Edit tour

Windows Analysis Report
https://lukltd-my.sharepoint.com/personal/jack_quinn_logicalis_com/Documents/NetApp/United%20Drug/United%20Drug%20AFF%20A200%20Installation%20%20v1.1.xlsx?d=w5530be7ff19d41eb8a183343e8d6e4dc&web=1

Overview

General Information

Sample URL:	https://lukltd-my.sharepoint.com/personal/jack_quinn_logicalis_com/Documents/NetApp/United%20Drug/United%20Drug%20AFF%20A200%20Installation%20%20v1.1.xlsx?d=w5530be7ff19d41eb8a183343e8d6e4dc&web=1
Analysis ID:	1428126
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

HTML body contains low number of good links

HTML title does not match URL

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 7056 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7108 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2204,i,11186399499180968135,2586960386879572005,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5892 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://lukltd-my.sharepoint.com/personal/jack_quinn_logicalis_com/Documents/NetApp/United%20Drug/United%20Drug%20AFF%20A200%20Installation%20%20v1.1.xlsx?d=w5530be7ff19d41eb8a183343e8d6e4dc&web=1" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://login.microsoftonline.com/eec52a17-bb08-469c-ad42-2e8c8071934f/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=1DB9C6CA2ADEE6503E04E40308602C40D3109B1BFD7B1A50%2D6BCA7BEF37AE8428591599593B5F4C8140A11656EEA567175AA6A4F66C6AF54E&redirect%5Furi=https%3A%2F%2Flukltd%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=923920a1%2D40e3%2D8000%2Dac6d%2D7dc73b9137d5	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/eec52a17-bb08-469c-ad42-2e8c8071934f/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=1DB9C6CA2ADEE6503E04E40308602C40D3109B1BFD7B1A50%2D6BCA7BEF37AE8428591599593B5F4C8140A11656EEA567175AA6A4F66C6AF54E&redirect%5Furi=https%3A%2F%2Flukltd%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=923920a1%2D40e3%2D8000%2Dac6d%2D7dc73b9137d5&sso_reload=true	HTTP Parser: Number of links: 0

Source: https://login.microsoftonline.com/eec52a17-bb08-469c-ad42-2e8c8071934f/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=1DB9C6CA2ADEE6503E04E40308602C40D3109B1BFD7B1A50%2D6BCA7BEF37AE8428591599593B5F4C8140A11656EEA567175AA6A4F66C6AF54E&redirect%5Furi=https%3A%2F%2Flukltd%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=923920a1%2D40e3%2D8000%2Dac6d%2D7dc73b9137d5	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/eec52a17-bb08-469c-ad42-2e8c8071934f/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=1DB9C6CA2ADEE6503E04E40308602C40D3109B1BFD7B1A50%2D6BCA7BEF37AE8428591599593B5F4C8140A11656EEA567175AA6A4F66C6AF54E&redirect%5Furi=https%3A%2F%2Flukltd%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=923920a1%2D40e3%2D8000%2Dac6d%2D7dc73b9137d5&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://login.microsoftonline.com/eec52a17-bb08-469c-ad42-2e8c8071934f/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=1DB9C6CA2ADEE6503E04E40308602C40D3109B1BFD7B1A50%2D6BCA7BEF37AE8428591599593B5F4C8140A11656EEA567175AA6A4F66C6AF54E&redirect%5Furi=https%3A%2F%2Flukltd%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=923920a1%2D40e3%2D8000%2Dac6d%2D7dc73b9137d5&sso_reload=true

HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

Source: https://login.microsoftonline.com/eec52a17-bb08-469c-ad42-2e8c8071934f/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=1DB9C6CA2ADEE6503E04E40308602C40D3109B1BFD7B1A50%2D6BCA7BEF37AE8428591599593B5F4C8140A11656EEA567175AA6A4F66C6AF54E&redirect%5Furi=https%3A%2F%2Flukltd%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=923920a1%2D40e3%2D8000%2Dac6d%2D7dc73b9137d5	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/eec52a17-bb08-469c-ad42-2e8c8071934f/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=1DB9C6CA2ADEE6503E04E40308602C40D3109B1BFD7B1A50%2D6BCA7BEF37AE8428591599593B5F4C8140A11656EEA567175AA6A4F66C6AF54E&redirect%5Furi=https%3A%2F%2Flukltd%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=923920a1%2D40e3%2D8000%2Dac6d%2D7dc73b9137d5&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/eec52a17-bb08-469c-ad42-2e8c8071934f/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=1DB9C6CA2ADEE6503E04E40308602C40D3109B1BFD7B1A50%2D6BCA7BEF37AE8428591599593B5F4C8140A11656EEA567175AA6A4F66C6AF54E&redirect%5Furi=https%3A%2F%2Flukltd%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=923920a1%2D40e3%2D8000%2Dac6d%2D7dc73b9137d5&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/eec52a17-bb08-469c-ad42-2e8c8071934f/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=1DB9C6CA2ADEE6503E04E40308602C40D3109B1BFD7B1A50%2D6BCA7BEF37AE8428591599593B5F4C8140A11656EEA567175AA6A4F66C6AF54E&redirect%5Furi=https%3A%2F%2Flukltd%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=923920a1%2D40e3%2D8000%2Dac6d%2D7dc73b9137d5	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/eec52a17-bb08-469c-ad42-2e8c8071934f/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=1DB9C6CA2ADEE6503E04E40308602C40D3109B1BFD7B1A50%2D6BCA7BEF37AE8428591599593B5F4C8140A11656EEA567175AA6A4F66C6AF54E&redirect%5Furi=https%3A%2F%2Flukltd%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=923920a1%2D40e3%2D8000%2Dac6d%2D7dc73b9137d5&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/eec52a17-bb08-469c-ad42-2e8c8071934f/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=1DB9C6CA2ADEE6503E04E40308602C40D3109B1BFD7B1A50%2D6BCA7BEF37AE8428591599593B5F4C8140A11656EEA567175AA6A4F66C6AF54E&redirect%5Furi=https%3A%2F%2Flukltd%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=923920a1%2D40e3%2D8000%2Dac6d%2D7dc73b9137d5&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown

HTTPS traffic detected: 23.206.229.226:443 -> 192.168.2.8:49744 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.8:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.8:49719 version: TLS 1.2

Source: unknown

HTTPS traffic detected: 23.206.229.226:443 -> 192.168.2.8:49744 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.40.205.26
Source: unknown	TCP traffic detected without corresponding DNS query: 23.40.205.26
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /personal/jack_quinn_logicalis_com/Documents/NetApp/United%20Drug/United%20Drug%20AFF%20A200%20Installation%20%20v1.1.xlsx?d=w5530be7ff19d41eb8a183343e8d6e4dc&web=1 HTTP/1.1Host: lukltd-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/jack_quinn_logicalis_com/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Fjack%5Fquinn%5Flogicalis%5Fcom%2FDocuments%2FNetApp%2FUnited%20Drug%2FUnited%20Drug%20AFF%20A200%20Installation%20%20v1%2E1%2Exlsx%3Fd%3Dw5530be7ff19d41eb8a183343e8d6e4dc%26web%3D1 HTTP/1.1Host: lukltd-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_forms/default.aspx?ReturnUrl=%2fpersonal%2fjack_quinn_logicalis_com%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Fjack%255Fquinn%255Flogicalis%255Fcom%252FDocuments%252FNetApp%252FUnited%2520Drug%252FUnited%2520Drug%2520AFF%2520A200%2520Installation%2520%2520v1%252E1%252Exlsx%253Fd%253Dw5530be7ff19d41eb8a183343e8d6e4dc%2526web%253D1&Source=cookie HTTP/1.1Host: lukltd-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: RpsContextCookie=U291cmNlPSUyRnBlcnNvbmFsJTJGamFjayU1RnF1aW5uJTVGbG9naWNhbGlzJTVGY29tJTJGRG9jdW1lbnRzJTJGTmV0QXBwJTJGVW5pdGVkJTIwRHJ1ZyUyRlVuaXRlZCUyMERydWclMjBBRkYlMjBBMjAwJTIwSW5zdGFsbGF0aW9uJTIwJTIwdjElMkUxJTJFeGxzeCUzRmQlM0R3NTUzMGJlN2ZmMTlkNDFlYjhhMTgzMzQzZThkNmU0ZGMlMjZ3ZWIlM0Qx
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_l2bvdjfwt697xziuhxpwsg2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c1c6b6c8-yddboip6hgdfke0vbtb74zupy1zas9i8wffenmqtq20/logintenantbranding/0/illustration?ts=636439259997006238 HTTP/1.1Host: aadcdn.msftauthimages.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c1c6b6c8-yddboip6hgdfke0vbtb74zupy1zas9i8wffenmqtq20/logintenantbranding/0/bannerlogo?ts=637229891902897714 HTTP/1.1Host: aadcdn.msftauthimages.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c1c6b6c8-yddboip6hgdfke0vbtb74zupy1zas9i8wffenmqtq20/logintenantbranding/0/bannerlogo?ts=637229891902897714 HTTP/1.1Host: aadcdn.msftauthimages.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c1c6b6c8-yddboip6hgdfke0vbtb74zupy1zas9i8wffenmqtq20/logintenantbranding/0/illustration?ts=636439259997006238 HTTP/1.1Host: aadcdn.msftauthimages.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: lukltd-my.sharepoint.com

Source: chromecache_82.2.dr	String found in binary or memory: http://feross.org
Source: chromecache_81.2.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_81.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_82.2.dr, chromecache_76.2.dr, chromecache_81.2.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_71.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_71.2.dr	String found in binary or memory: https://login.windows-ppe.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.8:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.8:49719 version: TLS 1.2

Source: classification engine

Classification label: clean2.win@17/37@18/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2204,i,11186399499180968135,2586960386879572005,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://lukltd-my.sharepoint.com/personal/jack_quinn_logicalis_com/Documents/NetApp/United%20Drug/United%20Drug%20AFF%20A200%20Installation%20%20v1.1.xlsx?d=w5530be7ff19d41eb8a183343e8d6e4dc&web=1"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2204,i,11186399499180968135,2586960386879572005,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css	0%	URL Reputation	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	0%	URL Reputation	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
dual-spo-0005.spo-msedge.net	13.107.136.10	true	false	unknown
part-0013.t-0009.t-msedge.net	13.107.246.41	true	false	unknown
cs1100.wpc.omegacdn.net	152.199.4.44	true	false	unknown
www.google.com	74.125.138.106	true	false	high
part-0042.t-0009.t-msedge.net	13.107.246.70	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
lukltd-my.sharepoint.com	unknown	unknown	false	unknown
identity.nel.measure.office.net	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	unknown
login.microsoftonline.com	unknown	unknown	false	high
aadcdn.msftauthimages.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://aadcdn.msftauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js	false		unknown
https://aadcdn.msftauthimages.net/c1c6b6c8-yddboip6hgdfke0vbtb74zupy1zas9i8wffenmqtq20/logintenantbranding/0/bannerlogo?ts=637229891902897714	false		unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js	false		unknown
https://aadcdn.msftauthimages.net/c1c6b6c8-yddboip6hgdfke0vbtb74zupy1zas9i8wffenmqtq20/logintenantbranding/0/illustration?ts=636439259997006238	false		unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js	false		unknown
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css	false	URL Reputation: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57.js	false		unknown
https://lukltd-my.sharepoint.com/personal/jack_quinn_logicalis_com/Documents/NetApp/United%20Drug/United%20Drug%20AFF%20A200%20Installation%20%20v1.1.xlsx?d=w5530be7ff19d41eb8a183343e8d6e4dc&web=1	false		unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	false	URL Reputation: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg	false	URL Reputation: safe	unknown
https://lukltd-my.sharepoint.com/_forms/default.aspx?ReturnUrl=%2fpersonal%2fjack_quinn_logicalis_com%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Fjack%255Fquinn%255Flogicalis%255Fcom%252FDocuments%252FNetApp%252FUnited%2520Drug%252FUnited%2520Drug%2520AFF%2520A200%2520Installation%2520%2520v1%252E1%252Exlsx%253Fd%253Dw5530be7ff19d41eb8a183343e8d6e4dc%2526web%253D1&Source=cookie	false		unknown
https://login.microsoftonline.com/eec52a17-bb08-469c-ad42-2e8c8071934f/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=1DB9C6CA2ADEE6503E04E40308602C40D3109B1BFD7B1A50%2D6BCA7BEF37AE8428591599593B5F4C8140A11656EEA567175AA6A4F66C6AF54E&redirect%5Furi=https%3A%2F%2Flukltd%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=923920a1%2D40e3%2D8000%2Dac6d%2D7dc73b9137d5&sso_reload=true	false		high
https://login.microsoftonline.com/eec52a17-bb08-469c-ad42-2e8c8071934f/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=1DB9C6CA2ADEE6503E04E40308602C40D3109B1BFD7B1A50%2D6BCA7BEF37AE8428591599593B5F4C8140A11656EEA567175AA6A4F66C6AF54E&redirect%5Furi=https%3A%2F%2Flukltd%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=923920a1%2D40e3%2D8000%2Dac6d%2D7dc73b9137d5	false		high
https://lukltd-my.sharepoint.com/personal/jack_quinn_logicalis_com/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Fjack%5Fquinn%5Flogicalis%5Fcom%2FDocuments%2FNetApp%2FUnited%20Drug%2FUnited%20Drug%20AFF%20A200%20Installation%20%20v1%2E1%2Exlsx%3Fd%3Dw5530be7ff19d41eb8a183343e8d6e4dc%26web%3D1	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://login.microsoftonline.com	chromecache_71.2.dr	false	high
http://www.opensource.org/licenses/mit-license.php)	chromecache_81.2.dr	false	high
http://knockoutjs.com/	chromecache_81.2.dr	false	high
https://github.com/douglascrockford/JSON-js	chromecache_82.2.dr, chromecache_76.2.dr, chromecache_81.2.dr	false	high
https://login.windows-ppe.net	chromecache_71.2.dr	false	high
http://feross.org	chromecache_82.2.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.41	part-0013.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
74.125.138.106	www.google.com	United States	15169	GOOGLEUS	false
152.199.4.44	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
13.107.246.70	part-0042.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.8

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428126
Start date and time:	2024-04-18 15:35:38 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://lukltd-my.sharepoint.com/personal/jack_quinn_logicalis_com/Documents/NetApp/United%20Drug/United%20Drug%20AFF%20A200%20Installation%20%20v1.1.xlsx?d=w5530be7ff19d41eb8a183343e8d6e4dc&web=1
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean2.win@17/37@18/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 74.125.138.94, 64.233.177.100, 64.233.177.113, 64.233.177.102, 64.233.177.139, 64.233.177.101, 64.233.177.138, 172.217.215.84, 34.104.35.123, 40.126.28.14, 40.126.28.13, 40.126.7.32, 40.126.28.20, 40.126.28.12, 40.126.28.11, 40.126.7.35, 40.126.28.21, 23.192.229.205, 23.192.229.198, 40.126.29.11, 40.126.29.6, 40.126.29.7, 40.126.29.9, 20.190.157.11, 40.126.29.14, 40.126.29.12, 40.126.29.13, 64.233.176.95, 142.251.15.95, 108.177.122.95, 142.250.9.95, 74.125.138.95, 74.125.136.95, 172.217.215.95, 142.250.105.95, 173.194.219.95, 172.253.124.95, 64.233.177.95, 64.233.185.95, 40.68.123.157, 192.229.211.108, 52.165.164.15, 13.95.31.18, 64.233.185.94, 13.85.23.86, 104.76.210.78, 104.76.210.85, 13.69.239.73, 51.11.192.49
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, ak.privatelink.msidentity.com, a1894.dscb.akamai.net, clients2.google.com, ocsp.digicert.com, login.live.com, onedscolprdneu03.northeurope.cloudapp.azure.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, onedscolprdfrc07.francecentral.cloudapp.azure.com, sls.update.microsoft.com, update.googleapis.com, login.mso.msidentity.com, glb.sls.prod.dcat.dsp.trafficmanager.net, prdv4a.aadg.msidentity.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, aadcdnoriginwus2.azureedge.net, aadcdn-msft.azureedge.net, www.tm.ak.prd.aadg.akadns.net, www.tm.v4.a.prd.aadg.akadns.net, 189392-ipv4v6w.farm.dprodmgd104.sharepointonline.com.akadns.net, aadcdn-msft.afd.azureedge.net, aadcdn.msauth.net, firstparty-azurefd-prod.trafficmanager.net, login.msa.msidentity.com, eu.events.data.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com,
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: https://lukltd-my.sharepoint.com/personal/jack_quinn_logicalis_com/Documents/NetApp/United%20Drug/United%20Drug%20AFF%20A200%20Installation%20%20v1.1.xlsx?d=w5530be7ff19d41eb8a183343e8d6e4dc&web=1

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 12:36:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9785075940764316
Encrypted:	false
SSDEEP:	48:8g0dWTS+zHsidAKZdA1oehwiZUklqehNy+3:8glj/Ky
MD5:	0C28248B8F6E035D46C115EF9AA2E16D
SHA1:	CC1F4501214279B4ABCF753BFD38AADF798D59B0
SHA-256:	77056528D45B36902705846E1D93D53BF84F816754C8F5B7899A9ACEAF0F3672
SHA-512:	875309007088154F716DA631592BAAA6E23FF1AC36A1F32FAFB5A986651F73E1888C278AAFBEC5E6757311E66333AFA4CBB8D5A2C7E8BC2D821FFD0ACB83CA37
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....KM9l....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.X.l....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.l....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.l....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.l..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.l...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 12:36:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.994528589559554
Encrypted:	false
SSDEEP:	48:8a0dWTS+zHsidAKZdA1leh/iZUkAQkqeh6y+2:8aljl9Q/y
MD5:	8F5F8B458F6D7D05E15F56D3AB7F8E6E
SHA1:	69492BB0594A449D4B0C3E6D0F2166AED1E9DB34
SHA-256:	931A7092195AFC612D505AEAC2D5EBD3B4D56761781F66E55A66D2B434B2D9BE
SHA-512:	4F76E8FB719A1588753B47BE0464D6BF822A08827074A9DF5D7BD75DD8063FE5E4392583E511B866161494EC943DC22A962095F2DB23D68B096E89F0E8F310EC
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......)l....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.X.l....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.l....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.l....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.l..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.l...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.004709638957637
Encrypted:	false
SSDEEP:	48:8z0dWTS+bHsidAKZdA14t5eh7sFiZUkmgqeh7s8y+BX:8zljtn2y
MD5:	20AFD31EC0AF0A911BD4DBD92A101C5D
SHA1:	47772CBF203EB24506C59B6A2600D8392BC6B642
SHA-256:	8F013DCD2F5EC6411564469E6B734FB859B9D9EDAC6EA7E0A87992F3DA14F3C9
SHA-512:	BA81E2E9E0F64962F0776D7F9B8B71A2A8CACCDCBAF542E22D78023E22ADCD794F86C0D84761EA3184F727AEA09DE560C29798BFA78B15A549AC23872EEC3C21
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.X.l....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.l....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.l....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.l..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 12:36:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9940115077014653
Encrypted:	false
SSDEEP:	48:8Ij0dWTS+zHsidAKZdA16ehDiZUkwqehOy+R:8Elj20y
MD5:	55CC6F7F12CBC2A6B743F24481B13687
SHA1:	7B7F35E9673F7994344B544FAC90D396F2132B1F
SHA-256:	C6276F38715F16BCBDD8CCB52E6D13FA750B4D94C5768AEB1DE2A2735D9F7C24
SHA-512:	82A154F479D82CFFAB26A2D6CAB6BB09628216C13C4CD54A7B26201D3B11C8F0159E3B480C86723104ACA2AC1DFD62523BBF80C0FE964B1250D0F3572925F8D9
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....;.#l....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.X.l....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.l....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.l....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.l..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.l...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 12:36:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.980841895581309
Encrypted:	false
SSDEEP:	48:8Z0dWTS+zHsidAKZdA1UehBiZUk1W1qehYy+C:8ZljW94y
MD5:	186D11F1B72ADE686D02D452E630787F
SHA1:	9EE6E8DF064586E3E087B3652B74D724E977058D
SHA-256:	D430A1B1411A66C103679A48A8F8F6E80C2424056DDE27DE49381F4236BA71E9
SHA-512:	46512236AA28D607B7A379372F15AE8B98987CB0770BB7C0B7386EBF12C5599DF0882841C629B73721672BF918479FB67EA8AA2C3DBB74FFD84238B6595D2C49
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....(.3l....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.X.l....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.l....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.l....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.l..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.l...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 12:36:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9941516937697648
Encrypted:	false
SSDEEP:	48:880dWTS+zHsidAKZdA1duTrehOuTbbiZUk5OjqehOuTb2y+yT+:88ljnTYTbxWOvTb2y7T
MD5:	ACF7C43B255A973357723FA4ABF51021
SHA1:	91D8C0CD042B95D613FA924DBB839FF1FCA380E0
SHA-256:	9CA65DF78FE07D027DAEE3A04F1F82B1298F08A79B94A1E863524CD9ADCB6B30
SHA-512:	53207BF23371DCE25FD0C57D94F9173618ADDF34B04ABFD7AB6D8883EDA4E049B7F5446997945B1C9F1A9E6D9878B0FBC696045CC9435CDE761A1C83B811B098
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......l....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.X.l....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.l....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.l....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.l..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.l...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2345), with CRLF line terminators
Category:	downloaded
Size (bytes):	2347
Entropy (8bit):	5.290031538794594
Encrypted:	false
SSDEEP:	48:gCgF0+kNL5iQ6+GhB+SYWzGuesAFcsGJOzgO6FIEv+sj+M++sx+suse+swsosmC0:gC3Na5+GX+Ti2XsYE2sqAsosushswsoB
MD5:	E86EF8B6111E5FB1D1665BCDC90888C9
SHA1:	994BF7651CB967CD9053056AF2D69ACB74DB7F29
SHA-256:	3410242720DE50B090D07A23AEE2DAD879B31D36F2615732962EC4CFA8A9D458
SHA-512:	2486B491681EE91A9CD1ECC9AA011A3FB34B48358C5D7A4D503A5357BC5CE4CA22999F918D40AC60A3063940D5F326FC7E4E5713D89D5C102DE68824E371B3AB
Malicious:	false
Reputation:	low
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(n,t){for(var e in t)n[e]=t[e]}(this,function(n){function t(i){if(e[i])return e[i].exports;var s=e[i]={exports:{},id:i,loaded:!1};return n[i].call(s.exports,s,s.exports,t),s.loaded=!0,s.exports}var e={};return t.m=n,t.c=e,t.p="",t(0)}([function(n,t){function e(n){for(var t=g[c],e=0,i=t.length;e<i;++e)if(t[e]===n)return!0;return!1}function i(n){if(!n)return null;for(var t=n+"=",e=document.cookie.split(";"),i=0,s=e.length;i<s;i++){var o=e[i].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===o.indexOf(t))return o.substring(t.length)}return null}function s(n,t,e){if(n)for(var i=n.split(":"),s=null,o=0,a=i.length;o<a;++o){var l=null,c=i[o].split("$");if(0===o&&(s=parseInt(c.shift()),!s))return;var p=c.length;if(p>=1){var f=r(s,c[0]);if(!f\|\|e[f])continue;l={signInName:f,idp:"msa",isSignedIn:!0}}if(p>=3&&(l.firstName=r(s,c[1]),l.lastName=r(s,c[2])),p>=4){var g=c[3],m=g.split("\|");l.otherHashedAliases=m}if(p>=5){var h=parseInt(c[4],16);h&&(l.

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1592
Entropy (8bit):	4.205005284721148
Encrypted:	false
SSDEEP:	48:ztSAS1OtmCtc7aIVmt4yyR9S2lKUyDWwh:RoOtmCtc7aCmVQHSRh
MD5:	4E48046CE74F4B89D45037C90576BFAC
SHA1:	4A41B3B51ED787F7B33294202DA72220C7CD2C32
SHA-256:	8E6DB1634F1812D42516778FC890010AA57F3E39914FB4803DF2C38ABBF56D93
SHA-512:	B2BBA2A68EDAA1A08CFA31ED058AFB5E6A3150AABB9A78DB9F5CCC2364186D44A015986A57707B57E2CC855FA7DA57861AD19FC4E7006C2C239C98063FE903CF
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,1,19,30a10.9,10.9,0,0,1-5.547-1.5,11.106,11.106,0,0,1-2.219-1.719A11.373,11.373,0,0,1,9.5,24.547a10.4,10.4,0,0,1-1.109-2.625A11.616,11.616,0,0,1,8,19a10.9,10.9,0,0,1,1.5-5.547,11.106,11.106,0,0,1,1.719-2.219A11.373,11.373,0,0,1,13.453,9.5a10.4,10.4,0,0,1,2.625-1.109A11.616,11.616,0,0,1,19,8a10.9,10.9,0,0,1,5.547,1.5,11.106,11.106,0,0,1,2.219,1.719A11.373,11.373,0,0,1,28.5,13.453a10.4,10.4,0,0,1,1.109,2.625A11.616,11.616,0,0,1,30,19a10.015,10.015,0,0,1-.125,1.578,10.879,10.879,0,0,1-.359,1.531Zm-2,.844L27.219,22.641a14.716,14.716,0,0,0,.562-1.782A7.751,7.751,0,0,0,28,19a8.786,8.786,0,0,0-.7-3.5,8.9,8.9,0,0,0-1.938-2.859A9.269,9.269,0,0,0,22.5,10.719,8.9,8.9,0,0,0,19,10a8.786,8.786,0,0,0-3.5.7,8.9,8.9,0,0,0-2.859,1.938A9.269,9.269,0,0,0,

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	low
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1920 x 1080, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	239370
Entropy (8bit):	7.96417331993445
Encrypted:	false
SSDEEP:	6144:y9S/1tcGngPC87cetIHIcVCCfA3cf8RFGXrmuL06f9J:y9StcGgPDw/HITh3cf8RFWmOFJ
MD5:	1ED8961F10030678EB9C6E184B52996D
SHA1:	F23CEBB2364EED19D9DDBEF8B87B491C499EC99A
SHA-256:	5D8FE9B5B67BF2912F8FE2B79C83E307213390B0C1D7C39B1E478279C6DA2086
SHA-512:	5F9AB4A72C6650F04FCD4D323C418B7F598AC1F7B704C9353CF32CD8D97F29303506B266F822EBD0FA3829A0513929838B61C74F7CFB811F03C795827078C8CD
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......8.......1q....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:12fcd881-e2c8-6240-b6e2-18e22da93fbf" xmpMM:DocumentID="xmp.did:528238FDBE9D11E4ACF3B60C84749956" xmpMM:InstanceID="xmp.iid:528238FCBE9D11E4ACF3B60C84749956" xmp:CreatorTool="Adobe Photoshop CC 2014 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6986816f-fd12-e844-865e-5febced28813" stRef:documentID="adobe:docid:photoshop:e8a955ad-be9c-11e4-aad1-fe6333a052b9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.@c.....PLTEBBB......9

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64612)
Category:	downloaded
Size (bytes):	113657
Entropy (8bit):	5.491599164368304
Encrypted:	false
SSDEEP:	1536:PKq+7j8gIRPY0+r5qnWiseKVeOIXYx15CevgbSvzNXteFN50Xu:bgDTMnWcdOswvgbmp8Fbiu
MD5:	5B0E3778C74235B06DA49808DD8DF90A
SHA1:	AD25897B0870B81568412F55B19898E406CC11B3
SHA-256:	7530B843A86F3155CE07CDA787A40DA87052664B09C22F3D4DB5E9238664DBE0
SHA-512:	EE1FB8F232311A45A10D2CC2A8F19B6C8F86ECE52688F909B0928C0F65AE0953EB2176D0ADEA893A371300D0E3FEE7AF046865D48FFC2812B3440D01ADAEB727
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[37],{487:function(e,t,r

