024 08:36:01.129463911 CET	56701	53	192.168.2.6	1.1.1.1
Oct 28, 2024 08:36:01.137526035 CET	53	56701	1.1.1.1	192.168.2.6
Oct 28, 2024 08:36:01.137676954 CET	53	49657	1.1.1.1	192.168.2.6
Oct 28, 2024 08:36:01.495007992 CET	54047	53	192.168.2.6	1.1.1.1
Oct 28, 2024 08:36:01.495388985 CET	59319	53	192.168.2.6	1.1.1.1
Oct 28, 2024 08:36:01.502240896 CET	53	54047	1.1.1.1	192.168.2.6
Oct 28, 2024 08:36:01.502682924 CET	53	59319	1.1.1.1	192.168.2.6
Oct 28, 2024 08:36:02.037873983 CET	59256	53	192.168.2.6	1.1.1.1
Oct 28, 2024 08:36:02.038475037 CET	57583	53	192.168.2.6	1.1.1.1
Oct 28, 2024 08:36:02.280550003 CET	53	57583	1.1.1.1	192.168.2.6
Oct 28, 2024 08:36:02.291104078 CET	53	59256	1.1.1.1	192.168.2.6
Oct 28, 2024 08:36:03.660414934 CET	64561	53	192.168.2.6	1.1.1.1
Oct 28, 2024 08:36:03.660609007 CET	53411	53	192.168.2.6	1.1.1.1
Oct 28, 2024 08:36:03.667853117 CET	53	64561	1.1.1.1	192.168.2.6
Oct 28, 2024 08:36:03.680129051 CET	53	53411	1.1.1.1	192.168.2.6
Oct 28, 2024 08:36:06.115940094 CET	52925	53	192.168.2.6	1.1.1.1
Oct 28, 2024 08:36:06.116450071 CET	54260	53	192.168.2.6	1.1.1.1
Oct 28, 2024 08:36:06.124991894 CET	53	54260	1.1.1.1	192.168.2.6
Oct 28, 2024 08:36:06.355864048 CET	53	52925	1.1.1.1	192.168.2.6
Oct 28, 2024 08:36:18.022429943 CET	53	51995	1.1.1.1	192.168.2.6
Oct 28, 2024 08:36:37.005650997 CET	53	54301	1.1.1.1	192.168.2.6
Oct 28, 2024 08:36:57.034722090 CET	53	58845	1.1.1.1	192.168.2.6
Oct 28, 2024 08:36:59.428126097 CET	53	61929	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 08:35:59.130273104 CET	192.168.2.6	1.1.1.1	0x5d93	Standard query (0)	ithelpdesk.automationanywhere.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:35:59.130446911 CET	192.168.2.6	1.1.1.1	0xe228	Standard query (0)	ithelpdesk.automationanywhere.com	65	IN (0x0001)	false
Oct 28, 2024 08:36:01.128758907 CET	192.168.2.6	1.1.1.1	0xa90a	Standard query (0)	accounts.zoho.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:36:01.129463911 CET	192.168.2.6	1.1.1.1	0x44bc	Standard query (0)	accounts.zoho.com	65	IN (0x0001)	false
Oct 28, 2024 08:36:01.495007992 CET	192.168.2.6	1.1.1.1	0x4d50	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:36:01.495388985 CET	192.168.2.6	1.1.1.1	0xcdb6	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 28, 2024 08:36:02.037873983 CET	192.168.2.6	1.1.1.1	0x1fa5	Standard query (0)	automationanywhere.okta.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:36:02.038475037 CET	192.168.2.6	1.1.1.1	0x4079	Standard query (0)	automationanywhere.okta.com	65	IN (0x0001)	false
Oct 28, 2024 08:36:03.660414934 CET	192.168.2.6	1.1.1.1	0xa3b6	Standard query (0)	ok6static.oktacdn.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:36:03.660609007 CET	192.168.2.6	1.1.1.1	0xb90b	Standard query (0)	ok6static.oktacdn.com	65	IN (0x0001)	false
Oct 28, 2024 08:36:06.115940094 CET	192.168.2.6	1.1.1.1	0x6661	Standard query (0)	automationanywhere.okta.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:36:06.116450071 CET	192.168.2.6	1.1.1.1	0x41d5	Standard query (0)	automationanywhere.okta.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 08:35:59.672713995 CET	1.1.1.1	192.168.2.6	0xe228	No error (0)	ithelpdesk.automationanywhere.com	customer-sdpondemand.manageuser.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 08:35:59.672713995 CET	1.1.1.1	192.168.2.6	0xe228	No error (0)	customer-sdpondemand.manageuser.com	csdp.manageuser.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 08:35:59.942277908 CET	1.1.1.1	192.168.2.6	0x5d93	No error (0)	ithelpdesk.automationanywhere.com	customer-sdpondemand.manageuser.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 08:35:59.942277908 CET	1.1.1.1	192.168.2.6	0x5d93	No error (0)	customer-sdpondemand.manageuser.com	csdp.manageuser.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 08:35:59.942277908 CET	1.1.1.1	192.168.2.6	0x5d93	No error (0)	csdp.manageuser.com		204.141.42.199	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:36:01.137676954 CET	1.1.1.1	192.168.2.6	0xa90a	No error (0)	accounts.zoho.com		204.141.42.100	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:36:01.502682924 CET	1.1.1.1	192.168.2.6	0xcdb6	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 28, 2024 08:36:02.113818884 CET	1.1.1.1	192.168.2.6	0x9a98	No error (0)	www.google.com		142.251.116.105	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:36:02.113818884 CET	1.1.1.1	192.168.2.6	0x9a98	No error (0)	www.google.com		142.251.116.106	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:36:02.113818884 CET	1.1.1.1	192.168.2.6	0x9a98	No error (0)	www.google.com		142.251.116.104	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:36:02.113818884 CET	1.1.1.1	192.168.2.6	0x9a98	No error (0)	www.google.com		142.251.116.147	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:36:02.113818884 CET	1.1.1.1	192.168.2.6	0x9a98	No error (0)	www.google.com		142.251.116.103	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:36:02.113818884 CET	1.1.1.1	192.168.2.6	0x9a98	No error (0)	www.google.com		142.251.116.99	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:36:02.280550003 CET	1.1.1.1	192.168.2.6	0x4079	No error (0)	automationanywhere.okta.com	ok6-crtrs.tng.okta.