Edit tour

Windows Analysis Report
https://visusewer-my.sharepoint.com/:b:/g/personal/andrewj_visu-sewer_com/EVRAxCWP2AROv6Avc61UgjEBiCCPFuGZSfuR7U720Gontw?e=vqq7tt

Overview

General Information

Sample URL:	https://visusewer-my.sharepoint.com/:b:/g/personal/andrewj_visu-sewer_com/EVRAxCWP2AROv6Avc61UgjEBiCCPFuGZSfuR7U720Gontw?e=vqq7tt
Analysis ID:	1428932
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1672 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6184 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2044,i,16513738988315491278,1890450464409074882,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2108 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://visusewer-my.sharepoint.com/:b:/g/personal/andrewj_visu-sewer_com/EVRAxCWP2AROv6Avc61UgjEBiCCPFuGZSfuR7U720Gontw?e=vqq7tt" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49733 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.60.84.144:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.60.84.144:443 -> 192.168.2.5:49727 version: TLS 1.2

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49733 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.84.144
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.84.144
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.84.144
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.84.144
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.84.144
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.84.144
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.84.144
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.84.144
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.84.144
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.84.144
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.84.144
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.84.144
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.84.144
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.84.144
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.84.144
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.84.144
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.84.144
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.84.144
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.84.144
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /:b:/g/personal/andrewj_visu-sewer_com/EVRAxCWP2AROv6Avc61UgjEBiCCPFuGZSfuR7U720Gontw?e=vqq7tt HTTP/1.1Host: visusewer-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/1033/styles/corev15.css?rev=34APf%2FlfLRHu1iumf2MGdw%3D%3DTAG442 HTTP/1.1Host: visusewer-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://visusewer-my.sharepoint.com/:b:/g/personal/andrewj_visu-sewer_com/EVRAxCWP2AROv6Avc61UgjEBiCCPFuGZSfuR7U720Gontw?e=vqq7ttAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG442 HTTP/1.1Host: visusewer-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://visusewer-my.sharepoint.com/:b:/g/personal/andrewj_visu-sewer_com/EVRAxCWP2AROv6Avc61UgjEBiCCPFuGZSfuR7U720Gontw?e=vqq7ttAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=__lzUVIbfgvUiJH3ULiLQHApSSctiq4SYenACacIKvjG6yoJteFHTTMQGs3v2Z-u6A9C1iy9MnRmfZpGShLsEGGH3sqJuxLys85t36aOqg5b2-yN8IOxlFETESdOb9GT2Omvd251mPL9T5eisI_Sq691tgyqtJiQvWnMPIu9_NUnc_M0cSVOmuE3Phb6aXsg0&t=722fe453 HTTP/1.1Host: visusewer-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://visusewer-my.sharepoint.com/:b:/g/personal/andrewj_visu-sewer_com/EVRAxCWP2AROv6Avc61UgjEBiCCPFuGZSfuR7U720Gontw?e=vqq7ttAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=WWVRr4224OtJKF3TM5jnRGyBAjsLB-qsWdyrdN_DLuZ1QelWvuIxCMmU3NGNulFwDFwDf3Fj3l1ODxiG6M8OrwLfM_HvgF5fhgaAsxhXev39UAFtNrbVQO1tO37inPddL_DP7l-38--WokwbccW-eRk1rvRp7k5icJ9FVh9y0Cj0LxxnlmTe2hc4GVuwlre10&t=722fe453 HTTP/1.1Host: visusewer-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://visusewer-my.sharepoint.com/:b:/g/personal/andrewj_visu-sewer_com/EVRAxCWP2AROv6Avc61UgjEBiCCPFuGZSfuR7U720Gontw?e=vqq7ttAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=l4QTkVK95fJZZGIRCQ1xtLafoQawd_OPBYaPMXggEwAEGEhd8Ol3EzJ4Wb9xck9XCKKgOPhT8HcuQrSxRF0SYoUXIp6QR_W2k22Cacsy-fM1&t=638449966421100877 HTTP/1.1Host: visusewer-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://visusewer-my.sharepoint.com/:b:/g/personal/andrewj_visu-sewer_com/EVRAxCWP2AROv6Avc61UgjEBiCCPFuGZSfuR7U720Gontw?e=vqq7ttAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1Host: visusewer-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://visusewer-my.sharepoint.com/:b:/g/personal/andrewj_visu-sewer_com/EVRAxCWP2AROv6Avc61UgjEBiCCPFuGZSfuR7U720Gontw?e=vqq7ttAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1Host: visusewer-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: visusewer-my.sharepoint.com

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1713555271032&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: chromecache_76.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.24803.12006/1033/initstrings.js
Source: chromecache_76.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.24803.12006/blank.js
Source: chromecache_76.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.24803.12006/init.js
Source: chromecache_76.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.24803.12006/theming.js

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 23.60.84.144:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.60.84.144:443 -> 192.168.2.5:49727 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@16/33@6/5

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2044,i,16513738988315491278,1890450464409074882,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://visusewer-my.sharepoint.com/:b:/g/personal/andrewj_visu-sewer_com/EVRAxCWP2AROv6Avc61UgjEBiCCPFuGZSfuR7U720Gontw?e=vqq7tt"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2044,i,16513738988315491278,1890450464409074882,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
dual-spo-0005.spo-msedge.net	13.107.136.10	true	false	unknown
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.50.24	true	false	unknown
www.google.com	172.253.124.103	true	false	high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
visusewer-my.sharepoint.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://visusewer-my.sharepoint.com/_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG442	false	unknown
https://visusewer-my.sharepoint.com/ScriptResource.axd?d=WWVRr4224OtJKF3TM5jnRGyBAjsLB-qsWdyrdN_DLuZ1QelWvuIxCMmU3NGNulFwDFwDf3Fj3l1ODxiG6M8OrwLfM_HvgF5fhgaAsxhXev39UAFtNrbVQO1tO37inPddL_DP7l-38--WokwbccW-eRk1rvRp7k5icJ9FVh9y0Cj0LxxnlmTe2hc4GVuwlre10&t=722fe453	false	unknown
https://visusewer-my.sharepoint.com/_layouts/15/images/favicon.ico?rev=47	false	unknown
https://visusewer-my.sharepoint.com/ScriptResource.axd?d=__lzUVIbfgvUiJH3ULiLQHApSSctiq4SYenACacIKvjG6yoJteFHTTMQGs3v2Z-u6A9C1iy9MnRmfZpGShLsEGGH3sqJuxLys85t36aOqg5b2-yN8IOxlFETESdOb9GT2Omvd251mPL9T5eisI_Sq691tgyqtJiQvWnMPIu9_NUnc_M0cSVOmuE3Phb6aXsg0&t=722fe453	false	unknown
https://visusewer-my.sharepoint.com/:b:/g/personal/andrewj_visu-sewer_com/EVRAxCWP2AROv6Avc61UgjEBiCCPFuGZSfuR7U720Gontw?e=vqq7tt	false	unknown
https://visusewer-my.sharepoint.com/_layouts/15/1033/styles/corev15.css?rev=34APf%2FlfLRHu1iumf2MGdw%3D%3DTAG442	false	unknown
https://visusewer-my.sharepoint.com/WebResource.axd?d=l4QTkVK95fJZZGIRCQ1xtLafoQawd_OPBYaPMXggEwAEGEhd8Ol3EzJ4Wb9xck9XCKKgOPhT8HcuQrSxRF0SYoUXIp6QR_W2k22Cacsy-fM1&t=638449966421100877	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.253.124.103	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.7
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428932
Start date and time:	2024-04-19 21:33:56 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://visusewer-my.sharepoint.com/:b:/g/personal/andrewj_visu-sewer_com/EVRAxCWP2AROv6Avc61UgjEBiCCPFuGZSfuR7U720Gontw?e=vqq7tt
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@16/33@6/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.9.94, 64.233.185.84, 142.250.105.138, 142.250.105.113, 142.250.105.101, 142.250.105.102, 142.250.105.100, 142.250.105.139, 34.104.35.123, 23.1.33.8, 23.1.33.7, 23.1.33.6, 23.1.33.4, 23.1.33.16, 23.1.33.18, 23.1.33.15, 23.1.33.12, 20.114.59.183, 192.229.211.108, 199.232.214.172, 20.3.187.198, 20.166.126.56, 64.233.185.94, 13.85.23.86, 23.40.205.58, 23.40.205.26, 23.40.205.66, 23.40.205.67, 23.40.205.49, 23.40.205.74, 23.40.205.83
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, e40491.dscd.akamaiedge.net, clientservices.googleapis.com, res-1.cdn.office.net, ctldl.windowsupdate.com, 191635-ipv4v6w.farm.dprodmgd105.sharepointonline.com.akadns.net, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, clients.l.google.com, res-1.cdn.office.net-c.edgekey.net, res-1.cdn.office.net-c.edgekey.net.globalredir.akadns.net, glb.sls.prod.dcat.dsp.trafficmanager.net
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: https://visusewer-my.sharepoint.com/:b:/g/personal/andrewj_visu-sewer_com/EVRAxCWP2AROv6Avc61UgjEBiCCPFuGZSfuR7U720Gontw?e=vqq7tt

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 18:34:48 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9801997181637154
Encrypted:	false
SSDEEP:	48:8jkdwT0IzHMidAKZdA19ehwiZUklqehuy+3:8zvGZy
MD5:	BDA330FC92ABEF6A343023F6773E4667
SHA1:	D7ABFECFE6E89119DD97EC2D96843E25579CE50E
SHA-256:	E4F4F938AF2A925B17B3C628CEEEA11C98571E718EA2A00CBEAE1E9B5A49E609
SHA-512:	C36D412368E96B1B121D55AF692D714897002DF69A332FCAE024542435528CE1C1882D4D60C92F71D47BED7FBAF2B89E41E2AFE23AEB1E2147B30B604DA85B18
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....z......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.XV.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XV.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XV.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XV............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........\.J......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 18:34:48 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.994546956496307
Encrypted:	false
SSDEEP:	48:8AdwT0IzHMidAKZdA1weh/iZUkAQkqehJy+2:8DvE9Q8y
MD5:	EBEF6468A66CBFAD71ADE452BCD13546
SHA1:	ACC74291C5C495ADF95FC60A56B04EF9A06D408D
SHA-256:	C795186DCA3A1B370BB3BAC9FBADFE9E7C67965839952F28AC0AF450AD575B1E
SHA-512:	FDF025718621DA8C516EBA22A142ADE952568C05313AA7DAE5B6A18D8AADA69B269E7A568669131E1C43C5AC142023579CFBF04777C57CC0A9761C77C72999F5
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....0.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.XV.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XV.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XV.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XV............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........\.J......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.0042845157733336
Encrypted:	false
SSDEEP:	48:8xBdwT0IsHMidAKZdA14tseh7sFiZUkmgqeh7svy+BX:8x0vJnVy
MD5:	ADC0E4800EB7CF389AA442BD4680550F
SHA1:	4CCDA863A244DBE26FF560348C8B93462D69A0A4
SHA-256:	ED088F695571E3DC4F7226EC4B04EB00F2C9A9A289BC27DB9A7D9775701FB8BB
SHA-512:	A339226C1EC6830ABC4D7ECC7F7E1B5AFC77D5870D2FE66B8D0DB80E3C99EF327A2F0AEBB036DD021261DCD9DE46A256EE63CCEC8D99CBCDAB512D9BE61F98C3
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.XV.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XV.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XV.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XV............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........\.J......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 18:34:48 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.989956838476543
Encrypted:	false
SSDEEP:	48:82dwT0IzHMidAKZdA1vehDiZUkwqehty+R:8RvPny
MD5:	9CF47ED7515E686B00C05B5E8DC71196
SHA1:	314F43F6C7A7660FEC0BAEA9FEEF1B6B7704F078
SHA-256:	D2FE7DE359030194C7A139C7443EC804A7E311EC4D6BC13E27779946BE3796F5
SHA-512:	03E7E9E54D672399091E51F80D3E2DE113F3F5B121981CC05B67742DF5EC0C9C644CB080C02BDE6B8CB14AE71297E40489A2EAD8E83571A3686616F0CC9361D6
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....:......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.XV.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XV.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XV.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XV............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........\.J......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 18:34:48 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.982961691687115
Encrypted:	false
SSDEEP:	48:8hdwT0IzHMidAKZdA1hehBiZUk1W1qehLy+C:8Uvv9ry
MD5:	FEE3710DA31937C25EBE9CF622066C14
SHA1:	73CB160C550FF9890538247445D15AF83BE41E46
SHA-256:	FAA0AE38315F1008334E3C8A0973653E10EDA9ACA75C7DD832B02E62DCAC8327
SHA-512:	9CF7E73C19F9517CB9D55CA5F51B7245843755BC032536DCC1AC8CE8EC845A7C0BD306A2895EB653749A6E261A749CC5A3149C00F9A6291754FA00813FDF3F14
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....X......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.XV.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XV.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XV.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XV............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........\.J......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 18:34:48 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9955988944048104
Encrypted:	false
SSDEEP:	48:8H5dwT0IzHMidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbVy+yT+:8HcvnT/TbxWOvTbVy7T
MD5:	672C35E7C4182188E099B5675EA95A4D
SHA1:	AD063C434EA32FD61EAC07F1C5F6E58E2D0A0099
SHA-256:	DB10FAF6D88B7D7BF328BA85C45498DF2E81EF18E04E21A9F28CC304C6E826A1
SHA-512:	6286F1A24F06C16F0F86A543FFECB5A0B5DBE8D49767AA4A11CDB8E4B46859A26679B219F8ACF333E2199E42511A8986CF02716C1F75597C54E56F4D110A582F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.XV.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XV.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XV.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XV............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........\.J......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	511765
Entropy (8bit):	5.44074312040271
Encrypted:	false
SSDEEP:	12288:A3OkpWeupsTyhEQLQr4ABnIF7wEyAJU7/:A3OkpWeuGTyhEQLQr4ABnIdwEyAm
MD5:	EFA73485352668C720342E73EBBF7E54
SHA1:	78907E786C7A1CCDD09E181A53AFEFC7439BA7D0
SHA-256:	F0D48CA4175EB6210E10BD4386300A9C12D88E8BE710233174CEDB4F842E3443
SHA-512:	45772385BEC7DC523E8155452E212E7DFD7B4A2D6174D8C18D2C247415A7FB048062A3DF132DA2BBB88D3AB4782D183BB127ECC1FDF6EBB83F1A0FD8BFA5EE1F
Malicious:	false
Reputation:	low
URL:	https://res-1.cdn.office.net/bld/_layouts/15/16.0.24803.12006/core.js
Preview:	function $_global_core(){if("undefined"==typeof g_all_modules)g_all_modules={};g_all_modules["core.js"]={version:{rmj:16,rmm:0,rup:24803,rpr:12006}};typeof spWriteProfilerMark=="function"&&spWriteProfilerMark("perfMarkBegin_core.js");SPAnimation={};SPAnimation.g_Curves=new Array(7);SPAnimation.g_Curves[0]=new SPCurve(0,0,0,0,0,0);SPAnimation.g_Curves[1]=new SPCurve(1,1,0,0,0,0);SPAnimation.g_Curves[2]=new SPCurve(2,2,0,0,0,0);SPAnimation.g_Curves[3]=new SPCurve(3,3,.1,.9,.2,1);SPAnimation.g_Curves[4]=new SPCurve(4,3,.42,0,1,1);SPAnimation.g_Curves[5]=new SPCurve(5,3,0,0,.58,1);SPAnimation.g_Curves[6]=new SPCurve(6,3,.42,0,.58,1);SPKeyFrame.prototype={type:0,curveID:0,startTime:0,endTime:0,startValue:0,endValue:0,relativeTo:0,operationType:0};SPAnimation.Attribute={PositionX:1,PositionY:2,Height:3,Width:4,Opacity:5};SPAnimation.ID={Basic_Show:0,Basic_SlowShow:1,Basic_Fade:2,Basic_Move:3,Basic_Size:4,Content_SlideInFadeInRight:5,Content_SlideInFadeInRightInc:6,Content_SlideOutFadeOutRigh