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1920 x 1080, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	239370
Entropy (8bit):	7.96417331993445
Encrypted:	false
SSDEEP:	6144:y9S/1tcGngPC87cetIHIcVCCfA3cf8RFGXrmuL06f9J:y9StcGgPDw/HITh3cf8RFWmOFJ
MD5:	1ED8961F10030678EB9C6E184B52996D
SHA1:	F23CEBB2364EED19D9DDBEF8B87B491C499EC99A
SHA-256:	5D8FE9B5B67BF2912F8FE2B79C83E307213390B0C1D7C39B1E478279C6DA2086
SHA-512:	5F9AB4A72C6650F04FCD4D323C418B7F598AC1F7B704C9353CF32CD8D97F29303506B266F822EBD0FA3829A0513929838B61C74F7CFB811F03C795827078C8CD
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauthimages.net/c1c6b6c8-yddboip6hgdfke0vbtb74zupy1zas9i8wffenmqtq20/logintenantbranding/0/illustration?ts=636439259997006238
Preview:	.PNG........IHDR.......8.......1q....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:12fcd881-e2c8-6240-b6e2-18e22da93fbf" xmpMM:DocumentID="xmp.did:528238FDBE9D11E4ACF3B60C84749956" xmpMM:InstanceID="xmp.iid:528238FCBE9D11E4ACF3B60C84749956" xmp:CreatorTool="Adobe Photoshop CC 2014 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6986816f-fd12-e844-865e-5febced28813" stRef:documentID="adobe:docid:photoshop:e8a955ad-be9c-11e4-aad1-fe6333a052b9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.@c.....PLTEBBB......9

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1592
Entropy (8bit):	4.205005284721148
Encrypted:	false
SSDEEP:	48:ztSAS1OtmCtc7aIVmt4yyR9S2lKUyDWwh:RoOtmCtc7aCmVQHSRh
MD5:	4E48046CE74F4B89D45037C90576BFAC
SHA1:	4A41B3B51ED787F7B33294202DA72220C7CD2C32
SHA-256:	8E6DB1634F1812D42516778FC890010AA57F3E39914FB4803DF2C38ABBF56D93
SHA-512:	B2BBA2A68EDAA1A08CFA31ED058AFB5E6A3150AABB9A78DB9F5CCC2364186D44A015986A57707B57E2CC855FA7DA57861AD19FC4E7006C2C239C98063FE903CF
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,1,19,30a10.9,10.9,0,0,1-5.547-1.5,11.106,11.106,0,0,1-2.219-1.719A11.373,11.373,0,0,1,9.5,24.547a10.4,10.4,0,0,1-1.109-2.625A11.616,11.616,0,0,1,8,19a10.9,10.9,0,0,1,1.5-5.547,11.106,11.106,0,0,1,1.719-2.219A11.373,11.373,0,0,1,13.453,9.5a10.4,10.4,0,0,1,2.625-1.109A11.616,11.616,0,0,1,19,8a10.9,10.9,0,0,1,5.547,1.5,11.106,11.106,0,0,1,2.219,1.719A11.373,11.373,0,0,1,28.5,13.453a10.4,10.4,0,0,1,1.109,2.625A11.616,11.616,0,0,1,30,19a10.015,10.015,0,0,1-.125,1.578,10.879,10.879,0,0,1-.359,1.531Zm-2,.844L27.219,22.641a14.716,14.716,0,0,0,.562-1.782A7.751,7.751,0,0,0,28,19a8.786,8.786,0,0,0-.7-3.5,8.9,8.9,0,0,0-1.938-2.859A9.269,9.269,0,0,0,22.5,10.719,8.9,8.9,0,0,0,19,10a8.786,8.786,0,0,0-3.5.7,8.9,8.9,0,0,0-2.859,1.938A9.269,9.269,0,0,0,

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (61177)
Category:	downloaded
Size (bytes):	113084
Entropy (8bit):	5.285180915082997
Encrypted:	false
SSDEEP:	1536:QpHDgBvguhw+EViazA/PWrF7qvEAFiQcpmchSeC2Jzc6VUWG:xkNh06VUT
MD5:	D62B4EDEB512B07ABEF4688E27ECDDE3
SHA1:	981A7825DA5E29938AB6FE0CBFE2DB622F7B8333
SHA-256:	4B01A0A34CE8ED4BC8A8713BE0442D49DA6A756236B7B4424622CA3DEE820F41
SHA-512:	6E91B285BEA8566EBB7829F592744A6706CF6498E6D5DC1C5A0EBDD0A685D767AA215B275A88568B957E6BE824AEE60521ED1D77D92A697A3CE0F446ECDCDDB9
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css
Preview:	/! Copyright (C) Microsoft Corporation. All rights reserved. //*!.------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------..This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise...//-----------------------------------------------------------------------------.twbs-bootstrap-sass (3.3.0).//-----------------------------------------------------------------------------..The MIT License (MIT)..Copyright (c) 2013 Twitter, Inc..Permission is hereby granted, free of charge, to any person

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	36
Entropy (8bit):	4.503258334775644
Encrypted:	false
SSDEEP:	3:Eq62iczBr9ks:EqdiczBys
MD5:	06B313E93DD76909460FBFC0CD98CB6B
SHA1:	C4F9B2BBD840A4328F85F54873C434336A193888
SHA-256:	B4532478707B495D0BB1C21C314AEF959DD1A5E0F66E52DAD5FC332C8B697CBA
SHA-512:	EFD7E8195D9C126883C71FED3EFEDE55916848B784F8434ED2677DF5004436F7EDE9F80277CB4675C4DEB8F243B2705A3806B412FAA8842E039E9DC467C11645
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwmCAmly1gHbXRIFDdFbUVISBQ1Xevf9?alt=proto
Preview:	ChgKDQ3RW1FSGgQIVhgCIAEKBw1Xevf9GgA=

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64616)
Category:	downloaded
Size (bytes):	444227
Entropy (8bit):	5.449991999950224
Encrypted:	false
SSDEEP:	6144:x17tl9prEilRPqNfFXQpOcNsCF18AfJ9Oxb4QZE0HfNX4TY:x1rsFXQpfSCX8z4QOU
MD5:	8C74AB954A2C743D71C5B99C47F94C34
SHA1:	3FF62FDC7AD0AAA2D36EBA473DC28ECDD0F6D4E4
SHA-256:	B449CE27BB6C0352DC780DBA81B4D323D4808DAEEE064DD934CEC65B67BE8D46
SHA-512:	9BBD28D7C890DC2595A12937B0C16466DD916D6B97D217CE4FFF11E2DFB624D1B1201D41E2566C977901471B1BB2C8818C99CA1F3BCF8EFB2568C7680BBA2300
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */!function(e){function n(n){for(var t,i,o=n[0],r=n[1],s=0,c=[];s<o.length;s++)

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (43896)
Category:	downloaded
Size (bytes):	223759
Entropy (8bit):	5.257227710687157
Encrypted:	false
SSDEEP:	3072:KO0fqoBmncEhWcjYcB6UpO2jrksurdPvsiQj:UmcKrpO7surRve
MD5:	5252837FFA272234E1CBF2D3D83EF32C
SHA1:	CAA4E48A54A2B1CA09327E42F24F6031FDF21CDA
SHA-256:	DF2E852C347ECF82F70A0C8A4B91713FBB0914D58F2CBAB01316BFE646ABEE7C
SHA-512:	523C59BC0D2861B8F35A8D46E52C935A26001B2A2EF8197F7F6DBFC38E8F0D51A5D3753FD4F0DCCD68DA08505D3313AFCFA7CB236E0363EDA4856D41F05A233A
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[8],{528:function(e,t,r)

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	190152
Entropy (8bit):	5.348678574819375
Encrypted:	false
SSDEEP:	3072:0+mTq9mTuZEOHEXp6WXWkYVlMBMwMlJNbdffVv6GhL+rUWxa:STekBWkYVdLlJNbr6m+rUGa
MD5:	4877EFC88055D60953886EC55B04DE34
SHA1:	2341B026A3E2A3B01AFA1A39D1706840D75E09B3
SHA-256:	8405362EB8F09DF13AE244DE155B51B1577274673D9728B6C81CD0278A63C8B0
SHA-512:	625844EDC37594D5C2F7622BD1B59278BF68ABB2FA22476C56826433C961C7B1924858A7588F8B6284D3C5AC8738ECB895EEC949DE18667A98C04A59CB03DAC0
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
Preview:	(window.telemetry_webpackJsonp=window.telemetry_webpackJsonp\|\|[]).push([[2],[,,,function(e,t,n){"use strict";n.r(t),n.d(t,"ValueKind",(function(){return r.e})),n.d(t,"EventLatency",(function(){return r.a})),n.d(t,"EventPersistence",(function(){return r.b})),n.d(t,"TraceLevel",(function(){return r.d})),n.d(t,"AppInsightsCore",(function(){return i.a})),n.d(t,"BaseCore",(function(){return d})),n.d(t,"_ExtendedInternalMessageId",(function(){return r.f})),n.d(t,"EventPropertyType",(function(){return r.c})),n.d(t,"ESPromise",(function(){return g})),n.d(t,"ESPromiseScheduler",(function(){return C})),n.d(t,"ValueSanitizer",(function(){return I})),n.d(t,"NotificationManager",(function(){return E.a})),n.d(t,"BaseTelemetryPlugin",(function(){return S.a})),n.d(t,"ProcessTelemetryContext",(function(){return N.a})),n.d(t,"MinChannelPriorty",(function(){return w.a})),n.d(t,"EventsDiscardedReason",(function(){return P.a})),n.d(t,"DiagnosticLogger",(function(){return c.a})),n.d(t,"LoggingSeverity",(fun

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (32153)
Category:	downloaded
Size (bytes):	55071
Entropy (8bit):	5.379765697692697
Encrypted:	false
SSDEEP:	1536:ABqF1tlfretkF7IKbVaqDRx3/ym+d/Px2g+0wtwGixnqTPRUbx3VDg/Mv+k:ABrkF7IyJvym+d/Pog+0wtwGiUig/MX
MD5:	976055749170B7AF7B5F38AE857A56B2
SHA1:	E3D736B8BC648B97AA403A7283ED6985A6FCF6B2
SHA-256:	190D2504B5C2EFE44DCE83474157D309A62DF8FA2B6BDF5D52B2CDDC1EB9E0D7
SHA-512:	0C6F404D513B25F6541D324243425D2D3B9C5D3BBC71D49628E9B782DDB315F4532830D4B5739EBF183A7C85DBC79A8382EBAD116272B812D9ABC79170E46AE2
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_l2bvdjfwt697xziuhxpwsg2.js
Preview:	!function(e){function o(n){if(i[n])return i[n].exports;var t=i[n]={exports:{},id:n,loaded:!1};return e[n].call(t.exports,t,t.exports,o),t.loaded=!0,t.exports}var i={};return o.m=e,o.c=i,o.p="",o(0)}([function(e,o,i){i(2);var n=i(1),t=i(5),r=i(6),a=r.StringsVariantId,s=r.AllowedIdentitiesType;n.registerSource("str",function(e,o){if(e.WF_STR_SignupLink_AriaLabel_Text="Create a Microsoft account",e.WF_STR_SignupLink_AriaLabel_Generic_Text="Create a new account",e.CT_STR_CookieBanner_Link_AriaLabel="Learn more about Microsoft's Cookie Policy",e.WF_STR_HeaderDefault_Title=o.iLoginStringsVariantId===a.CombinedSigninSignupV2WelcomeTitle?"Welcome":"Sign in",e.STR_Footer_IcpLicense_Text=".ICP.13015306.-10",o.oAppCobranding&&o.oAppCobranding.friendlyAppName){var i=o.fBreakBrandingSigninString?"to continue to {0}":"Continue to {0}";e.WF_STR_App_Title=t.format(i,o.oAppCobranding.friendlyAppName)}switch(o.oAppCobranding&&o.oAppCobranding.signinDescription&&(e.WF_STR_Default_Desc=o.oAppCobrand

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 141339
Category:	downloaded
Size (bytes):	49632
Entropy (8bit):	7.995756058904724
Encrypted:	true
SSDEEP:	1536:XOwJxyZ3lV31cfpmHBoep5KvsXS1SbI+o2Rd8yHk0GOmOY:ZJxyZ3lF3HBl5OSo238yE0GOpY
MD5:	DAF955BF2112F74E4F78B2187A8D6BEF
SHA1:	231CE9BE42327A3BC1AA7F48C03ABA46740DC456
SHA-256:	72D3BBFFAAD400572BF853223BFFD96DC0CC6A336CFA7F3452259BF468590A4D
SHA-512:	B4904C83951533E98F38F2040E22794BAADCFE528E86650DE13394195F004DFDEF66C47D8A7E4EA3A4556A535C7A570E7829CE28B38DFEEE66053DAEB0D80A4A
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js
Preview:	............[.8.8...+.w..OL..hpp..... .......pw....e .o?u.l.q.}.s....[.R..TUI.?..O.....S.....+.....g..Sx..r.??.;..z......W..DT....W..J.U.`.F.0r..W..7..Ie.....NT.Q.U...2......$\|.T.....Q.\9<5.P....[?..p...wI%...$n.Qm.x.bQ.....w..r.0..I%.#.?.G....?aU.HTb.T.a..q;..B.Zc...1&ph...A.c.(.B....8.A..L.L..Z#....6T.....d....m..v..w0=.....FI=..XD......xT!d....x..@<y..Fn.(W...so#!.E.X.<AE....~....Y..'.t&8.T.....".J.k.....Rm5.[k..F..$..........Qx....C.G.s../.......1....l.-......o...?.a.Ta...W...7.?.N.....2..#lXU./..T.x.....".w.......;.k.\^w.].>..mr.k53r.......k.0.I.<OE......d...#..jhE..jx.].....Y\|W....i...`.. .k.P...@.Uq.\;...T.huu....TK.Y=...I..s.A.en..K.n.;).\|.?.F.....d...\|........`....5.W..._..,$..51Qe...}.^&.J#K......<......8.(r....Y.ZR..G.zc.wc.A.pL.e&w...@<V.!. ..w.:+k..n..4..I.. .....S.....p"....8....v.l.[M.0..q..c;.....0...8.......t.\...n "..km..S...W..]......paJV.(J...g....!.\|........;.zN...5}.....DZ....=q.E.@ .Dv.z...@.d.#tE....

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 227 x 42, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8054
Entropy (8bit):	7.956082121132151
Encrypted:	false
SSDEEP:	192:3CBRAQeDlf4Jw8v+hXyWbJuG470grb8CFhX0m0H5S7I1HpoKw7IM96:3C/Af4JwqquZrbLFhX0c7qyKXz
MD5:	00AC3BCF223298281842544122AD4A7D
SHA1:	9594E197DAEADC1BE929AEC191CA89B759ED7868
SHA-256:	1F388FCF799E5487DF8A957DA70628321C39299F1561291C29C5E12CC603BE6B
SHA-512:	511773F96384C78E84ED9C9C90C4DC89CE28AA47AFB3C0671AE79B278DFA2F9FC9798F3DEC3623FFFD2F6F75AFFB01F3E21275B0C445818C008E47EC8D0772C7
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR............Ai.0....sRGB.........gAMA......a.....pHYs..........+......IDATx^...TE..'..N3.....H....0..@..A.]T..b...X.5.9...fTL..V@..V...... .L...w...=.=.0O.7....}.N.J._u..nu.....03#.......^...U....=..g.._uOZZ..qq...g\\j...L.i&.wA.WO.V..'.\|.....lJ:..<^.....r...~uJ.....l.R.....g.....j...k..5j..y.>........%...z</...p...!=..]...{=...e...\|...Y........s..LEd....~QJJ.{...n.x......>7../.t....xf....5 -.&...RGG...c.......~..'...f.........?j.oF....../.O=..4hA..=.5h.....Nt.I.:u.....O..Sto&....>b.....x.[.n..~..$.,ehj.I~p.`..Mt$.g ..M......\...o.L?..../(...:...H..,..W.^...~..uLP.D;4...kyyy.&:VJ....u.\|'.e.!).Q.F...+h....3f....-.]t..C..}.r]u.Yg....c.s2......n<....H.?-m.2...>........RR.2...0..h...y..+...........~.2...P..>...k..u.p.U...._@....G.Ct....v'y...I'.tB.>}n&.m.(....%..0...5.._jO.v.]...&:$1..0K.a.b.3,#......He.G.r#..EO.....'(..#..1.<.w.&:&b.r..s.......I..kS.g..gO...w...l...T.MhW'%.dV..}......{....7@.....W.......!

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 227 x 42, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	8054
Entropy (8bit):	7.956082121132151
Encrypted:	false
SSDEEP:	192:3CBRAQeDlf4Jw8v+hXyWbJuG470grb8CFhX0m0H5S7I1HpoKw7IM96:3C/Af4JwqquZrbLFhX0c7qyKXz
MD5:	00AC3BCF223298281842544122AD4A7D
SHA1:	9594E197DAEADC1BE929AEC191CA89B759ED7868
SHA-256:	1F388FCF799E5487DF8A957DA70628321C39299F1561291C29C5E12CC603BE6B
SHA-512:	511773F96384C78E84ED9C9C90C4DC89CE28AA47AFB3C0671AE79B278DFA2F9FC9798F3DEC3623FFFD2F6F75AFFB01F3E21275B0C445818C008E47EC8D0772C7
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauthimages.net/c1c6b6c8-yddboip6hgdfke0vbtb74zupy1zas9i8wffenmqtq20/logintenantbranding/0/bannerlogo?ts=637229891902897714
Preview:	.PNG........IHDR............Ai.0....sRGB.........gAMA......a.....pHYs..........+......IDATx^...TE..'..N3.....H....0..@..A.]T..b...X.5.9...fTL..V@..V...... .L...w...=.=.0O.7....}.N.J._u..nu.....03#.......^...U....=..g.._uOZZ..qq...g\\j...L.i&.wA.WO.V..'.\|.....lJ:..<^.....r...~uJ.....l.R.....g.....j...k..5j..y.>........%...z</...p...!=..]...{=...e...\|...Y........s..LEd....~QJJ.{...n.x......>7../.t....xf....5 -.&...RGG...c.......~..'...f.........?j.oF....../.O=..4hA..=.5h.....Nt.I.:u.....O..Sto&....>b.....x.[.n..~..$.,ehj.I~p.`..Mt$.g ..M......\...o.L?..../(...:...H..,..W.^...~..uLP.D;4...kyyy.&:VJ....u.\|'.e.!).Q.F...+h....3f....-.]t..C..}.r]u.Yg....c.s2......n<....H.?-m.2...>........RR.2...0..h...y..+...........~.2...P..>...k..u.p.U...._@....G.Ct....v'y...I'.tB.>}n&.m.(....%..0...5.._jO.v.]...&:$1..0K.a.b.3,#......He.G.r#..EO.....'(..#..1.<.w.&:&b.r..s.......I..kS.g..gO...w...l...T.MhW'%.dV..}......{....7@.....W.......!