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 08:36:02.280550003 CET	1.1.1.1	192.168.2.6	0x4079	No error (0)	ok6-crtrs.tng.okta.com	ok6-crtrs.oktaedge.okta.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 08:36:02.280550003 CET	1.1.1.1	192.168.2.6	0x4079	No error (0)	ok6-crtrs.oktaedge.okta.com	ae52e19d4a7095f43.awsglobalaccelerator.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 08:36:02.291104078 CET	1.1.1.1	192.168.2.6	0x1fa5	No error (0)	automationanywhere.okta.com	ok6-crtrs.tng.okta.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 08:36:02.291104078 CET	1.1.1.1	192.168.2.6	0x1fa5	No error (0)	ok6-crtrs.tng.okta.com	ok6-crtrs.oktaedge.okta.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 08:36:02.291104078 CET	1.1.1.1	192.168.2.6	0x1fa5	No error (0)	ok6-crtrs.oktaedge.okta.com	ae52e19d4a7095f43.awsglobalaccelerator.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 08:36:02.291104078 CET	1.1.1.1	192.168.2.6	0x1fa5	No error (0)	ae52e19d4a7095f43.awsglobalaccelerator.com		13.248.165.67	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:36:02.291104078 CET	1.1.1.1	192.168.2.6	0x1fa5	No error (0)	ae52e19d4a7095f43.awsglobalaccelerator.com		76.223.42.213	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:36:03.667853117 CET	1.1.1.1	192.168.2.6	0xa3b6	No error (0)	ok6static.oktacdn.com	dpxbp5vi8wz3w.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 08:36:03.667853117 CET	1.1.1.1	192.168.2.6	0xa3b6	No error (0)	dpxbp5vi8wz3w.cloudfront.net		52.222.214.58	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:36:03.667853117 CET	1.1.1.1	192.168.2.6	0xa3b6	No error (0)	dpxbp5vi8wz3w.cloudfront.net		52.222.214.26	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:36:03.667853117 CET	1.1.1.1	192.168.2.6	0xa3b6	No error (0)	dpxbp5vi8wz3w.cloudfront.net		52.222.214.124	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:36:03.667853117 CET	1.1.1.1	192.168.2.6	0xa3b6	No error (0)	dpxbp5vi8wz3w.cloudfront.net		52.222.214.99	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:36:03.680129051 CET	1.1.1.1	192.168.2.6	0xb90b	No error (0)	ok6static.oktacdn.com	dpxbp5vi8wz3w.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 08:36:06.124991894 CET	1.1.1.1	192.168.2.6	0x41d5	No error (0)	automationanywhere.okta.com	ok6-crtrs.tng.okta.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 08:36:06.124991894 CET	1.1.1.1	192.168.2.6	0x41d5	No error (0)	ok6-crtrs.tng.okta.com	ok6-crtrs.oktaedge.okta.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 08:36:06.124991894 CET	1.1.1.1	192.168.2.6	0x41d5	No error (0)	ok6-crtrs.oktaedge.okta.com	ae52e19d4a7095f43.awsglobalaccelerator.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 08:36:06.355864048 CET	1.1.1.1	192.168.2.6	0x6661	No error (0)	automationanywhere.okta.com	ok6-crtrs.tng.okta.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 08:36:06.355864048 CET	1.1.1.1	192.168.2.6	0x6661	No error (0)	ok6-crtrs.tng.okta.com	ok6-crtrs.oktaedge.okta.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 08:36:06.355864048 CET	1.1.1.1	192.168.2.6	0x6661	No error (0)	ok6-crtrs.oktaedge.okta.com	ae52e19d4a7095f43.awsglobalaccelerator.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 08:36:06.355864048 CET	1.1.1.1	192.168.2.6	0x6661	No error (0)	ae52e19d4a7095f43.awsglobalaccelerator.com		76.223.42.213	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:36:06.355864048 CET	1.1.1.1	192.168.2.6	0x6661	No error (0)	ae52e19d4a7095f43.awsglobalaccelerator.com		13.248.165.67	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:36:13.447606087 CET	1.1.1.1	192.168.2.6	0x3fe1	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 08:36:13.447606087 CET	1.1.1.1	192.168.2.6	0x3fe1	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:36:14.735183954 CET	1.1.1.1	192.168.2.6	0xceac	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:36:14.735183954 CET	1.1.1.1	192.168.2.6	0xceac	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:36:52.069540024 CET	1.1.1.1	192.168.2.6	0x21d2	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:36:52.069540024 CET	1.1.1.1	192.168.2.6	0x21d2	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:37:10.537375927 CET	1.1.1.1	192.168.2.6	0xcf15	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:37:10.537375927 CET	1.1.1.1	192.168.2.6	0xcf15	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ithelpdesk.automationanywhere.com