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 40329
Category:	downloaded
Size (bytes):	9984
Entropy (8bit):	7.979200972475404
Encrypted:	false
SSDEEP:	192:/Z/x+yzJpYhEFmtHByePw0JwScHXWumyaxkomNwWs8pQegUOX+B/rHiG:/JP8hEFshyePw8cHXx58k3OWVpQegUO0
MD5:	027A7D52E1CEED8AEF7DC13505B81D36
SHA1:	33CF0BCE6A4C8B44B4A80B3116C978C12EE93FD0
SHA-256:	29061464FB6FCE2326B952EACAA95C3C6183BFEA74C3851390E9838720D372A6
SHA-512:	FCDDEBF6DE759B5079E7DF2432771A866DE1824B119AD8CB3BAE11F9FAA060B943D52F121E4C63E7E20D43F31B2220C1D4E9C24A20004C4B061CD1A0A5EE5AC9
Malicious:	false
Reputation:	low
URL:	https://visusewer-my.sharepoint.com/ScriptResource.axd?d=WWVRr4224OtJKF3TM5jnRGyBAjsLB-qsWdyrdN_DLuZ1QelWvuIxCMmU3NGNulFwDFwDf3Fj3l1ODxiG6M8OrwLfM_HvgF5fhgaAsxhXev39UAFtNrbVQO1tO37inPddL_DP7l-38--WokwbccW-eRk1rvRp7k5icJ9FVh9y0Cj0LxxnlmTe2hc4GVuwlre10&t=722fe453
Preview:	...........}ks.H......@a{ebU......h.^.._a..3!k...HB....m.%....?i..e..U@.........wefefefU........O.....?8).we:...?x..eQ.....EQ.:-.`p.e.^....b.W..X.........UQ.......,...4.jV~..tQ........`......Y..,.]........sR..E...M....\.c>H5.t......xW.jt.?6?.c(..`_....B.G..'.<.1.c....o...yZ..cZ.a=K+....l.l...EQ..4.=......L_..Z..4gYuQ\|._!]m1.`Q.uQ....)..=..\|.....2.8G."XY.......]c..\|xT....3@..?..Zm..E.'........2..E gy..<(.Z...8XY..4O2....U...4.0..5.W!}x._i.`.T,.V.G...b/.t..j>...<.((....,."Uo5X}.@QE.b.khU.h...>...Q~=.k.?.....o.0k........GM..X......P^G....=..<fY.U..S....K....H..9:......'...J=).O....#G[m...30k...j.2+.im.(Km3.uxv._.pT.4.>..f.-..UZ.=e...C....._5..xR.:..\U..jR. .....9A..1:1.......a..2...U......YTP..`...l0.9.t.}.'.p.c3q.. {m.,...G1..".L.Aj@.D.h.p......fZ{...eYB......1.Ep.b&..% .c.._i9.).,.eD.'...`.E.i..M3#+6...9+....B..NYB..%..8..?....zv.r..XP..W.../+..e.N........Z..i..... ....4I..iR...8+.>....k...N?....MA.....uU...&...Xyb..u..H....%.

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (64255), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	200967
Entropy (8bit):	4.9862812145125455
Encrypted:	false
SSDEEP:	6144:aN+sv/ySGDl7Wg79MJHa4yBBCDRV51knP3cqMDUpgZ3sg/f+xD02:ebKSGDl7Wg79MJHAxFG92
MD5:	7B9DC6F4061F8B216066C74F16DD3699
SHA1:	B897CB193C5A9F97BD6B8744964C1B24AE4BE1E8
SHA-256:	3EE991F6408FADCAB5A8FC562368870A1A6588FB3B5F911BEBA826F49C7BF3EA
SHA-512:	BE47DC2BFD6505B3866C21A4102C653D69C22A50B667DF03368A5B15FC8021D5D8E62AAD5D92DFB61D86E1865DF4F50237EF11A4F3F9BAF06423B34DC64118EB
Malicious:	false
Reputation:	low
URL:	https://visusewer-my.sharepoint.com/:b:/g/personal/andrewj_visu-sewer_com/EVRAxCWP2AROv6Avc61UgjEBiCCPFuGZSfuR7U720Gontw?e=vqq7tt
Preview:	..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN".."http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns:o="urn:schemas-microsoft-com:office:office" lang="en-us" dir="ltr">..<head><meta name="GENERATOR" content="Microsoft SharePoint" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta http-equiv="Expires" content="0" /><meta http-equiv="X-UA-Compatible" content="IE=8"/><meta name="ROBOTS" content="NOHTMLINDEX" /><title>......Error....</title><link id="CssLink-147a5307bfa6436a9e442f657ce43dbf" rel="stylesheet" type="text/css" href="/_layouts/15/1033/styles/corev15.css?rev=34APf%2FlfLRHu1iumf2MGdw%3D%3DTAG442"/>.<link id="CssLink-b996d42f5a18410cb20125e93def07f8" rel="stylesheet" type="text/css" href="/_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG442"/>.<style id="SPThemeHideForms" type="text/css">body {opacity:0 !important}</style><script type="text/javascript">// <![CDATA[ ...var _initGlobalSnapShot = {};try { if

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (35238), with no line terminators
Category:	downloaded
Size (bytes):	35238
Entropy (8bit):	5.390650418562352
Encrypted:	false
SSDEEP:	768:PrxzCC2akwbs7lSZTprPaTrPyrfKwKTZiNOzpCk47S:hsp7ly9rP0S4pCkx
MD5:	C637DE6889D81964119BA1FD124E2454
SHA1:	5DB2B1681BE6FF9A7B26E269CD80D817D41A01BE
SHA-256:	18E8366C8C5590C3D056BA6CA9691B7471D6970EE00D0E22A4B68E517B54F087
SHA-512:	78288767F08DB38F6DC8C366546CECC05DF35C25BCD898B94DCCC5ECCB3ACD7807817BAF813BCA11F4CCAC169A980E4F10EBF4334000C4D2D0F74DCC30BB36EE
Malicious:	false
Reputation:	low
URL:	https://res-1.cdn.office.net/bld/_layouts/15/16.0.24803.12006/theming.js
Preview:	var Theming={__namespace:true};Theming_module_def();function Theming_module_def(){Theming.ApplyThemeToCss=tb;Theming.ReplaceCssTextForElement=J;Theming.ThemeInfo=E;Theming.ImageProcessor=R;Theming.Colors={Color:a,ColorApplication:x,HslColor:h};function cb(d,c,e){for(var b=true,a=0;a<c.length;a++)if(d.charCodeAt(e+a)!==c.charCodeAt(a)){b=false;break}return b}var c={text:0,comment:1,string:2,url:3,right_par:4,font_family:5,rgb:6,rgba:7,colon:8,semicolon:9,right_curly:10,color:11};function d(a,b){this.kind=a;this.text=b}function Db(b){var e,a,g,f,l="*/",u="url(",i=")",j="font-family",t="rgb(",s="rgba(",o="#",w=":",y=";",x="}",k=new d(c.text,"");if(!Boolean(b))b="";a=0;f=b.length;m.prototype={kind:0,text:"",getToken:function(){return null}};function m(){}var r={"/":{},"'":{},'"':{},"#":{},")":new d(c.right_par,")"),";":new d(c.semicolon,";"),":":new d(c.colon,":"),"}":new d(c.right_curly,"}"),u:{getToken:q},f:{getToken:n},r:{getToken:p}};function h(c){var a=b.indexOf(")",c);if(a<0)a=f;retu

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	23063
Entropy (8bit):	4.7535440881548165
Encrypted:	false
SSDEEP:	384:GvUzYI+Vi4g1V5it1ONhA6w+Kv8i/4CYzLKL4DrLU0iTxZTAzIzrwDlTWMClQip9:bkON69kClQq8hDRJHp2tWU25Zt/gREVG
MD5:	90EA7274F19755002360945D54C2A0D7
SHA1:	647B5D8BF7D119A2C97895363A07A0C6EB8CD284
SHA-256:	40732E9DCFA704CF615E4691BB07AECFD1CC5E063220A46E4A7FF6560C77F5DB
SHA-512:	7474667800FF52A0031029CC338F81E1586F237EB07A49183008C8EC44A8F67B37E5E896573F089A50283DF96A1C8F185E53D667741331B647894532669E2C07
Malicious:	false
Reputation:	low
URL:	https://visusewer-my.sharepoint.com/WebResource.axd?d=l4QTkVK95fJZZGIRCQ1xtLafoQawd_OPBYaPMXggEwAEGEhd8Ol3EzJ4Wb9xck9XCKKgOPhT8HcuQrSxRF0SYoUXIp6QR_W2k22Cacsy-fM1&t=638449966421100877
Preview:	function WebForm_PostBackOptions(eventTarget, eventArgument, validation, validationGroup, actionUrl, trackFocus, clientSubmit) {.. this.eventTarget = eventTarget;.. this.eventArgument = eventArgument;.. this.validation = validation;.. this.validationGroup = validationGroup;.. this.actionUrl = actionUrl;.. this.trackFocus = trackFocus;.. this.clientSubmit = clientSubmit;..}..function WebForm_DoPostBackWithOptions(options) {.. var validationResult = true;.. if (options.validation) {.. if (typeof(Page_ClientValidate) == 'function') {.. validationResult = Page_ClientValidate(options.validationGroup);.. }.. }.. if (validationResult) {.. if ((typeof(options.actionUrl) != "undefined") && (options.actionUrl != null) && (options.actionUrl.length > 0)) {.. theForm.action = options.actionUrl;.. }.. if (options.trackFocus) {.. var lastFocus = theForm.elements["__LASTFOCUS"];.. if ((typeo

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (23437), with CRLF line terminators
Category:	downloaded
Size (bytes):	23594
Entropy (8bit):	5.107347306409284
Encrypted:	false
SSDEEP:	384:zyWvVsT5pTtxJOyNm7lMqasjI8LWv3n8wyM:zJsT5pTt7kK+M
MD5:	964FCB2BAF87049DC68975291AE89431
SHA1:	D0CD8C989D44BC531472B632868D3FB2DE4B3184
SHA-256:	B8F7BD568E379502CF0C00027581D2761C7DC14B166F5D25FC048A0B56B7BFBB
SHA-512:	03CB58D197A776F9C315C2A14B9C034D88C7B7E9F4247C5698396F4FE7363A22FC2042A24C02A245C7E035DD2862F88E8EF46A7E5A269EDC2B69E39752A52987
Malicious:	false
Reputation:	low
URL:	https://res-1.cdn.office.net/bld/_layouts/15/16.0.24803.12006/1033/initstrings.js
Preview:	var Strings; if (Strings === undefined) { Strings=new Object(); }Strings.STS=function(){};Strings.STS.L_NewTab="New tab";Strings.STS.L_CalloutLastEditedNameAndDate="Changed by ^1 on ^2";Strings.STS.L_CalloutSourceUrlHeader="Location";Strings.STS.L_SPDiscBestUndo="Remove best reply";Strings.STS.L_SPClientManage="manage";Strings.STS.L_SPAddNewWiki="new Wiki page";Strings.STS.L_SPCategorySortRecent="Recent";Strings.STS.L_ViewSelectorTitle="Change View";Strings.STS.L_SPDiscNumberOfLikes="{0} likes\|\|{0} like\|\|{0} likes";Strings.STS.L_Timeline_DfltViewName="Timeline";Strings.STS.L_TimelineToday="Today";Strings.STS.L_SPDiscNoPreviewAvailable="No preview available for this reply";Strings.STS.L_NODOCView="There are no documents in this view.";Strings.STS.L_SPBlogPostAuthorCategories="by {0} in {1}";Strings.STS.L_SPBlogsNoItemsInCategory="There are no posts in this category.";Strings.STS.L_QRCodeDescription="Scan this QR code with your phone or tablet to open {0}";Strings.STS.L_RelativeDateTime

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	dropped
Size (bytes):	7886
Entropy (8bit):	3.9482833105763633
Encrypted:	false
SSDEEP:	48:gubb4a2MNTgopLqyhFTv07EVc91JbV5FIXH0wp53O:Bbb4a5NTX1c9L6E
MD5:	0B60F3C9E4DA6E807E808DA7360F24F2
SHA1:	9AFC7ABB910DE855EFB426206E547574A1E074B7
SHA-256:	ADDEEDEEEF393B6B1BE5BBB099B656DCD797334FF972C495CCB09CFCB1A78341
SHA-512:	1328363987ABBAD1B927FC95F0A3D5646184EF69D66B42F32D1185EE06603AE1A574FAC64472FB6E349C2CE99F9B54407BA72B2908CA7AB01D023EC2F47E7E80
Malicious:	false
Reputation:	low
Preview:	...... .... .....6......... ............... .h...f...(... ...@..... ...........................................................................70..7...7...7...7...7...7...70..............................................................................................7`..7...7...7...7...7...7...7...7...7`......................................................................................7P..7...7...7...7...7...7...7...7...7...7...7P..............................................................................7...7...7...7...7...7...7...7...7...7...7...7...7...7...........................................................................7`..7...7...7...7...7...7...7...7...7...7...7...7...7`..........................................................................,...,...,...,...,...,...,.......7...7...7...7...7...7...........................................................................'...'...'...'...'...'...'...'...2...7...7...7...7...,....................`..........................