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 15:36:21.705559969 CEST	49676	443	192.168.2.8	52.182.143.211
Apr 18, 2024 15:36:24.111826897 CEST	49676	443	192.168.2.8	52.182.143.211
Apr 18, 2024 15:36:24.908612013 CEST	49673	443	192.168.2.8	23.206.229.226
Apr 18, 2024 15:36:25.252361059 CEST	49672	443	192.168.2.8	23.206.229.226
Apr 18, 2024 15:36:28.938302040 CEST	49676	443	192.168.2.8	52.182.143.211
Apr 18, 2024 15:36:30.213615894 CEST	49671	443	192.168.2.8	204.79.197.203
Apr 18, 2024 15:36:31.383555889 CEST	49710	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:31.383594990 CEST	443	49710	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:31.383701086 CEST	49710	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:31.384223938 CEST	49711	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:31.384258032 CEST	443	49711	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:31.384330988 CEST	49711	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:31.384480953 CEST	49710	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:31.384495020 CEST	443	49710	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:31.384632111 CEST	49711	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:31.384641886 CEST	443	49711	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:31.707479954 CEST	443	49711	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:31.707757950 CEST	49711	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:31.707783937 CEST	443	49711	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:31.708864927 CEST	443	49711	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:31.708936930 CEST	49711	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:31.709456921 CEST	443	49710	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:31.709856033 CEST	49710	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:31.709870100 CEST	443	49710	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:31.710165977 CEST	49711	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:31.710233927 CEST	443	49711	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:31.710376978 CEST	49711	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:31.710383892 CEST	443	49711	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:31.711452007 CEST	443	49710	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:31.711555004 CEST	49710	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:31.711822987 CEST	49710	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:31.711883068 CEST	443	49710	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:31.754756927 CEST	49710	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:31.754759073 CEST	49711	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:31.754766941 CEST	443	49710	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:31.794337034 CEST	49710	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:32.023648024 CEST	443	49711	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:32.023732901 CEST	443	49711	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:32.023813963 CEST	49711	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:32.024257898 CEST	49711	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:32.024277925 CEST	443	49711	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:32.027081013 CEST	49710	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:32.068171978 CEST	443	49710	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:32.259527922 CEST	443	49710	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:32.259633064 CEST	443	49710	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:32.259686947 CEST	49710	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:32.259728909 CEST	49710	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:32.260817051 CEST	49710	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:32.260837078 CEST	443	49710	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:32.263715029 CEST	49714	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:32.263752937 CEST	443	49714	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:32.263860941 CEST	49714	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:32.264194965 CEST	49714	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:32.264203072 CEST	443	49714	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:32.467988014 CEST	49715	443	192.168.2.8	74.125.138.106
Apr 18, 2024 15:36:32.468020916 CEST	443	49715	74.125.138.106	192.168.2.8
Apr 18, 2024 15:36:32.468123913 CEST	49715	443	192.168.2.8	74.125.138.106
Apr 18, 2024 15:36:32.468533993 CEST	49715	443	192.168.2.8	74.125.138.106
Apr 18, 2024 15:36:32.468549013 CEST	443	49715	74.125.138.106	192.168.2.8
Apr 18, 2024 15:36:32.582024097 CEST	443	49714	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:32.606182098 CEST	49714	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:32.606200933 CEST	443	49714	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:32.606616974 CEST	443	49714	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:32.611434937 CEST	49714	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:32.611502886 CEST	443	49714	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:32.612457991 CEST	49714	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:32.660121918 CEST	443	49714	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:32.685313940 CEST	443	49715	74.125.138.106	192.168.2.8
Apr 18, 2024 15:36:32.685961962 CEST	49715	443	192.168.2.8	74.125.138.106
Apr 18, 2024 15:36:32.685980082 CEST	443	49715	74.125.138.106	192.168.2.8
Apr 18, 2024 15:36:32.687058926 CEST	443	49715	74.125.138.106	192.168.2.8
Apr 18, 2024 15:36:32.687264919 CEST	49715	443	192.168.2.8	74.125.138.106
Apr 18, 2024 15:36:32.689426899 CEST	49715	443	192.168.2.8	74.125.138.106
Apr 18, 2024 15:36:32.689517021 CEST	443	49715	74.125.138.106	192.168.2.8
Apr 18, 2024 15:36:32.734462976 CEST	49715	443	192.168.2.8	74.125.138.106
Apr 18, 2024 15:36:32.734484911 CEST	443	49715	74.125.138.106	192.168.2.8
Apr 18, 2024 15:36:32.774966002 CEST	49715	443	192.168.2.8	74.125.138.106
Apr 18, 2024 15:36:32.977776051 CEST	443	49714	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:32.977802992 CEST	443	49714	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:32.977818012 CEST	443	49714	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:32.977854967 CEST	49714	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:32.977868080 CEST	443	49714	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:32.977901936 CEST	443	49714	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:32.977916956 CEST	49714	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:32.977946997 CEST	49714	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:32.988665104 CEST	49714	443	192.168.2.8	13.107.136.10
Apr 18, 2024 15:36:32.988686085 CEST	443	49714	13.107.136.10	192.168.2.8
Apr 18, 2024 15:36:34.309052944 CEST	49717	443	192.168.2.8	184.31.62.93
Apr 18, 2024 15:36:34.309087038 CEST	443	49717	184.31.62.93	192.168.2.8
Apr 18, 2024 15:36:34.309233904 CEST	49717	443	192.168.2.8	184.31.62.93
Apr 18, 2024 15:36:34.311335087 CEST	49717	443	192.168.2.8	184.31.62.93
Apr 18, 2024 15:36:34.311350107 CEST	443	49717	184.31.62.93	192.168.2.8
Apr 18, 2024 15:36:34.509332895 CEST	49673	443	192.168.2.8	23.206.229.226
Apr 18, 2024 15:36:34.534468889 CEST	443	49717	184.31.62.93	192.168.2.8
Apr 18, 2024 15:36:34.534548998 CEST	49717	443	192.168.2.8	184.31.62.93
Apr 18, 2024 15:36:34.538738966 CEST	49718	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:34.538788080 CEST	443	49718	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:34.538861990 CEST	49718	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:34.539561033 CEST	49718	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:34.539575100 CEST	443	49718	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:34.548160076 CEST	49717	443	192.168.2.8	184.31.62.93
Apr 18, 2024 15:36:34.548180103 CEST	443	49717	184.31.62.93	192.168.2.8
Apr 18, 2024 15:36:34.548629999 CEST	443	49717	184.31.62.93	192.168.2.8
Apr 18, 2024 15:36:34.588865042 CEST	49717	443	192.168.2.8	184.31.62.93
Apr 18, 2024 15:36:34.665365934 CEST	49717	443	192.168.2.8	184.31.62.93
Apr 18, 2024 15:36:34.712119102 CEST	443	49717	184.31.62.93	192.168.2.8
Apr 18, 2024 15:36:34.769587994 CEST	443	49717	184.31.62.93	192.168.2.8
Apr 18, 2024 15:36:34.769686937 CEST	443	49717	184.31.62.93	192.168.2.8
Apr 18, 2024 15:36:34.769808054 CEST	49717	443	192.168.2.8	184.31.62.93
Apr 18, 2024 15:36:34.770080090 CEST	49717	443	192.168.2.8	184.31.62.93
Apr 18, 2024 15:36:34.770080090 CEST	49717	443	192.168.2.8	184.31.62.93
Apr 18, 2024 15:36:34.770097017 CEST	443	49717	184.31.62.93	192.168.2.8
Apr 18, 2024 15:36:34.770106077 CEST	443	49717	184.31.62.93	192.168.2.8
Apr 18, 2024 15:36:34.835464001 CEST	49719	443	192.168.2.8	184.31.62.93
Apr 18, 2024 15:36:34.835490942 CEST	443	49719	184.31.62.93	192.168.2.8
Apr 18, 2024 15:36:34.835608006 CEST	49719	443	192.168.2.8	184.31.62.93
Apr 18, 2024 15:36:34.835908890 CEST	49719	443	192.168.2.8	184.31.62.93
Apr 18, 2024 15:36:34.835920095 CEST	443	49719	184.31.62.93	192.168.2.8
Apr 18, 2024 15:36:34.853694916 CEST	49672	443	192.168.2.8	23.206.229.226
Apr 18, 2024 15:36:34.864382029 CEST	443	49718	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:34.864728928 CEST	49718	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:34.864753008 CEST	443	49718	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:34.865817070 CEST	443	49718	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:34.865883112 CEST	49718	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:34.872881889 CEST	49718	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:34.872956991 CEST	443	49718	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:34.873358965 CEST	49718	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:34.873387098 CEST	443	49718	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:34.916261911 CEST	49718	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:35.047485113 CEST	443	49719	184.31.62.93	192.168.2.8
Apr 18, 2024 15:36:35.047568083 CEST	49719	443	192.168.2.8	184.31.62.93
Apr 18, 2024 15:36:35.049992085 CEST	49719	443	192.168.2.8	184.31.62.93
Apr 18, 2024 15:36:35.049999952 CEST	443	49719	184.31.62.93	192.168.2.8
Apr 18, 2024 15:36:35.050288916 CEST	443	49719	184.31.62.93	192.168.2.8
Apr 18, 2024 15:36:35.052037954 CEST	49719	443	192.168.2.8	184.31.62.93
Apr 18, 2024 15:36:35.092129946 CEST	443	49719	184.31.62.93	192.168.2.8
Apr 18, 2024 15:36:35.174571991 CEST	443	49718	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:35.174628973 CEST	443	49718	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:35.174650908 CEST	443	49718	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:35.174691916 CEST	443	49718	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:35.174691916 CEST	49718	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:35.174742937 CEST	443	49718	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:35.174777031 CEST	49718	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:35.174777031 CEST	49718	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:35.174802065 CEST	443	49718	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:35.174830914 CEST	49718	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:35.174837112 CEST	443	49718	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:35.174880028 CEST	49718	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:35.174895048 CEST	443	49718	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:35.174896955 CEST	49718	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:35.174926043 CEST	443	49718	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:35.174962044 CEST	49718	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:35.174984932 CEST	49718	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:35.257762909 CEST	443	49719	184.31.62.93	192.168.2.8
Apr 18, 2024 15:36:35.257841110 CEST	443	49719	184.31.62.93	192.168.2.8
Apr 18, 2024 15:36:35.257886887 CEST	49719	443	192.168.2.8	184.31.62.93
Apr 18, 2024 15:36:35.263940096 CEST	49719	443	192.168.2.8	184.31.62.93
Apr 18, 2024 15:36:35.263956070 CEST	443	49719	184.31.62.93	192.168.2.8
Apr 18, 2024 15:36:35.278296947 CEST	443	49718	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:35.278361082 CEST	443	49718	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:35.278403997 CEST	49718	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:35.278445005 CEST	443	49718	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:35.278486013 CEST	49718	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:35.278508902 CEST	49718	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:35.278521061 CEST	443	49718	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:35.278613091 CEST	443	49718	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:35.278666019 CEST	49718	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:35.330985069 CEST	49718	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:35.331022024 CEST	443	49718	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:36.222971916 CEST	443	49703	23.206.229.226	192.168.2.8
Apr 18, 2024 15:36:36.223422050 CEST	49703	443	192.168.2.8	23.206.229.226
Apr 18, 2024 15:36:36.569960117 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:36.569982052 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:36.570374012 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:36.572130919 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:36.572144032 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:36.592222929 CEST	49724	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:36.592246056 CEST	443	49724	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:36.592645884 CEST	49724	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:36.592645884 CEST	49724	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:36.592677116 CEST	443	49724	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:36.593400002 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:36.593426943 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:36.593724966 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:36.595652103 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:36.595659971 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:36.897317886 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:36.901715994 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:36.901731014 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:36.902868986 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:36.903059959 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:36.906491041 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:36.906557083 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:36.907525063 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:36.907531977 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:36.913907051 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:36.914530993 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:36.914544106 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:36.915395975 CEST	443	49724	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:36.915575027 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:36.915791988 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:36.916305065 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:36.916374922 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:36.916922092 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:36.916922092 CEST	49724	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:36.916944981 CEST	443	49724	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:36.920407057 CEST	443	49724	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:36.920679092 CEST	49724	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:36.921099901 CEST	49724	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:36.921179056 CEST	443	49724	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:36.923675060 CEST	49724	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:36.923681974 CEST	443	49724	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:36.947793961 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:36.958384991 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:36.958395958 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:36.978080034 CEST	49724	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.010389090 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.100769997 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.101010084 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.101017952 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.101030111 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.101099014 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.101109028 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.101118088 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.101142883 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.101146936 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.101155043 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.101233006 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.101248980 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.123387098 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.123610973 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.123620033 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.123634100 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.123641968 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.123644114 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.123692989 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.123704910 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.123716116 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.123723030 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.123783112 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.123789072 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.123797894 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.123816967 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.123833895 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.123836040 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.123918056 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.123924017 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.125740051 CEST	443	49724	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.125952959 CEST	443	49724	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.125966072 CEST	443	49724	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.126032114 CEST	49724	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.126035929 CEST	443	49724	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.126050949 CEST	443	49724	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.126058102 CEST	443	49724	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.126079082 CEST	443	49724	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.126091957 CEST	49724	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.126095057 CEST	443	49724	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.126131058 CEST	443	49724	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.126137972 CEST	443	49724	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.126147985 CEST	49724	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.126161098 CEST	443	49724	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.126171112 CEST	49724	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.126174927 CEST	443	49724	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.126199007 CEST	49724	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.126216888 CEST	49724	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.166861057 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.204226017 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.204258919 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.204305887 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.204319954 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.204332113 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.204426050 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.204726934 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.204742908 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.204770088 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.204799891 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.204807043 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.204832077 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.204832077 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.204883099 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.204888105 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.204953909 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.226800919 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.226814985 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.226852894 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.226877928 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.226892948 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.226921082 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.226921082 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.226979017 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.227153063 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.227169037 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.227264881 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.227264881 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.227273941 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.227310896 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.227483988 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.227499962 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.227546930 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.227554083 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.227638960 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.229276896 CEST	443	49724	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.229309082 CEST	443	49724	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.229362011 CEST	443	49724	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.229408979 CEST	49724	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.229427099 CEST	443	49724	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.229453087 CEST	443	49724	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.229458094 CEST	49724	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.229468107 CEST	49724	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.229492903 CEST	49724	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.229886055 CEST	49724	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.229901075 CEST	443	49724	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.243999958 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.244021893 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.244057894 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.244075060 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.244122028 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.244122028 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.267113924 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.267153025 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.267190933 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.267205954 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.267247915 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.267261982 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.308187008 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.308239937 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.308268070 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.308295012 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.308307886 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.308315992 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.308360100 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.308758974 CEST	49723	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.308773994 CEST	443	49723	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.330430984 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.330463886 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.330509901 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.330523968 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.330565929 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.330611944 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.330991983 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.331017017 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.331053019 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.331059933 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.331087112 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.331103086 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.331208944 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.331228971 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.331274986 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.331280947 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.331301928 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.331324100 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.331331968 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.331341028 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.331384897 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.414988995 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.415015936 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.415072918 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.415085077 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.415126085 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.415138960 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.434017897 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.434037924 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.434106112 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.434128046 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.434153080 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.434174061 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.434195995 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.434207916 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.434238911 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.434308052 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.434659004 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.434674978 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.434722900 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.434731007 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.434775114 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.434858084 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.434875011 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.434914112 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.434917927 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.434946060 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.434957981 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.434961081 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.434967995 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.434995890 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.434997082 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.435029984 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.435043097 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.435059071 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.435096025 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.435100079 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.435125113 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.435138941 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.435188055 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.435194969 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.435218096 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.435273886 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.435300112 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.435329914 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.435333967 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.435358047 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.435446978 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.435462952 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.435516119 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.435520887 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.435626030 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.435659885 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.435684919 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.435688972 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.435724020 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.435816050 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.435832024 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.435874939 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.435879946 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.435909986 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.435915947 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.435931921 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.435964108 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.435971975 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.435996056 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.436608076 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.473841906 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.473862886 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.473927975 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.473934889 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.518721104 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.518750906 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.518790007 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.518800020 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.518851995 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.518857956 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.518893957 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.537419081 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.537451982 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.537511110 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.537522078 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.537575960 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.537595034 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.537828922 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.537846088 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.537888050 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.537894011 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.537918091 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.537938118 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.537939072 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.537952900 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.537977934 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.538000107 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.538017035 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.538031101 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.538036108 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.538053036 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.538110018 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.538163900 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.538805008 CEST	49725	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.538820982 CEST	443	49725	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.728601933 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.728629112 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:37.728701115 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.732597113 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:37.732614994 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.048341036 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.048887968 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.048902988 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.049989939 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.050122023 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.050755978 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.050755978 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.050776958 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.050831079 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.105424881 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.105449915 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.158617020 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.256289005 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.256356955 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.256364107 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.256376982 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.256383896 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.256388903 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.256477118 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.256477118 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.256509066 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.256524086 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.256551027 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.256575108 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.256582022 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.256596088 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.256608009 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.256608009 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.257200003 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.257517099 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.359766006 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.359778881 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.359808922 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.359910965 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.359910965 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.359931946 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.359961987 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.359982014 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.360011101 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.360011101 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.360018969 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.360032082 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.360047102 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.360078096 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.361632109 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.361639977 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.366146088 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.404033899 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.404052973 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.405812979 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.405831099 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.411211967 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.463578939 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.463604927 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.463665962 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.463685036 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.463790894 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.463840008 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.463840008 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.463855028 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.463923931 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.463939905 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.463951111 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.463951111 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.463959932 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.463973045 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.464083910 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.464097023 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.464118004 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.464137077 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.464143038 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.464153051 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.464173079 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.464190006 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.464251995 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.464386940 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.469660044 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.538676977 CEST	49676	443	192.168.2.8	52.182.143.211
Apr 18, 2024 15:36:38.545943022 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.551287889 CEST	49728	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.551301956 CEST	443	49728	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.633755922 CEST	49729	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.633800983 CEST	443	49729	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.633989096 CEST	49729	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.637669086 CEST	49729	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.637695074 CEST	443	49729	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.648971081 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.649013996 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.649636030 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.649672031 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.649677038 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.952519894 CEST	443	49729	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.952899933 CEST	49729	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.952917099 CEST	443	49729	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.953293085 CEST	443	49729	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.954343081 CEST	49729	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.954437971 CEST	443	49729	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.954556942 CEST	49729	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.966680050 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.968483925 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.968492031 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.969322920 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.969988108 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:38.970056057 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:38.970372915 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.000118971 CEST	443	49729	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.016123056 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.160262108 CEST	443	49729	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.160305977 CEST	443	49729	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.160322905 CEST	443	49729	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.160382032 CEST	49729	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.160396099 CEST	443	49729	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.160408020 CEST	443	49729	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.160451889 CEST	49729	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.164031029 CEST	49729	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.164041996 CEST	443	49729	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.174199104 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.174540043 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.174586058 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.174614906 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.174627066 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.174649954 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.174683094 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.174700022 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.174765110 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.174777985 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.174803019 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.174837112 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.228724003 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.228732109 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.275609970 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.277404070 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.277416945 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.277446985 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.277456999 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.277477026 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.277482033 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.277534008 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.277586937 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.277594090 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.277615070 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.277643919 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.277653933 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.277659893 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.277698994 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.277760983 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.281193018 CEST	49731	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.281230927 CEST	443	49731	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.281341076 CEST	49731	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.281549931 CEST	49731	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.281564951 CEST	443	49731	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.318934917 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.318957090 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.319019079 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.319025993 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.319075108 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.319148064 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.319165945 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.319524050 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.319530010 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.319576979 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.381006002 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.381025076 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.381076097 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.381083012 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.381107092 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.381129026 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.381131887 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.381145000 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.381176949 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.381186008 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.381205082 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.381207943 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.381232977 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.381267071 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.381423950 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.381442070 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.381469965 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.381474972 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.381499052 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.381519079 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.422853947 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.422874928 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.422928095 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.422934055 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.422980070 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.423098087 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.423115969 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.423165083 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.423171997 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.423212051 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.423255920 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.423271894 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.423337936 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.423341990 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.423381090 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.423427105 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.423441887 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.423487902 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.423494101 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.423532963 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.484194994 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.484231949 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.484272957 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.484282970 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.484334946 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.509712934 CEST	49730	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:39.509727955 CEST	443	49730	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.596739054 CEST	443	49731	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:39.646467924 CEST	49731	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:40.139002085 CEST	49731	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:40.139020920 CEST	443	49731	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:40.140347004 CEST	443	49731	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:40.140436888 CEST	49731	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:40.143358946 CEST	49731	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:40.143436909 CEST	443	49731	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:40.143958092 CEST	49732	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:40.144000053 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:40.144107103 CEST	49732	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:40.147979021 CEST	49732	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:40.147999048 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:40.148288965 CEST	49731	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:40.148303032 CEST	443	49731	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:40.199299097 CEST	49731	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:40.253495932 CEST	443	49731	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:40.253561974 CEST	443	49731	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:40.253570080 CEST	443	49731	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:40.253592968 CEST	443	49731	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:40.253607035 CEST	443	49731	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:40.253614902 CEST	443	49731	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:40.253695011 CEST	49731	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:40.253710985 CEST	443	49731	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:40.253720045 CEST	443	49731	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:40.253757954 CEST	49731	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:40.253757954 CEST	49731	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:40.280844927 CEST	49734	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:40.280877113 CEST	443	49734	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:40.280941010 CEST	49734	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:40.281152964 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:40.281176090 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:40.281270981 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:40.281982899 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:40.281996012 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:40.282258987 CEST	49734	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:40.282274961 CEST	443	49734	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:40.285365105 CEST	49731	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:40.285382986 CEST	443	49731	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:40.462795019 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:40.513859034 CEST	49732	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:40.603626966 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:40.607050896 CEST	443	49734	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:40.654515028 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:40.670088053 CEST	49734	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:40.886931896 CEST	49734	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:40.886957884 CEST	443	49734	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:40.887187004 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:40.887208939 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:40.887799978 CEST	49732	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:40.887826920 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:40.888283968 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:40.888474941 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:40.888550043 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:40.888664961 CEST	443	49734	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:40.888683081 CEST	443	49734	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:40.888712883 CEST	49734	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:40.908566952 CEST	49732	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:40.908723116 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:40.909190893 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:40.909297943 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:40.911369085 CEST	49732	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:40.911858082 CEST	49734	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:40.912157059 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:40.912173986 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:40.912244081 CEST	443	49734	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:40.912525892 CEST	49734	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:40.912537098 CEST	443	49734	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:40.931216002 CEST	49736	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:40.931258917 CEST	443	49736	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:40.931359053 CEST	49736	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:40.931762934 CEST	49736	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:40.931777954 CEST	443	49736	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:40.956124067 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:40.958558083 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:40.958566904 CEST	49734	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.017411947 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.017667055 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.017676115 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.017712116 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.017728090 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.017741919 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.017765999 CEST	49732	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:41.017786026 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.017796040 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.017822027 CEST	49732	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:41.017837048 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.017862082 CEST	49732	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:41.017867088 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.017896891 CEST	49732	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:41.017920971 CEST	49732	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:41.121087074 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.121114016 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.121232033 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.121236086 CEST	49732	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:41.121257067 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.121299028 CEST	49732	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:41.121335983 CEST	49732	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:41.121532917 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.121548891 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.121606112 CEST	49732	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:41.121615887 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.121634960 CEST	49732	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:41.129817963 CEST	443	49734	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.129842997 CEST	443	49734	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.129848957 CEST	443	49734	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.129883051 CEST	443	49734	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.129936934 CEST	49734	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.129945993 CEST	443	49734	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.129972935 CEST	443	49734	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.129975080 CEST	49734	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.130017996 CEST	49734	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.174599886 CEST	49732	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:41.224442959 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.224468946 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.224520922 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.224597931 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.224623919 CEST	49732	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:41.224687099 CEST	49732	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:41.249397039 CEST	443	49736	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.301682949 CEST	49736	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:41.721458912 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.721489906 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.721496105 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.721510887 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.721527100 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.721535921 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.721538067 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.721555948 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.721628904 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.721628904 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.721693993 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.721709967 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.721988916 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.721997023 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.722084045 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.758112907 CEST	49736	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:41.758133888 CEST	443	49736	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.758589029 CEST	49732	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:41.758630991 CEST	443	49736	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.760354042 CEST	49736	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:41.760454893 CEST	443	49736	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.760552883 CEST	49736	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:41.777228117 CEST	49734	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.777252913 CEST	443	49734	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.785789013 CEST	49732	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:41.785823107 CEST	443	49732	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.804119110 CEST	443	49736	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.825365067 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.825395107 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.825453043 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.825465918 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.825516939 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.825694084 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.825711012 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.825764894 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.825772047 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.825823069 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.825830936 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.825846910 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.825901031 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.825906038 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.826092958 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.866256952 CEST	443	49736	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.866300106 CEST	443	49736	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.866359949 CEST	49736	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:41.866364002 CEST	443	49736	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.866410017 CEST	49736	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:41.870824099 CEST	49736	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:41.870846987 CEST	443	49736	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.929318905 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.929348946 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.929409027 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.929419041 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.929475069 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.929625034 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.929645061 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.929681063 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.929685116 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.929735899 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.929769993 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.929997921 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.930017948 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.930058002 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.930073023 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.930083036 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.930111885 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.930196047 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.930217028 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.930265903 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.930269957 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.930289030 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.930334091 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.930428028 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.930449009 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.930494070 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.930497885 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.930618048 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.930680037 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.930697918 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.930732965 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.930737972 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:41.930766106 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.930807114 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:41.952356100 CEST	49737	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:41.952393055 CEST	443	49737	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.952518940 CEST	49737	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:41.952709913 CEST	49737	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:41.952732086 CEST	443	49737	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:41.957468033 CEST	49738	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:41.957505941 CEST	443	49738	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:41.957562923 CEST	49738	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:41.957761049 CEST	49738	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:41.957773924 CEST	443	49738	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:42.033286095 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:42.033344030 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:42.033425093 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:42.033433914 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:42.033535957 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:42.033591032 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:42.033607006 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:42.033651114 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:42.033657074 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:42.033696890 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:42.033804893 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:42.033824921 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:42.033854961 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:42.033859968 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:42.033889055 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:42.033916950 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:42.034240007 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:42.034267902 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:42.034301996 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:42.034306049 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:42.034370899 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:42.034408092 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:42.034408092 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:42.058693886 CEST	49735	443	192.168.2.8	13.107.246.70
Apr 18, 2024 15:36:42.058712959 CEST	443	49735	13.107.246.70	192.168.2.8
Apr 18, 2024 15:36:42.106369972 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:42.106403112 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:42.106467962 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:42.106756926 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:42.106770992 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:42.268044949 CEST	443	49737	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:42.268646002 CEST	49737	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:42.268661976 CEST	443	49737	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:42.269043922 CEST	443	49737	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:42.270242929 CEST	49737	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:42.270314932 CEST	443	49737	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:42.271100998 CEST	49737	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:42.277143955 CEST	443	49738	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:42.277623892 CEST	49738	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:42.277638912 CEST	443	49738	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:42.278704882 CEST	443	49738	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:42.278774023 CEST	49738	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:42.280206919 CEST	49738	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:42.280283928 CEST	443	49738	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:42.280941963 CEST	49738	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:42.280950069 CEST	443	49738	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:42.312119007 CEST	443	49737	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:42.322441101 CEST	49738	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:42.424778938 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:42.426423073 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:42.426436901 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:42.427551985 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:42.427612066 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:42.428801060 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:42.428917885 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:42.429474115 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:42.429481983 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:42.480875969 CEST	443	49737	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:42.480933905 CEST	443	49737	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:42.480977058 CEST	49737	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:42.480988979 CEST	443	49737	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:42.481024027 CEST	443	49737	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:42.481070995 CEST	49737	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:42.483966112 CEST	49737	443	192.168.2.8	152.199.4.44
Apr 18, 2024 15:36:42.483980894 CEST	443	49737	152.199.4.44	192.168.2.8
Apr 18, 2024 15:36:42.579808950 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:42.684674025 CEST	443	49715	74.125.138.106	192.168.2.8
Apr 18, 2024 15:36:42.684726954 CEST	443	49715	74.125.138.106	192.168.2.8
Apr 18, 2024 15:36:42.684798956 CEST	49715	443	192.168.2.8	74.125.138.106
Apr 18, 2024 15:36:42.960128069 CEST	443	49738	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:42.960150003 CEST	443	49738	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:42.960158110 CEST	443	49738	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:42.960237026 CEST	443	49738	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:42.960263968 CEST	49738	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:42.960426092 CEST	49738	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.270349026 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.270380974 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.270389080 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.270415068 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.270426035 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.270437002 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.270471096 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.270492077 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.270500898 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.270523071 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.270524025 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.270531893 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.270545959 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.270545006 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.270558119 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.270569086 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.270574093 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.270574093 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.270596027 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.289660931 CEST	49738	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.289679050 CEST	443	49738	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.374130964 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.374166012 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.374176979 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.374190092 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.374208927 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.374224901 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.374252081 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.375847101 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.375884056 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.375910044 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.375917912 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.375921965 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.375941992 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.375943899 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.375952959 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.375973940 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.376075029 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.385142088 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.385154963 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.385184050 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.385211945 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.385659933 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.385680914 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.478631973 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.478666067 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.478674889 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.478688002 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.478713989 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.478727102 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.478857994 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.478944063 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.478952885 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.478976965 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.478985071 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.478987932 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.479012012 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.479012012 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.479032993 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.479046106 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.479093075 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.479613066 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.479623079 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.479651928 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.479665041 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.479682922 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.479692936 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.479717016 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.479943991 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.479963064 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.479986906 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.480011940 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.480019093 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.480042934 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.487165928 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.487183094 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.487360001 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.487376928 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.490158081 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.490179062 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.490259886 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.490259886 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.490274906 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.582227945 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.582250118 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.582451105 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.582469940 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.585082054 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.585093021 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.585117102 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.585129976 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.585138083 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.585160017 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.585169077 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.585184097 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.585304022 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.585311890 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.585324049 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.585325956 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.585331917 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.585344076 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.585352898 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.585376024 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.585485935 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.585514069 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.585539103 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.585545063 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.585567951 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.585570097 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.585679054 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.586133957 CEST	49739	443	192.168.2.8	13.107.246.41
Apr 18, 2024 15:36:43.586149931 CEST	443	49739	13.107.246.41	192.168.2.8
Apr 18, 2024 15:36:43.842179060 CEST	49715	443	192.168.2.8	74.125.138.106
Apr 18, 2024 15:36:43.842214108 CEST	443	49715	74.125.138.106	192.168.2.8
Apr 18, 2024 15:36:47.580821991 CEST	49703	443	192.168.2.8	23.206.229.226
Apr 18, 2024 15:36:47.580936909 CEST	49703	443	192.168.2.8	23.206.229.226
Apr 18, 2024 15:36:47.585549116 CEST	49744	443	192.168.2.8	23.206.229.226
Apr 18, 2024 15:36:47.585572004 CEST	443	49744	23.206.229.226	192.168.2.8
Apr 18, 2024 15:36:47.585684061 CEST	49744	443	192.168.2.8	23.206.229.226
Apr 18, 2024 15:36:47.588572025 CEST	49744	443	192.168.2.8	23.206.229.226
Apr 18, 2024 15:36:47.588586092 CEST	443	49744	23.206.229.226	192.168.2.8
Apr 18, 2024 15:36:47.731277943 CEST	443	49703	23.206.229.226	192.168.2.8
Apr 18, 2024 15:36:47.731309891 CEST	443	49703	23.206.229.226	192.168.2.8
Apr 18, 2024 15:36:47.901694059 CEST	443	49744	23.206.229.226	192.168.2.8
Apr 18, 2024 15:36:47.901801109 CEST	49744	443	192.168.2.8	23.206.229.226
Apr 18, 2024 15:37:07.056787014 CEST	443	49744	23.206.229.226	192.168.2.8
Apr 18, 2024 15:37:07.057883978 CEST	49744	443	192.168.2.8	23.206.229.226
Apr 18, 2024 15:37:20.508038998 CEST	49704	80	192.168.2.8	23.40.205.26
Apr 18, 2024 15:37:20.620048046 CEST	80	49704	23.40.205.26	192.168.2.8
Apr 18, 2024 15:37:20.620107889 CEST	49704	80	192.168.2.8	23.40.205.26
Apr 18, 2024 15:37:32.406622887 CEST	49746	443	192.168.2.8	74.125.138.106
Apr 18, 2024 15:37:32.406646967 CEST	443	49746	74.125.138.106	192.168.2.8
Apr 18, 2024 15:37:32.406702042 CEST	49746	443	192.168.2.8	74.125.138.106
Apr 18, 2024 15:37:32.407038927 CEST	49746	443	192.168.2.8	74.125.138.106
Apr 18, 2024 15:37:32.407053947 CEST	443	49746	74.125.138.106	192.168.2.8
Apr 18, 2024 15:37:32.625890017 CEST	443	49746	74.125.138.106	192.168.2.8
Apr 18, 2024 15:37:32.626317024 CEST	49746	443	192.168.2.8	74.125.138.106
Apr 18, 2024 15:37:32.626332045 CEST	443	49746	74.125.138.106	192.168.2.8
Apr 18, 2024 15:37:32.627470970 CEST	443	49746	74.125.138.106	192.168.2.8
Apr 18, 2024 15:37:32.628163099 CEST	49746	443	192.168.2.8	74.125.138.106
Apr 18, 2024 15:37:32.628334999 CEST	443	49746	74.125.138.106	192.168.2.8
Apr 18, 2024 15:37:32.681482077 CEST	49746	443	192.168.2.8	74.125.138.106
Apr 18, 2024 15:37:42.618736982 CEST	443	49746	74.125.138.106	192.168.2.8
Apr 18, 2024 15:37:42.618813992 CEST	443	49746	74.125.138.106	192.168.2.8
Apr 18, 2024 15:37:42.618880033 CEST	49746	443	192.168.2.8	74.125.138.106
Apr 18, 2024 15:37:43.434273005 CEST	49746	443	192.168.2.8	74.125.138.106
Apr 18, 2024 15:37:43.434299946 CEST	443	49746	74.125.138.106	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 15:36:29.418140888 CEST	53	59195	1.1.1.1	192.168.2.8
Apr 18, 2024 15:36:29.471651077 CEST	53	56774	1.1.1.1	192.168.2.8
Apr 18, 2024 15:36:30.084986925 CEST	53	53098	1.1.1.1	192.168.2.8
Apr 18, 2024 15:36:31.120191097 CEST	62177	53	192.168.2.8	1.1.1.1
Apr 18, 2024 15:36:31.120356083 CEST	62686	53	192.168.2.8	1.1.1.1
Apr 18, 2024 15:36:32.359966040 CEST	58914	53	192.168.2.8	1.1.1.1
Apr 18, 2024 15:36:32.360131979 CEST	64355	53	192.168.2.8	1.1.1.1
Apr 18, 2024 15:36:32.464449883 CEST	53	64355	1.1.1.1	192.168.2.8
Apr 18, 2024 15:36:32.464823961 CEST	53	58914	1.1.1.1	192.168.2.8
Apr 18, 2024 15:36:32.991416931 CEST	52900	53	192.168.2.8	1.1.1.1
Apr 18, 2024 15:36:32.992124081 CEST	54359	53	192.168.2.8	1.1.1.1
Apr 18, 2024 15:36:36.244596958 CEST	49541	53	192.168.2.8	1.1.1.1
Apr 18, 2024 15:36:36.245292902 CEST	55187	53	192.168.2.8	1.1.1.1
Apr 18, 2024 15:36:36.439321041 CEST	61751	53	192.168.2.8	1.1.1.1
Apr 18, 2024 15:36:36.458204031 CEST	60848	53	192.168.2.8	1.1.1.1
Apr 18, 2024 15:36:36.544219017 CEST	53	61751	1.1.1.1	192.168.2.8
Apr 18, 2024 15:36:36.563379049 CEST	53	60848	1.1.1.1	192.168.2.8
Apr 18, 2024 15:36:39.175859928 CEST	55737	53	192.168.2.8	1.1.1.1
Apr 18, 2024 15:36:39.176109076 CEST	52382	53	192.168.2.8	1.1.1.1
Apr 18, 2024 15:36:39.280230045 CEST	53	55737	1.1.1.1	192.168.2.8
Apr 18, 2024 15:36:39.280702114 CEST	53	52382	1.1.1.1	192.168.2.8
Apr 18, 2024 15:36:40.141464949 CEST	61811	53	192.168.2.8	1.1.1.1
Apr 18, 2024 15:36:40.141849041 CEST	63638	53	192.168.2.8	1.1.1.1
Apr 18, 2024 15:36:40.249419928 CEST	53	64621	1.1.1.1	192.168.2.8
Apr 18, 2024 15:36:41.850068092 CEST	56039	53	192.168.2.8	1.1.1.1
Apr 18, 2024 15:36:41.850430965 CEST	59641	53	192.168.2.8	1.1.1.1
Apr 18, 2024 15:36:47.662736893 CEST	53	51017	1.1.1.1	192.168.2.8
Apr 18, 2024 15:37:09.899708986 CEST	53	54469	1.1.1.1	192.168.2.8
Apr 18, 2024 15:37:20.631339073 CEST	138	138	192.168.2.8	192.168.2.255
Apr 18, 2024 15:37:29.443533897 CEST	53	53912	1.1.1.1	192.168.2.8
Apr 18, 2024 15:37:32.416163921 CEST	53	63772	1.1.1.1	192.168.2.8
Apr 18, 2024 15:37:38.872807980 CEST	56310	53	192.168.2.8	1.1.1.1
Apr 18, 2024 15:37:38.872986078 CEST	60299	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 18, 2024 15:36:31.120191097 CEST	192.168.2.8	1.1.1.1	0x44f5	Standard query (0)	lukltd-my.sharepoint.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:36:31.120356083 CEST	192.168.2.8	1.1.1.1	0x989f	Standard query (0)	lukltd-my.sharepoint.com	65	IN (0x0001)	false
Apr 18, 2024 15:36:32.359966040 CEST	192.168.2.8	1.1.1.1	0x478b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:36:32.360131979 CEST	192.168.2.8	1.1.1.1	0x56fc	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 18, 2024 15:36:32.991416931 CEST	192.168.2.8	1.1.1.1	0x1d85	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:36:32.992124081 CEST	192.168.2.8	1.1.1.1	0x8f4f	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
Apr 18, 2024 15:36:36.244596958 CEST	192.168.2.8	1.1.1.1	0xbb4d	Standard query (0)	identity.nel.measure.office.net	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:36:36.245292902 CEST	192.168.2.8	1.1.1.1	0x2382	Standard query (0)	identity.nel.measure.office.net	65	IN (0x0001)	false
Apr 18, 2024 15:36:36.439321041 CEST	192.168.2.8	1.1.1.1	0xd8a0	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:36:36.458204031 CEST	192.168.2.8	1.1.1.1	0x6c7f	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Apr 18, 2024 15:36:39.175859928 CEST	192.168.2.8	1.1.1.1	0xd502	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:36:39.176109076 CEST	192.168.2.8	1.1.1.1	0xc59d	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Apr 18, 2024 15:36:40.141464949 CEST	192.168.2.8	1.1.1.1	0x5ee7	Standard query (0)	aadcdn.msftauthimages.net	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:36:40.141849041 CEST	192.168.2.8	1.1.1.1	0x9623	Standard query (0)	aadcdn.msftauthimages.net	65	IN (0x0001)	false
Apr 18, 2024 15:36:41.850068092 CEST	192.168.2.8	1.1.1.1	0x68bc	Standard query (0)	aadcdn.msftauthimages.net	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:36:41.850430965 CEST	192.168.2.8	1.1.1.1	0xd784	Standard query (0)	aadcdn.msftauthimages.net	65	IN (0x0001)	false
Apr 18, 2024 15:37:38.872807980 CEST	192.168.2.8	1.1.1.1	0xb4da	Standard query (0)	identity.nel.measure.office.net	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:37:38.872986078 CEST	192.168.2.8	1.1.1.1	0x6b7	Standard query (0)	identity.nel.measure.office.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 18, 2024 15:36:31.326174974 CEST	1.1.1.1	192.168.2.8	0x989f	No error (0)	lukltd-my.sharepoint.com	lukltd.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:31.326174974 CEST	1.1.1.1	192.168.2.8	0x989f	No error (0)	lukltd.sharepoint.com	13043-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:31.326174974 CEST	1.1.1.1	192.168.2.8	0x989f	No error (0)	13043-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com	189392-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:31.326174974 CEST	1.1.1.1	192.168.2.8	0x989f	No error (0)	189392-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com	189392-ipv4v6w.farm.dprodmgd104.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:31.382651091 CEST	1.1.1.1	192.168.2.8	0x44f5	No error (0)	lukltd-my.sharepoint.com	lukltd.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:31.382651091 CEST	1.1.1.1	192.168.2.8	0x44f5	No error (0)	lukltd.sharepoint.com	13043-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:31.382651091 CEST	1.1.1.1	192.168.2.8	0x44f5	No error (0)	13043-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com	189392-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:31.382651091 CEST	1.1.1.1	192.168.2.8	0x44f5	No error (0)	189392-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com	189392-ipv4v6w.farm.dprodmgd104.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:31.382651091 CEST	1.1.1.1	192.168.2.8	0x44f5	No error (0)	189392-ipv4v6.farm.dprodmgd104.aa-rt.sharepoint.com.dual-spo-0005.spo-msedge.net	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:31.382651091 CEST	1.1.1.1	192.168.2.8	0x44f5	No error (0)	dual-spo-0005.spo-msedge.net		13.107.136.10	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:36:31.382651091 CEST	1.1.1.1	192.168.2.8	0x44f5	No error (0)	dual-spo-0005.spo-msedge.net		13.107.138.10	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:36:32.464449883 CEST	1.1.1.1	192.168.2.8	0x56fc	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 18, 2024 15:36:32.464823961 CEST	1.1.1.1	192.168.2.8	0x478b	No error (0)	www.google.com		74.125.138.106	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:36:32.464823961 CEST	1.1.1.1	192.168.2.8	0x478b	No error (0)	www.google.com		74.125.138.103	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:36:32.464823961 CEST	1.1.1.1	192.168.2.8	0x478b	No error (0)	www.google.com		74.125.138.99	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:36:32.464823961 CEST	1.1.1.1	192.168.2.8	0x478b	No error (0)	www.google.com		74.125.138.105	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:36:32.464823961 CEST	1.1.1.1	192.168.2.8	0x478b	No error (0)	www.google.com		74.125.138.104	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:36:32.464823961 CEST	1.1.1.1	192.168.2.8	0x478b	No error (0)	www.google.com		74.125.138.147	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:36:33.096750021 CEST	1.1.1.1	192.168.2.8	0x1d85	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:33.096787930 CEST	1.1.1.1	192.168.2.8	0x8f4f	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:34.534970045 CEST	1.1.1.1	192.168.2.8	0x544f	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:34.534970045 CEST	1.1.1.1	192.168.2.8	0x544f	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:36:34.534970045 CEST	1.1.1.1	192.168.2.8	0x544f	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:36:36.349762917 CEST	1.1.1.1	192.168.2.8	0x2382	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:36.352147102 CEST	1.1.1.1	192.168.2.8	0xbb4d	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:36.544219017 CEST	1.1.1.1	192.168.2.8	0xd8a0	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:36.544219017 CEST	1.1.1.1	192.168.2.8	0xd8a0	No error (0)	cs1100.wpc.omegacdn.net		152.199.4.44	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:36:36.563379049 CEST	1.1.1.1	192.168.2.8	0x6c7f	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:39.280230045 CEST	1.1.1.1	192.168.2.8	0xd502	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:39.280230045 CEST	1.1.1.1	192.168.2.8	0xd502	No error (0)	cs1100.wpc.omegacdn.net		152.199.4.44	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:36:39.280702114 CEST	1.1.1.1	192.168.2.8	0xc59d	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:40.246638060 CEST	1.1.1.1	192.168.2.8	0x5ee7	No error (0)	aadcdn.msftauthimages.net	aadcdn-msft.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:40.246638060 CEST	1.1.1.1	192.168.2.8	0x5ee7	No error (0)	shed.dual-low.part-0042.t-0009.t-msedge.net	part-0042.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:40.246638060 CEST	1.1.1.1	192.168.2.8	0x5ee7	No error (0)	part-0042.t-0009.t-msedge.net		13.107.246.70	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:36:40.246638060 CEST	1.1.1.1	192.168.2.8	0x5ee7	No error (0)	part-0042.t-0009.t-msedge.net		13.107.213.70	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:36:40.247488976 CEST	1.1.1.1	192.168.2.8	0x9623	No error (0)	aadcdn.msftauthimages.net	aadcdn-msft.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:41.955240965 CEST	1.1.1.1	192.168.2.8	0xd784	No error (0)	aadcdn.msftauthimages.net	aadcdn-msft.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:41.956883907 CEST	1.1.1.1	192.168.2.8	0x68bc	No error (0)	aadcdn.msftauthimages.net	aadcdn-msft.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:41.956883907 CEST	1.1.1.1	192.168.2.8	0x68bc	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:41.956883907 CEST	1.1.1.1	192.168.2.8	0x68bc	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:36:41.956883907 CEST	1.1.1.1	192.168.2.8	0x68bc	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:36:45.742794037 CEST	1.1.1.1	192.168.2.8	0xc483	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:45.742794037 CEST	1.1.1.1	192.168.2.8	0xc483	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:37:01.842524052 CEST	1.1.1.1	192.168.2.8	0xee47	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:37:01.842524052 CEST	1.1.1.1	192.168.2.8	0xee47	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:37:25.111392975 CEST	1.1.1.1	192.168.2.8	0x24cc	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:37:25.111392975 CEST	1.1.1.1	192.168.2.8	0x24cc	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:37:38.977370977 CEST	1.1.1.1	192.168.2.8	0x6b7	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:37:38.977430105 CEST	1.1.1.1	192.168.2.8	0xb4da	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