accounts.zoho.com

otelrules.azureedge.net

automationanywhere.okta.com

https:

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Oct 28, 2024 08:36:07.004307032 CET	76.223.42.213	443	192.168.2.6	49773	CN=*.okta.com, O="Okta, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Feb 12 01:00:00 CET 2024 Wed Apr 14 02:00:00 CEST 2021	Sat Mar 15 00:59:59 CET 2025 Mon Apr 14 01:59:59 CEST 2031	771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-5-51-16-27-0-45-65281-23-17513-10-11-65037-43-18,29-23-24,0	645d580e25d6fe6fa34fe1950adf9c6b
Oct 28, 2024 08:36:07.004307032 CET	76.223.42.213	443	192.168.2.6	49773	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Apr 14 02:00:00 CEST 2021	Mon Apr 14 01:59:59 CEST 2031		645d580e25d6fe6fa34fe1950adf9c6b

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49722	204.141.42.199	443	4996	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:36:00 UTC	724	OUT	GET /app/itdesk/ui/requests/27746000065200260/details HTTP/1.1 Host: ithelpdesk.automationanywhere.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 07:36:00 UTC	739	IN	HTTP/1.1 302 Server: ZGS Date: Mon, 28 Oct 2024 07:36:00 GMT Content-Length: 0 Connection: close Set-Cookie: zalb_6bc9ae5955=8ffc757add8670d4be8660e2f5588b6e; Path=/; Secure; HttpOnly X-Content-Type-Options: nosniff Set-Cookie: sdpcscook=86188593-62bd-491c-b54e-1f56c1bcc4e6;path=/;SameSite=None;Secure;priority=high Set-Cookie: _zcsr_tmp=86188593-62bd-491c-b54e-1f56c1bcc4e6;path=/;SameSite=Strict;Secure;priority=high Cache-Control: private,no-cache,no-store,max-age=0,must-revalidate Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Location: https://ithelpdesk.automationanywhere.com/Login.jsp?serviceurl=%2Fapp%2Fitdesk%2Fui%2Frequests%2F27746000065200260%2Fdetails Strict-Transport-Security: max-age=63072000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49721	204.141.42.199	443	4996	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:36:00 UTC	912	OUT	GET /Login.jsp?serviceurl=%2Fapp%2Fitdesk%2Fui%2Frequests%2F27746000065200260%2Fdetails HTTP/1.1 Host: ithelpdesk.automationanywhere.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: zalb_6bc9ae5955=8ffc757add8670d4be8660e2f5588b6e; sdpcscook=86188593-62bd-491c-b54e-1f56c1bcc4e6; _zcsr_tmp=86188593-62bd-491c-b54e-1f56c1bcc4e6
2024-10-28 07:36:01 UTC	632	IN	HTTP/1.1 302 Server: ZGS Date: Mon, 28 Oct 2024 07:36:00 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 0 Connection: close X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-SDPOD-Version: 1955 Set-Cookie: JSESSIONID=F8BC5B6FDA87BACB0319D4DFAB00ABE2; Path=/; Secure; HttpOnly LOGIN_PAGE_URL: /HomePage.do Location: https://accounts.zoho.com/samlauthrequest/630778920?serviceurl=https%3A%2F%2Fithelpdesk.automationanywhere.com%2Fapp%2Fitdesk%2Fui%2Frequests%2F27746000065200260%2Fdetails&servicename=SDPOnDemand&portal_id=630778920&hide_signup=false Strict-Transport-Security: max-age=63072000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49725	204.141.42.100	443	4996	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:36:01 UTC	867	OUT	GET /samlauthrequest/630778920?serviceurl=https%3A%2F%2Fithelpdesk.automationanywhere.com%2Fapp%2Fitdesk%2Fui%2Frequests%2F27746000065200260%2Fdetails&servicename=SDPOnDemand&portal_id=630778920&hide_signup=false HTTP/1.1 Host: accounts.zoho.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 07:36:02 UTC	1693	IN	HTTP/1.1 302 Server: ZGS Date: Mon, 28 Oct 2024 07:36:01 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: zalb_e188bc05fe=4d6e62173a764ac5410d1192f41034cd; Path=/; Secure; HttpOnly X-Content-Type-Options: nosniff Set-Cookie: iamcsr=13e44fc8-fa5c-4a38-87c8-82d3a6e07f00;path=/;SameSite=None;Secure;priority=high Set-Cookie: _zcsr_tmp=13e44fc8-fa5c-4a38-87c8-82d3a6e07f00;path=/;SameSite=Strict;Secure;priority=high Cache-Control: private,no-cache,no-store,max-age=0,must-revalidate Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT X-Frame-Options: SAMEORIGIN P3P: CP="CAO PSA OUR" Set-Cookie: _scp_tmp=; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:01 GMT; Path=/; Secure; SameSite=None Location: https://automationanywhere.okta.com/app/automationanywhere_ithelpdesk_1/exk3ez7zehmk8x48s2p7/sso/saml?SAMLRequest=fVLLbtswEPwVgXdLpCxbFmEZUGMUNZC2Ruz2kIvBSKuKsESqXMpx%2FPWlmCYwkMd1Zndmdsgliq7teTHYRt3B3wHQBueuVcg9kZPBKK4FSuRKdIDclnxXfL%2FlcUh5b7TVpW5JsFnn5JCy2Yxm85omGU2qmi4qqJL5dJY9sCSrU8bSKWWUkuA3GJRa5cSJuF3EATYKrVDWQTROJoxO4sWepnw655SFWRLfk%2BCrNiX4oDmpRYswrm4FojzBK7L9H%2BmLVJVUfz7P%2F%2FA8hPzbfr%2BdbH%2Fu9iQoEMFYl%2B5GKxw6MDswJ1nCr7vbnDTW9sijSJSlHpTF8KIbHZa6i8a2DGDvliASg9WdGEWEenpswMA4Q4K1a1cqT1xpvR3WRyu8quj7d%2FiDtA20fQV4PLAIzscpXNILNN1xcU4WGPdphKh9JF%2FISVZgfrjrc3Lv8pLVcqS4791cvfbnZYmXYsjq5epldCX0rNrz0Wiz3upWlk9B0bb68caAsM7cmgH8M7pzPvZiIfOIrCa1H%2BXQCdkWVeX6RRc%2BeuvzCl7%2F49U%2F&RelayState=aHR0cHM6Ly9pdGhlbHBkZXNrLmF1dG9tYXRpb25hbnl3aGVyZS5jb20vYXBwL2l0ZGVzay91aS9yZXF1ZXN0cy8yNzc0NjAwMDA2NTIwMDI2MC9kZXRhaWxzX19JQU1fX1NEUE9uRGVtYW5kX19JQU1fX19fSUFNX19mYWxzZV9fSUFNX18%3D Strict-Transport-Security: max-age=63072000