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 102804
Category:	downloaded
Size (bytes):	25609
Entropy (8bit):	7.992070293592458
Encrypted:	true
SSDEEP:	768:65FO8CctusRS+4iLLuVC9Vri5MLPMTleAD5:8FbxwsR/4iAz5MbMl5
MD5:	B62553925BD98826C60457D2EB6B9A46
SHA1:	84DBBB6D9B36A587C21B5A56B1D9E587E33BA943
SHA-256:	C58166FE4DF4BA8F25A960C21451EAF841D97F6F552F104E43431C9DB1C2E2CC
SHA-512:	7B6872144AE308224FF671A1EC63F040A40115888790CF6834AD85D517471CE5DAD3EC297EE751FB196B55118A181017151F7F06FCE0F2F26FF94E8EEC070033
Malicious:	false
Reputation:	low
URL:	https://visusewer-my.sharepoint.com/ScriptResource.axd?d=__lzUVIbfgvUiJH3ULiLQHApSSctiq4SYenACacIKvjG6yoJteFHTTMQGs3v2Z-u6A9C1iy9MnRmfZpGShLsEGGH3sqJuxLys85t36aOqg5b2-yN8IOxlFETESdOb9GT2Omvd251mPL9T5eisI_Sq691tgyqtJiQvWnMPIu9_NUnc_M0cSVOmuE3Phb6aXsg0&t=722fe453
Preview:	............r.I.(.>f..d..B6. )U/.(....mGRuw.... I..B..X...<.O..p}.=#.P.>s.Y...D,..........................'.......;.'..2.Uu5.C..%..v.M&;T...u1.T.=...m....'_z.......4.&?~.__....".db00..IR..\|.(tj6+.y.$.L.$..."..FIx3+..tG%.7...N.'..........A9....9;.O...j...Y\|8.........LW........h&.%WW...\|\.Q..Tr....$\..?-&....}O...w..$R}....W.k.+.._..q...P..dR......`^.j]0.L..9......)...."...I....,.K..j...`1.a9-.`..-p..O..t...\|Bo..Uu.~.t...uB9S.J.o..Fe<.....A.SM.....d>.].HO..Qx...ao....a.J..h6K..q7.N.n'..Ga78....v..n...>..0.I.X?...$=...x..H..&.V.+.h..GyTJ....AT...x.Jl...X..t.H4...$9..^u....r9rq3.._..a...^I.{{.Ch....@.l.....@..BW.[..8~6.U3].I#....8....H`...4..I..6...I...Q1...W^]>...P.KJ.L......A...>.@hf.M...RP..)m.F...Wp{.!.R.".j.....!soO..]k...a."eo.S,...G\|n.\|!F[..O../.aR...$.\..4.N.-p1..}...2...r\a[`e.E..{H..?.....J.ak.Y...P......DP.d.?...<..Y.8....%d...@..e.....exc..g...b.....<z....7*8!...n..wG0.C..f..Y5....qE..p....2.rH-..r.S........q..R.$Q^q....!....

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	downloaded
Size (bytes):	7886
Entropy (8bit):	3.9482833105763633
Encrypted:	false
SSDEEP:	48:gubb4a2MNTgopLqyhFTv07EVc91JbV5FIXH0wp53O:Bbb4a5NTX1c9L6E
MD5:	0B60F3C9E4DA6E807E808DA7360F24F2
SHA1:	9AFC7ABB910DE855EFB426206E547574A1E074B7
SHA-256:	ADDEEDEEEF393B6B1BE5BBB099B656DCD797334FF972C495CCB09CFCB1A78341
SHA-512:	1328363987ABBAD1B927FC95F0A3D5646184EF69D66B42F32D1185EE06603AE1A574FAC64472FB6E349C2CE99F9B54407BA72B2908CA7AB01D023EC2F47E7E80
Malicious:	false
Reputation:	low
URL:	https://visusewer-my.sharepoint.com/_layouts/15/images/favicon.ico?rev=47
Preview:	...... .... .....6......... ............... .h...f...(... ...@..... ...........................................................................70..7...7...7...7...7...7...70..............................................................................................7`..7...7...7...7...7...7...7...7...7`......................................................................................7P..7...7...7...7...7...7...7...7...7...7...7P..............................................................................7...7...7...7...7...7...7...7...7...7...7...7...7...7...........................................................................7`..7...7...7...7...7...7...7...7...7...7...7...7...7`..........................................................................,...,...,...,...,...,...,.......7...7...7...7...7...7...........................................................................'...'...'...'...'...'...'...'...2...7...7...7...7...,....................`..........................

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (456), with no line terminators
Category:	downloaded
Size (bytes):	456
Entropy (8bit):	5.2314971256182465
Encrypted:	false
SSDEEP:	6:A+roDEH6IgMbIZc8Z1k8JFPU3IKMPAI0qKIKMPAI0qeCMRTxIj+01KyBui9YDre:A+MYcYkc8Z1JtMASAWCKx2+Wuit
MD5:	CB04B41E7876D11755C54B37A3220DC8
SHA1:	07DC758CC46A33B3FA87E3B7E967A4661CF89264
SHA-256:	3D38C1410E89777F3D109DC8773E6BDD81C0A121DB9F23540609F4FEC99B08A2
SHA-512:	82A1EA89BD2BB5A82CD252C5E78B5E4308D93349FB5971DEA20A74C055F59911D481FE7D02C01175586B70BB02694F761F49AC546770A1D4F4D3DE19436E5B2C
Malicious:	false
Reputation:	low
URL:	https://res-1.cdn.office.net/bld/_layouts/15/16.0.24803.12006/blank.js
Preview:	function $_global_blank(){if("undefined"==typeof g_all_modules)g_all_modules={};g_all_modules["blank.js"]={version:{rmj:16,rmm:0,rup:24803,rpr:12006}};typeof spWriteProfilerMark=="function"&&spWriteProfilerMark("perfMarkBegin_blank.js");typeof spWriteProfilerMark=="function"&&spWriteProfilerMark("perfMarkEnd_blank.js")}function ULSaew(){var a={};a.ULSTeamName="Microsoft SharePoint Foundation";a.ULSFileName="blank.commentedjs";return a}$_global_blank();

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	341066
Entropy (8bit):	5.44337274738708
Encrypted:	false
SSDEEP:	6144:3XVJjsUJaW86hPIjcfbO47IunpizIcxdS+MI4Ny6qF+HNJdWLWnAboc3lexR1YhZ:3XVJjsUPl0ugzIy
MD5:	468353C553341493F5AA2054FDA516DC
SHA1:	40B0DBE25AD873652BC3E38581DD1F45920A16C4
SHA-256:	92D0165F645A21E726DD0697B1B18ABA5E9E05DE1AF86E5397444993560F51D3
SHA-512:	5E69EBADD0690682E65BC79241B00E8CA4AF30BBCFDD582BF15D693D12DD84455CEC4FF3445C57474A064A5ACBC9C1AD32AEA98F071B19B9D35CD434A8F788B0
Malicious:	false
Reputation:	low
URL:	https://res-1.cdn.office.net/bld/_layouts/15/16.0.24803.12006/init.js
Preview:	function $_global_init(){if("undefined"==typeof g_all_modules)g_all_modules={};g_all_modules["init.js"]={version:{rmj:16,rmm:0,rup:24803,rpr:12006}};if(-1!=navigator.userAgent.indexOf("ProfilerMark")&&"function"==typeof msWriteProfilerMark)spWriteProfilerMark=function(a){window.msWriteProfilerMark(a)};typeof spWriteProfilerMark=="function"&&spWriteProfilerMark("perfMarkBegin_init.js");if(typeof OffSwitch=="undefined"){OffSwitch={__namespace:true};OffSwitch_module_def()}if(typeof RuntimeErrors=="undefined"){RuntimeErrors={__namespace:true};RuntimeErrors_module_def()}if(typeof Verify=="undefined"){Verify={__namespace:true};Verify_module_def()}if(typeof Define=="undefined"){Define={__namespace:true};Define_module_def()}if(typeof BrowserDetection=="undefined"){BrowserDetection={__namespace:true};BrowserDetection_module_def()}(function(){b.prototype={firefox:undefined,firefox36up:undefined,firefox3up:undefined,firefox4up:undefined,ie:undefined,ie55up:undefined,ie5up:undefined,ie7down:undefi

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	341640
Entropy (8bit):	5.323828565757342
Encrypted:	false
SSDEEP:	1536:k6Bi397Ra/9FjWr5JwiaPyJmbu52JmKI1DS9sw83nm5ZMUuj24S+o0WmuGUmh4jA:Lvf42B9Hee3s
MD5:	DF800F7FF95F2D11EED62BA67F630677
SHA1:	7E6C6696874F1657E5D5B942562B61CDA6F925B7
SHA-256:	0A8090020B2D42FC859B054EF147B09844046A67B65DBDD175828F1B4244028B
SHA-512:	8CE2E13E55A77FB465F2126C36C7F80EDF1643EFDFDC4A66008A0CDED09CDC97DF77B98AEF05064F530442CBB34D66A6063E22A4CE1AB6D5BC8D5222FC853520
Malicious:	false
Reputation:	low
URL:	https://visusewer-my.sharepoint.com/_layouts/15/1033/styles/corev15.css?rev=34APf%2FlfLRHu1iumf2MGdw%3D%3DTAG442
Preview:	/* _lcid="1033".._LocalBinding /..body,...ms-core-defaultFont,..#pageStatusBar,..#hybridTooltipStatusBar,...ms-status-msg,...js-callout-body..{../ [ReplaceFont(themeFont:"body")] / font-family:"Segoe UI","Segoe",Tahoma,Helvetica,Arial,sans-serif;..font-size:13px;..}..body,...ms-core-defaultFont,...js-callout-body..{../ [ReplaceColor(themeColor:"BodyText")] / color:#444;..}...ms-core-defaultFont..{..font-weight:normal;..text-decoration:none;..white-space:normal;..word-break:normal;..line-height:normal;..}..body..{..margin:0px;..overflow:hidden;../ [ReplaceColor(themeColor:"PageBackground")] / background-color:#fff;..background-size:cover;..background-repeat:no-repeat;..}..html > .ms-core-needIEFilter..{../ [ReplaceBGImage] / -ms-filter:"progid:DXImageTransform.Microsoft.AlphaImageLoader(src='about:blank',sizingMethod='scale');";..}...ms-backgroundImage..{../ [ReplaceBGImage] */ background-image:url();..}..#s4-ribbonrow..{..position:relative;..}..#s4-workspace..{..overflow:auto

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	186722
Entropy (8bit):	5.127936869447186
Encrypted:	false
SSDEEP:	1536:qofu83Pw6jz1+8YZwf7BN6pJsnNxezT8+zacaS8Ob4C//aT5L4DK:883z5+nMDEuvezT8++6kZCe
MD5:	2DE2482829622DE740DB42E04CBCD047
SHA1:	2A88D65A01BDA232B97B24163F66BA7F90A63386
SHA-256:	947D9E7117E8528021EC98FBBD6FE75A4D393A699DFFFFB3A2803EAE42845CEB
SHA-512:	35A2B88CF1FD1505BAD30CF68FB235ED5E5029D4824EC8586452A53E820563229AEA06156B46702C5046DC4BCE0046DFC74E934E215BFDD040B2715D298E8886
Malicious:	false
Reputation:	low
URL:	https://res-1.cdn.office.net/bld/_layouts/15/16.0.24803.12006/1033/strings.js
Preview:	var Strings; if (Strings === undefined) { Strings=new Object(); }Strings.CMS=function(){};Strings.CMS.L_SelectAllAltKey_TEXT="false";Strings.CMS.L_SpellCheckKey_VALUE="0x76";Strings.CMS.L_Callout_Usage_Count="<p>{0}</p>view\|\|<p>{0}</p>views";Strings.CMS.L_NoElementStylesWereRemoved_TEXT="The selection did not contain any instances of element styles to remove.";Strings.CMS.L_DecWidthAltKey_TEXT="false";Strings.CMS.L_ExpandedTagNameH4="Heading 4";Strings.CMS.L_DecWidthShiftKey_TEXT="true";Strings.CMS.L_EditImageRenditionsAction="Edit Renditions";Strings.CMS.L_TabBackKey_TEXT="N";Strings.CMS.L_SvrBusySpellchecker_TEXT="The spell checking server was busy";Strings.CMS.L_RemoveLinkShiftKey_TEXT="false";Strings.CMS.L_Show_TEXT="Show";Strings.CMS.L_Title_TEXT="Title:";Strings.CMS.L_ShowSpecific_TEXT="Show the selected item in navigation";Strings.CMS.L_DecHeightShiftKey_TEXT="true";Strings.CMS.L_ChangeColumnWidthAndRowHeightKey_TEXT="W";Strings.CMS.L_UnlinkToolTip_TEXT="Remove Hyperlink";Strin

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	622
Entropy (8bit):	5.030708856292114
Encrypted:	false
SSDEEP:	12:UXRtEohlWNmONv0MBR0/vUvFa9vN8ESve77Lxukm3auDjqHV:Ofa9n2H8qzxukmKuDjkV
MD5:	B45EDFC9FCDB690CCDA004A8483955E0
SHA1:	BAEDF73329EABB32504CAC640538EE3B6B31819F
SHA-256:	E817BF53005172205995AA07E0021BD8254A0204A1177E925F365E838C32D069
SHA-512:	E2709C77BA686FC58FE528EC2C2CEB6B9C84D045018D77FB9B376359F204FB6B889910B6748C978B4FF9712A7611342DF3C8C59711AA42090219DEC0C83778D2
Malicious:	false
Reputation:	low
URL:	https://visusewer-my.sharepoint.com/_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG442
Preview:	/* _lcid="1033".._LocalBinding */..#ms-error-header..{..margin:118px 0px 16px;..min-height:50px;..}..#ms-error-gobackcont..{..margin-top:28px;..}..#ms-accessDenied-reqDialog..{..max-width:100%;..}..#ms-error-body..{..background-size:auto;..overflow:auto;..width:830px;..margin-right:auto;..margin-left:auto;..}...ms-error-returnLink..{..line-height:19px;..vertical-align:middle;..}...ms-error-detailsFold..{..padding-top:42px;..}...ms-error-techMsg..{..padding-top:28px;..}...ms-error-groupJoinPanel..{..margin-top:15px;..}...ms-error-groupProfileText..{..margin-top:17px;..}...ms-error-separator..{..margin:34px 0px;..}..