lukltd-my.sharepoint.com

https:

aadcdn.msauth.net

aadcdn.msftauth.net

aadcdn.msftauthimages.net

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49711	13.107.136.10	443	7108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 13:36:31 UTC	830	OUT	GET /personal/jack_quinn_logicalis_com/Documents/NetApp/United%20Drug/United%20Drug%20AFF%20A200%20Installation%20%20v1.1.xlsx?d=w5530be7ff19d41eb8a183343e8d6e4dc&web=1 HTTP/1.1 Host: lukltd-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 13:36:32 UTC	1234	IN	HTTP/1.1 302 Found Content-Length: 415 Content-Type: text/html; charset=utf-8 Location: https://lukltd-my.sharepoint.com/personal/jack_quinn_logicalis_com/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Fjack%5Fquinn%5Flogicalis%5Fcom%2FDocuments%2FNetApp%2FUnited%20Drug%2FUnited%20Drug%20AFF%20A200%20Installation%20%20v1%2E1%2Exlsx%3Fd%3Dw5530be7ff19d41eb8a183343e8d6e4dc%26web%3D1 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-NetworkStatistics: 0,525568,0,268,839255,0,273206 X-SharePointHealthScore: 2 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: 923920a1-e0a5-8000-ac6d-72c4cec24c3c request-id: 923920a1-e0a5-8000-ac6d-72c4cec24c3c MS-CV: oSA5kqXgAICsbXLEzsJMPA.0 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: E15CFDBE44CD4CD3A0D7CC3B4FECAB88 Ref B: ATL331000101033 Ref C: 2024-04-18T13:36:31Z Date: Thu, 18 Apr 2024 13:36:31 GMT Connection: close
2024-04-18 13:36:32 UTC	415	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 75 6b 6c 74 64 2d 6d 79 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 70 65 72 73 6f 6e 61 6c 2f 6a 61 63 6b 5f 71 75 69 6e 6e 5f 6c 6f 67 69 63 61 6c 69 73 5f 63 6f 6d 2f 5f 6c 61 79 6f 75 74 73 2f 31 35 2f 41 75 74 68 65 6e 74 69 63 61 74 65 2e 61 73 70 78 3f 53 6f 75 72 63 65 3d 25 32 46 70 65 72 73 6f 6e 61 6c 25 32 46 6a 61 63 6b 25 35 46 71 75 69 6e 6e 25 35 46 6c 6f 67 69 63 61 6c 69 73 25 35 46 63 6f 6d 25 32 46 44 6f 63 75 6d 65 6e 74 73 25 32 46 4e 65 74 41 70 70 25 32 46 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://lukltd-my.sharepoint.com/personal/jack_quinn_logicalis_com/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Fjack%5Fquinn%5Flogicalis%5Fcom%2FDocuments%2FNetApp%2F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49710	13.107.136.10	443	7108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 13:36:32 UTC	932	OUT	GET /personal/jack_quinn_logicalis_com/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Fjack%5Fquinn%5Flogicalis%5Fcom%2FDocuments%2FNetApp%2FUnited%20Drug%2FUnited%20Drug%20AFF%20A200%20Installation%20%20v1%2E1%2Exlsx%3Fd%3Dw5530be7ff19d41eb8a183343e8d6e4dc%26web%3D1 HTTP/1.1 Host: lukltd-my.sharepoint.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 13:36:32 UTC	2162	IN	HTTP/1.1 302 Found Cache-Control: private Content-Length: 490 Content-Type: text/html; charset=utf-8 Location: /_forms/default.aspx?ReturnUrl=%2fpersonal%2fjack_quinn_logicalis_com%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Fjack%255Fquinn%255Flogicalis%255Fcom%252FDocuments%252FNetApp%252FUnited%2520Drug%252FUnited%2520Drug%2520AFF%2520A200%2520Installation%2520%2520v1%252E1%252Exlsx%253Fd%253Dw5530be7ff19d41eb8a183343e8d6e4dc%2526web%253D1&Source=cookie P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: RpsContextCookie=U291cmNlPSUyRnBlcnNvbmFsJTJGamFjayU1RnF1aW5uJTVGbG9naWNhbGlzJTVGY29tJTJGRG9jdW1lbnRzJTJGTmV0QXBwJTJGVW5pdGVkJTIwRHJ1ZyUyRlVuaXRlZCUyMERydWclMjBBRkYlMjBBMjAwJTIwSW5zdGFsbGF0aW9uJTIwJTIwdjElMkUxJTJFeGxzeCUzRmQlM0R3NTUzMGJlN2ZmMTlkNDFlYjhhMTgzMzQzZThkNmU0ZGMlMjZ3ZWIlM0Qx; expires=Thu, 18-Apr-2024 13:46:32 GMT; path=/; SameSite=None; secure; HttpOnly X-NetworkStatistics: 0,525568,0,0,235545,0,54151 X-SharePointHealthScore: 3 X-AspNet-Version: 4.0.30319 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: 923920a1-60b8-8000-ac6d-79cb09aba235 request-id: 923920a1-60b8-8000-ac6d-79cb09aba235 MS-CV: oSA5krhgAICsbXnLCauiNQ.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=Edge-Prod-ATL33r5d&frontEnd=AFD&RemoteIP=81.181.57.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 SPRequestDuration: 14 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 43330BCCBEB54EFCA8D2995FBF66FB40 Ref B: ATL331000107053 Ref C: 2024-04-18T13:36:32Z Date: Thu, 18 Apr 2024 13:36:31 GMT Connection: close
2024-04-18 13:36:32 UTC	490	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 2f 5f 66 6f 72 6d 73 2f 64 65 66 61 75 6c 74 2e 61 73 70 78 3f 52 65 74 75 72 6e 55 72 6c 3d 25 32 66 70 65 72 73 6f 6e 61 6c 25 32 66 6a 61 63 6b 5f 71 75 69 6e 6e 5f 6c 6f 67 69 63 61 6c 69 73 5f 63 6f 6d 25 32 66 5f 6c 61 79 6f 75 74 73 25 32 66 31 35 25 32 66 41 75 74 68 65 6e 74 69 63 61 74 65 2e 61 73 70 78 25 33 66 53 6f 75 72 63 65 25 33 64 25 32 35 32 46 70 65 72 73 6f 6e 61 6c 25 32 35 32 46 6a 61 63 6b 25 32 35 35 46 71 75 69 6e 6e 25 32 35 35 46 6c 6f 67 69 63 61 6c 69 73 25 32 35 35 46 63 6f 6d 25 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="/_forms/default.aspx?ReturnUrl=%2fpersonal%2fjack_quinn_logicalis_com%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Fjack%255Fquinn%255Flogicalis%255Fcom%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49714	13.107.136.10	443	7108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 13:36:32 UTC	1330	OUT	GET /_forms/default.aspx?ReturnUrl=%2fpersonal%2fjack_quinn_logicalis_com%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Fjack%255Fquinn%255Flogicalis%255Fcom%252FDocuments%252FNetApp%252FUnited%2520Drug%252FUnited%2520Drug%2520AFF%2520A200%2520Installation%2520%2520v1%252E1%252Exlsx%253Fd%253Dw5530be7ff19d41eb8a183343e8d6e4dc%2526web%253D1&Source=cookie HTTP/1.1 Host: lukltd-my.sharepoint.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: RpsContextCookie=U291cmNlPSUyRnBlcnNvbmFsJTJGamFjayU1RnF1aW5uJTVGbG9naWNhbGlzJTVGY29tJTJGRG9jdW1lbnRzJTJGTmV0QXBwJTJGVW5pdGVkJTIwRHJ1ZyUyRlVuaXRlZCUyMERydWclMjBBRkYlMjBBMjAwJTIwSW5zdGFsbGF0aW9uJTIwJTIwdjElMkUxJTJFeGxzeCUzRmQlM0R3NTUzMGJlN2ZmMTlkNDFlYjhhMTgzMzQzZThkNmU0ZGMlMjZ3ZWIlM0Qx
2024-04-18 13:36:32 UTC	4131	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Length: 882 Content-Type: text/html; charset=utf-8 Expires: -1 Location: https://login.microsoftonline.com:443/eec52a17-bb08-469c-ad42-2e8c8071934f/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=1DB9C6CA2ADEE6503E04E40308602C40D3109B1BFD7B1A50%2D6BCA7BEF37AE8428591599593B5F4C8140A11656EEA567175AA6A4F66C6AF54E&redirect%5Furi=https%3A%2F%2Flukltd%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=923920a1%2D40e3%2D8000%2Dac6d%2D7dc73b9137d5 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: nSGt-1DB9C6CA2ADEE6503E04E40308602C40D3109B1BFD7B1A50=gYEwOUZDM0QzRDU0M0M0NzIxQzM1MkY3MjBBODM4MTU1NzBCMjA1REE4MzgxNTMzNEVEMDFEQjlDNkNBMkFERUU2NTAzRTA0RTQwMzA4NjAyQzQwRDMxMDlCMUJGRDdCMUE1MBIxMzM1NzkyMTIzMjgzNjMxNjMYbHVrbHRkLW15LnNoYXJlcG9pbnQuY29tCo4y0DKHsLbFG0fCNx32miQVLQ2Tmrv0QazI+fVgctBck2BlHxc4+PCpEkPCvdVvDyWI+E7GJYi4Kn/KCGCPIHNRd9HMy5kZ/h6ogysgmo4L/tNSevtuah93scDxKxE5nbaTZrMV9/Nfo0vt29+I4QbiApyCZjksFbWqR8h7ScMd4SbuNjqOjEWb4k/+aLQ9U50+b2V8Dci7VRyiIXWCLnm3a1m8UXtI2WTR9Fw9/jQDjnECcHw0zbsyMzuJMDDjgCk/jnmbfT575eigpJYjflwDKQ+piNWqAyAp6HctaE14fnFItZzPt55BWIdJDPMQxDZEYRoj5mLOo2NTuf5q0pAAAAA=; expires=Thu, 18-Apr-2024 13:40:32 GMT; path=/; SameSite=None; secure; HttpOnly Set-Cookie: nSGt-1DB9C6CA2ADEE6503E04E40308602C40D3109B1BFD7B1A50=; expires=Thu, 01-Jan-1970 08:00:00 GMT; path=/; SameSite=None; Partitioned; secure; HttpOnly Set-Cookie: RpsContextCookie=U291cmNlPSUyRnBlcnNvbmFsJTJGamFjayU1RnF1aW5uJTVGbG9naWNhbGlzJTVGY29tJTJGRG9jdW1lbnRzJTJGTmV0QXBwJTJGVW5pdGVkJTIwRHJ1ZyUyRlVuaXRlZCUyMERydWclMjBBRkYlMjBBMjAwJTIwSW5zdGFsbGF0aW9uJTIwJTIwdjElMkUxJTJFeGxzeCUzRmQlM0R3NTUzMGJlN2ZmMTlkNDFlYjhhMTgzMzQzZThkNmU0ZGMlMjZ3ZWIlM0QxJlByZXZpb3VzUmVxdWVzdENvcnJlbGF0aW9uSWQ9OTIzOTIwYTElMkQ0MGUzJTJEODAwMCUyRGFjNmQlMkQ3ZGM3M2I5MTM3ZDUmUmV0dXJuVXJsPSUyRnBlcnNvbmFsJTJGamFjayU1RnF1aW5uJTVGbG9naWNhbGlzJTVGY29tJTJGJTVGbGF5b3V0cyUyRjE1JTJGQXV0aGVudGljYXRlJTJFYXNweCUzRlNvdXJjZSUzRCUyNTJGcGVyc29uYWwlMjUyRmphY2slMjU1RnF1aW5uJTI1NUZsb2dpY2FsaXMlMjU1RmNvbSUyNTJGRG9jdW1lbnRzJTI1MkZOZXRBcHAlMjUyRlVuaXRlZCUyNTIwRHJ1ZyUyNTJGVW5pdGVkJTI1MjBEcnVnJTI1MjBBRkYlMjUyMEEyMDAlMjUyMEluc3RhbGxhdGlvbiUyNTIwJTI1MjB2MSUyNTJFMSUyNTJFeGxzeCUyNTNGZCUyNTNEdzU1MzBiZTdmZjE5ZDQxZWI4YTE4MzM0M2U4ZDZlNGRjJTI1MjZ3ZWIlMjUzRDE=; expires=Thu, 18-Apr-2024 13:46:32 GMT; path=/; SameSite=None; secure; HttpOnly Set-Cookie: RpsContextCookie=; expires=Thu, 01-Jan-1970 08:00:00 GMT; path=/; SameSite=None; Partitioned; secure; HttpOnly X-NetworkStatistics: 0,525568,0,0,878755,0,126370 X-SharePointHealthScore: 2 X-AspNet-Version: 4.0.30319 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: 923920a1-40e3-8000-ac6d-7dc73b9137d5 request-id: 923920a1-40e3-8000-ac6d-7dc73b9137d5 MS-CV: oSA5kuNAAICsbX3HO5E31Q.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=eec52a17-bb08-469c-ad42-2e8c8071934f&destinationEndpoint=Edge-Prod-ATL33r5d&frontEnd=AFD&RemoteIP=81.181.57.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 SPRequestDuration: 44 SPIisLatency: 1 Include-Referred-Token-Binding-ID: true X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 14BB32E3727748D9BF2E50D7F3F09542 Ref B: ATL331000107047 Ref C: 2024-04-18T13:36:32Z Date: Thu, 18 Apr 2024 13:36:32 GMT Connection: close
2024-04-18 13:36:32 UTC	882	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 3a 34 34 33 2f 65 65 63 35 32 61 31 37 2d 62 62 30 38 2d 34 36 39 63 2d 61 64 34 32 2d 32 65 38 63 38 30 37 31 39 33 34 66 2f 6f 61 75 74 68 32 2f 61 75 74 68 6f 72 69 7a 65 3f 63 6c 69 65 6e 74 25 35 46 69 64 3d 30 30 30 30 30 30 30 33 25 32 44 30 30 30 30 25 32 44 30 66 66 31 25 32 44 63 65 30 30 25 32 44 30 30 30 30 30 30 30 30 30 30 30 30 26 61 6d 70 3b 72 65 73 70 6f 6e 73 65 25 35 46 6d 6f 64 65 3d 66 6f 72 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://login.microsoftonline.com:443/eec52a17-bb08-469c-ad42-2e8c8071934f/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=for