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49730	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:36:03 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:36:03 UTC	568	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:36:03 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Sun, 27 Oct 2024 10:35:44 GMT ETag: "0x8DCF6731CF80310" x-ms-request-id: 89d6c6b8-201e-0033-2798-28b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T073603Z-15b8d89586fdmfsg1u7xrpfws000000008y0000000005qyf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-28 07:36:03 UTC	15816	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-28 07:36:03 UTC	16384	IN	Data Raw: 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 Data Ascii: <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L>
2024-10-28 07:36:03 UTC	16384	IN	Data Raw: 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 Data Ascii: > <S T="3" /> </T> <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-776
2024-10-28 07:36:03 UTC	16384	IN	Data Raw: 22 4d 61 78 45 76 65 6e 74 73 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e Data Ascii: "MaxEvents" /> </C> <C T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Coun
2024-10-28 07:36:03 UTC	16384	IN	Data Raw: 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: /F> </S> <C T="U32" I="0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T
2024-10-28 07:36:04 UTC	16384	IN	Data Raw: 65 72 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 Data Ascii: er_Null_Count"> <C> <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C>
2024-10-28 07:36:04 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <
2024-10-28 07:36:04 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f Data Ascii: /> </L> <R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O
2024-10-28 07:36:04 UTC	16384	IN	Data Raw: 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 Data Ascii: "false" T="B" /> </R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" />
2024-10-28 07:36:04 UTC	16384	IN	Data Raw: 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 Data Ascii: </O> </F> <F T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49728	13.248.165.67	443	4996	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:36:03 UTC	1520	OUT	GET /app/automationanywhere_ithelpdesk_1/exk3ez7zehmk8x48s2p7/sso/saml?SAMLRequest=fVLLbtswEPwVgXdLpCxbFmEZUGMUNZC2Ruz2kIvBSKuKsESqXMpx%2FPWlmCYwkMd1Zndmdsgliq7teTHYRt3B3wHQBueuVcg9kZPBKK4FSuRKdIDclnxXfL%2FlcUh5b7TVpW5JsFnn5JCy2Yxm85omGU2qmi4qqJL5dJY9sCSrU8bSKWWUkuA3GJRa5cSJuF3EATYKrVDWQTROJoxO4sWepnw655SFWRLfk%2BCrNiX4oDmpRYswrm4FojzBK7L9H%2BmLVJVUfz7P%2F%2FA8hPzbfr%2BdbH%2Fu9iQoEMFYl%2B5GKxw6MDswJ1nCr7vbnDTW9sijSJSlHpTF8KIbHZa6i8a2DGDvliASg9WdGEWEenpswMA4Q4K1a1cqT1xpvR3WRyu8quj7d%2FiDtA20fQV4PLAIzscpXNILNN1xcU4WGPdphKh9JF%2FISVZgfrjrc3Lv8pLVcqS4791cvfbnZYmXYsjq5epldCX0rNrz0Wiz3upWlk9B0bb68caAsM7cmgH8M7pzPvZiIfOIrCa1H%2BXQCdkWVeX6RRc%2BeuvzCl7%2F49U%2F&RelayState=aHR0cHM6Ly9pdGhlbHBkZXNrLmF1dG9tYXRpb25hbnl3aGVyZS5jb20vYXBwL2l0ZGVzay91aS9yZXF1ZXN0cy8yNzc0NjAwMDA2NTIwMDI2MC9kZXRhaWxzX19JQU1fX1NEUE9uRGVtYW5kX19JQU1fX19fSUFNX19mYWxzZV9fSUFNX18%3D HTTP/1.1 Host: automationanywhere.okta.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 07:36:03 UTC	4500	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:36:03 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Server: nginx Vary: Accept-Encoding x-okta-request-id: 1ea47a46299eb49e80102ec2ba436b4a x-xss-protection: 0 p3p: CP="HONK" set-cookie: xids="";Version=1;Path=/;Max-Age=0 content-security-policy-report-only: default-src 'self' automationanywhere.okta.com .oktacdn.com; connect-src 'self' automationanywhere.okta.com automationanywhere-admin.okta.com .oktacdn.com .mixpanel.com .mapbox.com .mtls.okta.com automationanywhere.kerberos.okta.com .authenticatorlocalprod.com:8769 http://localhost:8769 http://127.0.0.1:8769 .authenticatorlocalprod.com:65111 http://localhost:65111 http://127.0.0.1:65111 .authenticatorlocalprod.com:65121 http://localhost:65121 http://127.0.0.1:65121 .authenticatorlocalprod.com:65131 http://localhost:65131 http://127.0.0.1:65131 .authenticatorlocalprod.com:65141 http://localhost:65141 http://127.0.0.1:65141 .authenticatorlocalprod.com:65151 http://localhost:65151 http://127.0.0.1:65151 https://oinmanager.okta.com data: data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com; script-src 'unsafe-inline' 'nonce-Rqo9lD4yMtv0fwPL91bCzw' 'unsafe-eval' 'self' 'report-sample' automationanywhe [TRUNCATED] content-security-policy: default-src 