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 21:34:41.685816050 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 19, 2024 21:34:41.701442003 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 19, 2024 21:34:41.810888052 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 19, 2024 21:34:49.660330057 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:49.660362959 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:49.660458088 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:49.661032915 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:49.661065102 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:49.661139965 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:49.661660910 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:49.661673069 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:49.661853075 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:49.661865950 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:49.989882946 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:49.994097948 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:49.994133949 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:49.995819092 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:49.995919943 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:49.997390985 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:49.997508049 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:49.997601986 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:49.997612000 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.000317097 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.003037930 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.003053904 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.004664898 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.004740000 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.005760908 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.005856037 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.037488937 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.053622961 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.053637981 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.100107908 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.357425928 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.357455015 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.357536077 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.357544899 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.357593060 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.357692003 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.357712984 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.357777119 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.379054070 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.380692959 CEST	49714	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.380773067 CEST	443	49714	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.380887032 CEST	49714	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.381176949 CEST	49714	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.381212950 CEST	443	49714	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.420124054 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.461711884 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.461798906 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.461837053 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.461848021 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.461920977 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.462124109 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.462194920 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.462201118 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.462212086 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.462260008 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.462291002 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.462297916 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.462343931 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.502990007 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.519742966 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.519798040 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.519962072 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.519982100 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.519996881 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.520004034 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.520031929 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.520037889 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.520062923 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.520195961 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.520251989 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.520266056 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.520281076 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.520303965 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.520309925 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.520324945 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.520355940 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.520392895 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.520399094 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.565022945 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.565280914 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.565296888 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.565660954 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.565725088 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.565727949 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.565743923 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.565797091 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.565808058 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.565814018 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.565860987 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.565869093 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.565912962 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.566024065 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.566092968 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.566098928 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.566293001 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.566354990 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.566360950 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.566417933 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.566476107 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.566483021 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.566541910 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.566585064 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.566601038 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.566606045 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.566662073 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.568084955 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.577657938 CEST	49715	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.577702045 CEST	443	49715	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.577792883 CEST	49715	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.578255892 CEST	49715	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.578285933 CEST	443	49715	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.578797102 CEST	49716	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.578874111 CEST	443	49716	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.578960896 CEST	49716	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.579191923 CEST	49716	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.579212904 CEST	443	49716	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.579999924 CEST	49717	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.580023050 CEST	443	49717	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.580120087 CEST	49717	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.580347061 CEST	49717	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.580355883 CEST	443	49717	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.623425961 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.623449087 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.623575926 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.623591900 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.623886108 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.623904943 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.623950005 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.623958111 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.623989105 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.624083042 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.624118090 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.624152899 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.624161005 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.624190092 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.624258995 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.624321938 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.624329090 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.624385118 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.624485970 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.624499083 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.624516010 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.624563932 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.624571085 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.624614954 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.668929100 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.669091940 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.669115067 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.669553041 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.669573069 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.669711113 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.669711113 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.669718981 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.669934988 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.669954062 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.669986963 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.669992924 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.670027971 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.670173883 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.670191050 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.670243979 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.670249939 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.670264006 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.670273066 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.670357943 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.670363903 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.670403957 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.670453072 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.708206892 CEST	443	49714	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.710545063 CEST	49714	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.710611105 CEST	443	49714	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.711756945 CEST	443	49714	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.715459108 CEST	49714	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.715641975 CEST	443	49714	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.716033936 CEST	49714	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.717868090 CEST	49711	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.717890024 CEST	443	49711	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.727322102 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.727402925 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.727416039 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.727523088 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.727611065 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.727617979 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.727677107 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.727730989 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.727739096 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.727806091 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.727859020 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.727865934 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.727921963 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.727974892 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.727992058 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.728192091 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.728245020 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.728251934 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.728337049 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.728393078 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.728400946 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.728446007 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.728496075 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.728516102 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.756150961 CEST	443	49714	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.770901918 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.830941916 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.831032038 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.831053019 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.832530022 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.832571030 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.832597017 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.832612038 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.832642078 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.832730055 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.832787037 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.832797050 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.832812071 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.832865000 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.832895994 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.833070040 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.833107948 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.833138943 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.833149910 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.833178997 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.833498001 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.833534002 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.833563089 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.833573103 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.833597898 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.833784103 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.833822012 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.833861113 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.833870888 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.833899975 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.834032059 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.834069967 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.834084988 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.834094048 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.834139109 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.834319115 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.834361076 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.834389925 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.834399939 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.834414959 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.834655046 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.834702015 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.834714890 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.834731102 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.834772110 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.840615034 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.858690977 CEST	443	49714	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.858880997 CEST	443	49714	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.858928919 CEST	49714	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.860109091 CEST	49714	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.860136032 CEST	443	49714	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.898408890 CEST	443	49715	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.898833990 CEST	49715	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.898854017 CEST	443	49715	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.899339914 CEST	443	49715	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.900125980 CEST	49715	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.900216103 CEST	443	49715	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.904192924 CEST	49715	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.905982971 CEST	443	49716	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.906349897 CEST	49716	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.906378984 CEST	443	49716	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.909858942 CEST	443	49716	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.909933090 CEST	49716	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.911561966 CEST	49716	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.911664963 CEST	443	49716	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.912389994 CEST	49716	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.912405014 CEST	443	49716	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.934676886 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.934699059 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.934752941 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.934770107 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.934801102 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.934820890 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.935926914 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.935941935 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.935986042 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.936002016 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.936023951 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.936062098 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.936410904 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.936424971 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.936470985 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.936481953 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.936494112 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.936520100 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.936522961 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.936533928 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.936553955 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.936584949 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.936592102 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.936604023 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.936640978 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.939572096 CEST	49710	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:50.939587116 CEST	443	49710	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.952111959 CEST	443	49715	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:50.964610100 CEST	49716	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.011579037 CEST	443	49717	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.042490005 CEST	49717	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.042496920 CEST	443	49717	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.046109915 CEST	443	49717	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.046180964 CEST	49717	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.048806906 CEST	49717	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.048985958 CEST	443	49717	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.057203054 CEST	49717	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.057212114 CEST	443	49717	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.059950113 CEST	443	49716	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.060206890 CEST	443	49716	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.060231924 CEST	443	49716	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.060255051 CEST	443	49716	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.060270071 CEST	49716	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.060280085 CEST	443	49716	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.060306072 CEST	49716	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.060477972 CEST	443	49716	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.060530901 CEST	49716	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.060537100 CEST	443	49716	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.060590982 CEST	443	49716	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.060636997 CEST	49716	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.063154936 CEST	443	49715	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.063178062 CEST	443	49715	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.063252926 CEST	49715	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.063266993 CEST	443	49715	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.063334942 CEST	49715	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.063364983 CEST	443	49715	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.063374996 CEST	443	49715	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.063435078 CEST	49715	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.063446045 CEST	443	49715	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.063466072 CEST	443	49715	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.063503981 CEST	443	49715	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.063519955 CEST	49715	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.063530922 CEST	443	49715	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.063560009 CEST	49715	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.063580036 CEST	49715	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.063599110 CEST	49715	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.063843966 CEST	49716	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.063855886 CEST	443	49716	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.097553015 CEST	49717	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.166958094 CEST	443	49715	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.167017937 CEST	49715	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.167027950 CEST	443	49715	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.167064905 CEST	443	49715	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.167112112 CEST	49715	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.184550047 CEST	49715	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.184578896 CEST	443	49715	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.193417072 CEST	443	49717	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.193471909 CEST	443	49717	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.193536997 CEST	49717	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.193542004 CEST	443	49717	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.193588018 CEST	49717	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.193614006 CEST	443	49717	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.193634987 CEST	443	49717	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.193651915 CEST	443	49717	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.193665981 CEST	49717	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.193706989 CEST	49717	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.193710089 CEST	443	49717	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.240470886 CEST	49717	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.286524057 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 19, 2024 21:34:51.297321081 CEST	443	49717	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.297358036 CEST	443	49717	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.297385931 CEST	49717	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.297432899 CEST	49717	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.297529936 CEST	443	49717	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.297549963 CEST	443	49717	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.297570944 CEST	443	49717	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.297590971 CEST	49717	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.297605038 CEST	49717	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.297651052 CEST	443	49717	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.297699928 CEST	49717	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.298562050 CEST	49717	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.298571110 CEST	443	49717	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.302031040 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 19, 2024 21:34:51.399925947 CEST	49722	443	192.168.2.5	172.253.124.103