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49717	184.31.62.93	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 13:36:34 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-18 13:36:34 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/079C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=235607 Date: Thu, 18 Apr 2024 13:36:34 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49718	13.107.246.41	443	7108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 13:36:34 UTC	633	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 13:36:35 UTC	818	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 13:36:35 GMT Content-Type: application/x-javascript Content-Length: 49632 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Tue, 26 Mar 2024 18:07:05 GMT ETag: 0x8DC4DBF8B990C6B x-ms-request-id: 5bb51516-d01e-004f-7966-91bf90000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240418T133635Z-r1f585c6b65rth2nfsetehk7wn00000007vg000000006kpn x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-18 13:36:35 UTC	15566	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e4 bd eb 5b e3 38 d2 38 fa fd fd 2b 82 77 0f 13 4f 4c c8 05 68 70 70 e7 97 06 ba 9b 19 20 0c 81 e9 99 05 96 c7 89 15 70 77 b0 b3 b6 c3 65 20 e7 6f 3f 75 91 6c d9 71 e8 9e 7d cf 73 be 9c b9 04 5b 2a c9 52 a9 aa 54 55 2a 49 eb 3f af fc 4f e5 e7 ca da 8f ff 53 19 9c f7 ce ce 2b fd 8f 95 f3 cf 87 67 fb 95 53 78 fb b3 72 d2 3f 3f dc 3b f8 f1 7a f0 a3 f8 ff f9 9d 1f 57 c6 fe 44 54 e0 ef d0 8d 85 57 09 83 4a 18 55 fc 60 14 46 d3 30 72 13 11 57 ee e1 37 f2 dd 49 65 1c 85 f7 95 e4 4e 54 a6 51 f8 55 8c 92 b8 32 f1 e3 04 0a 0d c5 24 7c ac 54 a1 ba c8 ab 9c ba 51 f2 5c 39 3c 35 eb 50 bf 80 da fc 5b 3f 80 d2 a3 70 fa 0c cf 77 49 25 08 13 7f 24 2a 6e e0 51 6d 13 78 09 62 51 99 05 9e 88 2a 8f 77 fe e8 ae 72 ec 8f a2 30 0e c7 49 25 12 23 e1 Data Ascii: [88+wOLhpp pwe o?ulq}s[RTUI?OS+gSxr??;zWDTWJU`F0rW7IeNTQU2$\|TQ\9<5P[?pwI%$nQmxbQwr0I%#
2024-04-18 13:36:35 UTC	16384	IN	Data Raw: 54 e8 18 15 8b 89 14 57 a2 6c bc e0 07 a6 80 09 c8 16 10 1e f1 47 54 39 1b 8d a5 67 aa e2 65 f5 9d a0 4e c7 2f 5d 04 77 80 5e 40 f9 c1 13 9e 67 01 b0 7d 30 45 bf 32 2d e7 8e d4 14 97 06 1d e8 63 5c 57 4b 8e 64 14 1d bc 32 11 50 05 56 47 38 e6 d3 ca e8 2c 7b ed ec b2 f4 5b 15 79 84 6b 25 52 5f b2 2b 46 0d cf 3d 8c 85 d2 50 b4 8f 98 2f f2 a4 a8 b9 69 35 e8 72 02 40 5c e9 8d 73 0b c7 bf 69 17 8a 45 5a 8d a1 e5 e3 dd 08 e9 3d 72 55 d3 ac a3 e8 a4 8c 65 8d 08 f1 fc 7e 13 af f3 31 cd 37 70 bb 69 5a 74 f6 49 03 8f 15 c7 d3 c0 2c 97 31 9e 9d 25 99 a2 0d 4f 16 c7 83 51 66 8e 8f e7 b4 90 86 4f 07 20 f3 81 fb 7c 28 bc 35 a2 8b e8 eb 63 66 0e 36 ca 51 41 b9 47 b7 25 e6 f8 9c 06 f2 84 0e 99 b1 f8 8c a8 ec 83 9e 76 1c 67 fe 76 bb 89 3a cd 6b 72 29 ae e5 31 8b 13 cb 8d Data Ascii: TWlGT9geN/]w^@g}0E2-c\WKd2PVG8,{[yk%R_+F=P/i5r@\siEZ=rUe~17piZtI,1%OQfO \|(5cf6QAG%vgv:kr)1
2024-04-18 13:36:35 UTC	16384	IN	Data Raw: d5 86 60 33 d4 ee 0e 52 a8 d1 b9 e2 6a 7b c5 bf ea 36 f4 d7 7c 3c 3b 69 d7 d9 b2 bc f5 47 2b a9 c4 5e 81 a5 ae 45 36 4e 76 6d 11 53 b1 a3 55 23 dd 42 e2 1b ac 4b a9 8e 07 0c 6e ab 98 b7 cc 38 3a f1 5b 07 51 fd a0 2f 55 68 5d c6 7a d6 6b 16 2c 47 3a d3 a6 ce 95 39 69 e8 96 da 4f 03 4e 42 db 60 15 1b 66 45 59 20 1d bf 69 a0 6f fd 6b 95 16 c9 84 23 1d f4 85 6b 5f 79 ee b1 29 d6 9a 96 a4 47 2f c0 39 9f 7f 8f e1 54 ec 28 93 bb 73 22 31 36 d6 0d 92 85 85 fc 07 89 eb bc 2f 89 ae a8 2f f8 83 e9 0a 7c fe e0 c9 cb 67 8a 70 21 4f 14 08 1e 28 3c 48 63 d5 b4 6c 76 cd 24 99 d6 21 76 28 a1 76 41 47 26 4b 62 d7 f5 b6 00 61 32 b0 f4 dd 7c ab 3b 59 3f e0 f7 8c 8f a6 55 11 89 2d 90 a4 11 aa 9e cf 05 76 78 98 76 92 1a d4 0d e1 76 a0 63 3a 7d a6 fe 3a a3 aa 45 9c 80 4d 88 4c Data Ascii: `3Rj{6\|<;iG+^E6NvmSU#BKn8:[Q/Uh]zk,G:9iONB`fEY iok#k_y)G/9T(s"16//\|gp!O(<Hclv$!v(vAG&Kba2\|;Y?U-vxvvc:}:EML
2024-04-18 13:36:35 UTC	1298	IN	Data Raw: dc 00 b7 88 03 05 8e ec fa fd 82 bd 9f 8c 0b 40 5f cc ab 16 c9 2c 13 c1 24 45 9b f2 c5 95 32 0f ac 16 0c f7 e9 05 a9 ed 10 12 2b 87 10 71 c9 25 6e 4c d0 b4 d8 26 e3 b3 13 af d7 74 bb 7d 57 d3 95 83 db 5b 37 ea 39 ca bb f7 00 bc c7 7d 71 70 80 36 07 87 17 11 46 47 79 ad 8b 01 fd 00 09 4b 55 8e 3a 38 8f 1e 84 6f dc b5 0c 51 d0 bb ee cc 84 05 26 25 92 1e 94 cd 46 8d dc 13 3a 77 0e ea ae 3c 71 25 c3 84 72 72 e7 c4 a4 e1 cd 68 9e 16 65 c5 b1 5d e3 6c ec 81 f7 8c 45 1d 0f a2 72 ff be b3 5c 66 d3 6c 99 e4 8b b3 8b 74 76 96 9c 5d 4c 2f a6 1f 2f cf 17 d4 96 7c 99 7e 4c 1d 76 b6 c7 4b 70 03 a2 1f c8 6f 23 8e 6b 12 b1 97 79 ed ef b0 ef 8e 02 df b7 67 c5 79 95 1b c7 9c 86 93 8e 72 77 64 cf 6d b8 1a 8e 1c a5 d9 35 ce 2c b6 af 91 eb 98 05 3b 82 33 5d d2 9e 83 f7 65 3d Data Ascii: @_,$E2+q%nL&t}W[79}qp6FGyKU:8oQ&%F:w<q%rrhe]lEr\fltv]L//\|~LvKpo#kygyrwdm5,;3]e=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49719	184.31.62.93	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 13:36:35 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-18 13:36:35 UTC	805	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0778) X-CID: 11 X-CCC: US X-Azure-Ref-OriginShield: Ref A: 52EA27DBDE0C4533B819423583F6692E Ref B: CH1AA2040902052 Ref C: 2023-07-09T23:10:08Z X-MSEdge-Ref: Ref A: 528BB8D443C042AA9AEA4EC3F75C7762 Ref B: CHI30EDGE0111 Ref C: 2023-07-09T23:11:11Z Content-Type: application/octet-stream X-Azure-Ref: 01uvbYwAAAACkqWtaEMjWQL/4cpisZkorTUVNMzBFREdFMDgxMQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=235627 Date: Thu, 18 Apr 2024 13:36:35 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-18 13:36:35 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49723	152.199.4.44	443	7108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 13:36:36 UTC	660	OUT	GET /ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 13:36:37 UTC	734	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 4496484 Cache-Control: public, max-age=31536000 Content-MD5: kqhA3D0Xczna4D/t8ioitQ== Content-Type: text/css Date: Thu, 18 Apr 2024 13:36:37 GMT Etag: 0x8DC070858CA028D Last-Modified: Wed, 27 Dec 2023 18:19:21 GMT Server: ECAcc (agc/7F47) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: dfa3d384-201e-0075-56b0-682f2c000000 x-ms-version: 2009-09-19 Content-Length: 113084 Connection: close
2024-04-18 13:36:37 UTC	16383	IN	Data Raw: 2f 2a 21 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2a 2f 2f 2a 21 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 0a 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 Data Ascii: /! Copyright (C) Microsoft Corporation. All rights reserved. //*!------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------This file is based on or incorporates material from the projects listed
2024-04-18 13:36:37 UTC	1	IN	Data Raw: 73 Data Ascii: s
2024-04-18 13:36:37 UTC	16383	IN	Data Raw: 2d 31 2c 2e 63 6f 6c 2d 78 73 2d 32 2c 2e 63 6f 6c 2d 78 73 2d 33 2c 2e 63 6f 6c 2d 78 73 2d 34 2c 2e 63 6f 6c 2d 78 73 2d 35 2c 2e 63 6f 6c 2d 78 73 2d 36 2c 2e 63 6f 6c 2d 78 73 2d 37 2c 2e 63 6f 6c 2d 78 73 2d 38 2c 2e 63 6f 6c 2d 78 73 2d 39 2c 2e 63 6f 6c 2d 78 73 2d 31 30 2c 2e 63 6f 6c 2d 78 73 2d 31 31 2c 2e 63 6f 6c 2d 78 73 2d 31 32 2c 2e 63 6f 6c 2d 78 73 2d 31 33 2c 2e 63 6f 6c 2d 78 73 2d 31 34 2c 2e 63 6f 6c 2d 78 73 2d 31 35 2c 2e 63 6f 6c 2d 78 73 2d 31 36 2c 2e 63 6f 6c 2d 78 73 2d 31 37 2c 2e 63 6f 6c 2d 78 73 2d 31 38 2c 2e 63 6f 6c 2d 78 73 2d 31 39 2c 2e 63 6f 6c 2d 78 73 2d 32 30 2c 2e 63 6f 6c 2d 78 73 2d 32 31 2c 2e 63 6f 6c 2d 78 73 2d 32 32 2c 2e 63 6f 6c 2d 78 73 2d 32 33 2c 2e 63 6f 6c 2d 78 73 2d 32 34 7b 66 6c 6f 61 74 3a 6c Data Ascii: -1,.col-xs-2,.col-xs-3,.col-xs-4,.col-xs-5,.col-xs-6,.col-xs-7,.col-xs-8,.col-xs-9,.col-xs-10,.col-xs-11,.col-xs-12,.col-xs-13,.col-xs-14,.col-xs-15,.col-xs-16,.col-xs-17,.col-xs-18,.col-xs-19,.col-xs-20,.col-xs-21,.col-xs-22,.col-xs-23,.col-xs-24{float:l
2024-04-18 13:36:37 UTC	1	IN	Data Raw: 67 Data Ascii: g
2024-04-18 13:36:37 UTC	16383	IN	Data Raw: 69 6e 2d 6c 65 66 74 3a 39 35 2e 38 33 33 33 33 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 32 34 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 31 30 30 25 7d 7d 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 62 6f 72 64 65 72 3a 30 3b 6d 69 6e 2d 77 69 64 74 68 3a 30 7d 6c 65 67 65 6e 64 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 31 30 30 25 3b 70 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 7d 6c 61 62 65 6c 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 65 61 72 63 68 22 5d 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 Data Ascii: in-left:95.83333%}.col-xl-offset-24{margin-left:100%}}fieldset{padding:0;margin:0;border:0;min-width:0}legend{display:block;width:100%;padding:0;border:0}label{display:inline-block;max-width:100%}input[type="search"]{-webkit-box-sizing:border-box;-moz-box
2024-04-18 13:36:37 UTC	1	IN	Data Raw: 6f Data Ascii: o
2024-04-18 13:36:37 UTC	16383	IN	Data Raw: 77 2d 78 3a 61 75 74 6f 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2e 30 31 25 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 35 33 39 70 78 29 7b 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 7b 77 69 64 74 68 3a 31 30 30 25 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 35 70 78 3b 6f 76 65 72 66 6c 6f 77 2d 79 3a 68 69 64 64 65 6e 3b 2d 6d 73 2d 6f 76 65 72 66 6c 6f 77 2d 73 74 79 6c 65 3a 2d 6d 73 2d 61 75 74 6f 68 69 64 69 6e 67 2d 73 63 72 6f 6c 6c 62 61 72 7d 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 3e 2e 74 61 62 6c 65 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 3e 2e 74 61 62 6c 65 3e 74 68 65 61 64 3e 74 72 3e 74 68 2c 2e 74 61 62 6c 65 Data Ascii: w-x:auto;min-height:.01%}@media screen and (max-width:539px){.table-responsive{width:100%;margin-bottom:15px;overflow-y:hidden;-ms-overflow-style:-ms-autohiding-scrollbar}.table-responsive>.table{margin-bottom:0}.table-responsive>.table>thead>tr>th,.table
2024-04-18 13:36:37 UTC	16383	IN	Data Raw: 2c 22 54 75 6e 67 61 22 2c 22 4c 61 6f 20 55 49 22 2c 22 52 61 61 76 69 22 2c 22 49 73 6b 6f 6f 6c 61 20 50 6f 74 61 22 2c 22 4c 61 74 68 61 22 2c 22 4c 65 65 6c 61 77 61 64 65 65 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 59 61 48 65 69 20 55 49 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 4a 68 65 6e 67 48 65 69 20 55 49 22 2c 22 4d 61 6c 67 75 6e 20 47 6f 74 68 69 63 22 2c 22 45 73 74 72 61 6e 67 65 6c 6f 20 45 64 65 73 73 61 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 48 69 6d 61 6c 61 79 61 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 4e 65 77 20 54 61 69 20 4c 75 65 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 50 68 61 67 73 50 61 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 54 61 69 20 4c 65 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 59 69 20 42 61 69 74 69 22 2c 22 4d 6f 6e 67 6f 6c Data Ascii: ,"Tunga","Lao UI","Raavi","Iskoola Pota","Latha","Leelawadee","Microsoft YaHei UI","Microsoft JhengHei UI","Malgun Gothic","Estrangelo Edessa","Microsoft Himalaya","Microsoft New Tai Lue","Microsoft PhagsPa","Microsoft Tai Le","Microsoft Yi Baiti","Mongol
2024-04-18 13:36:37 UTC	2	IN	Data Raw: 79 70 Data Ascii: yp
2024-04-18 13:36:37 UTC	16383	IN	Data Raw: 65 3d 22 72 65 73 65 74 22 5d 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 35 64 61 36 7d 2e 62 74 6e 2e 62 74 6e 2d 70 72 69 6d 61 72 79 2d 66 6f 63 75 73 2c 2e 62 74 6e 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 66 6f 63 75 73 2c 62 75 74 74 6f 6e 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 5d 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 75 62 6d 69 74 22 5d 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 65 73 65 74 22 5d 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 66 6f 63 75 73 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c Data Ascii: e="reset"].btn-primary:hover{background-color:#005da6}.btn.btn-primary-focus,.btn.btn-primary:focus,button.btn-primary:focus,input[type="button"].btn-primary:focus,input[type="submit"].btn-primary:focus,input[type="reset"].btn-primary:focus{background-col