'self' automationanywhere.okta.com .oktacdn.com; connect-src 'self' automationanywhere.okta.com automationanywhere-admin.okta.com .oktacdn.com .mixpanel.com .mapbox.com .mtls.okta.com automationanywhere.kerberos.okta.com .authenticatorlocalprod.com:8769 http://localhost:8769 http://127.0.0.1:8769 .authenticatorlocalprod.com:65111 http://localhost:65111 http://127.0.0.1:65111 .authenticatorlocalprod.com:65121 http://localhost:65121 http://127.0.0.1:65121 .authenticatorlocalprod.com:65131 http://localhost:65131 http://127.0.0.1:65131 .authenticatorlocalprod.com:65141 http://localhost:65141 http://127.0.0.1:65141 .authenticatorlocalprod.com:65151 http://localhost:65151 http://127.0.0.1:65151 https://oinmanager.okta.com data: data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com; script-src 'unsafe-inline' 'unsafe-eval' 'self' 'report-sample' automationanywhere.okta.com *.oktacdn.com; style-src 'unsaf [TRUNCATED] x-rate-limit-limit: 750 x-rate-limit-remaining: 749 x-rate-limit-reset: 1730101023 referrer-policy: strict-origin-when-cross-origin accept-ch: Sec-CH-UA-Platform-Version cache-control: no-cache, no-store pragma: no-cache expires: 0 set-cookie: sid="";Version=1;Path=/;Max-Age=0 set-cookie: autolaunch_triggered=""; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/ set-cookie: activate_ca_modal_triggered=""; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/ set-cookie: JSESSIONID=FDA37EE175411A44AC964E71264A30E0; Path=/; Secure; HttpOnly set-cookie: t=""; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/ set-cookie: DT=DI1xilJgciFQtiXvrCZ_ut5jw;Version=1;Path=/;Max-Age=63072000;Secure;Expires=Wed, 28 Oct 2026 07:36:03 GMT;HttpOnly;SameSite=None x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-ua-compatible: IE=edge content-language: en Strict-Transport-Security: max-age=315360000; includeSubDomains X-Robots-Tag: noindex,nofollow
2024-10-28 07:36:03 UTC	11881	IN	Data Raw: 32 65 36 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 6c 74 2d 69 65 31 30 20 6c 74 2d 69 65 39 20 6c 74 2d 69 65 38 22 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 6c 74 2d 69 65 31 30 20 6c 74 2d 69 65 39 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 5d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 6c 74 2d 69 65 31 30 22 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 39 5d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c Data Ascii: 2e61<!DOCTYPE html>...[if IE 7]><html lang="en" class="lt-ie10 lt-ie9 lt-ie8"><![endif]-->...[if IE 8]><html lang="en" class="lt-ie10 lt-ie9"> <![endif]-->...[if IE 9]><html lang="en" class="lt-ie10"><![endif]-->...[if gt IE 9]><html lang="en"><
2024-10-28 07:36:03 UTC	16384	IN	Data Raw: 34 35 35 31 0d 0a 4e 64 6b 64 43 68 53 38 47 69 74 49 79 52 5a 39 58 34 6e 39 35 6a 65 4c 6f 4f 37 35 6d 30 4b 57 6a 52 71 5a 34 38 51 37 56 35 4e 50 37 35 6c 41 77 6d 5f 66 4a 70 70 7a 34 64 69 5f 35 7a 4f 77 70 32 41 55 5a 66 39 57 52 56 78 58 70 39 4f 35 45 68 6e 67 6c 47 61 61 49 4d 52 75 39 5c 78 32 44 63 6f 72 64 62 31 53 6a 65 47 53 51 49 71 62 5a 4f 34 49 5a 67 35 63 4a 6e 47 41 48 6c 74 76 36 56 45 75 46 55 55 4c 4a 71 6b 56 53 47 77 45 70 31 49 52 46 4c 73 30 35 54 4b 71 71 6b 69 4d 38 69 6b 71 54 33 76 5f 6d 72 4d 65 47 45 70 4b 49 35 42 65 66 32 69 70 57 6a 6e 68 6c 48 75 42 4a 30 71 59 4d 51 66 4b 4e 5a 57 37 50 77 62 66 54 46 75 70 53 39 39 6f 79 39 35 72 4c 65 65 61 49 34 34 73 37 62 45 54 31 39 79 36 31 6a 6c 69 45 55 39 5f 7a 4f 4c 4f 35 Data Ascii: 4551NdkdChS8GitIyRZ9X4n95jeLoO75m0KWjRqZ48Q7V5NP75lAwm_fJppz4di_5zOwp2AUZf9WRVxXp9O5EhnglGaaIMRu9\x2Dcordb1SjeGSQIqbZO4IZg5cJnGAHltv6VEuFUULJqkVSGwEp1IRFLs05TKqqkiM8ikqT3v_mrMeGEpKI5Bef2ipWjnhlHuBJ0qYMQfKNZW7PwbfTFupS99oy95rLeeaI44s7bET19y61jliEU9_zOLO5
2024-10-28 07:36:03 UTC	1369	IN	Data Raw: 74 74 70 73 3f 3a 5c 2f 5c 2f 2f 69 3b 0a 20 20 20 20 72 65 74 75 72 6e 20 70 61 74 2e 74 65 73 74 28 75 72 69 29 3b 0a 20 20 7d 0a 0a 20 20 76 61 72 20 75 6e 73 75 70 70 6f 72 74 65 64 43 6f 6e 74 61 69 6e 65 72 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 6f 6b 74 61 2d 73 69 67 6e 2d 69 6e 27 29 3b 0a 0a 20 20 76 61 72 20 66 61 69 6c 49 66 43 6f 6f 6b 69 65 73 44 69 73 61 62 6c 65 64 20 3d 20 74 72 75 65 3b 0a 20 20 0a 0a 20 20 2f 2f 20 4f 6c 64 20 76 65 72 73 69 6f 6e 73 20 6f 66 20 57 65 62 42 72 6f 77 73 65 72 20 43 6f 6e 74 72 6f 6c 73 20 28 73 70 65 63 69 66 69 63 61 6c 6c 79 2c 20 4f 6e 65 44 72 69 76 65 29 20 72 65 6e 64 65 72 20 69 6e 20 49 45 37 20 62 72 6f 77 73 65 72 0a 20 20 2f 2f 20 6d 6f 64 65 2c 20 Data Ascii: ttps?:\/\//i; return pat.test(uri); } var unsupportedContainer = document.getElementById('okta-sign-in'); var failIfCookiesDisabled = true; // Old versions of WebBrowser Controls (specifically, OneDrive) render in IE7 browser // mode,