Apr 19, 2024 21:34:51.399991035 CEST	443	49722	172.253.124.103	192.168.2.5
Apr 19, 2024 21:34:51.400073051 CEST	49722	443	192.168.2.5	172.253.124.103
Apr 19, 2024 21:34:51.400893927 CEST	49722	443	192.168.2.5	172.253.124.103
Apr 19, 2024 21:34:51.400926113 CEST	443	49722	172.253.124.103	192.168.2.5
Apr 19, 2024 21:34:51.413085938 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 19, 2024 21:34:51.630569935 CEST	443	49722	172.253.124.103	192.168.2.5
Apr 19, 2024 21:34:51.630806923 CEST	49722	443	192.168.2.5	172.253.124.103
Apr 19, 2024 21:34:51.630831957 CEST	443	49722	172.253.124.103	192.168.2.5
Apr 19, 2024 21:34:51.631992102 CEST	443	49722	172.253.124.103	192.168.2.5
Apr 19, 2024 21:34:51.632081032 CEST	49722	443	192.168.2.5	172.253.124.103
Apr 19, 2024 21:34:51.633227110 CEST	49722	443	192.168.2.5	172.253.124.103
Apr 19, 2024 21:34:51.633297920 CEST	443	49722	172.253.124.103	192.168.2.5
Apr 19, 2024 21:34:51.676084042 CEST	49722	443	192.168.2.5	172.253.124.103
Apr 19, 2024 21:34:51.676142931 CEST	443	49722	172.253.124.103	192.168.2.5
Apr 19, 2024 21:34:51.729402065 CEST	49722	443	192.168.2.5	172.253.124.103
Apr 19, 2024 21:34:51.928828001 CEST	49723	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.928864002 CEST	443	49723	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:51.929018021 CEST	49723	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.929702044 CEST	49723	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:51.929724932 CEST	443	49723	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:52.247889042 CEST	443	49723	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:52.248581886 CEST	49723	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:52.248605967 CEST	443	49723	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:52.248895884 CEST	443	49723	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:52.249525070 CEST	49723	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:52.249581099 CEST	443	49723	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:52.249777079 CEST	49723	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:52.296113014 CEST	443	49723	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:52.390141964 CEST	443	49723	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:52.390254974 CEST	443	49723	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:52.390316963 CEST	49723	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:52.390317917 CEST	443	49723	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:52.390391111 CEST	49723	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:52.392462015 CEST	49723	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:52.392472029 CEST	443	49723	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:52.560213089 CEST	49725	443	192.168.2.5	23.60.84.144
Apr 19, 2024 21:34:52.560257912 CEST	443	49725	23.60.84.144	192.168.2.5
Apr 19, 2024 21:34:52.560343981 CEST	49725	443	192.168.2.5	23.60.84.144
Apr 19, 2024 21:34:52.562994003 CEST	49725	443	192.168.2.5	23.60.84.144
Apr 19, 2024 21:34:52.563024044 CEST	443	49725	23.60.84.144	192.168.2.5
Apr 19, 2024 21:34:52.780289888 CEST	443	49725	23.60.84.144	192.168.2.5
Apr 19, 2024 21:34:52.780369997 CEST	49725	443	192.168.2.5	23.60.84.144
Apr 19, 2024 21:34:52.826081991 CEST	49725	443	192.168.2.5	23.60.84.144
Apr 19, 2024 21:34:52.826122999 CEST	443	49725	23.60.84.144	192.168.2.5
Apr 19, 2024 21:34:52.826339006 CEST	443	49725	23.60.84.144	192.168.2.5
Apr 19, 2024 21:34:52.866775990 CEST	49725	443	192.168.2.5	23.60.84.144
Apr 19, 2024 21:34:52.875631094 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 19, 2024 21:34:52.875761986 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 19, 2024 21:34:52.996362925 CEST	49725	443	192.168.2.5	23.60.84.144
Apr 19, 2024 21:34:53.044130087 CEST	443	49725	23.60.84.144	192.168.2.5
Apr 19, 2024 21:34:53.105644941 CEST	443	49725	23.60.84.144	192.168.2.5
Apr 19, 2024 21:34:53.105832100 CEST	443	49725	23.60.84.144	192.168.2.5
Apr 19, 2024 21:34:53.105911970 CEST	49725	443	192.168.2.5	23.60.84.144
Apr 19, 2024 21:34:53.106990099 CEST	49725	443	192.168.2.5	23.60.84.144
Apr 19, 2024 21:34:53.107023954 CEST	443	49725	23.60.84.144	192.168.2.5
Apr 19, 2024 21:34:53.107038975 CEST	49725	443	192.168.2.5	23.60.84.144
Apr 19, 2024 21:34:53.107048988 CEST	443	49725	23.60.84.144	192.168.2.5
Apr 19, 2024 21:34:53.170252085 CEST	49727	443	192.168.2.5	23.60.84.144
Apr 19, 2024 21:34:53.170272112 CEST	443	49727	23.60.84.144	192.168.2.5
Apr 19, 2024 21:34:53.170401096 CEST	49727	443	192.168.2.5	23.60.84.144
Apr 19, 2024 21:34:53.170681000 CEST	49727	443	192.168.2.5	23.60.84.144
Apr 19, 2024 21:34:53.170696020 CEST	443	49727	23.60.84.144	192.168.2.5
Apr 19, 2024 21:34:53.382472992 CEST	443	49727	23.60.84.144	192.168.2.5
Apr 19, 2024 21:34:53.382560968 CEST	49727	443	192.168.2.5	23.60.84.144
Apr 19, 2024 21:34:53.414103031 CEST	49728	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:53.414117098 CEST	443	49728	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:53.414259911 CEST	49728	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:53.414813995 CEST	49729	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:53.414836884 CEST	443	49729	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:53.414966106 CEST	49729	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:53.415548086 CEST	49728	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:53.415558100 CEST	443	49728	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:53.415916920 CEST	49729	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:53.415931940 CEST	443	49729	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:53.418606997 CEST	49727	443	192.168.2.5	23.60.84.144
Apr 19, 2024 21:34:53.418618917 CEST	443	49727	23.60.84.144	192.168.2.5
Apr 19, 2024 21:34:53.418847084 CEST	443	49727	23.60.84.144	192.168.2.5
Apr 19, 2024 21:34:53.420710087 CEST	49727	443	192.168.2.5	23.60.84.144
Apr 19, 2024 21:34:53.464163065 CEST	443	49727	23.60.84.144	192.168.2.5
Apr 19, 2024 21:34:53.590606928 CEST	443	49727	23.60.84.144	192.168.2.5
Apr 19, 2024 21:34:53.590845108 CEST	443	49727	23.60.84.144	192.168.2.5
Apr 19, 2024 21:34:53.591000080 CEST	49727	443	192.168.2.5	23.60.84.144
Apr 19, 2024 21:34:53.602936029 CEST	49727	443	192.168.2.5	23.60.84.144
Apr 19, 2024 21:34:53.602946997 CEST	443	49727	23.60.84.144	192.168.2.5
Apr 19, 2024 21:34:53.602977991 CEST	49727	443	192.168.2.5	23.60.84.144
Apr 19, 2024 21:34:53.602983952 CEST	443	49727	23.60.84.144	192.168.2.5
Apr 19, 2024 21:34:53.734282970 CEST	443	49728	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:53.742759943 CEST	443	49729	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:53.746862888 CEST	49728	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:53.746884108 CEST	443	49728	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:53.747428894 CEST	49729	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:53.747441053 CEST	443	49729	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:53.747764111 CEST	443	49728	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:53.747834921 CEST	49728	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:53.748339891 CEST	443	49729	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:53.748404026 CEST	49729	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:53.756751060 CEST	49728	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:53.756808043 CEST	443	49728	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:53.761492968 CEST	49729	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:53.761548042 CEST	443	49729	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:53.762470961 CEST	49728	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:53.762485981 CEST	443	49728	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:53.816936016 CEST	49728	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:53.816936970 CEST	49729	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:53.816945076 CEST	443	49729	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:53.863815069 CEST	49729	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:53.902637959 CEST	443	49728	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:53.902817011 CEST	443	49728	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:53.902823925 CEST	443	49728	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:53.902861118 CEST	443	49728	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:53.902887106 CEST	443	49728	13.107.136.10	192.168.2.5
Apr 19, 2024 21:34:53.902888060 CEST	49728	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:53.902940989 CEST	49728	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:53.906531096 CEST	49728	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:34:53.906544924 CEST	443	49728	13.107.136.10	192.168.2.5
Apr 19, 2024 21:35:01.621531963 CEST	443	49722	172.253.124.103	192.168.2.5
Apr 19, 2024 21:35:01.621608019 CEST	443	49722	172.253.124.103	192.168.2.5
Apr 19, 2024 21:35:01.621954918 CEST	49722	443	192.168.2.5	172.253.124.103
Apr 19, 2024 21:35:01.991436005 CEST	49722	443	192.168.2.5	172.253.124.103
Apr 19, 2024 21:35:01.991465092 CEST	443	49722	172.253.124.103	192.168.2.5
Apr 19, 2024 21:35:02.677520990 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 19, 2024 21:35:02.677704096 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 19, 2024 21:35:02.678483009 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 19, 2024 21:35:02.678519011 CEST	443	49733	23.1.237.91	192.168.2.5
Apr 19, 2024 21:35:02.678653002 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 19, 2024 21:35:02.679124117 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 19, 2024 21:35:02.679141998 CEST	443	49733	23.1.237.91	192.168.2.5
Apr 19, 2024 21:35:02.831238985 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 19, 2024 21:35:02.831407070 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 19, 2024 21:35:02.997431993 CEST	443	49733	23.1.237.91	192.168.2.5
Apr 19, 2024 21:35:02.997590065 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 19, 2024 21:35:03.111090899 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 19, 2024 21:35:03.111109018 CEST	443	49733	23.1.237.91	192.168.2.5
Apr 19, 2024 21:35:03.111723900 CEST	443	49733	23.1.237.91	192.168.2.5
Apr 19, 2024 21:35:03.111923933 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 19, 2024 21:35:03.112255096 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 19, 2024 21:35:03.112292051 CEST	443	49733	23.1.237.91	192.168.2.5
Apr 19, 2024 21:35:03.112395048 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 19, 2024 21:35:03.112402916 CEST	443	49733	23.1.237.91	192.168.2.5
Apr 19, 2024 21:35:03.341515064 CEST	443	49733	23.1.237.91	192.168.2.5
Apr 19, 2024 21:35:03.341649055 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 19, 2024 21:35:03.341766119 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 19, 2024 21:35:03.341823101 CEST	443	49733	23.1.237.91	192.168.2.5
Apr 19, 2024 21:35:03.341876030 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 19, 2024 21:35:38.823709965 CEST	49729	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:35:38.823719025 CEST	443	49729	13.107.136.10	192.168.2.5
Apr 19, 2024 21:35:51.349982023 CEST	49739	443	192.168.2.5	172.253.124.103
Apr 19, 2024 21:35:51.349992037 CEST	443	49739	172.253.124.103	192.168.2.5
Apr 19, 2024 21:35:51.350083113 CEST	49739	443	192.168.2.5	172.253.124.103
Apr 19, 2024 21:35:51.350326061 CEST	49739	443	192.168.2.5	172.253.124.103
Apr 19, 2024 21:35:51.350331068 CEST	443	49739	172.253.124.103	192.168.2.5
Apr 19, 2024 21:35:51.568857908 CEST	443	49739	172.253.124.103	192.168.2.5
Apr 19, 2024 21:35:51.569259882 CEST	49739	443	192.168.2.5	172.253.124.103
Apr 19, 2024 21:35:51.569273949 CEST	443	49739	172.253.124.103	192.168.2.5
Apr 19, 2024 21:35:51.569618940 CEST	443	49739	172.253.124.103	192.168.2.5
Apr 19, 2024 21:35:51.570002079 CEST	49739	443	192.168.2.5	172.253.124.103
Apr 19, 2024 21:35:51.570070982 CEST	443	49739	172.253.124.103	192.168.2.5
Apr 19, 2024 21:35:51.613822937 CEST	49739	443	192.168.2.5	172.253.124.103
Apr 19, 2024 21:35:54.001662970 CEST	49729	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:35:54.001743078 CEST	443	49729	13.107.136.10	192.168.2.5
Apr 19, 2024 21:35:54.001821995 CEST	49729	443	192.168.2.5	13.107.136.10
Apr 19, 2024 21:36:01.566170931 CEST	443	49739	172.253.124.103	192.168.2.5
Apr 19, 2024 21:36:01.566232920 CEST	443	49739	172.253.124.103	192.168.2.5
Apr 19, 2024 21:36:01.566436052 CEST	49739	443	192.168.2.5	172.253.124.103
Apr 19, 2024 21:36:01.992171049 CEST	49739	443	192.168.2.5	172.253.124.103
Apr 19, 2024 21:36:01.992193937 CEST	443	49739	172.253.124.103	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 21:34:47.696793079 CEST	53	63759	1.1.1.1	192.168.2.5
Apr 19, 2024 21:34:47.835318089 CEST	53	61253	1.1.1.1	192.168.2.5
Apr 19, 2024 21:34:48.439138889 CEST	53	55117	1.1.1.1	192.168.2.5
Apr 19, 2024 21:34:49.409070015 CEST	54555	53	192.168.2.5	1.1.1.1
Apr 19, 2024 21:34:49.409230947 CEST	60973	53	192.168.2.5	1.1.1.1
Apr 19, 2024 21:34:51.289254904 CEST	50545	53	192.168.2.5	1.1.1.1
Apr 19, 2024 21:34:51.289566040 CEST	60079	53	192.168.2.5	1.1.1.1
Apr 19, 2024 21:34:51.394025087 CEST	53	50545	1.1.1.1	192.168.2.5
Apr 19, 2024 21:34:51.394503117 CEST	53	60079	1.1.1.1	192.168.2.5
Apr 19, 2024 21:34:53.105725050 CEST	63577	53	192.168.2.5	1.1.1.1
Apr 19, 2024 21:34:53.106301069 CEST	59106	53	192.168.2.5	1.1.1.1
Apr 19, 2024 21:35:05.548772097 CEST	53	58328	1.1.1.1	192.168.2.5
Apr 19, 2024 21:35:24.564697981 CEST	53	63751	1.1.1.1	192.168.2.5
Apr 19, 2024 21:35:47.206835985 CEST	53	57125	1.1.1.1	192.168.2.5
Apr 19, 2024 21:35:47.595624924 CEST	53	57130	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 19, 2024 21:34:49.409070015 CEST	192.168.2.5	1.1.1.1	0x158b	Standard query (0)	visusewer-my.sharepoint.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 21:34:49.409230947 CEST	192.168.2.5	1.1.1.1	0x55f5	Standard query (0)	visusewer-my.sharepoint.com	65	IN (0x0001)	false
Apr 19, 2024 21:34:51.289254904 CEST	192.168.2.5	1.1.1.1	0xaae3	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 21:34:51.289566040 CEST	192.168.2.5	1.1.1.1	0x8bb9	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 19, 2024 21:34:53.105725050 CEST	192.168.2.5	1.1.1.1	0x7bf	Standard query (0)	visusewer-my.sharepoint.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 21:34:53.106301069 CEST	192.168.2.5	1.1.1.1	0x1c39	Standard query (0)	visusewer-my.sharepoint.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 19, 2024 21:34:49.632846117 CEST	1.1.1.1	192.168.2.5	0x55f5	No error (0)	visusewer-my.sharepoint.com	visusewer.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 21:34:49.632846117 CEST	1.1.1.1	192.168.2.5	0x55f5	No error (0)	visusewer.sharepoint.com	4412-ipv4v6e.clump.dprodmgd105.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 21:34:49.632846117 CEST	1.1.1.1	192.168.2.5	0x55f5	No error (0)	4412-ipv4v6e.clump.dprodmgd105.aa-rt.sharepoint.com	191635-ipv4v6e.farm.dprodmgd105.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 21:34:49.632846117 CEST	1.1.1.1	192.168.2.5	0x55f5	No error (0)	191635-ipv4v6e.farm.dprodmgd105.aa-rt.sharepoint.com	191635-ipv4v6w.farm.dprodmgd105.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 21:34:49.653126955 CEST	1.1.1.1	192.168.2.5	0x158b	No error (0)	visusewer-my.sharepoint.com	visusewer.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 21:34:49.653126955 CEST	1.1.1.1	192.168.2.5	0x158b	No error (0)	visusewer.sharepoint.com	4412-ipv4v6e.clump.dprodmgd105.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 21:34:49.653126955 CEST	1.1.1.1	192.168.2.5	0x158b	No error (0)	4412-ipv4v6e.clump.dprodmgd105.aa-rt.sharepoint.com	191635-ipv4v6e.farm.dprodmgd105.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 21:34:49.653126955 CEST	1.1.1.1	192.168.2.5	0x158b	No error (0)	191635-ipv4v6e.farm.dprodmgd105.aa-rt.sharepoint.com	191635-ipv4v6w.farm.dprodmgd105.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 21:34:49.653126955 CEST	1.1.1.1	192.168.2.5	0x158b	No error (0)	191635-ipv4v6.farm.dprodmgd105.aa-rt.sharepoint.com.dual-spo-0005.spo-msedge.net	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 21:34:49.653126955 CEST	1.1.1.1	192.168.2.5	0x158b	No error (0)	dual-spo-0005.spo-msedge.net		13.107.136.10	A (IP address)	IN (0x0001)	false
Apr 19, 2024 21:34:49.653126955 CEST	1.1.1.1	192.168.2.5	0x158b	No error (0)	dual-spo-0005.spo-msedge.net		13.107.138.10	A (IP address)	IN (0x0001)	false
Apr 19, 2024 21:34:51.394025087 CEST	1.1.1.1	192.168.2.5	0xaae3	No error (0)	www.google.com		172.253.124.103	A (IP address)	IN (0x0001)	false
Apr 19, 2024 21:34:51.394025087 CEST	1.1.1.1	192.168.2.5	0xaae3	No error (0)	www.google.com		172.253.124.99	A (IP address)	IN (0x0001)	false
Apr 19, 2024 21:34:51.394025087 CEST	1.1.1.1	192.168.2.5	0xaae3	No error (0)	www.google.com		172.253.124.105	A (IP address)	IN (0x0001)	false
Apr 19, 2024 21:34:51.394025087 CEST	1.1.1.1	192.168.2.5	0xaae3	No error (0)	www.google.com		172.253.124.104	A (IP address)	IN (0x0001)	false
Apr 19, 2024 21:34:51.394025087 CEST	1.1.1.1	192.168.2.5	0xaae3	No error (0)	www.google.com		172.253.124.106	A (IP address)	IN (0x0001)	false
Apr 19, 2024 21:34:51.394025087 CEST	1.1.1.1	192.168.2.5	0xaae3	No error (0)	www.google.com		172.253.124.147	A (IP address)	IN (0x0001)	false
Apr 19, 2024 21:34:51.394503117 CEST	1.1.1.1	192.168.2.5	0x8bb9	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 19, 2024 21:34:53.304723978 CEST	1.1.1.1	192.168.2.5	0x1c39	No error (0)	visusewer-my.sharepoint.com	visusewer.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 21:34:53.304723978 CEST	1.1.1.1	192.168.2.5	0x1c39	No error (0)	visusewer.sharepoint.com	4412-ipv4v6e.clump.dprodmgd105.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 21:34:53.304723978 CEST	1.1.1.1	192.168.2.5	0x1c39	No error (0)	4412-ipv4v6e.clump.dprodmgd105.aa-rt.sharepoint.com	191635-ipv4v6e.farm.dprodmgd105.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 21:34:53.304723978 CEST	1.1.1.1	192.168.2.5	0x1c39	No error (0)	191635-ipv4v6e.farm.dprodmgd105.aa-rt.sharepoint.com	191635-ipv4v6w.farm.dprodmgd105.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 21:34:53.340210915 CEST	1.1.1.1	192.168.2.5	0x7bf	No error (0)	visusewer-my.sharepoint.com	visusewer.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 21:34:53.340210915 CEST	1.1.1.1	192.168.2.5	0x7bf	No error (0)	visusewer.sharepoint.com	4412-ipv4v6e.clump.dprodmgd105.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 21:34:53.340210915 CEST	1.1.1.1	192.168.2.5	0x7bf	No error (0)	4412-ipv4v6e.clump.dprodmgd105.aa-rt.sharepoint.com	191635-ipv4v6e.farm.dprodmgd105.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 21:34:53.340210915 CEST	1.1.1.1	192.168.2.5	0x7bf	No error (0)	191635-ipv4v6e.farm.dprodmgd105.aa-rt.sharepoint.com	191635-ipv4v6w.farm.dprodmgd105.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 21:34:53.340210915 CEST	1.1.1.1	192.168.2.5	0x7bf	No error (0)	191635-ipv4v6.farm.dprodmgd105.aa-rt.sharepoint.com.dual-spo-0005.spo-msedge.net	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 21:34:53.340210915 CEST	1.1.1.1	192.168.2.5	0x7bf	No error (0)	dual-spo-0005.spo-msedge.net		13.107.136.10	A (IP address)	IN (0x0001)	false
Apr 19, 2024 21:34:53.340210915 CEST	1.1.1.1	192.168.2.5	0x7bf	No error (0)	dual-spo-0005.spo-msedge.net		13.107.138.10	A (IP address)	IN (0x0001)	false
Apr 19, 2024 21:35:02.454446077 CEST	1.1.1.1	192.168.2.5	0xa837	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 21:35:02.454446077 CEST	1.1.1.1	192.168.2.5	0xa837	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 19, 2024 21:35:02.572033882 CEST	1.1.1.1	192.168.2.5	0x94d8	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 19, 2024 21:35:02.572033882 CEST	1.1.1.1	192.168.2.5	0x94d8	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 19, 2024 21:35:15.735001087 CEST	1.1.1.1	192.168.2.5	0x5da3	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 19, 2024 21:35:15.735001087 CEST	1.1.1.1	192.168.2.5	0x5da3	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 19, 2024 21:35:39.673350096 CEST	1.1.1.1	192.168.2.5	0x52b1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.50.24	A (IP address)	IN (0x0001)	false
Apr 19, 2024 21:35:39.673350096 CEST	1.1.1.1	192.168.2.5	0x52b1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.53.37	A (IP address)	IN (0x0001)	false
Apr 19, 2024 21:35:39.673350096 CEST	1.1.1.1	192.168.2.5	0x52b1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.48.36	A (IP address)	IN (0x0001)	false
Apr 19, 2024 21:35:39.673350096 CEST	1.1.1.1	192.168.2.5	0x52b1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.48.35	A (IP address)	IN (0x0001)	false
Apr 19, 2024 21:35:39.673350096 CEST	1.1.1.1	192.168.2.5	0x52b1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.50.18	A (IP address)	IN (0x0001)	false
Apr 19, 2024 21:35:39.673350096 CEST	1.1.1.1	192.168.2.5	0x52b1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.50.98	A (IP address)	IN (0x0001)	false
Apr 19, 2024 21:35:39.673350096 CEST	1.1.1.1	192.168.2.5	0x52b1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.51.18	A (IP address)	IN (0x0001)	false
Apr 19, 2024 21:35:39.673350096 CEST	1.1.1.1	192.168.2.5	0x52b1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.50.38	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