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49725	152.199.4.44	443	7108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 13:36:36 UTC	637	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 13:36:37 UTC	749	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 591096 Cache-Control: public, max-age=31536000 Content-MD5: CGjaLdXv/tkpBAR0OeSdSA== Content-Type: application/x-javascript Date: Thu, 18 Apr 2024 13:36:37 GMT Etag: 0x8DC4E99276653A1 Last-Modified: Wed, 27 Mar 2024 20:04:47 GMT Server: ECAcc (agc/7FA5) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: fc1a7177-801e-0093-6235-8cc057000000 x-ms-version: 2009-09-19 Content-Length: 444227 Connection: close
2024-04-18 13:36:37 UTC	16383	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-04-18 13:36:37 UTC	1	IN	Data Raw: 37 Data Ascii: 7
2024-04-18 13:36:37 UTC	16383	IN	Data Raw: 38 44 36 22 2c 50 50 5f 45 5f 49 44 50 5f 47 49 54 48 55 42 5f 42 49 4e 44 49 4e 47 5f 4e 4f 54 5f 41 4c 4c 4f 57 45 44 3a 22 38 30 30 34 37 38 44 37 22 2c 50 50 5f 45 5f 49 44 50 5f 42 49 4e 44 49 4e 47 5f 45 58 49 53 54 53 5f 53 41 4d 53 55 4e 47 3a 22 38 30 30 34 34 35 33 45 22 2c 50 50 5f 45 5f 54 52 41 4e 53 46 45 52 5f 54 4f 4b 45 4e 5f 49 4e 56 41 4c 49 44 5f 53 45 53 53 49 4f 4e 3a 22 38 30 30 34 33 35 41 30 22 7d 2c 6e 2e 45 73 74 73 45 72 72 6f 72 3d 7b 55 73 65 72 41 63 63 6f 75 6e 74 53 65 6c 65 63 74 69 6f 6e 49 6e 76 61 6c 69 64 3a 22 31 36 30 30 31 22 2c 55 73 65 72 55 6e 61 75 74 68 6f 72 69 7a 65 64 3a 22 35 30 30 32 30 22 2c 55 73 65 72 55 6e 61 75 74 68 6f 72 69 7a 65 64 41 70 69 56 65 72 73 69 6f 6e 4e 6f 74 53 75 70 70 6f 72 74 65 64 Data Ascii: 8D6",PP_E_IDP_GITHUB_BINDING_NOT_ALLOWED:"800478D7",PP_E_IDP_BINDING_EXISTS_SAMSUNG:"8004453E",PP_E_TRANSFER_TOKEN_INVALID_SESSION:"800435A0"},n.EstsError={UserAccountSelectionInvalid:"16001",UserUnauthorized:"50020",UserUnauthorizedApiVersionNotSupported
2024-04-18 13:36:37 UTC	16383	IN	Data Raw: 28 65 29 7b 76 61 72 20 6e 3d 65 2e 6f 72 69 67 69 6e 41 6e 64 50 61 74 68 7c 7c 22 22 3b 72 65 74 75 72 6e 20 65 2e 71 75 65 72 79 26 26 28 6e 2b 3d 22 3f 22 2b 63 2e 6a 6f 69 6e 28 65 2e 71 75 65 72 79 2c 22 26 22 2c 22 3d 22 29 29 2c 65 2e 66 72 61 67 6d 65 6e 74 26 26 28 6e 2b 3d 22 23 22 2b 63 2e 6a 6f 69 6e 28 65 2e 66 72 61 67 6d 65 6e 74 2c 22 26 22 2c 22 3d 22 29 29 2c 6e 7d 2c 61 70 70 65 6e 64 43 75 72 72 65 6e 74 51 75 65 72 79 50 61 72 61 6d 65 74 65 72 49 66 4e 6f 74 45 78 69 73 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 44 2e 70 61 72 73 65 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 3b 72 65 74 75 72 6e 20 63 2e 66 6f 72 45 61 63 68 28 6e 2e 71 75 65 72 79 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 Data Ascii: (e){var n=e.originAndPath\|\|"";return e.query&&(n+="?"+c.join(e.query,"&","=")),e.fragment&&(n+="#"+c.join(e.fragment,"&","=")),n},appendCurrentQueryParameterIfNotExist:function(e){var n=D.parse(window.location.href);return c.forEach(n.query,(function(n,t)
2024-04-18 13:36:37 UTC	16383	IN	Data Raw: 73 2e 74 72 61 63 65 42 65 67 69 6e 52 65 71 75 65 73 74 3d 75 28 22 74 72 61 63 65 42 65 67 69 6e 52 65 71 75 65 73 74 22 29 2c 73 2e 74 72 61 63 65 45 6e 64 52 65 71 75 65 73 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 2c 69 2c 61 29 7b 6c 3f 6c 2e 74 72 61 63 65 45 6e 64 52 65 71 75 65 73 74 28 65 2c 6e 2c 74 2c 69 2c 61 29 3a 61 26 26 61 28 29 7d 2c 73 2e 73 65 74 50 61 67 65 56 69 65 77 4d 6f 64 65 6c 3d 75 28 22 73 65 74 50 61 67 65 56 69 65 77 4d 6f 64 65 6c 22 29 2c 73 2e 6c 6f 67 43 6f 6d 70 6f 6e 65 6e 74 45 76 65 6e 74 3d 75 28 22 6c 6f 67 43 6f 6d 70 6f 6e 65 6e 74 45 76 65 6e 74 22 29 2c 73 2e 6c 6f 67 56 69 65 77 53 74 61 74 65 3d 75 28 22 6c 6f 67 56 69 65 77 53 74 61 74 65 22 29 2c 73 2e 73 65 74 56 69 65 77 56 69 65 77 4d 6f 64 65 6c Data Ascii: s.traceBeginRequest=u("traceBeginRequest"),s.traceEndRequest=function(e,n,t,i,a){l?l.traceEndRequest(e,n,t,i,a):a&&a()},s.setPageViewModel=u("setPageViewModel"),s.logComponentEvent=u("logComponentEvent"),s.logViewState=u("logViewState"),s.setViewViewModel
2024-04-18 13:36:37 UTC	16383	IN	Data Raw: 72 2e 65 78 74 72 61 63 74 28 22 6c 63 22 29 2c 61 3d 5b 5d 2e 63 6f 6e 63 61 74 28 6e 3f 5b 5b 22 6d 6b 74 22 2c 6e 5d 5d 3a 5b 5d 2c 74 3f 5b 5b 22 6c 63 69 64 22 2c 74 5d 5d 3a 5b 5d 2c 53 3f 5b 5b 22 69 64 22 2c 53 5d 5d 3a 5b 5d 2c 43 3f 5b 5b 22 63 6c 69 65 6e 74 5f 69 64 22 2c 43 5d 5d 3a 5b 5d 2c 77 3f 5b 5b 22 66 63 69 22 2c 77 5d 5d 3a 5b 5d 2c 78 3f 5b 5b 22 6e 6f 70 61 22 2c 78 5d 5d 3a 5b 5d 29 2c 63 3d 7b 74 61 72 67 65 74 55 72 6c 3a 72 2e 61 64 64 28 22 47 65 74 4f 6e 65 54 69 6d 65 43 6f 64 65 2e 73 72 66 22 2c 61 29 2c 72 65 71 75 65 73 74 54 79 70 65 3a 69 2e 52 65 71 75 65 73 74 54 79 70 65 2e 50 6f 73 74 2c 64 61 74 61 3a 6f 2e 67 65 6e 65 72 61 74 65 52 65 71 75 65 73 74 53 74 72 69 6e 67 28 6d 29 2c 69 73 41 73 79 6e 63 3a 21 30 2c Data Ascii: r.extract("lc"),a=[].concat(n?[["mkt",n]]:[],t?[["lcid",t]]:[],S?[["id",S]]:[],C?[["client_id",C]]:[],w?[["fci",w]]:[],x?[["nopa",x]]:[]),c={targetUrl:r.add("GetOneTimeCode.srf",a),requestType:i.RequestType.Post,data:o.generateRequestString(m),isAsync:!0,
2024-04-18 13:36:37 UTC	4	IN	Data Raw: 6f 6d 70 6f Data Ascii: ompo
2024-04-18 13:36:37 UTC	16383	IN	Data Raw: 6e 65 6e 74 28 70 2e 65 78 74 72 61 63 74 28 22 6d 6b 74 22 29 29 29 29 2c 65 3d 70 2e 61 70 70 65 6e 64 4f 72 52 65 70 6c 61 63 65 28 65 2c 22 6c 63 22 2c 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 70 2e 65 78 74 72 61 63 74 28 22 6c 63 22 29 29 29 29 7d 28 6e 2e 43 72 65 64 65 6e 74 69 61 6c 73 2e 46 65 64 65 72 61 74 69 6f 6e 52 65 64 69 72 65 63 74 55 72 6c 2c 65 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 6d 2e 43 6c 6f 75 64 46 65 64 65 72 61 74 69 6f 6e 3a 69 2e 69 64 70 52 65 64 69 72 65 63 74 55 72 6c 3d 6e 2e 43 72 65 64 65 6e 74 69 61 6c 73 2e 46 65 64 65 72 61 74 69 6f 6e 52 65 64 69 72 65 63 74 55 72 6c 3b 62 72 65 61 6b 3b 63 61 73 65 20 6d 2e 4c 69 6e 6b 65 64 49 6e 3a 69 2e Data Ascii: nent(p.extract("mkt")))),e=p.appendOrReplace(e,"lc",encodeURIComponent(decodeURIComponent(p.extract("lc"))))}(n.Credentials.FederationRedirectUrl,e);break;case m.CloudFederation:i.idpRedirectUrl=n.Credentials.FederationRedirectUrl;break;case m.LinkedIn:i.
2024-04-18 13:36:37 UTC	16383	IN	Data Raw: 29 7b 76 61 72 20 65 3d 4f 26 26 4f 2e 63 72 65 64 54 79 70 65 7c 7c 6d 2e 50 61 73 73 77 6f 72 64 3b 73 77 69 74 63 68 28 6e 2e 63 72 65 64 4c 69 6e 6b 45 72 72 6f 72 28 22 22 29 2c 65 29 7b 63 61 73 65 20 6d 2e 4f 6e 65 54 69 6d 65 43 6f 64 65 3a 69 66 28 4f 2e 70 72 6f 6f 66 2e 63 6c 65 61 72 44 69 67 69 74 73 29 6e 2e 6f 6e 53 77 69 74 63 68 56 69 65 77 28 67 2e 50 72 6f 6f 66 43 6f 6e 66 69 72 6d 61 74 69 6f 6e 2c 21 31 2c 4f 29 3b 65 6c 73 65 7b 76 61 72 20 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 75 73 65 72 6e 61 6d 65 3a 66 2e 63 6c 65 61 6e 73 65 55 73 65 72 6e 61 6d 65 28 61 29 2c 70 72 6f 6f 66 44 61 74 61 3a 4f 2e 70 72 6f 6f 66 2e 64 61 74 61 2c 70 72 6f 6f 66 54 79 70 65 3a 4f 2e 70 72 6f 6f 66 2e 74 79 70 65 2c 70 75 72 Data Ascii: ){var e=O&&O.credType\|\|m.Password;switch(n.credLinkError(""),e){case m.OneTimeCode:if(O.proof.clearDigits)n.onSwitchView(g.ProofConfirmation,!1,O);else{var t=function(){var e={username:f.cleanseUsername(a),proofData:O.proof.data,proofType:O.proof.type,pur
2024-04-18 13:36:37 UTC	16383	IN	Data Raw: 2e 73 68 6f 77 4c 6f 67 6f 28 29 7d 29 29 2c 61 2e 73 68 6f 77 45 72 72 6f 72 50 61 67 65 44 65 62 75 67 44 65 74 61 69 6c 73 3d 69 2e 70 75 72 65 43 6f 6d 70 75 74 65 64 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 2e 70 61 67 69 6e 61 74 69 6f 6e 43 6f 6e 74 72 6f 6c 4d 65 74 68 6f 64 73 28 29 26 26 61 2e 70 61 67 69 6e 61 74 69 6f 6e 43 6f 6e 74 72 6f 6c 4d 65 74 68 6f 64 73 28 29 2e 63 75 72 72 65 6e 74 56 69 65 77 48 61 73 4d 65 74 61 64 61 74 61 28 22 65 78 74 72 61 44 65 62 75 67 44 65 74 61 69 6c 73 22 29 7d 29 29 2c 61 2e 73 68 6f 77 46 6f 6f 74 65 72 43 6f 6e 74 72 6f 6c 3d 69 2e 70 75 72 65 43 6f 6d 70 75 74 65 64 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 72 26 26 61 2e 70 61 67 69 6e 61 74 69 6f 6e 43 6f 6e Data Ascii: .showLogo()})),a.showErrorPageDebugDetails=i.pureComputed((function(){return a.paginationControlMethods()&&a.paginationControlMethods().currentViewHasMetadata("extraDebugDetails")})),a.showFooterControl=i.pureComputed((function(){return!r&&a.paginationCon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49724	152.199.4.44	443	7108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 13:36:36 UTC	656	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_l2bvdjfwt697xziuhxpwsg2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 13:36:37 UTC	748	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 591096 Cache-Control: public, max-age=31536000 Content-MD5: l4psGqk05bHFMg1RX9JWYg== Content-Type: application/x-javascript Date: Thu, 18 Apr 2024 13:36:37 GMT Etag: 0x8DC4ECE6B595BA6 Last-Modified: Thu, 28 Mar 2024 02:26:05 GMT Server: ECAcc (agc/7F84) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 21e52600-501e-00c2-5c35-8c8866000000 x-ms-version: 2009-09-19 Content-Length: 55071 Connection: close
2024-04-18 13:36:37 UTC	16383	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 69 5b 6e 5d 29 72 65 74 75 72 6e 20 69 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 74 3d 69 5b 6e 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 2c 69 64 3a 6e 2c 6c 6f 61 64 65 64 3a 21 31 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 74 2e 65 78 70 6f 72 74 73 2c 74 2c 74 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 74 2e 6c 6f 61 64 65 64 3d 21 30 2c 74 2e 65 78 70 6f 72 74 73 7d 76 61 72 20 69 3d 7b 7d 3b 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 69 2c 6f 2e 70 3d 22 22 2c 6f 28 30 29 7d 28 5b 66 75 6e 63 74 69 6f 6e 28 65 2c 6f 2c 69 29 7b 69 28 32 29 3b 76 61 72 20 6e 3d 69 28 31 29 2c 74 3d 69 28 35 29 2c 72 3d 69 28 36 29 2c 61 3d 72 2e 53 74 72 69 6e Data Ascii: !function(e){function o(n){if(i[n])return i[n].exports;var t=i[n]={exports:{},id:n,loaded:!1};return e[n].call(t.exports,t,t.exports,o),t.loaded=!0,t.exports}var i={};return o.m=e,o.c=i,o.p="",o(0)}([function(e,o,i){i(2);var n=i(1),t=i(5),r=i(6),a=r.Strin
2024-04-18 13:36:37 UTC	16383	IN	Data Raw: 44 65 73 63 72 69 70 74 69 6f 6e 5f 55 6e 66 61 6d 69 6c 69 61 72 44 65 76 69 63 65 3d 22 54 6f 20 73 69 67 6e 20 69 6e 20 77 69 74 68 20 7b 30 7d 2c 20 70 6c 65 61 73 65 20 66 6f 6c 6c 6f 77 20 74 68 65 20 69 6e 73 74 72 75 63 74 69 6f 6e 73 20 6f 6e 20 79 6f 75 72 20 70 68 6f 6e 65 20 61 6e 64 20 65 6e 74 65 72 20 74 68 65 20 6e 75 6d 62 65 72 20 79 6f 75 20 73 65 65 20 62 65 6c 6f 77 2e 22 2c 65 2e 43 54 5f 52 4e 47 43 5f 53 54 52 5f 4c 53 5f 54 69 6d 65 6f 75 74 5f 54 69 74 6c 65 3d 22 52 65 71 75 65 73 74 20 74 69 6d 65 6f 75 74 22 2c 65 2e 43 54 5f 52 4e 47 43 5f 53 54 52 5f 4c 53 5f 54 69 6d 65 6f 75 74 5f 50 61 67 65 44 65 73 63 72 69 70 74 69 6f 6e 3d 22 57 65 20 64 69 64 6e 27 74 20 68 65 61 72 20 66 72 6f 6d 20 79 6f 75 20 69 6e 20 74 69 6d 65 Data Ascii: Description_UnfamiliarDevice="To sign in with {0}, please follow the instructions on your phone and enter the number you see below.",e.CT_RNGC_STR_LS_Timeout_Title="Request timeout",e.CT_RNGC_STR_LS_Timeout_PageDescription="We didn't hear from you in time
2024-04-18 13:36:37 UTC	16383	IN	Data Raw: 6f 74 50 61 73 73 77 6f 72 64 30 22 20 68 72 65 66 3d 22 23 22 3e 72 65 73 65 74 20 69 74 20 6e 6f 77 2e 3c 2f 61 3e 27 3a 27 59 6f 75 72 20 65 6d 61 69 6c 20 6f 72 20 70 61 73 73 77 6f 72 64 20 69 73 20 69 6e 63 6f 72 72 65 63 74 2e 20 49 66 20 79 6f 75 20 64 6f 6e 5c 27 74 20 72 65 6d 65 6d 62 65 72 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 2c 20 3c 61 20 69 64 3d 22 69 64 41 5f 49 4c 5f 46 6f 72 67 6f 74 50 61 73 73 77 6f 72 64 30 22 20 68 72 65 66 3d 22 23 22 3e 72 65 73 65 74 20 69 74 20 6e 6f 77 2e 3c 2f 61 3e 27 2c 65 2e 43 54 5f 53 54 52 5f 43 6f 6e 66 69 72 6d 53 65 6e 64 5f 4f 74 63 3d 22 57 65 27 6c 6c 20 73 65 6e 64 20 61 20 63 6f 64 65 20 74 6f 20 7b 30 7d 20 74 6f 20 73 69 67 6e 20 79 6f 75 20 69 6e 2e 22 2c 65 2e 43 54 5f 4f 54 43 5f 53 54 Data Ascii: otPassword0" href="#">reset it now.</a>':'Your email or password is incorrect. If you don\'t remember your password, <a id="idA_IL_ForgotPassword0" href="#">reset it now.</a>',e.CT_STR_ConfirmSend_Otc="We'll send a code to {0} to sign you in.",e.CT_OTC_ST
2024-04-18 13:36:37 UTC	5922	IN	Data Raw: 72 65 64 42 75 74 4e 6f 74 55 73 65 64 22 2c 49 6e 63 6f 6d 70 61 74 69 62 6c 65 41 70 70 56 65 72 73 69 6f 6e 3a 22 49 6e 63 6f 6d 70 61 74 69 62 6c 65 41 70 70 56 65 72 73 69 6f 6e 22 2c 46 6c 6f 77 54 6f 6b 65 6e 45 78 70 69 72 65 64 54 66 61 3a 22 46 6c 6f 77 54 6f 6b 65 6e 45 78 70 69 72 65 64 22 2c 41 70 70 6c 69 63 61 74 69 6f 6e 55 73 65 64 49 73 4e 6f 74 41 6e 41 70 70 72 6f 76 65 64 41 70 70 52 65 71 75 69 72 65 64 42 79 43 6f 6e 64 69 74 69 6f 6e 61 6c 41 63 63 65 73 73 3a 22 35 33 30 30 32 31 22 2c 42 6c 6f 63 6b 65 64 42 79 43 6f 6e 64 69 74 69 6f 6e 61 6c 41 63 63 65 73 73 3a 22 35 33 30 30 33 22 2c 42 6c 6f 63 6b 65 64 42 79 43 6f 6e 64 69 74 69 6f 6e 61 6c 41 63 63 65 73 73 46 6f 72 52 65 6d 6f 74 65 44 65 76 69 63 65 46 6c 6f 77 3a 22 35 Data Ascii: redButNotUsed",IncompatibleAppVersion:"IncompatibleAppVersion",FlowTokenExpiredTfa:"FlowTokenExpired",ApplicationUsedIsNotAnApprovedAppRequiredByConditionalAccess:"530021",BlockedByConditionalAccess:"53003",BlockedByConditionalAccessForRemoteDeviceFlow:"5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49728	152.199.4.44	443	7108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 13:36:38 UTC	579	OUT	GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 13:36:38 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2181723 Cache-Control: public, max-age=31536000 Content-MD5: wegr9xrdYirQ87+FcvY0/A== Content-Type: application/x-javascript Date: Thu, 18 Apr 2024 13:36:38 GMT Etag: 0x8DB5D44A2CEB430 Last-Modified: Thu, 25 May 2023 17:22:37 GMT Server: ECAcc (agc/7F33) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 7ccf8736-d01e-0036-34bd-7d813b000000 x-ms-version: 2009-09-19 Content-Length: 190152 Connection: close
2024-04-18 13:36:38 UTC	16383	IN	Data Raw: 28 77 69 6e 64 6f 77 2e 74 65 6c 65 6d 65 74 72 79 5f 77 65 62 70 61 63 6b 4a 73 6f 6e 70 3d 77 69 6e 64 6f 77 2e 74 65 6c 65 6d 65 74 72 79 5f 77 65 62 70 61 63 6b 4a 73 6f 6e 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 32 5d 2c 5b 2c 2c 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 72 28 74 29 2c 6e 2e 64 28 74 2c 22 56 61 6c 75 65 4b 69 6e 64 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 2e 65 7d 29 29 2c 6e 2e 64 28 74 2c 22 45 76 65 6e 74 4c 61 74 65 6e 63 79 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 2e 61 7d 29 29 2c 6e 2e 64 28 74 2c 22 45 76 65 6e 74 50 65 72 73 69 73 74 65 6e 63 65 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 2e 62 7d Data Ascii: (window.telemetry_webpackJsonp=window.telemetry_webpackJsonp\|\|[]).push([[2],[,,,function(e,t,n){"use strict";n.r(t),n.d(t,"ValueKind",(function(){return r.e})),n.d(t,"EventLatency",(function(){return r.a})),n.d(t,"EventPersistence",(function(){return r.b}
2024-04-18 13:36:38 UTC	16383	IN	Data Raw: 74 2c 22 50 72 6f 70 65 72 74 69 65 73 50 6c 75 67 69 6e 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 67 2e 61 7d 29 29 2c 6e 2e 64 28 74 2c 22 50 6f 73 74 43 68 61 6e 6e 65 6c 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 76 2e 61 7d 29 29 2c 6e 2e 64 28 74 2c 22 43 6f 72 65 55 74 69 6c 73 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 2e 61 7d 29 29 2c 6e 2e 64 28 74 2c 22 42 45 5f 50 52 4f 46 49 4c 45 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 70 2e 61 7d 29 29 2c 6e 2e 64 28 74 2c 22 4e 52 54 5f 50 52 4f 46 49 4c 45 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 70 2e 62 7d 29 29 2c 6e 2e 64 28 74 2c 22 52 54 5f 50 52 4f 46 49 4c 45 22 2c 28 66 75 6e 63 74 69 6f Data Ascii: t,"PropertiesPlugin",(function(){return g.a})),n.d(t,"PostChannel",(function(){return v.a})),n.d(t,"CoreUtils",(function(){return c.a})),n.d(t,"BE_PROFILE",(function(){return p.a})),n.d(t,"NRT_PROFILE",(function(){return p.b})),n.d(t,"RT_PROFILE",(functio
2024-04-18 13:36:38 UTC	2	IN	Data Raw: 68 69 Data Ascii: hi
2024-04-18 13:36:38 UTC	16383	IN	Data Raw: 73 2e 74 79 70 65 4e 61 6d 65 29 29 7c 7c 22 6e 6f 74 5f 73 70 65 63 69 66 69 65 64 22 3b 76 61 72 20 61 3d 74 2e 73 74 61 63 6b 44 65 74 61 69 6c 73 7c 7c 6c 65 28 74 29 3b 74 68 69 73 2e 70 61 72 73 65 64 53 74 61 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3d 65 2e 6f 62 6a 3b 69 66 28 6e 26 26 6e 2e 6c 65 6e 67 74 68 3e 30 29 7b 74 3d 5b 5d 3b 76 61 72 20 72 3d 30 2c 69 3d 30 3b 4f 62 6a 65 63 74 28 53 2e 62 29 28 6e 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 67 65 2e 72 65 67 65 78 2e 74 65 73 74 28 6e 29 29 7b 76 61 72 20 61 3d 6e 65 77 20 67 65 28 6e 2c 72 2b 2b 29 3b 69 2b 3d 61 2e 73 69 7a 65 49 6e 42 79 74 65 73 2c 74 2e 70 75 73 68 28 61 29 7d 7d 29 29 3b 69 Data Ascii: s.typeName))\|\|"not_specified";var a=t.stackDetails\|\|le(t);this.parsedStack=function(e){var t,n=e.obj;if(n&&n.length>0){t=[];var r=0,i=0;Object(S.b)(n,(function(e){var n=e.toString();if(ge.regex.test(n)){var a=new ge(n,r++);i+=a.sizeInBytes,t.push(a)}}));i
2024-04-18 13:36:38 UTC	16383	IN	Data Raw: 79 20 70 72 65 76 65 6e 74 73 20 75 73 20 66 72 6f 6d 20 67 65 74 74 69 6e 67 20 74 68 65 20 64 65 74 61 69 6c 73 20 6f 66 20 74 68 69 73 20 65 78 63 65 70 74 69 6f 6e 2e 20 43 6f 6e 73 69 64 65 72 20 75 73 69 6e 67 20 74 68 65 20 27 63 72 6f 73 73 6f 72 69 67 69 6e 27 20 61 74 74 72 69 62 75 74 65 2e 22 2c 61 2c 74 2e 6c 69 6e 65 4e 75 6d 62 65 72 7c 7c 30 2c 74 2e 63 6f 6c 75 6d 6e 4e 75 6d 62 65 72 7c 7c 30 2c 6e 2c 72 2c 6e 75 6c 6c 2c 6f 29 2c 63 29 3a 28 74 2e 65 72 72 6f 72 53 72 63 7c 7c 28 74 2e 65 72 72 6f 72 53 72 63 3d 6f 29 2c 65 2e 74 72 61 63 6b 45 78 63 65 70 74 69 6f 6e 28 7b 65 78 63 65 70 74 69 6f 6e 3a 74 2c 73 65 76 65 72 69 74 79 4c 65 76 65 6c 3a 33 7d 2c 63 29 29 7d 63 61 74 63 68 28 65 29 7b 76 61 72 20 75 3d 6e 3f 6e 2e 6e 61 6d Data Ascii: y prevents us from getting the details of this exception. Consider using the 'crossorigin' attribute.",a,t.lineNumber\|\|0,t.columnNumber\|\|0,n,r,null,o),c):(t.errorSrc\|\|(t.errorSrc=o),e.trackException({exception:t,severityLevel:3},c))}catch(e){var u=n?n.nam
2024-04-18 13:36:38 UTC	16383	IN	Data Raw: 3d 4f 62 6a 65 63 74 28 63 2e 74 29 28 65 29 3f 65 3a 7b 7d 3b 76 61 72 20 6e 3d 7b 7d 2c 72 3d 4f 62 6a 65 63 74 28 63 2e 74 29 28 74 29 3f 74 3a 7b 7d 3b 74 68 69 73 2e 5f 73 65 74 42 61 73 69 63 50 72 6f 70 65 72 74 69 65 73 28 6e 2c 65 29 2c 74 68 69 73 2e 5f 73 65 74 50 61 67 65 54 61 67 73 28 6e 2c 65 29 2c 6e 2e 69 73 4d 61 6e 75 61 6c 3d 21 65 2e 69 73 41 75 74 6f 2c 72 2e 62 65 68 61 76 69 6f 72 3d 74 68 69 73 2e 5f 67 65 74 42 65 68 61 76 69 6f 72 28 65 29 2c 72 2e 76 70 48 65 69 67 68 74 3d 65 2e 76 70 48 65 69 67 68 74 2c 72 2e 76 70 57 69 64 74 68 3d 65 2e 76 70 57 69 64 74 68 2c 72 2e 66 72 61 6d 65 77 6f 72 6b 3d 65 2e 66 72 61 6d 65 77 6f 72 6b 2c 72 2e 73 79 73 74 65 6d 54 69 6d 69 6e 67 3d 65 2e 73 79 73 74 65 6d 54 69 6d 69 6e 67 2c 72 Data Ascii: =Object(c.t)(e)?e:{};var n={},r=Object(c.t)(t)?t:{};this._setBasicProperties(n,e),this._setPageTags(n,e),n.isManual=!e.isAuto,r.behavior=this._getBehavior(e),r.vpHeight=e.vpHeight,r.vpWidth=e.vpWidth,r.framework=e.framework,r.systemTiming=e.systemTiming,r
2024-04-18 13:36:38 UTC	16383	IN	Data Raw: 72 22 5d 29 2c 65 2e 65 6d 70 74 79 53 6e 69 70 70 65 74 51 75 65 75 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 72 79 7b 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 29 7b 4f 62 6a 65 63 74 28 53 2e 73 29 28 6e 29 7c 7c 6e 2c 4f 62 6a 65 63 74 28 53 2e 43 29 28 65 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 72 29 7b 69 66 28 4f 62 6a 65 63 74 28 53 2e 76 29 28 6e 29 26 26 21 4f 62 6a 65 63 74 28 53 2e 70 29 28 72 29 26 26 6e 26 26 22 5f 22 21 3d 3d 6e 5b 30 5d 26 26 2d 31 3d 3d 3d 4f 62 6a 65 63 74 28 53 2e 63 29 28 52 74 2c 6e 29 29 74 72 79 7b 74 5b 6e 5d 3d 72 7d 63 61 74 63 68 28 74 29 7b 4f 62 6a 65 63 74 28 66 2e 64 29 28 65 2e 6c 6f 67 67 65 72 2c 32 2c 35 31 34 2c 22 46 61 69 6c 65 64 20 74 6f 20 73 65 74 20 5b 22 2b 6e 2b 22 5d 20 64 75 72 Data Ascii: r"]),e.emptySnippetQueue=function(t){try{if(function(){if(t){Object(S.s)(n)\|\|n,Object(S.C)(e,(function(n,r){if(Object(S.v)(n)&&!Object(S.p)(r)&&n&&"_"!==n[0]&&-1===Object(S.c)(Rt,n))try{t[n]=r}catch(t){Object(f.d)(e.logger,2,514,"Failed to set ["+n+"] dur
2024-04-18 13:36:38 UTC	16383	IN	Data Raw: 65 2e 69 6e 64 65 78 4f 66 28 74 2c 6e 29 3b 76 61 72 20 72 3d 65 5b 61 2e 78 5d 2c 69 3d 6e 7c 7c 30 3b 74 72 79 7b 66 6f 72 28 76 61 72 20 6f 3d 4d 61 74 68 2e 6d 61 78 28 69 3e 3d 30 3f 69 3a 72 2d 4d 61 74 68 2e 61 62 73 28 69 29 2c 30 29 3b 6f 3c 72 3b 6f 2b 2b 29 69 66 28 6f 20 69 6e 20 65 26 26 65 5b 6f 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6f 7d 63 61 74 63 68 28 65 29 7b 7d 7d 72 65 74 75 72 6e 2d 31 7d 66 75 6e 63 74 69 6f 6e 20 57 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3b 69 66 28 65 29 7b 69 66 28 65 2e 6d 61 70 29 72 65 74 75 72 6e 20 65 2e 6d 61 70 28 74 2c 6e 29 3b 76 61 72 20 69 3d 65 5b 61 2e 78 5d 2c 6f 3d 6e 7c 7c 65 3b 72 3d 6e 65 77 20 41 72 72 61 79 28 69 29 3b 74 72 79 7b 66 6f 72 28 76 61 72 20 63 3d 30 3b 63 3c 69 3b 63 2b 2b 29 Data Ascii: e.indexOf(t,n);var r=e[a.x],i=n\|\|0;try{for(var o=Math.max(i>=0?i:r-Math.abs(i),0);o<r;o++)if(o in e&&e[o]===t)return o}catch(e){}}return-1}function W(e,t,n){var r;if(e){if(e.map)return e.map(t,n);var i=e[a.x],o=n\|\|e;r=new Array(i);try{for(var c=0;c<i;c++)
2024-04-18 13:36:38 UTC	16383	IN	Data Raw: 2e 45 5d 7c 7c 39 3d 3d 3d 65 5b 69 2e 45 5d 7c 7c 21 2b 65 5b 69 2e 45 5d 7d 66 75 6e 63 74 69 6f 6e 20 64 28 65 2c 74 29 7b 76 61 72 20 6e 3d 74 5b 65 2e 69 64 5d 3b 69 66 28 21 6e 29 7b 6e 3d 7b 7d 3b 74 72 79 7b 6c 28 74 29 26 26 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 69 66 28 75 29 74 72 79 7b 72 65 74 75 72 6e 20 75 28 65 2c 74 2c 7b 76 61 6c 75 65 3a 6e 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 31 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 2c 21 30 7d 63 61 74 63 68 28 65 29 7b 7d 72 65 74 75 72 6e 21 31 7d 28 74 2c 65 2e 69 64 2c 6e 29 7c 7c 28 74 5b 65 2e 69 64 5d 3d 6e 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 62 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d Data Ascii: .E]\|\|9===e[i.E]\|\|!+e[i.E]}function d(e,t){var n=t[e.id];if(!n){n={};try{l(t)&&(function(e,t,n){if(u)try{return u(e,t,{value:n,enumerable:!1,configurable:!0}),!0}catch(e){}return!1}(t,e.id,n)\|\|(t[e.id]=n))}catch(e){}}return n}function b(e,t){return void 0=
2024-04-18 13:36:38 UTC	16383	IN	Data Raw: 73 65 74 4e 61 6d 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 64 26 26 64 2e 73 65 74 4e 61 6d 65 28 65 29 2c 62 2e 6e 61 6d 65 3d 65 7d 2c 67 65 74 54 72 61 63 65 49 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 2e 74 72 61 63 65 49 64 7d 2c 73 65 74 54 72 61 63 65 49 64 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 64 26 26 64 2e 73 65 74 54 72 61 63 65 49 64 28 65 29 2c 4f 62 6a 65 63 74 28 6f 2e 66 29 28 65 29 26 26 28 62 2e 74 72 61 63 65 49 64 3d 65 29 7d 2c 67 65 74 53 70 61 6e 49 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 2e 70 61 72 65 6e 74 49 64 7d 2c 73 65 74 53 70 61 6e 49 64 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 64 26 26 64 2e 73 65 74 53 70 61 6e 49 64 28 65 29 2c 4f 62 6a 65 63 74 28 6f 2e 65 29 28 65 29 26 26 Data Ascii: setName:function(e){d&&d.setName(e),b.name=e},getTraceId:function(){return b.traceId},setTraceId:function(e){d&&d.setTraceId(e),Object(o.f)(e)&&(b.traceId=e)},getSpanId:function(){return b.parentId},setSpanId:function(e){d&&d.setSpanId(e),Object(o.e)(e)&&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49729	152.199.4.44	443	7108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 13:36:38 UTC	651	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 13:36:39 UTC	719	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2181729 Cache-Control: public, max-age=31536000 Content-MD5: EuPayFgGHQiAI7K9SOL6lg== Content-Type: image/x-icon Date: Thu, 18 Apr 2024 13:36:39 GMT Etag: 0x8D8731240E548EB Last-Modified: Sun, 18 Oct 2020 03:02:30 GMT Server: ECAcc (agc/7F29) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 12fef581-701e-0054-4ebd-7d951d000000 x-ms-version: 2009-09-19 Content-Length: 17174 Connection: close
2024-04-18 13:36:39 UTC	16383	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-04-18 13:36:39 UTC	791	IN	Data Raw: 01 80 00 00 01 80 00 28 00 00 00 18 00 00 00 30 00 00 00 01 00 04 00 00 00 00 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 Data Ascii: (0"P""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49730	152.199.4.44	443	7108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 13:36:38 UTC	620	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 13:36:39 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2181718 Cache-Control: public, max-age=31536000 Content-MD5: eZ+IAUPxfkfE79uz/zWlTA== Content-Type: application/x-javascript Date: Thu, 18 Apr 2024 13:36:39 GMT Etag: 0x8DC2E5A3BC19A93 Last-Modified: Thu, 15 Feb 2024 19:13:46 GMT Server: ECAcc (agc/7F21) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: b4f08e49-b01e-0074-4ebd-7d042e000000 x-ms-version: 2009-09-19 Content-Length: 223759 Connection: close
2024-04-18 13:36:39 UTC	16383	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-04-18 13:36:39 UTC	16383	IN	Data Raw: 30 21 3d 3d 28 6e 3d 65 2e 6f 72 69 67 69 6e 61 6c 4c 69 6e 65 2d 74 2e 6f 72 69 67 69 6e 61 6c 4c 69 6e 65 29 7c 7c 30 21 3d 3d 28 6e 3d 65 2e 6f 72 69 67 69 6e 61 6c 43 6f 6c 75 6d 6e 2d 74 2e 6f 72 69 67 69 6e 61 6c 43 6f 6c 75 6d 6e 29 3f 6e 3a 66 28 65 2e 6e 61 6d 65 2c 74 2e 6e 61 6d 65 29 7d 2c 74 2e 63 6f 6d 70 61 72 65 42 79 47 65 6e 65 72 61 74 65 64 50 6f 73 69 74 69 6f 6e 73 49 6e 66 6c 61 74 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 72 3d 65 2e 67 65 6e 65 72 61 74 65 64 4c 69 6e 65 2d 74 2e 67 65 6e 65 72 61 74 65 64 4c 69 6e 65 3b 72 65 74 75 72 6e 20 30 21 3d 3d 72 7c 7c 30 21 3d 3d 28 72 3d 65 2e 67 65 6e 65 72 61 74 65 64 43 6f 6c 75 6d 6e 2d 74 2e 67 65 6e 65 72 61 74 65 64 43 6f 6c 75 6d 6e 29 7c 7c 30 21 3d 3d 28 Data Ascii: 0!==(n=e.originalLine-t.originalLine)\|\|0!==(n=e.originalColumn-t.originalColumn)?n:f(e.name,t.name)},t.compareByGeneratedPositionsInflated=function(e,t){var r=e.generatedLine-t.generatedLine;return 0!==r\|\|0!==(r=e.generatedColumn-t.generatedColumn)\|\|0!==(
2024-04-18 13:36:39 UTC	2	IN	Data Raw: 67 74 Data Ascii: gt
2024-04-18 13:36:39 UTC	16383	IN	Data Raw: 68 3b 69 2b 3d 32 29 6f 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 5b 69 5d 2b 32 35 36 2a 6e 5b 69 2b 31 5d 29 3b 72 65 74 75 72 6e 20 6f 7d 66 75 6e 63 74 69 6f 6e 20 52 28 65 2c 74 2c 72 29 7b 69 66 28 65 25 31 21 3d 30 7c 7c 65 3c 30 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 6f 66 66 73 65 74 20 69 73 20 6e 6f 74 20 75 69 6e 74 22 29 3b 69 66 28 65 2b 74 3e 72 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 54 72 79 69 6e 67 20 74 6f 20 61 63 63 65 73 73 20 62 65 79 6f 6e 64 20 62 75 66 66 65 72 20 6c 65 6e 67 74 68 22 29 7d 66 75 6e 63 74 69 6f 6e 20 4d 28 65 2c 74 2c 72 2c 6e 2c 6f 2c 69 29 7b 69 66 28 21 75 2e 69 73 42 75 66 66 65 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 Data Ascii: h;i+=2)o+=String.fromCharCode(n[i]+256*n[i+1]);return o}function R(e,t,r){if(e%1!=0\|\|e<0)throw new RangeError("offset is not uint");if(e+t>r)throw new RangeError("Trying to access beyond buffer length")}function M(e,t,r,n,o,i){if(!u.isBuffer(e))throw new
2024-04-18 13:36:39 UTC	16383	IN	Data Raw: 3d 74 68 69 73 3b 65 3d 65 2e 70 61 72 65 6e 74 3b 29 65 5b 68 5d 3d 21 31 7d 7d 7d 2c 7b 6b 65 79 3a 22 6e 65 78 74 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 74 68 69 73 2e 70 61 72 65 6e 74 29 72 65 74 75 72 6e 20 75 6e 64 65 66 69 6e 65 64 3b 76 61 72 20 65 3d 74 68 69 73 2e 70 61 72 65 6e 74 2e 69 6e 64 65 78 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 61 72 65 6e 74 2e 6e 6f 64 65 73 5b 65 2b 31 5d 7d 7d 2c 7b 6b 65 79 3a 22 70 6f 73 69 74 69 6f 6e 42 79 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 72 3d 74 68 69 73 2e 73 6f 75 72 63 65 2e 73 74 61 72 74 3b 69 66 28 65 2e 69 6e 64 65 78 29 72 3d 74 68 69 73 2e 70 6f 73 69 74 69 6f 6e 49 6e 73 69 64 65 28 65 2e 69 6e 64 65 78 Data Ascii: =this;e=e.parent;)e[h]=!1}}},{key:"next",value:function(){if(!this.parent)return undefined;var e=this.parent.index(this);return this.parent.nodes[e+1]}},{key:"positionBy",value:function(e,t){var r=this.source.start;if(e.index)r=this.positionInside(e.index
2024-04-18 13:36:39 UTC	16383	IN	Data Raw: 72 73 65 28 29 7d 63 61 74 63 68 28 73 29 7b 74 68 72 6f 77 20 73 7d 72 65 74 75 72 6e 20 69 2e 72 6f 6f 74 7d 3b 74 5b 22 64 65 66 61 75 6c 74 22 5d 3d 73 2c 65 2e 65 78 70 6f 72 74 73 3d 74 5b 22 64 65 66 61 75 6c 74 22 5d 7d 2c 35 39 35 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3b 74 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3d 21 30 2c 74 5b 22 64 65 66 61 75 6c 74 22 5d 3d 76 6f 69 64 20 30 3b 76 61 72 20 6f 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 72 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 74 29 7b 76 61 72 20 72 3b 72 65 74 75 72 6e 28 72 3d 65 2e 63 61 6c 6c 28 74 68 69 73 2c 74 29 7c 7c 74 68 69 73 29 2e 74 79 70 65 3d 22 63 6f 6d 6d 65 6e 74 22 2c 72 7d 72 65 74 75 72 6e 20 72 3d Data Ascii: rse()}catch(s){throw s}return i.root};t["default"]=s,e.exports=t["default"]},595:function(e,t,r){"use strict";var n;t.__esModule=!0,t["default"]=void 0;var o=function(e){var t,r;function n(t){var r;return(r=e.call(this,t)\|\|this).type="comment",r}return r=
2024-04-18 13:36:39 UTC	16383	IN	Data Raw: 74 75 72 6e 20 61 20 70 72 69 6d 69 74 69 76 65 20 76 61 6c 75 65 2e 22 29 7d 72 65 74 75 72 6e 28 22 73 74 72 69 6e 67 22 3d 3d 3d 74 3f 53 74 72 69 6e 67 3a 4e 75 6d 62 65 72 29 28 65 29 7d 28 65 2c 22 73 74 72 69 6e 67 22 29 3b 72 65 74 75 72 6e 22 73 79 6d 62 6f 6c 22 3d 3d 6e 28 74 29 3f 74 3a 53 74 72 69 6e 67 28 74 29 7d 76 61 72 20 73 3d 72 28 36 33 36 29 2c 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 74 2c 72 2c 6e 29 7b 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 21 28 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 74 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 63 61 6c 6c 20 61 20 63 6c 61 73 73 20 61 73 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 7d 28 74 68 69 73 2c 65 29 Data Ascii: turn a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"==n(t)?t:String(t)}var s=r(636),a=function(){function e(t,r,n){!function(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}(this,e)
2024-04-18 13:36:39 UTC	16383	IN	Data Raw: 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 61 73 79 6e 63 28 29 2e 74 68 65 6e 28 65 2c 65 29 7d 2c 66 2e 68 61 6e 64 6c 65 45 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 72 79 7b 69 66 28 74 68 69 73 2e 65 72 72 6f 72 3d 65 2c 22 43 73 73 53 79 6e 74 61 78 45 72 72 6f 72 22 21 3d 3d 65 2e 6e 61 6d 65 7c 7c 65 2e 70 6c 75 67 69 6e 29 7b 69 66 28 74 2e 70 6f 73 74 63 73 73 56 65 72 73 69 6f 6e 29 3b 7d 65 6c 73 65 20 65 2e 70 6c 75 67 69 6e 3d 74 2e 70 6f 73 74 63 73 73 50 6c 75 67 69 6e 2c 65 2e 73 65 74 4d 65 73 73 61 67 65 28 29 7d 63 61 74 63 68 28 72 29 7b 63 6f 6e 73 6f 6c 65 26 26 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 26 26 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 72 29 7d 7d 2c 66 2e 61 73 79 6e 63 54 69 63 6b 3d 66 Data Ascii: ion(e){return this.async().then(e,e)},f.handleError=function(e,t){try{if(this.error=e,"CssSyntaxError"!==e.name\|\|e.plugin){if(t.postcssVersion);}else e.plugin=t.postcssPlugin,e.setMessage()}catch(r){console&&console.error&&console.error(r)}},f.asyncTick=f
2024-04-18 13:36:39 UTC	5	IN	Data Raw: 6e 65 64 22 21 Data Ascii: ned"!
2024-04-18 13:36:39 UTC	16383	IN	Data Raw: 3d 74 79 70 65 6f 66 20 65 2e 72 61 77 73 2e 62 65 74 77 65 65 6e 29 72 65 74 75 72 6e 20 74 3d 65 2e 72 61 77 73 2e 62 65 74 77 65 65 6e 2e 72 65 70 6c 61 63 65 28 2f 5b 5e 5c 73 3a 5d 2f 67 2c 22 22 29 2c 21 31 7d 29 29 2c 74 7d 7d 2c 7b 6b 65 79 3a 22 72 61 77 45 6d 70 74 79 42 6f 64 79 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 65 2e 77 61 6c 6b 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 65 2e 6e 6f 64 65 73 26 26 30 3d 3d 3d 65 2e 6e 6f 64 65 73 2e 6c 65 6e 67 74 68 26 26 76 6f 69 64 20 30 21 3d 3d 28 74 3d 65 2e 72 61 77 73 2e 61 66 74 65 72 29 29 72 65 74 75 72 6e 21 31 7d 29 29 2c 74 7d 7d 2c 7b 6b 65 79 3a 22 72 61 77 49 6e 64 65 6e 74 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e Data Ascii: =typeof e.raws.between)return t=e.raws.between.replace(/[^\s:]/g,""),!1})),t}},{key:"rawEmptyBody",value:function(e){var t;return e.walk((function(e){if(e.nodes&&0===e.nodes.length&&void 0!==(t=e.raws.after))return!1})),t}},{key:"rawIndent",value:function