2024-10-28 07:36:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49734	13.248.165.67	443	4996	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:36:04 UTC	1684	OUT	GET /api/internal/brand/theme/style-sheet?touch-point=SIGN_IN_PAGE&v=abc4780733b2999dc5536ea4bf18a7237d32beafe91e2f7611b8af3ecb8ae0d0dfb208992a3b1ecefd0c0f9333f4b59d HTTP/1.1 Host: automationanywhere.okta.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://automationanywhere.okta.com/app/automationanywhere_ithelpdesk_1/exk3ez7zehmk8x48s2p7/sso/saml?SAMLRequest=fVLLbtswEPwVgXdLpCxbFmEZUGMUNZC2Ruz2kIvBSKuKsESqXMpx%2FPWlmCYwkMd1Zndmdsgliq7teTHYRt3B3wHQBueuVcg9kZPBKK4FSuRKdIDclnxXfL%2FlcUh5b7TVpW5JsFnn5JCy2Yxm85omGU2qmi4qqJL5dJY9sCSrU8bSKWWUkuA3GJRa5cSJuF3EATYKrVDWQTROJoxO4sWepnw655SFWRLfk%2BCrNiX4oDmpRYswrm4FojzBK7L9H%2BmLVJVUfz7P%2F%2FA8hPzbfr%2BdbH%2Fu9iQoEMFYl%2B5GKxw6MDswJ1nCr7vbnDTW9sijSJSlHpTF8KIbHZa6i8a2DGDvliASg9WdGEWEenpswMA4Q4K1a1cqT1xpvR3WRyu8quj7d%2FiDtA20fQV4PLAIzscpXNILNN1xcU4WGPdphKh9JF%2FISVZgfrjrc3Lv8pLVcqS4791cvfbnZYmXYsjq5epldCX0rNrz0Wiz3upWlk9B0bb68caAsM7cmgH8M7pzPvZiIfOIrCa1H%2BXQCdkWVeX6RRc%2BeuvzCl7%2F49U%2F&RelayState=aHR0cHM6Ly9pdGhlbHBkZXNrLmF1dG9tYXRpb25hbnl3aGVyZS5jb20vYXBwL2l0ZGVzay91aS9yZXF1ZXN0cy8yNzc0NjAwMDA2NTIwMDI2MC9kZXRhaWxzX19JQU1fX1NEUE9uRGVtYW5kX19JQU1fX19fSUFNX19mYWxzZV9fSUFNX18%3D Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=FDA37EE175411A44AC964E71264A30E0; DT=DI1xilJgciFQtiXvrCZ_ut5jw
2024-10-28 07:36:04 UTC	2555	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:36:04 GMT Content-Type: text/css Content-Length: 556 Connection: close Server: nginx Vary: Accept-Encoding x-okta-request-id: 0f94120e90f7366212150bd47fcc2ca5 x-xss-protection: 0 p3p: CP="HONK" set-cookie: sid="";Version=1;Path=/;Max-Age=0 set-cookie: xids="";Version=1;Path=/;Max-Age=0 set-cookie: autolaunch_triggered=""; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/ set-cookie: activate_ca_modal_triggered=""; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/ content-security-policy: default-src 'self' automationanywhere.okta.com .oktacdn.com; connect-src 'self' automationanywhere.okta.com automationanywhere-admin.okta.com .oktacdn.com .mixpanel.com .mapbox.com .mtls.okta.com automationanywhere.kerberos.okta.com .authenticatorlocalprod.com:8769 http://localhost:8769 http://127.0.0.1:8769 .authenticatorlocalprod.com:65111 http://localhost:65111 http://127.0.0.1:65111 .authenticatorlocalprod.com:65121 http://localhost:65121 http://127.0.0.1:65121 .authenticatorlocalprod.com:65131 http://localhost:65131 http://127.0.0.1:65131 .authenticatorlocalprod.com:65141 http://localhost:65141 http://127.0.0.1:65141 .authenticatorlocalprod.com:65151 http://localhost:65151 http://127.0.0.1:65151 https://oinmanager.okta.com data: data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com; script-src 'unsafe-inline' 'unsafe-eval' 'self' 'report-sample' automationanywhere.okta.com .oktacdn.com; style-src 'unsaf [TRUNCATED] x-rate-limit-limit: 2400 x-rate-limit-remaining: 2394 x-rate-limit-reset: 1730100971 set-cookie: JSESSIONID=A7CDE4AA7CA38E344464BACCD7A20BB9; Path=/; Secure; HttpOnly referrer-policy: strict-origin-when-cross-origin accept-ch: Sec-CH-UA-Platform-Version cache-control: max-age=31536000, must-revalidate expires: Tue, 28 Oct 2025 07:36:04 GMT x-content-type-options: nosniff Strict-Transport-Security: max-age=315360000; includeSubDomains
2024-10-28 07:36:04 UTC	556	IN	Data Raw: 2e 74 62 2d 2d 62 61 63 6b 67 72 6f 75 6e 64 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 65 62 65 62 65 64 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 7d 0a 2e 74 62 2d 2d 62 75 74 74 6f 6e 2c 0a 2e 62 75 74 74 6f 6e 2d 70 72 69 6d 61 72 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 31 36 36 32 64 64 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 31 36 36 32 64 64 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 7d 0a 2e 74 62 2d 2d 62 75 74 74 6f 6e 3a 68 6f 76 65 72 2c 0a 2e 62 75 74 74 6f 6e 2d 70 72 69 6d 61 72 79 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: .tb--background { background-color: #ebebed !important;}.tb--button,.button-primary { background: #1662dd !important; border-color: #1662dd !important; color: #ffffff !important;}.tb--button:hover,.button-primary:hover {