visusewer-my.sharepoint.com

https:

www.bing.com

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49711	13.107.136.10	443	6184	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 19:34:49 UTC	763	OUT	GET /:b:/g/personal/andrewj_visu-sewer_com/EVRAxCWP2AROv6Avc61UgjEBiCCPFuGZSfuR7U720Gontw?e=vqq7tt HTTP/1.1 Host: visusewer-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 19:34:50 UTC	1489	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 200967 Content-Type: text/html; charset=utf-8 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-NetworkStatistics: 0,4204800,91,150,3551142,0,3326209 X-SharePointHealthScore: 0 Referrer-Policy: no-referrer, strict-origin-when-cross-origin SharePointError: 0 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: 78a020a1-e0fd-5000-5999-85f8ca72c224 request-id: 78a020a1-e0fd-5000-5999-85f8ca72c224 MS-CV: oSCgeP3gAFBZmYX4ynLCJA.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=55b7945f-5b66-4f62-84e2-56d770585737&destinationEndpoint=Edge-Prod-ATL33r5d&frontEnd=AFD&RemoteIP=81.181.57.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 SPRequestDuration: 191 SPIisLatency: 3 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: CA65CEFC848B4E3AB29FFEC522DF38A2 Ref B: ATL331000108027 Ref C: 2024-04-19T19:34:50Z Date: Fri, 19 Apr 2024 19:34:50 GMT Connection: close
2024-04-19 19:34:50 UTC	2681	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0d 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3a 6f 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 6f 66 66 69 63 65 3a 6f 66 66 69 63 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 64 69 72 3d 22 6c 74 72 22 3e 0d 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 47 45 4e 45 52 41 54 4f 52 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 69 63 72 6f 73 6f 66 74 20 53 68 61 72 65 50 6f 69 6e 74 22 20 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns:o="urn:schemas-microsoft-com:office:office" lang="en-us" dir="ltr"><head><meta name="GENERATOR" content="Microsoft SharePoint"
2024-04-19 19:34:50 UTC	8192	IN	Data Raw: 44 45 37 37 45 44 36 39 32 32 31 22 3a 31 2c 22 45 38 36 32 45 43 36 31 2d 35 30 35 45 2d 34 39 30 46 2d 41 46 44 46 2d 42 42 42 33 35 32 46 39 42 42 37 33 22 3a 31 2c 22 38 34 42 33 34 30 38 32 2d 46 34 32 43 2d 34 42 31 35 2d 39 43 42 37 2d 35 33 30 36 30 36 42 36 46 33 36 33 22 3a 31 2c 22 38 32 34 34 44 44 44 35 2d 44 45 38 34 2d 34 31 43 42 2d 39 46 35 36 2d 43 38 33 32 30 38 42 37 33 38 46 32 22 3a 31 2c 22 43 41 43 39 43 38 43 35 2d 39 46 41 44 2d 37 41 44 46 2d 42 33 43 31 2d 35 35 31 37 31 44 43 31 43 43 31 42 22 3a 31 2c 22 33 39 33 32 46 36 42 43 2d 37 41 31 46 2d 34 33 34 35 2d 38 32 41 43 2d 38 41 39 37 30 34 38 35 30 32 44 42 22 3a 31 2c 22 36 37 30 38 36 45 38 39 2d 30 30 43 38 2d 45 45 41 45 2d 41 38 43 45 2d 43 31 30 38 44 31 31 45 43 39 Data Ascii: DE77ED69221":1,"E862EC61-505E-490F-AFDF-BBB352F9BB73":1,"84B34082-F42C-4B15-9CB7-530606B6F363":1,"8244DDD5-DE84-41CB-9F56-C83208B738F2":1,"CAC9C8C5-9FAD-7ADF-B3C1-55171DC1CC1B":1,"3932F6BC-7A1F-4345-82AC-8A97048502DB":1,"67086E89-00C8-EEAE-A8CE-C108D11EC9
2024-04-19 19:34:50 UTC	4144	IN	Data Raw: 42 2d 39 39 42 37 2d 30 41 41 34 46 38 32 31 36 39 36 42 22 3a 31 2c 22 34 44 46 38 42 45 36 34 2d 45 38 36 34 2d 34 38 45 30 2d 41 42 31 42 2d 44 32 36 32 34 34 31 30 35 33 46 41 22 3a 31 2c 22 42 42 37 35 43 38 45 42 2d 35 36 46 39 2d 34 42 46 43 2d 41 32 39 46 2d 43 36 42 44 33 42 38 35 31 39 37 36 22 3a 31 2c 22 33 33 45 37 31 39 45 30 2d 46 38 41 46 2d 34 45 39 38 2d 42 31 46 31 2d 30 42 41 38 33 39 36 41 37 31 41 34 22 3a 31 2c 22 37 46 46 32 46 37 39 46 2d 35 46 37 31 2d 34 44 33 34 2d 38 30 44 43 2d 45 34 33 43 45 36 32 41 39 32 32 43 22 3a 31 2c 22 30 30 30 45 44 39 39 42 2d 42 39 31 30 2d 34 45 37 46 2d 39 34 32 36 2d 36 31 41 41 44 35 38 44 37 36 37 30 22 3a 31 2c 22 31 38 32 41 35 45 45 39 2d 37 42 36 39 2d 34 32 46 31 2d 41 31 41 39 2d 35 42 Data Ascii: B-99B7-0AA4F821696B":1,"4DF8BE64-E864-48E0-AB1B-D262441053FA":1,"BB75C8EB-56F9-4BFC-A29F-C6BD3B851976":1,"33E719E0-F8AF-4E98-B1F1-0BA8396A71A4":1,"7FF2F79F-5F71-4D34-80DC-E43CE62A922C":1,"000ED99B-B910-4E7F-9426-61AAD58D7670":1,"182A5EE9-7B69-42F1-A1A9-5B
2024-04-19 19:34:50 UTC	8192	IN	Data Raw: 46 41 34 2d 46 35 38 41 33 34 42 41 42 32 33 45 22 3a 31 2c 22 39 31 33 46 38 37 42 37 2d 31 37 31 34 2d 34 45 31 32 2d 41 44 35 36 2d 36 42 33 42 43 37 45 44 31 33 46 42 22 3a 31 2c 22 43 43 38 41 30 43 35 46 2d 33 36 41 33 2d 34 43 42 44 2d 39 41 34 33 2d 45 37 43 39 36 41 46 34 39 30 36 37 22 3a 31 2c 22 45 34 38 32 33 31 34 37 2d 38 44 41 30 2d 34 37 42 41 2d 39 32 41 42 2d 30 45 41 34 38 46 39 37 39 43 30 34 22 3a 31 2c 22 43 34 35 38 43 46 38 32 2d 44 42 38 45 2d 34 45 42 32 2d 41 44 37 42 2d 36 42 46 30 32 45 31 44 44 43 30 31 22 3a 31 2c 22 31 35 38 43 41 43 35 43 2d 37 30 30 35 2d 34 41 41 41 2d 38 43 31 41 2d 36 38 36 35 33 41 34 31 32 37 36 45 22 3a 31 2c 22 30 30 33 30 35 38 37 34 2d 35 30 41 37 2d 34 45 34 42 2d 41 30 31 45 2d 33 39 34 43 36 Data Ascii: FA4-F58A34BAB23E":1,"913F87B7-1714-4E12-AD56-6B3BC7ED13FB":1,"CC8A0C5F-36A3-4CBD-9A43-E7C96AF49067":1,"E4823147-8DA0-47BA-92AB-0EA48F979C04":1,"C458CF82-DB8E-4EB2-AD7B-6BF02E1DDC01":1,"158CAC5C-7005-4AAA-8C1A-68653A41276E":1,"00305874-50A7-4E4B-A01E-394C6
2024-04-19 19:34:50 UTC	8192	IN	Data Raw: 45 2d 34 38 46 33 2d 41 34 39 36 2d 39 44 32 31 31 42 39 37 46 30 41 46 22 3a 31 2c 22 34 34 46 33 32 39 46 31 2d 43 32 31 33 2d 34 37 43 35 2d 39 32 32 33 2d 45 43 30 42 30 37 38 34 33 43 46 34 22 3a 31 2c 22 32 46 34 44 39 30 43 42 2d 33 44 38 30 2d 34 43 32 35 2d 42 39 37 39 2d 38 35 33 39 34 43 45 39 39 42 30 42 22 3a 31 2c 22 35 43 35 34 45 36 37 32 2d 30 33 42 31 2d 34 46 46 44 2d 39 43 43 33 2d 31 43 31 45 31 33 30 44 36 32 39 46 22 3a 31 2c 22 33 44 36 37 45 38 37 31 2d 43 37 35 45 2d 34 45 34 41 2d 41 31 39 46 2d 45 43 39 44 45 39 43 38 46 45 46 38 22 3a 31 2c 22 45 33 43 42 44 32 32 34 2d 44 34 35 32 2d 34 46 34 37 2d 39 41 37 31 2d 45 43 45 34 42 45 45 44 35 43 43 45 22 3a 31 2c 22 41 46 42 38 39 44 44 46 2d 39 44 37 43 2d 34 35 39 34 2d 42 35 Data Ascii: E-48F3-A496-9D211B97F0AF":1,"44F329F1-C213-47C5-9223-EC0B07843CF4":1,"2F4D90CB-3D80-4C25-B979-85394CE99B0B":1,"5C54E672-03B1-4FFD-9CC3-1C1E130D629F":1,"3D67E871-C75E-4E4A-A19F-EC9DE9C8FEF8":1,"E3CBD224-D452-4F47-9A71-ECE4BEED5CCE":1,"AFB89DDF-9D7C-4594-B5
2024-04-19 19:34:50 UTC	8192	IN	Data Raw: 43 31 35 31 2d 33 32 31 38 2d 34 38 34 31 2d 38 31 36 45 2d 42 43 30 39 31 43 33 46 33 43 43 35 22 3a 31 2c 22 38 38 32 42 41 30 39 30 2d 34 39 36 33 2d 34 37 30 32 2d 39 44 35 33 2d 39 42 45 43 32 42 42 34 43 43 35 45 22 3a 31 2c 22 39 30 30 33 32 32 38 37 2d 42 31 38 43 2d 34 44 42 41 2d 38 39 41 42 2d 37 38 30 35 35 30 41 36 32 33 32 32 22 3a 31 2c 22 31 32 35 35 35 45 32 32 2d 41 32 41 37 2d 34 30 43 31 2d 42 35 42 34 2d 36 41 33 41 42 30 43 41 32 45 41 42 22 3a 31 2c 22 31 39 43 38 46 33 31 33 2d 33 30 41 41 2d 34 45 41 34 2d 38 39 38 42 2d 35 34 41 32 42 39 33 39 43 39 45 44 22 3a 31 2c 22 43 46 36 37 35 42 38 41 2d 31 37 45 37 2d 34 36 33 33 2d 41 43 37 31 2d 38 34 35 42 37 31 37 41 30 32 42 43 22 3a 31 2c 22 44 34 35 39 33 30 39 46 2d 44 39 31 42 Data Ascii: C151-3218-4841-816E-BC091C3F3CC5":1,"882BA090-4963-4702-9D53-9BEC2BB4CC5E":1,"90032287-B18C-4DBA-89AB-780550A62322":1,"12555E22-A2A7-40C1-B5B4-6A3AB0CA2EAB":1,"19C8F313-30AA-4EA4-898B-54A2B939C9ED":1,"CF675B8A-17E7-4633-AC71-845B717A02BC":1,"D459309F-D91B
2024-04-19 19:34:50 UTC	8192	IN	Data Raw: 3a 31 2c 22 38 45 43 43 32 45 31 38 2d 45 44 43 36 2d 34 35 32 45 2d 42 44 36 33 2d 30 39 45 35 34 36 39 39 31 46 41 43 22 3a 31 2c 22 35 36 32 35 35 31 42 38 2d 32 33 37 46 2d 34 36 41 30 2d 39 46 38 41 2d 42 38 41 45 41 42 43 41 39 41 45 31 22 3a 31 2c 22 30 36 35 36 43 41 32 32 2d 31 43 35 33 2d 34 41 44 31 2d 38 42 34 44 2d 42 35 42 37 35 32 39 44 39 38 38 30 22 3a 31 2c 22 34 45 44 45 35 46 43 37 2d 34 46 44 46 2d 34 33 42 44 2d 42 34 33 41 2d 44 32 43 36 46 38 42 38 46 34 42 38 22 3a 31 2c 22 36 45 34 44 43 43 43 36 2d 43 39 34 45 2d 34 32 35 41 2d 42 35 41 46 2d 32 46 35 41 42 39 38 33 32 33 45 30 22 3a 31 2c 22 44 31 43 46 42 46 37 35 2d 39 33 45 46 2d 34 38 42 42 2d 42 36 30 45 2d 46 34 37 30 37 41 35 30 37 30 39 37 22 3a 31 2c 22 32 45 31 39 31 Data Ascii: :1,"8ECC2E18-EDC6-452E-BD63-09E546991FAC":1,"562551B8-237F-46A0-9F8A-B8AEABCA9AE1":1,"0656CA22-1C53-4AD1-8B4D-B5B7529D9880":1,"4EDE5FC7-4FDF-43BD-B43A-D2C6F8B8F4B8":1,"6E4DCCC6-C94E-425A-B5AF-2F5AB98323E0":1,"D1CFBF75-93EF-48BB-B60E-F4707A507097":1,"2E191
2024-04-19 19:34:50 UTC	8192	IN	Data Raw: 44 32 43 41 37 30 35 22 3a 31 2c 22 32 46 33 42 44 44 38 38 2d 46 45 44 44 2d 34 30 36 30 2d 41 41 45 44 2d 38 38 30 39 36 32 32 42 43 30 37 34 22 3a 31 2c 22 46 37 41 42 34 35 33 31 2d 41 41 44 33 2d 34 42 44 31 2d 39 42 38 39 2d 31 44 33 33 36 32 36 41 37 42 39 34 22 3a 31 2c 22 33 33 42 34 38 41 32 33 2d 42 37 44 45 2d 34 31 43 32 2d 38 34 38 41 2d 37 44 33 39 34 41 42 37 36 34 46 32 22 3a 31 2c 22 37 33 33 37 43 38 42 31 2d 37 39 42 43 2d 34 43 42 42 2d 38 46 30 36 2d 41 31 41 37 46 31 43 31 35 36 44 44 22 3a 31 2c 22 39 36 39 36 39 45 44 34 2d 42 35 36 33 2d 34 31 37 37 2d 38 39 42 42 2d 36 39 35 30 44 44 44 37 39 35 31 38 22 3a 31 2c 22 38 44 45 30 32 36 31 39 2d 39 39 33 39 2d 34 37 37 31 2d 41 39 46 32 2d 45 34 33 36 46 30 36 38 36 37 30 38 22 3a Data Ascii: D2CA705":1,"2F3BDD88-FEDD-4060-AAED-8809622BC074":1,"F7AB4531-AAD3-4BD1-9B89-1D33626A7B94":1,"33B48A23-B7DE-41C2-848A-7D394AB764F2":1,"7337C8B1-79BC-4CBB-8F06-A1A7F1C156DD":1,"96969ED4-B563-4177-89BB-6950DDD79518":1,"8DE02619-9939-4771-A9F2-E436F0686708":
2024-04-19 19:34:50 UTC	8192	IN	Data Raw: 32 43 2d 35 36 32 44 44 33 45 41 43 35 33 43 22 3a 31 2c 22 41 43 43 46 30 44 30 42 2d 43 44 45 44 2d 34 43 43 35 2d 39 36 46 43 2d 41 44 38 46 34 38 36 42 44 38 38 33 22 3a 31 2c 22 30 44 44 31 43 36 33 38 2d 44 41 32 46 2d 34 32 36 41 2d 42 35 36 34 2d 46 38 33 32 35 36 30 42 36 46 43 31 22 3a 31 2c 22 44 32 34 46 41 31 30 42 2d 43 33 44 32 2d 34 42 39 45 2d 41 43 38 43 2d 39 31 37 35 39 41 35 32 42 30 33 44 22 3a 31 2c 22 46 45 42 37 39 32 39 45 2d 45 39 44 38 2d 34 31 35 41 2d 38 39 45 37 2d 33 32 42 36 44 32 31 43 41 34 37 31 22 3a 31 2c 22 34 46 43 37 44 46 46 34 2d 32 31 44 34 2d 34 30 36 39 2d 38 38 42 36 2d 30 41 44 36 35 32 45 46 30 39 34 32 22 3a 31 2c 22 44 38 33 37 33 34 38 44 2d 45 31 35 30 2d 34 37 33 33 2d 41 30 35 45 2d 43 30 43 31 37 46 Data Ascii: 2C-562DD3EAC53C":1,"ACCF0D0B-CDED-4CC5-96FC-AD8F486BD883":1,"0DD1C638-DA2F-426A-B564-F832560B6FC1":1,"D24FA10B-C3D2-4B9E-AC8C-91759A52B03D":1,"FEB7929E-E9D8-415A-89E7-32B6D21CA471":1,"4FC7DFF4-21D4-4069-88B6-0AD652EF0942":1,"D837348D-E150-4733-A05E-C0C17F
2024-04-19 19:34:50 UTC	8192	IN	Data Raw: 2d 34 34 45 43 2d 42 34 43 31 2d 37 39 41 39 33 38 33 39 41 30 34 45 22 3a 31 2c 22 32 36 34 43 37 39 42 32 2d 33 43 38 41 2d 34 44 31 34 2d 39 46 37 32 2d 41 41 30 34 35 34 46 35 33 37 37 46 22 3a 31 2c 22 41 30 43 35 44 35 32 42 2d 34 45 42 44 2d 34 44 39 30 2d 39 38 35 42 2d 34 43 42 41 32 46 37 42 38 43 34 37 22 3a 31 2c 22 46 43 41 35 38 38 36 34 2d 33 33 30 33 2d 34 41 45 38 2d 41 34 34 31 2d 46 30 42 43 31 41 33 39 30 32 38 34 22 3a 31 2c 22 46 34 37 35 36 33 37 43 2d 46 43 42 45 2d 34 30 46 41 2d 42 43 39 32 2d 44 32 44 39 37 39 38 41 36 31 31 42 22 3a 31 2c 22 41 36 43 39 44 31 37 30 2d 35 31 44 33 2d 34 44 37 34 2d 41 33 33 30 2d 46 44 34 43 37 34 45 35 36 41 31 39 22 3a 31 2c 22 45 36 32 45 36 38 44 34 2d 42 32 41 39 2d 34 45 32 31 2d 38 37 34 Data Ascii: -44EC-B4C1-79A93839A04E":1,"264C79B2-3C8A-4D14-9F72-AA0454F5377F":1,"A0C5D52B-4EBD-4D90-985B-4CBA2F7B8C47":1,"FCA58864-3303-4AE8-A441-F0BC1A390284":1,"F475637C-FCBE-40FA-BC92-D2D9798A611B":1,"A6C9D170-51D3-4D74-A330-FD4C74E56A19":1,"E62E68D4-B2A9-4E21-874