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49731	152.199.4.44	443	7108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 13:36:40 UTC	406	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 13:36:40 UTC	719	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2181730 Cache-Control: public, max-age=31536000 Content-MD5: EuPayFgGHQiAI7K9SOL6lg== Content-Type: image/x-icon Date: Thu, 18 Apr 2024 13:36:40 GMT Etag: 0x8D8731240E548EB Last-Modified: Sun, 18 Oct 2020 03:02:30 GMT Server: ECAcc (agc/7F29) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 12fef581-701e-0054-4ebd-7d951d000000 x-ms-version: 2009-09-19 Content-Length: 17174 Connection: close
2024-04-18 13:36:40 UTC	16383	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-04-18 13:36:40 UTC	791	IN	Data Raw: 01 80 00 00 01 80 00 28 00 00 00 18 00 00 00 30 00 00 00 01 00 04 00 00 00 00 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 Data Ascii: (0"P""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49732	152.199.4.44	443	7108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 13:36:40 UTC	626	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 13:36:41 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2181707 Cache-Control: public, max-age=31536000 Content-MD5: V5EQEHVskNWHVMke8e4nZQ== Content-Type: application/x-javascript Date: Thu, 18 Apr 2024 13:36:40 GMT Etag: 0x8DC2E5A3CC5D827 Last-Modified: Thu, 15 Feb 2024 19:13:48 GMT Server: ECAcc (agc/7F31) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: b856517d-601e-00d9-1abd-7d1d53000000 x-ms-version: 2009-09-19 Content-Length: 113657 Connection: close
2024-04-18 13:36:41 UTC	16383	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-04-18 13:36:41 UTC	1	IN	Data Raw: 69 Data Ascii: i
2024-04-18 13:36:41 UTC	16383	IN	Data Raw: 74 60 20 70 72 65 73 65 74 2c 20 63 61 6e 27 74 20 62 65 20 65 6d 70 74 79 22 29 3b 72 65 74 75 72 6e 20 65 2e 6f 70 74 69 6f 6e 73 26 26 72 2e 73 65 74 28 65 2e 6f 70 74 69 6f 6e 73 29 2c 65 2e 63 6f 6d 70 6f 6e 65 6e 74 73 26 26 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 2e 63 6f 6d 70 6f 6e 65 6e 74 73 29 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 65 2e 63 6f 6d 70 6f 6e 65 6e 74 73 5b 74 5d 2e 72 75 6c 65 73 26 26 72 5b 74 5d 2e 72 75 6c 65 72 2e 65 6e 61 62 6c 65 4f 6e 6c 79 28 65 2e 63 6f 6d 70 6f 6e 65 6e 74 73 5b 74 5d 2e 72 75 6c 65 73 29 2c 65 2e 63 6f 6d 70 6f 6e 65 6e 74 73 5b 74 5d 2e 72 75 6c 65 73 32 26 26 72 5b 74 5d 2e 72 75 6c 65 72 32 2e 65 6e 61 62 6c 65 4f 6e 6c 79 28 65 2e 63 6f 6d 70 6f 6e 65 6e 74 73 5b 74 5d 2e Data Ascii: t` preset, can't be empty");return e.options&&r.set(e.options),e.components&&Object.keys(e.components).forEach((function(t){e.components[t].rules&&r[t].ruler.enableOnly(e.components[t].rules),e.components[t].rules2&&r[t].ruler2.enableOnly(e.components[t].
2024-04-18 13:36:41 UTC	16383	IN	Data Raw: 30 33 66 30 22 2c 22 4b 63 65 64 69 6c 22 3a 22 5c 75 30 31 33 36 22 2c 22 6b 63 65 64 69 6c 22 3a 22 5c 75 30 31 33 37 22 2c 22 4b 63 79 22 3a 22 5c 75 30 34 31 61 22 2c 22 6b 63 79 22 3a 22 5c 75 30 34 33 61 22 2c 22 4b 66 72 22 3a 22 5c 75 64 38 33 35 5c 75 64 64 30 65 22 2c 22 6b 66 72 22 3a 22 5c 75 64 38 33 35 5c 75 64 64 32 38 22 2c 22 6b 67 72 65 65 6e 22 3a 22 5c 75 30 31 33 38 22 2c 22 4b 48 63 79 22 3a 22 5c 75 30 34 32 35 22 2c 22 6b 68 63 79 22 3a 22 5c 75 30 34 34 35 22 2c 22 4b 4a 63 79 22 3a 22 5c 75 30 34 30 63 22 2c 22 6b 6a 63 79 22 3a 22 5c 75 30 34 35 63 22 2c 22 4b 6f 70 66 22 3a 22 5c 75 64 38 33 35 5c 75 64 64 34 32 22 2c 22 6b 6f 70 66 22 3a 22 5c 75 64 38 33 35 5c 75 64 64 35 63 22 2c 22 4b 73 63 72 22 3a 22 5c 75 64 38 33 35 5c Data Ascii: 03f0","Kcedil":"\u0136","kcedil":"\u0137","Kcy":"\u041a","kcy":"\u043a","Kfr":"\ud835\udd0e","kfr":"\ud835\udd28","kgreen":"\u0138","KHcy":"\u0425","khcy":"\u0445","KJcy":"\u040c","kjcy":"\u045c","Kopf":"\ud835\udd42","kopf":"\ud835\udd5c","Kscr":"\ud835\
2024-04-18 13:36:41 UTC	16383	IN	Data Raw: 63 61 72 6f 6e 22 3a 22 5c 75 30 31 36 30 22 2c 22 73 63 61 72 6f 6e 22 3a 22 5c 75 30 31 36 31 22 2c 22 53 63 22 3a 22 5c 75 32 61 62 63 22 2c 22 73 63 22 3a 22 5c 75 32 32 37 62 22 2c 22 73 63 63 75 65 22 3a 22 5c 75 32 32 37 64 22 2c 22 73 63 65 22 3a 22 5c 75 32 61 62 30 22 2c 22 73 63 45 22 3a 22 5c 75 32 61 62 34 22 2c 22 53 63 65 64 69 6c 22 3a 22 5c 75 30 31 35 65 22 2c 22 73 63 65 64 69 6c 22 3a 22 5c 75 30 31 35 66 22 2c 22 53 63 69 72 63 22 3a 22 5c 75 30 31 35 63 22 2c 22 73 63 69 72 63 22 3a 22 5c 75 30 31 35 64 22 2c 22 73 63 6e 61 70 22 3a 22 5c 75 32 61 62 61 22 2c 22 73 63 6e 45 22 3a 22 5c 75 32 61 62 36 22 2c 22 73 63 6e 73 69 6d 22 3a 22 5c 75 32 32 65 39 22 2c 22 73 63 70 6f 6c 69 6e 74 22 3a 22 5c 75 32 61 31 33 22 2c 22 73 63 73 69 Data Ascii: caron":"\u0160","scaron":"\u0161","Sc":"\u2abc","sc":"\u227b","sccue":"\u227d","sce":"\u2ab0","scE":"\u2ab4","Scedil":"\u015e","scedil":"\u015f","Scirc":"\u015c","scirc":"\u015d","scnap":"\u2aba","scnE":"\u2ab6","scnsim":"\u22e9","scpolint":"\u2a13","scsi
2024-04-18 13:36:41 UTC	16383	IN	Data Raw: 5b 5d 2c 63 3c 30 3f 6c 2e 70 75 73 68 28 5b 22 63 6c 61 73 73 22 2c 72 2e 6c 61 6e 67 50 72 65 66 69 78 2b 64 5d 29 3a 28 6c 5b 63 5d 3d 6c 5b 63 5d 2e 73 6c 69 63 65 28 29 2c 6c 5b 63 5d 5b 31 5d 2b 3d 22 20 22 2b 72 2e 6c 61 6e 67 50 72 65 66 69 78 2b 64 29 2c 70 3d 7b 61 74 74 72 73 3a 6c 7d 2c 22 3c 70 72 65 3e 3c 63 6f 64 65 22 2b 69 2e 72 65 6e 64 65 72 41 74 74 72 73 28 70 29 2b 22 3e 22 2b 61 2b 22 3c 2f 63 6f 64 65 3e 3c 2f 70 72 65 3e 5c 6e 22 29 3a 22 3c 70 72 65 3e 3c 63 6f 64 65 22 2b 69 2e 72 65 6e 64 65 72 41 74 74 72 73 28 68 29 2b 22 3e 22 2b 61 2b 22 3c 2f 63 6f 64 65 3e 3c 2f 70 72 65 3e 5c 6e 22 7d 2c 69 2e 69 6d 61 67 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 2c 6e 2c 73 29 7b 76 61 72 20 6f 3d 65 5b 74 5d 3b 72 65 74 75 72 6e Data Ascii: [],c<0?l.push(["class",r.langPrefix+d]):(l[c]=l[c].slice(),l[c][1]+=" "+r.langPrefix+d),p={attrs:l},"<pre><code"+i.renderAttrs(p)+">"+a+"</code></pre>\n"):"<pre><code"+i.renderAttrs(h)+">"+a+"</code></pre>\n"},i.image=function(e,t,r,n,s){var o=e[t];return
2024-04-18 13:36:41 UTC	4	IN	Data Raw: 6f 75 6e 74 Data Ascii: ount
2024-04-18 13:36:41 UTC	16383	IN	Data Raw: 5b 74 5d 2d 65 2e 62 6c 6b 49 6e 64 65 6e 74 3e 3d 34 29 62 72 65 61 6b 3b 66 6f 72 28 4c 3d 21 31 2c 63 3d 30 2c 64 3d 7a 2e 6c 65 6e 67 74 68 3b 63 3c 64 3b 63 2b 2b 29 69 66 28 7a 5b 63 5d 28 65 2c 76 2c 72 2c 21 30 29 29 7b 4c 3d 21 30 3b 62 72 65 61 6b 7d 69 66 28 4c 29 62 72 65 61 6b 3b 69 66 28 68 29 7b 69 66 28 28 45 3d 6f 28 65 2c 76 29 29 3c 30 29 62 72 65 61 6b 3b 46 3d 65 2e 62 4d 61 72 6b 73 5b 76 5d 2b 65 2e 74 53 68 69 66 74 5b 76 5d 7d 65 6c 73 65 20 69 66 28 28 45 3d 73 28 65 2c 76 29 29 3c 30 29 62 72 65 61 6b 3b 69 66 28 5f 21 3d 3d 65 2e 73 72 63 2e 63 68 61 72 43 6f 64 65 41 74 28 45 2d 31 29 29 62 72 65 61 6b 7d 72 65 74 75 72 6e 28 52 3d 68 3f 65 2e 70 75 73 68 28 22 6f 72 64 65 72 65 64 5f 6c 69 73 74 5f 63 6c 6f 73 65 22 2c 22 6f Data Ascii: [t]-e.blkIndent>=4)break;for(L=!1,c=0,d=z.length;c<d;c++)if(z[c](e,v,r,!0)){L=!0;break}if(L)break;if(h){if((E=o(e,v))<0)break;F=e.bMarks[v]+e.tShift[v]}else if((E=s(e,v))<0)break;if(_!==e.src.charCodeAt(E-1))break}return(R=h?e.push("ordered_list_close","o
2024-04-18 13:36:41 UTC	15354	IN	Data Raw: 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 72 2c 6e 3d 30 2c 73 3d 65 2e 74 6f 6b 65 6e 73 2c 6f 3d 65 2e 74 6f 6b 65 6e 73 2e 6c 65 6e 67 74 68 3b 66 6f 72 28 74 3d 72 3d 30 3b 74 3c 6f 3b 74 2b 2b 29 73 5b 74 5d 2e 6e 65 73 74 69 6e 67 3c 30 26 26 6e 2d 2d 2c 73 5b 74 5d 2e 6c 65 76 65 6c 3d 6e 2c 73 5b 74 5d 2e 6e 65 73 74 69 6e 67 3e 30 26 26 6e 2b 2b 2c 22 74 65 78 74 22 3d 3d 3d 73 5b 74 5d 2e 74 79 70 65 26 26 74 2b 31 3c 6f 26 26 22 74 65 78 74 22 3d 3d 3d 73 5b 74 2b 31 5d 2e 74 79 70 65 3f 73 5b 74 2b 31 5d 2e 63 6f 6e 74 65 6e 74 3d 73 5b 74 5d 2e 63 6f 6e 74 65 6e 74 2b 73 5b 74 2b 31 5d 2e 63 6f 6e 74 65 6e 74 3a 28 74 21 3d 3d 72 26 26 28 73 5b 72 5d 3d 73 5b 74 5d 29 2c 72 2b 2b 29 3b 74 21 3d 3d 72 26 26 28 73 2e 6c 65 6e 67 74 68 3d 72 Data Ascii: ction(e){var t,r,n=0,s=e.tokens,o=e.tokens.length;for(t=r=0;t<o;t++)s[t].nesting<0&&n--,s[t].level=n,s[t].nesting>0&&n++,"text"===s[t].type&&t+1<o&&"text"===s[t+1].type?s[t+1].content=s[t].content+s[t+1].content:(t!==r&&(s[r]=s[t]),r++);t!==r&&(s.length=r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49735	13.107.246.70	443	7108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 13:36:40 UTC	703	OUT	GET /c1c6b6c8-yddboip6hgdfke0vbtb74zupy1zas9i8wffenmqtq20/logintenantbranding/0/illustration?ts=636439259997006238 HTTP/1.1 Host: aadcdn.msftauthimages.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 13:36:41 UTC	739	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 13:36:41 GMT Content-Type: image/* Content-Length: 239370 Connection: close Cache-Control: public, max-age=86400 Last-Modified: Wed, 18 Oct 2017 12:20:00 GMT ETag: 0x8D516228DE251DD x-ms-request-id: 40a3bd9a-e01e-002f-7a95-915667000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240418T133640Z-r1f585c6b65gj7jwqmmy8fr0dc00000005zg0000000060nb x-fd-int-roxy-purgeid: 50755578 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-18 13:36:41 UTC	15645	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 07 80 00 00 04 38 08 03 00 00 00 df 0d 31 71 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 84 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 30 31 34 20 37 39 2e 31 35 36 37 39 37 2c 20 32 30 31 34 2f 30 38 2f 32 30 2d 30 39 3a 35 33 3a 30 32 20 20 Data Ascii: PNGIHDR81qtEXtSoftwareAdobe ImageReadyqe<iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02
2024-04-18 13:36:41 UTC	16384	IN	Data Raw: f6 2d 1e b9 00 86 8a 2e d3 7b 45 12 82 28 8c fb 20 a7 d3 90 d5 ad 5f b8 05 7a b3 61 71 b6 b3 db c0 da 41 33 7e da 22 43 1b be c1 c0 c9 8e 52 8e cf 6e 37 32 4d e3 e8 6e cd c2 72 27 42 51 9e 52 64 33 b9 6e 18 b1 89 96 0c 80 44 f4 65 ae 74 4f 26 6f c1 1e 3d 35 e3 83 69 c1 0f 48 3f 2c 53 79 24 53 6e 72 96 ff 62 e6 12 cd 4a 8a 70 7f ac 94 af 0e b3 6b 84 20 58 21 87 b3 5f 4c 9d 33 68 45 a5 2c 8b 79 e2 0e ec 02 38 93 b9 a4 5d 29 dc 01 23 d9 0f c0 c8 63 c0 db 1f c0 07 82 c2 9b eb ce 3d 80 3d b1 47 b5 58 f0 6d 76 01 c4 c8 d7 6e ab bc ee 2b 9c 03 05 18 99 5e 10 e4 1b 0b e9 eb 0c 01 8c bc bd cc 6e 41 3e f7 49 07 c0 a6 a5 b9 d7 7b df 94 66 bc ad 7d 31 b9 bf 5b d0 97 2b 5b dc df 2b cf e6 24 b8 99 30 65 3a 6c be 00 0a 57 e4 9c d9 a2 f1 65 21 9a 34 d8 5b 6c 36 73 fe ef Data Ascii: -.{E( _zaqA3~"CRn72Mnr'BQRd3nDetO&o=5iH?,Sy$SnrbJpk X!_L3hE,y8])#c==GXmvn+^nA>I{f}1[+[+$0e:lWe!4[l6s
2024-04-18 13:36:41 UTC	16384	IN	Data Raw: 8d 86 51 90 70 3d b8 ba 12 4a b4 70 00 13 02 7b a9 31 9c 87 00 3e 0b 26 e8 e0 05 05 30 93 6a 83 2d 7d c4 62 54 92 0a 66 2b c2 6a bc 15 7a e5 16 24 2b 74 90 5d 0c ce 39 b9 84 04 8e 88 5a 05 38 1c 02 ca 6f 20 14 52 03 98 cf 0a 60 af 02 60 78 73 05 cf f6 43 0d e3 7c b3 65 f6 45 25 15 a8 37 db da d4 31 46 4e 92 7a 3e 9e 0b c0 ad ad ad 8c 97 95 2a b2 88 89 ea 95 00 dc dd 4d 2c df 65 d0 de ac 01 30 eb d0 1c 80 05 76 e1 2c a2 99 8a e3 85 75 0f 12 f9 7e 7d ff fa ba c6 70 16 27 e9 2f 04 9c 6f e2 00 a9 b7 a2 83 78 4f 6d 6f a3 af 70 a0 b5 dc e8 8e 1d de 17 80 b7 9c 68 5b 52 be 9b d3 d7 73 b3 52 76 97 48 91 31 45 c9 21 f6 1c 00 0e c1 67 95 e6 96 d9 62 c9 67 a2 b0 ba 5c b0 ec 63 c0 a5 d1 5d 95 02 2d 8a 31 5a c7 1a ed ad a9 e1 05 59 72 d8 bb 9d ce 2c 00 16 b1 2b 16 35 Data Ascii: Qp=Jp{1>&0j-}bTf+jz$+t]9Z8o R``xsC\|eE%71FNz>*M,e0v,u~}p'/oxOmoph[RsRvH1E!gbg\c]-1ZYr,+5
2024-04-18 13:36:41 UTC	16384	IN	Data Raw: a1 67 77 b7 dd 85 42 f9 15 2f e8 95 95 95 61 03 66 c4 3b 77 72 98 5b 6d 77 80 86 c2 c3 4c ce 8f 21 eb f9 fe 91 e9 01 87 63 fe f2 e5 65 64 8c ea 78 78 fd fa 4d 34 ef 6d 5b 1c ad 3b c4 d6 fa 86 3a a8 39 54 75 f7 00 ad 77 18 c6 1f c2 69 03 f4 7b 79 3c 0a 8b f1 ea d7 bd 47 b9 99 f5 01 6c 93 c6 50 98 46 89 4d 48 05 b5 21 45 b1 ad d9 ba f5 fc f9 e0 3c 9a 4f 43 47 2a 2a f0 89 b6 30 4b d6 48 c8 5c d9 5e 07 99 2b 85 7c 8e 40 6d 2e 5d c0 f5 7b f8 f2 81 32 54 ac be 46 e5 d5 5f bf fe ae e0 fb e0 ef bf 8b 8f 23 2b 33 2d c5 73 50 08 80 61 fd 24 fa f4 cd cc 53 f3 dd 9e 9e 49 c5 a5 ac bf bf 97 ba d9 1a 9b 9a 88 75 c2 de d9 d9 49 a7 c8 32 77 74 74 10 52 57 9b ec 76 3c e0 d8 6c 5a 03 6f 2a 45 01 d8 e1 60 47 33 b3 39 49 ec d3 30 24 89 4e ef e1 f6 d4 d4 48 0f 78 2c 16 a3 01 Data Ascii: gwB/af;wr[mwL!cedxxM4m[;:9Tuwi{y<GlPFMH!E<OCG*0KH\^+\|@m.]{2TF_#+3-sPa$SIuI2wttRWv<lZoE`G39I0$NHx,
2024-04-18 13:36:41 UTC	16384	IN	Data Raw: ea f8 f1 9c d8 1c 93 1a 9f b1 c7 4d 01 8c 77 8e dd 98 1b 0e 8e 6e 09 c0 dc 6a 84 fe 57 48 c4 c8 69 d3 95 cd 8d 8d 6d e4 86 c7 01 0c fd fb a4 9b 4f 40 9c b4 98 b3 30 21 96 5a c5 00 ae 96 d7 84 83 3c 25 36 65 08 fa 1a e6 c9 01 3c 25 56 90 de 04 c5 a3 2b c3 a4 3b 5c 85 d0 68 71 fa 7b 46 e2 11 c6 9f 5b 53 53 63 e2 c4 d1 9e c0 6d 93 f6 28 9c 79 42 45 45 89 bc 42 56 46 53 13 9d ee 9f 3d 4b 01 1c 70 b1 93 71 3c b5 b4 34 10 85 da a6 a0 c8 86 db 5a 8f 46 a0 5d d9 d9 de 9c b5 f8 7d a3 76 88 0f e5 ee dd 61 ab 02 d8 0a 11 98 5d e1 20 eb 4f 18 10 c0 00 18 4d e9 09 81 7d 04 02 3b eb 44 00 73 06 3b 5c be 98 d7 d7 1d 1c d8 39 86 29 80 8d 52 00 af d6 2c d8 c3 b4 ca a3 19 1d f8 b3 01 98 94 f2 92 9c 08 94 7f c6 b5 bf 5c b9 6f 62 56 9a 4e e7 89 86 9e f0 4c a1 b7 6f 46 7c 7c Data Ascii: MwnjWHimO@0!Z<%6e<%V+;\hq{F[SScm(yBEEBVFS=Kpq<4ZF]}va] OM};Ds;\9)R,\obVNLoF\|\|
2024-04-18 13:36:41 UTC	16384	IN	Data Raw: 35 fd 7f f6 ce fc 9b aa ef 7f fc 2c 14 2e 72 2d 2d 97 c5 bf e1 a7 cb bd 52 12 95 a2 58 25 89 26 34 28 cd 29 a5 28 4a 93 26 56 d1 80 48 25 8a a2 f2 51 2a 2a 2a a5 50 11 25 a9 94 86 15 19 de df d7 f9 ee e1 0c fb 9c 7b ee 90 a1 57 f5 ba cf 1f 38 c3 3e e7 dc 7b ee 39 fb b1 9f cf fd 1c 8c 19 7b 9a d0 94 6d da c0 f5 35 09 2f 4c 09 23 1d ee 1f 52 af 9e aa 9a 4c 99 ed f9 fc 01 e3 36 22 72 d5 aa bb a6 94 d9 96 c6 7c 3c 46 36 cb 38 88 63 78 cf 5e b8 90 8e 87 cf ef 41 87 88 4a bd 6b 9e 0b de 7c aa b8 b8 2c 6c d9 b2 cd 0d c5 e5 b4 c7 d4 0e 98 a7 f8 40 f3 ab f1 38 44 97 d6 72 77 00 2d f7 43 60 d6 b5 dc 83 70 72 17 66 c6 87 91 b8 37 e3 9a ae 81 76 e3 3f 61 f7 dd ce 2b c1 58 d7 15 f1 23 72 ed 28 74 55 fb 31 5c ef 41 be aa b8 a7 9c 00 14 ed 61 26 10 c0 22 11 8a 52 d4 d3 Data Ascii: 5,.r--RX%&4()(J&VH%Q***P%{W8>{9{m5/L#RL6"r\|<F68cx^AJk\|,l@8Drw-C`prf7v?a+X#r(tU1\Aa&"R
2024-04-18 13:36:41 UTC	16384	IN	Data Raw: 59 cc 69 78 fc f8 36 fd 04 ba cd 45 04 26 b2 d3 2c 8a 8d 8d 0b 3c 4b 0f fa a5 de 11 bb e7 cf 9f bd 99 2d 5e 37 fe 28 20 f0 d6 ad eb e7 19 90 2a e9 a8 a3 51 1b f6 ef 9f c1 2a 3f a6 41 d3 a7 4f a4 b5 6a 3b 23 00 60 3f 73 66 cf 44 04 60 83 11 94 d5 c8 91 34 80 e1 58 c6 de d2 8a 06 b0 dc 86 28 b4 67 e3 82 00 2c 97 6a 50 6c 1d 11 82 59 85 18 a8 c1 cc 1e 7b 5b 5b db e1 d0 88 0d 70 6d 60 27 67 67 1e 80 9d e9 84 1c 30 33 96 0c e3 97 16 e8 83 c5 84 21 81 45 07 07 07 c6 25 cb d1 de ce 9e 92 d9 db d9 8e b6 77 62 3f b5 54 2a b5 fd 83 82 96 dc f7 ec 5e c4 4e 54 4c 09 9c 37 fc 57 84 e6 67 76 c5 fc 2a cf dc 58 53 f3 9c ab e0 c7 d5 1b dc 94 31 c7 8c 19 02 b3 95 8e a0 e7 15 77 64 23 00 70 2e 0b e0 4e d6 c6 d5 d1 85 a4 07 49 fa 30 f1 97 2b 8b 28 7f d4 af b9 71 fc 8a 15 1a Data Ascii: Yix6E&,<K-^7( Q?AOj;#`?sfD`4X(g,jPlY{[[pm`'gg03!E%wb?T^NTL7WgvXS1wd#p.NI0+(q
2024-04-18 13:36:41 UTC	16384	IN	Data Raw: 60 5f 5a 57 0e 1f 80 6c ce be 34 75 c7 b1 36 68 16 c0 87 f1 b0 d0 e0 8b c4 22 81 4b 05 30 b1 e8 87 88 0a 8c 01 38 89 37 0d 69 02 04 30 fa 14 0e 82 de e9 31 54 38 30 34 f4 b9 38 80 37 85 91 03 3e 82 00 a6 fa c5 7f dd 7c 81 be da fb 53 08 1e 80 a9 23 f3 f2 c8 d7 33 a8 98 0c e1 31 9c 04 f0 cc fc fc f7 ef df 83 ee fa a7 af c7 79 e7 5e 05 55 e0 97 42 57 ed 91 95 95 a0 d4 0a e0 7e 06 02 f0 38 16 c0 53 21 d4 3b 2a 7c a6 93 e3 5d d6 16 a6 3d 06 52 9f be d9 9c e5 23 22 56 ad 9a 71 70 6e 57 37 4b b3 1e 7f 90 94 ac d5 a9 9b b9 1f 5d da a3 2f 58 54 cb 7c 7a a3 01 50 87 4e a6 de de e6 26 d6 a5 04 30 61 ab 54 f2 08 5c 71 00 76 42 00 26 d1 eb 04 39 ec 44 6b c3 48 18 e7 e7 76 18 80 a9 6d 0e b6 f6 f6 0e 40 00 82 11 70 6d 6c 6c eb 01 81 0c a6 bb 2f b6 90 bf f0 59 ea fc 44 Data Ascii: `_ZWl4u6h"K087i01T80487>\|S#31y^UBW~8S!;*\|]=R#"VqpnW7K]/XT\|zPN&0aT\qvB&9DkHvm@pmll/YD
2024-04-18 13:36:41 UTC	16384	IN	Data Raw: 2a d5 02 06 60 f8 49 99 b1 00 e6 f9 5c 9d cf d3 00 70 49 09 03 60 e8 7a b5 4d 1c c0 69 69 7c 00 9f e6 01 38 5a 32 80 cd df 61 11 4c a6 c7 c4 40 0f a7 db b7 a9 b9 bb 8f cf ed 18 bc 0a 74 5e 26 ed b9 b3 68 ee a1 8d fb f6 2d 9c aa 1a 75 2f 7c f3 9c e1 8f 5f 4f f2 55 a8 32 e3 07 55 11 00 13 2e 10 c0 14 90 ec 54 4a b9 75 15 74 c2 b2 67 bc a0 81 e8 bc 7f 2b 03 01 d8 cc 00 00 ee 3e 72 e4 ac 11 b5 f8 15 01 00 3c 7e 59 35 05 f0 b8 68 bd 0e 47 d1 69 35 01 0c a7 07 ff 6c 00 b7 d6 66 bc c4 fd 88 71 2b e7 ff f1 b4 bb d6 65 2c c3 8d f2 d4 50 cb 7d d0 e6 e6 ff 6b ac b5 40 53 fd a7 c6 42 69 2e 25 ad 50 5d e9 71 38 c4 2d c3 7a 3f 70 29 2b 56 14 c0 00 b0 e2 00 be 84 d2 27 1c 64 01 9c 2f 7e aa 4f f0 8d 83 6d c8 5c f2 1f 29 d0 cd ea 93 68 19 a8 f3 32 00 16 8a 47 b3 f5 00 d6 Data Ascii: *`I\pI`zMii\|8Z2aL@t^&h-u/\|_OU2U.TJutg+>r<~Y5hGi5lfq+e,P}k@SBi.%P]q8-z?p)+V'd/~Om\)h2G