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49753	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:36:05 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:36:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:36:05 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 11ae3112-301e-005d-596b-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T073605Z-16849878b78qf2gleqhwczd21s000000050g000000000swz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:36:06 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49766	13.248.165.67	443	4996	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:36:05 UTC	1581	OUT	GET /favicon.ico HTTP/1.1 Host: automationanywhere.okta.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://automationanywhere.okta.com/app/automationanywhere_ithelpdesk_1/exk3ez7zehmk8x48s2p7/sso/saml?SAMLRequest=fVLLbtswEPwVgXdLpCxbFmEZUGMUNZC2Ruz2kIvBSKuKsESqXMpx%2FPWlmCYwkMd1Zndmdsgliq7teTHYRt3B3wHQBueuVcg9kZPBKK4FSuRKdIDclnxXfL%2FlcUh5b7TVpW5JsFnn5JCy2Yxm85omGU2qmi4qqJL5dJY9sCSrU8bSKWWUkuA3GJRa5cSJuF3EATYKrVDWQTROJoxO4sWepnw655SFWRLfk%2BCrNiX4oDmpRYswrm4FojzBK7L9H%2BmLVJVUfz7P%2F%2FA8hPzbfr%2BdbH%2Fu9iQoEMFYl%2B5GKxw6MDswJ1nCr7vbnDTW9sijSJSlHpTF8KIbHZa6i8a2DGDvliASg9WdGEWEenpswMA4Q4K1a1cqT1xpvR3WRyu8quj7d%2FiDtA20fQV4PLAIzscpXNILNN1xcU4WGPdphKh9JF%2FISVZgfrjrc3Lv8pLVcqS4791cvfbnZYmXYsjq5epldCX0rNrz0Wiz3upWlk9B0bb68caAsM7cmgH8M7pzPvZiIfOIrCa1H%2BXQCdkWVeX6RRc%2BeuvzCl7%2F49U%2F&RelayState=aHR0cHM6Ly9pdGhlbHBkZXNrLmF1dG9tYXRpb25hbnl3aGVyZS5jb20vYXBwL2l0ZGVzay91aS9yZXF1ZXN0cy8yNzc0NjAwMDA2NTIwMDI2MC9kZXRhaWxzX19JQU1fX1NEUE9uRGVtYW5kX19JQU1fX19fSUFNX19mYWxzZV9fSUFNX18%3D Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: DT=DI1xilJgciFQtiXvrCZ_ut5jw; JSESSIONID=A7CDE4AA7CA38E344464BACCD7A20BB9
2024-10-28 07:36:06 UTC	368	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:36:06 GMT Content-Type: image/x-icon Content-Length: 5430 Connection: close Server: nginx accept-ranges: bytes etag: W/"5430-1729274500000" last-modified: Fri, 18 Oct 2024 18:01:40 GMT x-content-type-options: nosniff Strict-Transport-Security: max-age=315360000; includeSubDomains X-Robots-Tag: noindex,nofollow
2024-10-28 07:36:06 UTC	5430	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 13 0b 00 00 13 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 79 29 00 00 79 29 00 0a 79 29 00 4c 7a 29 00 a9 7a 29 00 df 7a 29 00 fb 7a 29 00 fb 7a 29 00 df 7a 29 00 a8 79 28 00 56 78 29 00 0b 78 29 00 00 00 00 00 00 00 00 00 00 7a 2b 00 00 79 29 00 00 79 29 00 1c 79 29 00 99 7a 29 00 ec 7a 29 00 ff 7a 29 00 ff 7a 29 00 ff 7a 29 00 ff 7a 29 00 ff 7a 29 00 ff 7a 29 00 ee 79 29 00 95 79 29 00 1d 79 29 00 00 7a 2b 00 00 7a 2a 00 00 7a 2a 00 1e 7a 29 00 b0 7a 29 00 fe 7a 29 00 ff 7a 29 00 ff 7a 29 00 ff 7a 29 00 ff 7a 29 00 ff 7a 29 00 ff 7a 29 00 ff 7a 29 00 ff 7a Data Ascii: h& ( y)y)y)Lz)z)z)z)z)z)y(Vx)x)z+y)y)y)z)z)z)z)z)z)z)z)y)y)y)z+zzz)z)z)z)z)z)z)z)z)z)z