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49710	13.107.136.10	443	6184	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 19:34:50 UTC	722	OUT	GET /_layouts/15/1033/styles/corev15.css?rev=34APf%2FlfLRHu1iumf2MGdw%3D%3DTAG442 HTTP/1.1 Host: visusewer-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://visusewer-my.sharepoint.com/:b:/g/personal/andrewj_visu-sewer_com/EVRAxCWP2AROv6Avc61UgjEBiCCPFuGZSfuR7U720Gontw?e=vqq7tt Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 19:34:50 UTC	676	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 341640 Content-Type: text/css Last-Modified: Wed, 17 Apr 2024 03:01:02 GMT Accept-Ranges: bytes ETag: "0abfe7a7390da1:0" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" SPRequestDuration: 4 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 6ACCC218B98E4C28BF9DD9DE1AF670D6 Ref B: ATL331000103029 Ref C: 2024-04-19T19:34:50Z Date: Fri, 19 Apr 2024 19:34:50 GMT Connection: close
2024-04-19 19:34:50 UTC	3487	IN	Data Raw: 2f 2a 20 5f 6c 63 69 64 3d 22 31 30 33 33 22 0d 0a 5f 4c 6f 63 61 6c 42 69 6e 64 69 6e 67 20 2a 2f 0d 0a 62 6f 64 79 2c 0d 0a 2e 6d 73 2d 63 6f 72 65 2d 64 65 66 61 75 6c 74 46 6f 6e 74 2c 0d 0a 23 70 61 67 65 53 74 61 74 75 73 42 61 72 2c 0d 0a 23 68 79 62 72 69 64 54 6f 6f 6c 74 69 70 53 74 61 74 75 73 42 61 72 2c 0d 0a 2e 6d 73 2d 73 74 61 74 75 73 2d 6d 73 67 2c 0d 0a 2e 6a 73 2d 63 61 6c 6c 6f 75 74 2d 62 6f 64 79 0d 0a 7b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 46 6f 6e 74 28 74 68 65 6d 65 46 6f 6e 74 3a 22 62 6f 64 79 22 29 5d 20 2a 2f 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 53 65 67 6f 65 20 55 49 22 2c 22 53 65 67 6f 65 22 2c 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 66 6f 6e 74 Data Ascii: /* _lcid="1033"_LocalBinding /body,.ms-core-defaultFont,#pageStatusBar,#hybridTooltipStatusBar,.ms-status-msg,.js-callout-body{/ [ReplaceFont(themeFont:"body")] */ font-family:"Segoe UI","Segoe",Tahoma,Helvetica,Arial,sans-serif;font
2024-04-19 19:34:50 UTC	8192	IN	Data Raw: 64 22 29 5d 20 2a 2f 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 64 66 64 66 64 3b 0d 0a 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 31 30 70 78 3b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 46 6f 6e 74 28 74 68 65 6d 65 46 6f 6e 74 3a 22 62 6f 64 79 22 29 5d 20 2a 2f 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 53 65 67 6f 65 20 55 49 22 2c 22 53 65 67 6f 65 22 2c 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 66 6f 6e 74 2d 73 69 7a 65 3a 31 31 70 78 3b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 42 75 74 74 6f 6e 54 65 78 74 22 29 5d 20 2a 2f 20 63 6f 6c 6f 72 3a 23 34 34 34 3b 0d 0a 7d 0d 0a 69 6e 70 75 74 5b 74 79 70 65 3d 70 61 73 73 77 6f Data Ascii: d")] / background-color:#fdfdfd;margin-left:10px;/ [ReplaceFont(themeFont:"body")] / font-family:"Segoe UI","Segoe",Tahoma,Helvetica,Arial,sans-serif;font-size:11px;/ [ReplaceColor(themeColor:"ButtonText")] */ color:#444;}input[type=passwo
2024-04-19 19:34:50 UTC	4151	IN	Data Raw: 72 65 2d 70 61 67 65 54 69 74 6c 65 20 61 0d 0a 7b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 46 6f 6e 74 28 74 68 65 6d 65 46 6f 6e 74 3a 22 74 69 74 6c 65 22 29 5d 20 2a 2f 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 53 65 67 6f 65 20 55 49 20 4c 69 67 68 74 22 2c 22 53 65 67 6f 65 20 55 49 22 2c 22 53 65 67 6f 65 22 2c 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 53 69 74 65 54 69 74 6c 65 22 29 5d 20 2a 2f 20 63 6f 6c 6f 72 3a 23 32 36 32 36 32 36 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 63 6f 72 65 2d 70 61 67 65 54 69 74 6c 65 0d 0a 7b 0d 0a 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 37 37 65 6d 3b 0d 0a 77 68 69 74 65 2d 73 Data Ascii: re-pageTitle a{/* [ReplaceFont(themeFont:"title")] / font-family:"Segoe UI Light","Segoe UI","Segoe",Tahoma,Helvetica,Arial,sans-serif;/ [ReplaceColor(themeColor:"SiteTitle")] */ color:#262626;}.ms-core-pageTitle{font-size:2.77em;white-s
2024-04-19 19:34:50 UTC	8192	IN	Data Raw: 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 48 65 61 64 65 72 42 61 63 6b 67 72 6f 75 6e 64 22 2c 6f 70 61 63 69 74 79 3a 22 31 22 29 5d 20 2a 2f 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 48 65 61 64 65 72 42 61 63 6b 67 72 6f 75 6e 64 22 29 5d 20 2a 2f 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 20 32 35 35 2c 32 35 35 2c 32 35 35 2c 30 2e 38 35 20 29 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 73 72 63 68 2d 73 62 2d 62 6f 72 64 65 72 0d 0a 7b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 4c 69 6e 65 73 22 29 5d 20 2a 2f 20 62 6f 72 64 65 Data Ascii: * [ReplaceColor(themeColor:"HeaderBackground",opacity:"1")] / background-color:#fff;/ [ReplaceColor(themeColor:"HeaderBackground")] / background-color:rgba( 255,255,255,0.85 );}.ms-srch-sb-border{/ [ReplaceColor(themeColor:"Lines")] */ borde
2024-04-19 19:34:50 UTC	8192	IN	Data Raw: 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 45 6d 70 68 61 73 69 73 42 61 63 6b 67 72 6f 75 6e 64 22 29 5d 20 2a 2f 20 2d 6d 73 2d 66 69 6c 74 65 72 3a 22 70 72 6f 67 69 64 3a 44 58 49 6d 61 67 65 54 72 61 6e 73 66 6f 72 6d 2e 4d 69 63 72 6f 73 6f 66 74 2e 67 72 61 64 69 65 6e 74 28 47 72 61 64 69 65 6e 74 54 79 70 65 3d 30 2c 73 74 61 72 74 43 6f 6c 6f 72 73 74 72 3d 23 66 66 30 30 37 32 63 36 2c 65 6e 64 43 6f 6c 6f 72 73 74 72 3d 23 66 66 30 30 37 32 63 36 29 22 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 73 74 6f 72 65 66 72 6f 6e 74 2d 6e 6f 62 61 63 6b 67 72 6f 75 6e 64 61 70 70 69 63 6f 6e 73 70 61 6e 2e 6d 73 2d 73 74 6f 72 65 66 72 6f 6e 74 2d 61 70 70 69 Data Ascii: -color:transparent;/* [ReplaceColor(themeColor:"EmphasisBackground")] */ -ms-filter:"progid:DXImageTransform.Microsoft.gradient(GradientType=0,startColorstr=#ff0072c6,endColorstr=#ff0072c6)";}.ms-storefront-nobackgroundappiconspan.ms-storefront-appi
2024-04-19 19:34:50 UTC	8192	IN	Data Raw: 72 6d 76 61 6c 69 64 61 74 69 6f 6e 2c 0d 0a 2e 6d 73 2d 64 69 66 66 64 65 6c 65 74 65 6e 6f 73 74 72 69 6b 65 2c 0d 0a 2e 6d 73 2d 64 69 66 66 64 65 6c 65 74 65 0d 0a 7b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 45 72 72 6f 72 54 65 78 74 22 29 5d 20 2a 2f 20 63 6f 6c 6f 72 3a 23 62 66 30 30 30 30 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 74 6f 6f 6c 74 69 70 0d 0a 7b 0d 0a 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 0d 0a 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 64 6f 74 74 65 64 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 65 6d 70 74 79 4d 6f 64 65 2c 0d 0a 2e 6d 73 2d 61 74 74 72 61 63 74 4d 6f 64 65 7b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 46 6f 6e 74 28 74 68 65 6d 65 46 6f 6e 74 3a 22 6c 61 Data Ascii: rmvalidation,.ms-diffdeletenostrike,.ms-diffdelete{/* [ReplaceColor(themeColor:"ErrorText")] / color:#bf0000;}.ms-tooltip{text-decoration:none;border-bottom:1px dotted;}.ms-emptyMode,.ms-attractMode{/ [ReplaceFont(themeFont:"la
2024-04-19 19:34:50 UTC	8192	IN	Data Raw: 70 78 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 68 69 67 68 43 6f 6e 74 72 61 73 74 42 6f 72 64 65 72 0d 0a 7b 0d 0a 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 63 75 72 73 6f 72 44 65 66 61 75 6c 74 0d 0a 7b 0d 0a 63 75 72 73 6f 72 3a 64 65 66 61 75 6c 74 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 63 75 72 73 6f 72 50 6f 69 6e 74 65 72 0d 0a 7b 0d 0a 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 73 68 61 64 6f 77 0d 0a 7b 0d 0a 62 6f 78 2d 73 68 61 64 6f 77 3a 30 70 78 20 30 70 78 20 37 70 78 20 30 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 34 37 29 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 6c 69 6e 65 73 7b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f Data Ascii: px;}.ms-highContrastBorder{border:1px solid transparent;}.ms-cursorDefault{cursor:default;}.ms-cursorPointer{cursor:pointer;}.ms-shadow{box-shadow:0px 0px 7px 0px rgba(0,0,0,0.47);}.ms-lines{/* [ReplaceColor(themeColo
2024-04-19 19:34:50 UTC	8192	IN	Data Raw: 38 38 30 35 34 3b 7d 0d 0a 2e 6d 73 2d 43 6f 6e 74 65 6e 74 41 63 63 65 6e 74 34 2d 62 6f 72 64 65 72 43 6f 6c 6f 72 7b 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 43 6f 6e 74 65 6e 74 41 63 63 65 6e 74 34 22 2c 6f 70 61 63 69 74 79 3a 22 31 22 29 5d 20 2a 2f 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 37 36 37 39 35 36 3b 7d 0d 0a 2e 6d 73 2d 43 6f 6e 74 65 6e 74 41 63 63 65 6e 74 35 2d 62 6f 72 64 65 72 43 6f 6c 6f 72 7b 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 43 6f 6e 74 65 6e 74 41 63 63 65 6e 74 35 22 2c 6f 70 61 63 69 74 79 3a 22 31 22 29 5d 20 2a 2f 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 45 44 30 30 33 33 3b 7d 0d 0a 2e 6d 73 2d 43 6f 6e 74 65 6e 74 41 Data Ascii: 88054;}.ms-ContentAccent4-borderColor{/* [ReplaceColor(themeColor:"ContentAccent4",opacity:"1")] / border-color:#767956;}.ms-ContentAccent5-borderColor{/ [ReplaceColor(themeColor:"ContentAccent5",opacity:"1")] */ border-color:#ED0033;}.ms-ContentA
2024-04-19 19:34:50 UTC	8192	IN	Data Raw: 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 72 74 65 54 68 65 6d 65 46 6f 72 65 43 6f 6c 6f 72 2d 36 2d 31 0d 0a 7b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 43 6f 6e 74 65 6e 74 41 63 63 65 6e 74 32 2d 4c 69 67 68 74 65 73 74 22 2c 6f 70 61 63 69 74 79 3a 22 31 22 29 5d 20 2a 2f 20 63 6f 6c 6f 72 3a 23 44 35 46 36 46 46 3b 0d 0a 2d 6d 73 2d 6e 61 6d 65 3a 22 41 63 63 65 6e 74 20 32 20 4c 69 67 68 74 65 73 74 22 3b 0d 0a 2f 2a 20 5b 43 6f 6c 6f 72 4e 61 6d 65 5d 20 2a 2f 20 2d 6d 73 2d 63 6f 6c 6f 72 3a 22 50 69 6e 6b 22 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 72 74 65 54 68 65 6d 65 46 6f 72 65 43 6f 6c 6f 72 2d 37 2d 31 0d 0a 7b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 43 6f Data Ascii: ;}.ms-rteThemeForeColor-6-1{/* [ReplaceColor(themeColor:"ContentAccent2-Lightest",opacity:"1")] / color:#D5F6FF;-ms-name:"Accent 2 Lightest";/ [ColorName] / -ms-color:"Pink";}.ms-rteThemeForeColor-7-1{/ [ReplaceColor(themeColor:"Co