2024-04-18 13:36:41 UTC	16384	IN	Data Raw: d4 30 cd 61 1b b6 77 6f 5d 74 62 6b c5 8b 17 85 d4 49 3a 90 f9 e5 4b 94 34 d3 41 54 8d c4 00 5e c3 55 d1 38 fa a4 8a 07 e0 57 98 bc af 9e 16 1b fc bc d3 a4 ec cd bd e8 41 be 07 44 2f 5b 95 7a 7a 55 15 ed 6f de 9b 93 33 8f f3 3b d3 6f f3 83 9d a1 df b9 0d bb 59 61 91 49 d6 27 15 ce fc 36 37 74 76 f6 6d f8 40 bf 81 c9 b9 e7 ce 15 14 cc d3 7f 63 be 8f 4f 24 0b 60 c0 5f fe 09 00 fe ae 4c a6 5f 43 fe 96 31 5e 43 0d e0 6f 21 91 a0 04 f9 3b 87 94 06 4e d3 c3 66 cf 50 92 00 b6 e1 00 ac f3 45 5d 90 6c b9 a7 bc da d2 20 80 29 a5 27 4d 15 25 4d 79 ad 5a 09 1f fc 5a 8d ca 59 ab 56 39 82 17 0e 0e 6a 60 5a 27 47 e4 b9 d5 3a 33 b4 75 d5 39 39 39 bb d0 00 76 91 06 30 7f 1a d8 c5 c5 f8 45 45 00 76 d3 ab 82 85 67 90 4d 04 b0 24 e6 35 06 00 ac 55 a1 93 a7 5c 54 f6 32 4c 60 Data Ascii: 0awo]tbkI:K4AT^U8WAD/[zzUo3;oYaI'67tvm@cO$`_L_C1^Co!;NfPE]l )'M%MyZZYV9j`Z'G:3u999v0EEvgM$5U\T2L`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49734	13.107.246.70	443	7108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 13:36:40 UTC	701	OUT	GET /c1c6b6c8-yddboip6hgdfke0vbtb74zupy1zas9i8wffenmqtq20/logintenantbranding/0/bannerlogo?ts=637229891902897714 HTTP/1.1 Host: aadcdn.msftauthimages.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 13:36:41 UTC	737	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 13:36:41 GMT Content-Type: image/* Content-Length: 8054 Connection: close Cache-Control: public, max-age=86400 Last-Modified: Mon, 20 Apr 2020 14:19:50 GMT ETag: 0x8D7E535E34C07C7 x-ms-request-id: 7faf1cb0-901e-000a-5295-91ff1b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240418T133640Z-15497cdd9fd7xqjqsvryefhbyn00000000dg00000000c6ba x-fd-int-roxy-purgeid: 50755578 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-18 13:36:41 UTC	8054	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 e3 00 00 00 2a 08 06 00 00 00 41 69 ec 30 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 1f 0b 49 44 41 54 78 5e ed 9d 07 98 54 45 b6 c7 27 cf f4 84 4e 33 8a 88 0a a8 80 48 8e 92 04 86 30 84 19 40 a2 04 41 c0 5d 54 9e e0 62 04 9f fb 58 94 35 ac 39 af 8a b0 66 54 4c bb 18 56 40 01 11 56 8c a8 80 0a 8a e4 a0 20 20 08 4c e2 fd fe 77 aa db db 3d dd 3d dd 30 4f 94 37 e7 fb ce d7 7d ab 4e 9d 4a e7 5f 75 aa ba 6e 75 9c 9d 06 c5 c5 9d 30 33 23 e3 fc f5 2e d7 03 a5 5e ef 82 d2 9c 9c 55 f0 97 a5 d9 d9 8b 0a 3d 9e c7 67 a6 a7 5f 75 4f 5a 5a a7 0e 71 71 1e 93 e4 a8 a8 67 5c 5c 6a a7 b8 b8 4c c3 69 26 f8 Data Ascii: PNGIHDR*Ai0sRGBgAMAapHYs+IDATx^TE'N3H0@A]TbX59fTLV@V Lw==0O7}NJ_unu03#.^U=g_uOZZqqg\\jLi&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49736	152.199.4.44	443	7108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 13:36:41 UTC	665	OUT	GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 13:36:41 UTC	737	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2181714 Cache-Control: public, max-age=31536000 Content-MD5: R2FAVxfpONfnQAuxVxXbHg== Content-Type: image/svg+xml Date: Thu, 18 Apr 2024 13:36:41 GMT Etag: 0x8DB5C3F4BB4F03C Last-Modified: Wed, 24 May 2023 10:11:52 GMT Server: ECAcc (agc/7FA7) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 687a15df-701e-0054-73bd-7d951d000000 x-ms-version: 2009-09-19 Content-Length: 1592 Connection: close
2024-04-18 13:36:41 UTC	1592	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 61 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 2e 62 7b 66 69 6c 6c 3a 23 34 30 34 30 34 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 72 65 63 74 20 63 6c 61 73 73 3d 22 61 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 62 22 20 64 3d 22 4d 34 30 2c 33 32 2e 35 37 38 56 34 30 48 33 32 56 33 36 48 32 38 56 33 32 48 32 34 56 32 38 2e 37 36 36 41 31 30 2e 36 38 39 2c 31 30 2e 36 38 39 2c 30 2c 30 2c Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49737	152.199.4.44	443	7108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 13:36:42 UTC	420	OUT	GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 13:36:42 UTC	737	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2181715 Cache-Control: public, max-age=31536000 Content-MD5: R2FAVxfpONfnQAuxVxXbHg== Content-Type: image/svg+xml Date: Thu, 18 Apr 2024 13:36:42 GMT Etag: 0x8DB5C3F4BB4F03C Last-Modified: Wed, 24 May 2023 10:11:52 GMT Server: ECAcc (agc/7FA7) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 687a15df-701e-0054-73bd-7d951d000000 x-ms-version: 2009-09-19 Content-Length: 1592 Connection: close
2024-04-18 13:36:42 UTC	1592	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 61 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 2e 62 7b 66 69 6c 6c 3a 23 34 30 34 30 34 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 72 65 63 74 20 63 6c 61 73 73 3d 22 61 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 62 22 20 64 3d 22 4d 34 30 2c 33 32 2e 35 37 38 56 34 30 48 33 32 56 33 36 48 32 38 56 33 32 48 32 34 56 32 38 2e 37 36 36 41 31 30 2e 36 38 39 2c 31 30 2e 36 38 39 2c 30 2c 30 2c Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49738	13.107.246.41	443	7108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 13:36:42 UTC	456	OUT	GET /c1c6b6c8-yddboip6hgdfke0vbtb74zupy1zas9i8wffenmqtq20/logintenantbranding/0/bannerlogo?ts=637229891902897714 HTTP/1.1 Host: aadcdn.msftauthimages.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 13:36:42 UTC	737	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 13:36:42 GMT Content-Type: image/* Content-Length: 8054 Connection: close Cache-Control: public, max-age=86400 Last-Modified: Mon, 20 Apr 2020 14:19:50 GMT ETag: 0x8D7E535E34C07C7 x-ms-request-id: 27196b8e-a01e-0063-5295-91c657000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240418T133642Z-r1f585c6b65ntpkvc0tnrvwbbn00000000xg000000004fgv x-fd-int-roxy-purgeid: 50755578 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-18 13:36:42 UTC	8054	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 e3 00 00 00 2a 08 06 00 00 00 41 69 ec 30 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 1f 0b 49 44 41 54 78 5e ed 9d 07 98 54 45 b6 c7 27 cf f4 84 4e 33 8a 88 0a a8 80 48 8e 92 04 86 30 84 19 40 a2 04 41 c0 5d 54 9e e0 62 04 9f fb 58 94 35 ac 39 af 8a b0 66 54 4c bb 18 56 40 01 11 56 8c a8 80 0a 8a e4 a0 20 20 08 4c e2 fd fe 77 aa db db 3d dd 3d dd 30 4f 94 37 e7 fb ce d7 7d ab 4e 9d 4a e7 5f 75 aa ba 6e 75 9c 9d 06 c5 c5 9d 30 33 23 e3 fc f5 2e d7 03 a5 5e ef 82 d2 9c 9c 55 f0 97 a5 d9 d9 8b 0a 3d 9e c7 67 a6 a7 5f 75 4f 5a 5a a7 0e 71 71 1e 93 e4 a8 a8 67 5c 5c 6a a7 b8 b8 4c c3 69 26 f8 Data Ascii: PNGIHDR*Ai0sRGBgAMAapHYs+IDATx^TE'N3H0@A]TbX59fTLV@V Lw==0O7}NJ_unu03#.^U=g_uOZZqqg\\jLi&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49739	13.107.246.41	443	7108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 13:36:42 UTC	458	OUT	GET /c1c6b6c8-yddboip6hgdfke0vbtb74zupy1zas9i8wffenmqtq20/logintenantbranding/0/illustration?ts=636439259997006238 HTTP/1.1 Host: aadcdn.msftauthimages.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 13:36:43 UTC	739	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 13:36:43 GMT Content-Type: image/* Content-Length: 239370 Connection: close Cache-Control: public, max-age=86400 Last-Modified: Wed, 18 Oct 2017 12:20:00 GMT ETag: 0x8D516228DE251DD x-ms-request-id: fa5cc54d-e01e-003f-1b95-91930f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240418T133642Z-15497cdd9fdtp976bg8q1vzk2g00000000fg000000006a8m x-fd-int-roxy-purgeid: 50755578 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-18 13:36:43 UTC	15645	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 07 80 00 00 04 38 08 03 00 00 00 df 0d 31 71 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 84 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 30 31 34 20 37 39 2e 31 35 36 37 39 37 2c 20 32 30 31 34 2f 30 38 2f 32 30 2d 30 39 3a 35 33 3a 30 32 20 20 Data Ascii: PNGIHDR81qtEXtSoftwareAdobe ImageReadyqe<iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02
2024-04-18 13:36:43 UTC	16384	IN	Data Raw: f6 2d 1e b9 00 86 8a 2e d3 7b 45 12 82 28 8c fb 20 a7 d3 90 d5 ad 5f b8 05 7a b3 61 71 b6 b3 db c0 da 41 33 7e da 22 43 1b be c1 c0 c9 8e 52 8e cf 6e 37 32 4d e3 e8 6e cd c2 72 27 42 51 9e 52 64 33 b9 6e 18 b1 89 96 0c 80 44 f4 65 ae 74 4f 26 6f c1 1e 3d 35 e3 83 69 c1 0f 48 3f 2c 53 79 24 53 6e 72 96 ff 62 e6 12 cd 4a 8a 70 7f ac 94 af 0e b3 6b 84 20 58 21 87 b3 5f 4c 9d 33 68 45 a5 2c 8b 79 e2 0e ec 02 38 93 b9 a4 5d 29 dc 01 23 d9 0f c0 c8 63 c0 db 1f c0 07 82 c2 9b eb ce 3d 80 3d b1 47 b5 58 f0 6d 76 01 c4 c8 d7 6e ab bc ee 2b 9c 03 05 18 99 5e 10 e4 1b 0b e9 eb 0c 01 8c bc bd cc 6e 41 3e f7 49 07 c0 a6 a5 b9 d7 7b df 94 66 bc ad 7d 31 b9 bf 5b d0 97 2b 5b dc df 2b cf e6 24 b8 99 30 65 3a 6c be 00 0a 57 e4 9c d9 a2 f1 65 21 9a 34 d8 5b 6c 36 73 fe ef Data Ascii: -.{E( _zaqA3~"CRn72Mnr'BQRd3nDetO&o=5iH?,Sy$SnrbJpk X!_L3hE,y8])#c==GXmvn+^nA>I{f}1[+[+$0e:lWe!4[l6s
2024-04-18 13:36:43 UTC	16384	IN	Data Raw: 8d 86 51 90 70 3d b8 ba 12 4a b4 70 00 13 02 7b a9 31 9c 87 00 3e 0b 26 e8 e0 05 05 30 93 6a 83 2d 7d c4 62 54 92 0a 66 2b c2 6a bc 15 7a e5 16 24 2b 74 90 5d 0c ce 39 b9 84 04 8e 88 5a 05 38 1c 02 ca 6f 20 14 52 03 98 cf 0a 60 af 02 60 78 73 05 cf f6 43 0d e3 7c b3 65 f6 45 25 15 a8 37 db da d4 31 46 4e 92 7a 3e 9e 0b c0 ad ad ad 8c 97 95 2a b2 88 89 ea 95 00 dc dd 4d 2c df 65 d0 de ac 01 30 eb d0 1c 80 05 76 e1 2c a2 99 8a e3 85 75 0f 12 f9 7e 7d ff fa ba c6 70 16 27 e9 2f 04 9c 6f e2 00 a9 b7 a2 83 78 4f 6d 6f a3 af 70 a0 b5 dc e8 8e 1d de 17 80 b7 9c 68 5b 52 be 9b d3 d7 73 b3 52 76 97 48 91 31 45 c9 21 f6 1c 00 0e c1 67 95 e6 96 d9 62 c9 67 a2 b0 ba 5c b0 ec 63 c0 a5 d1 5d 95 02 2d 8a 31 5a c7 1a ed ad a9 e1 05 59 72 d8 bb 9d ce 2c 00 16 b1 2b 16 35 Data Ascii: Qp=Jp{1>&0j-}bTf+jz$+t]9Z8o R``xsC\|eE%71FNz>*M,e0v,u~}p'/oxOmoph[RsRvH1E!gbg\c]-1ZYr,+5
2024-04-18 13:36:43 UTC	16384	IN	Data Raw: a1 67 77 b7 dd 85 42 f9 15 2f e8 95 95 95 61 03 66 c4 3b 77 72 98 5b 6d 77 80 86 c2 c3 4c ce 8f 21 eb f9 fe 91 e9 01 87 63 fe f2 e5 65 64 8c ea 78 78 fd fa 4d 34 ef 6d 5b 1c ad 3b c4 d6 fa 86 3a a8 39 54 75 f7 00 ad 77 18 c6 1f c2 69 03 f4 7b 79 3c 0a 8b f1 ea d7 bd 47 b9 99 f5 01 6c 93 c6 50 98 46 89 4d 48 05 b5 21 45 b1 ad d9 ba f5 fc f9 e0 3c 9a 4f 43 47 2a 2a f0 89 b6 30 4b d6 48 c8 5c d9 5e 07 99 2b 85 7c 8e 40 6d 2e 5d c0 f5 7b f8 f2 81 32 54 ac be 46 e5 d5 5f bf fe ae e0 fb e0 ef bf 8b 8f 23 2b 33 2d c5 73 50 08 80 61 fd 24 fa f4 cd cc 53 f3 dd 9e 9e 49 c5 a5 ac bf bf 97 ba d9 1a 9b 9a 88 75 c2 de d9 d9 49 a7 c8 32 77 74 74 10 52 57 9b ec 76 3c e0 d8 6c 5a 03 6f 2a 45 01 d8 e1 60 47 33 b3 39 49 ec d3 30 24 89 4e ef e1 f6 d4 d4 48 0f 78 2c 16 a3 01 Data Ascii: gwB/af;wr[mwL!cedxxM4m[;:9Tuwi{y<GlPFMH!E<OCG*0KH\^+\|@m.]{2TF_#+3-sPa$SIuI2wttRWv<lZoE`G39I0$NHx,
2024-04-18 13:36:43 UTC	16384	IN	Data Raw: ea f8 f1 9c d8 1c 93 1a 9f b1 c7 4d 01 8c 77 8e dd 98 1b 0e 8e 6e 09 c0 dc 6a 84 fe 57 48 c4 c8 69 d3 95 cd 8d 8d 6d e4 86 c7 01 0c fd fb a4 9b 4f 40 9c b4 98 b3 30 21 96 5a c5 00 ae 96 d7 84 83 3c 25 36 65 08 fa 1a e6 c9 01 3c 25 56 90 de 04 c5 a3 2b c3 a4 3b 5c 85 d0 68 71 fa 7b 46 e2 11 c6 9f 5b 53 53 63 e2 c4 d1 9e c0 6d 93 f6 28 9c 79 42 45 45 89 bc 42 56 46 53 13 9d ee 9f 3d 4b 01 1c 70 b1 93 71 3c b5 b4 34 10 85 da a6 a0 c8 86 db 5a 8f 46 a0 5d d9 d9 de 9c b5 f8 7d a3 76 88 0f e5 ee dd 61 ab 02 d8 0a 11 98 5d e1 20 eb 4f 18 10 c0 00 18 4d e9 09 81 7d 04 02 3b eb 44 00 73 06 3b 5c be 98 d7 d7 1d 1c d8 39 86 29 80 8d 52 00 af d6 2c d8 c3 b4 ca a3 19 1d f8 b3 01 98 94 f2 92 9c 08 94 7f c6 b5 bf 5c b9 6f 62 56 9a 4e e7 89 86 9e f0 4c a1 b7 6f 46 7c 7c Data Ascii: MwnjWHimO@0!Z<%6e<%V+;\hq{F[SScm(yBEEBVFS=Kpq<4ZF]}va] OM};Ds;\9)R,\obVNLoF\|\|
2024-04-18 13:36:43 UTC	16384	IN	Data Raw: 35 fd 7f f6 ce fc 9b aa ef 7f fc 2c 14 2e 72 2d 2d 97 c5 bf e1 a7 cb bd 52 12 95 a2 58 25 89 26 34 28 cd 29 a5 28 4a 93 26 56 d1 80 48 25 8a a2 f2 51 2a 2a 2a a5 50 11 25 a9 94 86 15 19 de df d7 f9 ee e1 0c fb 9c 7b ee 90 a1 57 f5 ba cf 1f 38 c3 3e e7 dc 7b ee 39 fb b1 9f cf fd 1c 8c 19 7b 9a d0 94 6d da c0 f5 35 09 2f 4c 09 23 1d ee 1f 52 af 9e aa 9a 4c 99 ed f9 fc 01 e3 36 22 72 d5 aa bb a6 94 d9 96 c6 7c 3c 46 36 cb 38 88 63 78 cf 5e b8 90 8e 87 cf ef 41 87 88 4a bd 6b 9e 0b de 7c aa b8 b8 2c 6c d9 b2 cd 0d c5 e5 b4 c7 d4 0e 98 a7 f8 40 f3 ab f1 38 44 97 d6 72 77 00 2d f7 43 60 d6 b5 dc 83 70 72 17 66 c6 87 91 b8 37 e3 9a ae 81 76 e3 3f 61 f7 dd ce 2b c1 58 d7 15 f1 23 72 ed 28 74 55 fb 31 5c ef 41 be aa b8 a7 9c 00 14 ed 61 26 10 c0 22 11 8a 52 d4 d3 Data Ascii: 5,.r--RX%&4()(J&VH%Q***P%{W8>{9{m5/L#RL6"r\|<F68cx^AJk\|,l@8Drw-C`prf7v?a+X#r(tU1\Aa&"R
2024-04-18 13:36:43 UTC	16384	IN	Data Raw: 59 cc 69 78 fc f8 36 fd 04 ba cd 45 04 26 b2 d3 2c 8a 8d 8d 0b 3c 4b 0f fa a5 de 11 bb e7 cf 9f bd 99 2d 5e 37 fe 28 20 f0 d6 ad eb e7 19 90 2a e9 a8 a3 51 1b f6 ef 9f c1 2a 3f a6 41 d3 a7 4f a4 b5 6a 3b 23 00 60 3f 73 66 cf 44 04 60 83 11 94 d5 c8 91 34 80 e1 58 c6 de d2 8a 06 b0 dc 86 28 b4 67 e3 82 00 2c 97 6a 50 6c 1d 11 82 59 85 18 a8 c1 cc 1e 7b 5b 5b db e1 d0 88 0d 70 6d 60 27 67 67 1e 80 9d e9 84 1c 30 33 96 0c e3 97 16 e8 83 c5 84 21 81 45 07 07 07 c6 25 cb d1 de ce 9e 92 d9 db d9 8e b6 77 62 3f b5 54 2a b5 fd 83 82 96 dc f7 ec 5e c4 4e 54 4c 09 9c 37 fc 57 84 e6 67 76 c5 fc 2a cf dc 58 53 f3 9c ab e0 c7 d5 1b dc 94 31 c7 8c 19 02 b3 95 8e a0 e7 15 77 64 23 00 70 2e 0b e0 4e d6 c6 d5 d1 85 a4 07 49 fa 30 f1 97 2b 8b 28 7f d4 af b9 71 fc 8a 15 1a Data Ascii: Yix6E&,<K-^7( Q?AOj;#`?sfD`4X(g,jPlY{[[pm`'gg03!E%wb?T^NTL7WgvXS1wd#p.NI0+(q
2024-04-18 13:36:43 UTC	16384	IN	Data Raw: 60 5f 5a 57 0e 1f 80 6c ce be 34 75 c7 b1 36 68 16 c0 87 f1 b0 d0 e0 8b c4 22 81 4b 05 30 b1 e8 87 88 0a 8c 01 38 89 37 0d 69 02 04 30 fa 14 0e 82 de e9 31 54 38 30 34 f4 b9 38 80 37 85 91 03 3e 82 00 a6 fa c5 7f dd 7c 81 be da fb 53 08 1e 80 a9 23 f3 f2 c8 d7 33 a8 98 0c e1 31 9c 04 f0 cc fc fc f7 ef df 83 ee fa a7 af c7 79 e7 5e 05 55 e0 97 42 57 ed 91 95 95 a0 d4 0a e0 7e 06 02 f0 38 16 c0 53 21 d4 3b 2a 7c a6 93 e3 5d d6 16 a6 3d 06 52 9f be d9 9c e5 23 22 56 ad 9a 71 70 6e 57 37 4b b3 1e 7f 90 94 ac d5 a9 9b b9 1f 5d da a3 2f 58 54 cb 7c 7a a3 01 50 87 4e a6 de de e6 26 d6 a5 04 30 61 ab 54 f2 08 5c 71 00 76 42 00 26 d1 eb 04 39 ec 44 6b c3 48 18 e7 e7 76 18 80 a9 6d 0e b6 f6 f6 0e 40 00 82 11 70 6d 6c 6c eb 01 81 0c a6 bb 2f b6 90 bf f0 59 ea fc 44 Data Ascii: `_ZWl4u6h"K087i01T80487>\|S#31y^UBW~8S!;*\|]=R#"VqpnW7K]/XT\|zPN&0aT\qvB&9DkHvm@pmll/YD
2024-04-18 13:36:43 UTC	16384	IN	Data Raw: 2a d5 02 06 60 f8 49 99 b1 00 e6 f9 5c 9d cf d3 00 70 49 09 03 60 e8 7a b5 4d 1c c0 69 69 7c 00 9f e6 01 38 5a 32 80 cd df 61 11 4c a6 c7 c4 40 0f a7 db b7 a9 b9 bb 8f cf ed 18 bc 0a 74 5e 26 ed b9 b3 68 ee a1 8d fb f6 2d 9c aa 1a 75 2f 7c f3 9c e1 8f 5f 4f f2 55 a8 32 e3 07 55 11 00 13 2e 10 c0 14 90 ec 54 4a b9 75 15 74 c2 b2 67 bc a0 81 e8 bc 7f 2b 03 01 d8 cc 00 00 ee 3e 72 e4 ac 11 b5 f8 15 01 00 3c 7e 59 35 05 f0 b8 68 bd 0e 47 d1 69 35 01 0c a7 07 ff 6c 00 b7 d6 66 bc c4 fd 88 71 2b e7 ff f1 b4 bb d6 65 2c c3 8d f2 d4 50 cb 7d d0 e6 e6 ff 6b ac b5 40 53 fd a7 c6 42 69 2e 25 ad 50 5d e9 71 38 c4 2d c3 7a 3f 70 29 2b 56 14 c0 00 b0 e2 00 be 84 d2 27 1c 64 01 9c 2f 7e aa 4f f0 8d 83 6d c8 5c f2 1f 29 d0 cd ea 93 68 19 a8 f3 32 00 16 8a 47 b3 f5 00 d6 Data Ascii: *`I\pI`zMii\|8Z2aL@t^&h-u/\|_OU2U.TJutg+>r<~Y5hGi5lfq+e,P}k@SBi.%P]q8-z?p)+V'd/~Om\)h2G
2024-04-18 13:36:43 UTC	16384	IN	Data Raw: d4 30 cd 61 1b b6 77 6f 5d 74 62 6b c5 8b 17 85 d4 49 3a 90 f9 e5 4b 94 34 d3 41 54 8d c4 00 5e c3 55 d1 38 fa a4 8a 07 e0 57 98 bc af 9e 16 1b fc bc d3 a4 ec cd bd e8 41 be 07 44 2f 5b 95 7a 7a 55 15 ed 6f de 9b 93 33 8f f3 3b d3 6f f3 83 9d a1 df b9 0d bb 59 61 91 49 d6 27 15 ce fc 36 37 74 76 f6 6d f8 40 bf 81 c9 b9 e7 ce 15 14 cc d3 7f 63 be 8f 4f 24 0b 60 c0 5f fe 09 00 fe ae 4c a6 5f 43 fe 96 31 5e 43 0d e0 6f 21 91 a0 04 f9 3b 87 94 06 4e d3 c3 66 cf 50 92 00 b6 e1 00 ac f3 45 5d 90 6c b9 a7 bc da d2 20 80 29 a5 27 4d 15 25 4d 79 ad 5a 09 1f fc 5a 8d ca 59 ab 56 39 82 17 0e 0e 6a 60 5a 27 47 e4 b9 d5 3a 33 b4 75 d5 39 39 39 bb d0 00 76 91 06 30 7f 1a d8 c5 c5 f8 45 45 00 76 d3 ab 82 85 67 90 4d 04 b0 24 e6 35 06 00 ac 55 a1 93 a7 5c 54 f6 32 4c 60 Data Ascii: 0awo]tbkI:K4AT^U8WAD/[zzUo3;oYaI'67tvm@cO$`_L_C1^Co!;NfPE]l )'M%MyZZYV9j`Z'G:3u999v0EEvgM$5U\T2L`

Target ID:	0
Start time:	15:36:25
Start date:	18/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	15:36:26
Start date:	18/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2204,i,11186399499180968135,2586960386879572005,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	15:36:30
Start date:	18/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://lukltd-my.sharepoint.com/personal/jack_quinn_logicalis_com/Documents/NetApp/United%20Drug/United%20Drug%20AFF%20A200%20Installation%20%20v1.1.xlsx?d=w5530be7ff19d41eb8a183343e8d6e4dc&web=1"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://lukltd-my.sharepoint.com/personal/jack_quinn_logicalis_com/Documents/NetApp/United%20Drug/United%20Drug%20AFF%20A200%20Installation%20%20v1.1.xlsx?d=w5530be7ff19d41eb8a183343e8d6e4dc&web=1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
https://lukltd-my.sharepoint.com/personal/jack_quinn_logicalis_com/Documents/NetApp/United%20Drug/United%20Drug%20AFF%20A200%20Installation%20%20v1.1.xlsx?d=w5530be7ff19d41eb8a183343e8d6e4dc&web=1