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49769	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:36:05 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:36:06 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:36:06 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: bebabdad-901e-0029-5d45-28274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T073605Z-r197bdfb6b47gqdjqh2kwsuz8c000000056g000000001qhu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:36:06 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49760	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:36:06 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:36:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:36:06 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: d919e2dc-e01e-001f-153d-261633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T073606Z-17c5cb586f66g7mvbfuqdb2m3n00000004x000000000129k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:36:06 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49770	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:36:06 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:36:06 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:36:06 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1a9c8bfd-301e-0000-1fee-25eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T073606Z-15b8d89586fhl2qtatrz3vfkf00000000as0000000002vdt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:36:06 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Target ID:	0
Start time:	03:35:53
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	03:35:55
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 --field-trial-handle=2216,i,14187799758207872673,14442970336596630755,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	03:35:57
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ithelpdesk.automationanywhere.com/app/itdesk/ui/requests/27746000065200260/details"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://ithelpdesk.automationanywhere.com/app/itdesk/ui/requests/27746000065200260/details

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 38

Chrome Cache Entry: 39

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Connections

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 5324, Parent PID: 5884

General

Chronological Activities

Analysis Process: chrome.exePID: 4996, Parent PID: 5324

General

Chronological Activities

Analysis Process: chrome.exePID: 4540, Parent PID: 5884

General

Chronological Activities

Disassembly

Windows Analysis Report
https://ithelpdesk.automationanywhere.com/app/itdesk/ui/requests/27746000065200260/details