2024-04-19 19:34:50 UTC	8192	IN	Data Raw: 0a 7d 0d 0a 2e 6d 73 2d 72 74 65 54 68 65 6d 65 46 6f 72 65 43 6f 6c 6f 72 2d 39 2d 35 0d 0a 7b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 43 6f 6e 74 65 6e 74 41 63 63 65 6e 74 35 2d 44 61 72 6b 65 73 74 22 2c 6f 70 61 63 69 74 79 3a 22 31 22 29 5d 20 2a 2f 20 63 6f 6c 6f 72 3a 23 37 36 30 30 31 39 3b 0d 0a 2d 6d 73 2d 6e 61 6d 65 3a 22 41 63 63 65 6e 74 20 35 20 44 61 72 6b 65 73 74 22 3b 0d 0a 2f 2a 20 5b 43 6f 6c 6f 72 4e 61 6d 65 5d 20 2a 2f 20 2d 6d 73 2d 63 6f 6c 6f 72 3a 22 44 61 72 6b 20 47 72 65 65 6e 22 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 72 74 65 54 68 65 6d 65 46 6f 72 65 43 6f 6c 6f 72 2d 31 30 2d 35 0d 0a 7b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a Data Ascii: }.ms-rteThemeForeColor-9-5{/* [ReplaceColor(themeColor:"ContentAccent5-Darkest",opacity:"1")] / color:#760019;-ms-name:"Accent 5 Darkest";/ [ColorName] / -ms-color:"Dark Green";}.ms-rteThemeForeColor-10-5{/ [ReplaceColor(themeColor:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49714	13.107.136.10	443	6184	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 19:34:50 UTC	718	OUT	GET /_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG442 HTTP/1.1 Host: visusewer-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://visusewer-my.sharepoint.com/:b:/g/personal/andrewj_visu-sewer_com/EVRAxCWP2AROv6Avc61UgjEBiCCPFuGZSfuR7U720Gontw?e=vqq7tt Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 19:34:50 UTC	673	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 622 Content-Type: text/css Last-Modified: Wed, 17 Apr 2024 03:01:02 GMT Accept-Ranges: bytes ETag: "0abfe7a7390da1:0" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" SPRequestDuration: 5 SPIisLatency: 2 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 14BEF054D5FD4182B3B88D9A1EBE815B Ref B: ATL331000106009 Ref C: 2024-04-19T19:34:50Z Date: Fri, 19 Apr 2024 19:34:50 GMT Connection: close
2024-04-19 19:34:50 UTC	622	IN	Data Raw: 2f 2a 20 5f 6c 63 69 64 3d 22 31 30 33 33 22 0d 0a 5f 4c 6f 63 61 6c 42 69 6e 64 69 6e 67 20 2a 2f 0d 0a 23 6d 73 2d 65 72 72 6f 72 2d 68 65 61 64 65 72 0d 0a 7b 0d 0a 6d 61 72 67 69 6e 3a 31 31 38 70 78 20 30 70 78 20 31 36 70 78 3b 0d 0a 6d 69 6e 2d 68 65 69 67 68 74 3a 35 30 70 78 3b 0d 0a 7d 0d 0a 23 6d 73 2d 65 72 72 6f 72 2d 67 6f 62 61 63 6b 63 6f 6e 74 0d 0a 7b 0d 0a 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 38 70 78 3b 0d 0a 7d 0d 0a 23 6d 73 2d 61 63 63 65 73 73 44 65 6e 69 65 64 2d 72 65 71 44 69 61 6c 6f 67 0d 0a 7b 0d 0a 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 0d 0a 7d 0d 0a 23 6d 73 2d 65 72 72 6f 72 2d 62 6f 64 79 0d 0a 7b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 61 75 74 6f 3b 0d 0a 6f 76 65 72 66 6c 6f 77 3a 61 75 74 6f 3b 0d Data Ascii: /* _lcid="1033"_LocalBinding */#ms-error-header{margin:118px 0px 16px;min-height:50px;}#ms-error-gobackcont{margin-top:28px;}#ms-accessDenied-reqDialog{max-width:100%;}#ms-error-body{background-size:auto;overflow:auto;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49715	13.107.136.10	443	6184	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 19:34:50 UTC	857	OUT	GET /ScriptResource.axd?d=__lzUVIbfgvUiJH3ULiLQHApSSctiq4SYenACacIKvjG6yoJteFHTTMQGs3v2Z-u6A9C1iy9MnRmfZpGShLsEGGH3sqJuxLys85t36aOqg5b2-yN8IOxlFETESdOb9GT2Omvd251mPL9T5eisI_Sq691tgyqtJiQvWnMPIu9_NUnc_M0cSVOmuE3Phb6aXsg0&t=722fe453 HTTP/1.1 Host: visusewer-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://visusewer-my.sharepoint.com/:b:/g/personal/andrewj_visu-sewer_com/EVRAxCWP2AROv6Avc61UgjEBiCCPFuGZSfuR7U720Gontw?e=vqq7tt Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 19:34:51 UTC	727	IN	HTTP/1.1 200 OK Cache-Control: public Content-Length: 25609 Content-Type: application/x-javascript Content-Encoding: gzip Expires: Sat, 19 Apr 2025 19:34:50 GMT Last-Modified: Fri, 19 Apr 2024 19:34:50 GMT P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-AspNet-Version: 4.0.30319 SPRequestDuration: 12 SPIisLatency: 0 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 9B3D11C0F5B344D2897C8BFAF6C8E67B Ref B: ATL331000102021 Ref C: 2024-04-19T19:34:50Z Date: Fri, 19 Apr 2024 19:34:50 GMT Connection: close
2024-04-19 19:34:51 UTC	3436	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed bd d9 72 1b 49 92 28 fa 3e 66 f3 0f 64 8e 8a 42 36 92 20 29 55 2f 05 28 c5 d1 da a5 1e 6d 47 52 75 77 0d c9 96 e5 06 20 49 10 c9 42 02 92 58 04 be ec 3c dc 4f ba bf 70 7d 89 3d 23 01 50 aa 3e 73 8f 59 97 95 a4 44 2c 1e 11 1e 1e 1e 1e 1e ee 1e ff ef ff fe 7f 0e 0e f6 bf fa bf 7f ff b7 83 83 9d 27 d5 d5 f5 ac 1c 8d e7 3b 9d 27 e1 ce ab 32 9b 55 75 35 9c 43 fa ec aa 9a 25 f3 b2 9a f6 76 1e 4d 26 3b 54 a8 de 99 15 75 31 fb 54 e4 3d ac fd 8d 6d ab d6 1e 9d 27 5f 7a e7 f5 bf ff db f3 c5 34 a3 26 3f 7e 9c 5f 5f 15 af 93 cb 22 0e 64 62 30 30 b2 b3 49 52 d7 f1 7c b6 28 74 6a 36 2b 92 79 f1 24 99 4c d2 24 bb 88 87 22 bd 93 46 49 78 33 2b e6 8b d9 74 47 25 86 37 9f 92 d9 4e 11 27 b3 d1 e2 b2 98 ce eb de a4 98 8e e6 e3 41 39 ec 14 0f Data Ascii: rI(>fdB6 )U/(mGRuw IBX<Op}=#P>sYD,';'2Uu5C%vM&;Tu1T=m'_z4&?~__"db00IR\|(tj6+y$L$"FIx3+tG%7N'A9
2024-04-19 19:34:51 UTC	8192	IN	Data Raw: bf 96 c5 67 b4 4c 82 1d 11 4a fe 8d 58 f8 00 4e b0 50 96 8f 9b 59 2c 67 be 97 56 f9 b5 3d fd 72 4c bb d9 6a c0 52 8a a9 04 a2 94 40 65 18 12 38 27 25 79 ce 56 8b bd 62 fa cb a2 58 b8 67 32 53 3d 90 ae 74 25 c7 00 83 cb 92 24 6c e9 6c a4 d8 54 24 33 0b b9 12 68 7c a8 cb 80 68 e5 8a 1b aa 58 1c ab 03 f1 09 5e fe 9c 59 7a 22 d1 2b 6a 17 a7 96 8e 34 b6 b2 63 8d 82 48 1e bd 31 e3 a1 ee 50 5e b8 f8 50 d5 d4 45 8e 2c 0b 0c e4 59 92 19 37 04 69 84 a6 05 37 86 b2 3a 42 05 80 ef 78 01 22 ae 10 6c fd d7 62 21 6b db c8 fe 82 90 2a 1b 15 fd b6 d8 7c fb d8 32 63 3e 00 1f c5 cc da 1f 52 5c 71 09 c9 0c 19 5e f1 1f 46 99 2a ed 08 6a 9f d0 92 84 66 67 97 3f e5 bc a8 15 48 52 0e e7 49 18 b3 e2 b2 fa 64 1b 83 ca 55 6c f5 33 95 f6 e6 30 11 61 2a fb 93 44 47 fa c4 6e 4c 11 43 Data Ascii: gLJXNPY,gV=rLjR@e8'%yVbXg2S=t%$llT$3h\|hX^Yz"+j4cH1P^PE,Y7i7:Bx"lb!k\|2c>R\q^Fjfg?HRIdUl30a*DGnLC
2024-04-19 19:34:51 UTC	4151	IN	Data Raw: 6e a4 9c 98 cd 14 dc ce 35 37 b4 a8 e7 dc d6 bc a0 30 d3 d4 62 c5 5f d0 aa 4c 84 a6 e5 27 b6 df dc 54 99 f7 c9 a5 fa 9a f7 71 65 f0 b8 a3 98 54 13 41 96 68 fd 4f 41 94 af 85 ff a3 08 03 5e 57 08 06 09 30 7a 4f 61 db 21 1f b4 c3 b3 55 68 44 75 fc f8 31 33 b4 12 71 1c 54 f4 5c 49 20 1e 0c 6b bd d0 69 93 a7 2c 78 e1 20 2f 26 c5 bc b0 5b 61 5d f5 d7 81 57 e2 5a 31 dd ff e9 fd 3f 4b 66 23 cd fa ff 94 d0 76 e7 5f f2 da bf e4 b5 7f c9 6b 1c c8 e6 9f 27 b0 09 11 2a 62 81 68 cc c2 d6 ce 7c be 46 66 b3 aa 78 85 36 0b cc ff a0 d8 76 b0 4e 68 c3 4e 72 0f ff af 10 db 10 69 0a e5 ff 92 db fe af 96 db c4 c6 fa 2f c1 ed 6b 05 b7 75 ef 99 be 2f 66 f4 10 48 c2 01 ba 07 8d b4 de 5f 92 4f c9 fb 6c 56 5e cd 65 ba ef 49 8d cd 75 bc af 6d 6f ac b5 75 97 e8 a9 91 59 fd a1 7a 56 Data Ascii: n570b_L'TqeTAhOA^W0zOa!UhDu13qT\I ki,x /&[a]WZ1?Kf#v_k'*bh\|Ffx6vNhNri/ku/fH_OlV^eIumouYzV
2024-04-19 19:34:51 UTC	8192	IN	Data Raw: e5 23 e8 23 fe 27 15 af c4 67 83 64 70 1e 27 51 67 14 c3 9e a6 b4 26 6f 89 12 c3 b0 f5 6c 25 e2 c1 bc 9f 5f 4f c8 14 4c 2e f6 79 32 c2 9d ef 58 7d d9 61 0c fb 92 8e 3b b2 25 5e 85 f2 17 ae aa bd 3d 3a 0f 05 8f df 3c fd 19 68 9a e4 e1 51 ef 8a a2 85 b0 0e 30 49 eb 6a b2 98 17 68 be 78 93 77 63 13 d6 a0 d0 bf 71 0e f9 21 02 0f 9d 3f 8c ef 53 65 fd ec 0d 50 33 ae 1b 84 42 b4 19 22 ac 46 36 00 e5 dc d5 6a 2b e4 64 8c 9c 71 9c 1e a7 6a 14 0a 0f bb b0 2f 8f ed 31 89 89 31 38 31 cc 11 4e 8d 4e 80 63 d7 2d 70 ad b1 c9 26 ee c1 8f 1f 5e bd 84 ef 4e 62 71 c2 c4 e0 6c 80 99 fd d8 ce 3e 1c 14 3a 89 58 e1 e1 76 08 10 d4 51 fa 11 50 ee ed 95 b1 35 7e 96 75 db 28 1b a3 f8 ae d4 65 e4 36 0b 2a 67 03 61 b5 a0 72 bd a0 f2 e5 32 bf e5 82 c2 c5 34 a4 05 55 da 0b 8a 8f 31 3c Data Ascii: ##'gdp'Qg&ol%_OL.y2X}a;%^=:<hQ0Ijhxwcq!?SeP3B"F6j+dqj/1181NNc-p&^Nbql>:XvQP5~u(e6*gar24U1<
2024-04-19 19:34:51 UTC	1638	IN	Data Raw: 84 10 11 5c f8 fb 8c fd 10 16 a4 d1 38 be c0 19 40 f6 41 93 39 e6 77 21 a1 c9 cd eb 2d 93 eb 0d be f4 fa 81 1f d6 ca 89 b2 70 e5 1f a1 17 37 bb 99 92 1c b2 5e ee 88 d5 59 1f d2 b0 9b c3 07 c0 1b 96 cb e1 c3 f8 3e fe 3b 96 6c 82 ec f0 61 bf 19 6f 35 80 db 71 09 7a ce d0 58 fa 43 58 fa 99 67 e9 8b 34 75 49 55 0e 14 05 4a c3 5a 20 bc 32 be 05 b7 16 24 b2 b1 8a dd 61 c9 c8 d7 21 c2 ed 57 54 46 41 00 ff 87 62 60 f2 7a a5 5d 28 fa 38 42 25 09 46 8e 80 59 cb 61 3d d4 40 4c 99 e5 61 a8 5f 39 74 5c f3 d3 d0 79 58 10 c5 33 7a 06 0d 37 09 96 6b 3f ce d9 48 4f 9c b8 59 7c 3f 6c ef 8e 90 8a e2 83 7f 9c d6 bf eb 9c 24 fb bf 3e da ff ef c3 fd 1f 4e bb a7 fb a7 bd b3 ee 69 3f 3c 3d 38 3d e8 9c fc e3 f8 3f 4e 0f ce ba e1 81 07 16 21 c7 7a 7d 00 04 2b 23 c2 a3 f2 18 93 66 Data Ascii: \8@A9w!-p7^Y>;lao5qzXCXg4uIUJZ 2$a!WTFAb`z](8B%FYa=@La_9t\yX3z7k?HOY\|?l$>Ni?<=8=?N!z}+#f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49716	13.107.136.10	443	6184	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 19:34:50 UTC	857	OUT	GET /ScriptResource.axd?d=WWVRr4224OtJKF3TM5jnRGyBAjsLB-qsWdyrdN_DLuZ1QelWvuIxCMmU3NGNulFwDFwDf3Fj3l1ODxiG6M8OrwLfM_HvgF5fhgaAsxhXev39UAFtNrbVQO1tO37inPddL_DP7l-38--WokwbccW-eRk1rvRp7k5icJ9FVh9y0Cj0LxxnlmTe2hc4GVuwlre10&t=722fe453 HTTP/1.1 Host: visusewer-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://visusewer-my.sharepoint.com/:b:/g/personal/andrewj_visu-sewer_com/EVRAxCWP2AROv6Avc61UgjEBiCCPFuGZSfuR7U720Gontw?e=vqq7tt Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 19:34:51 UTC	725	IN	HTTP/1.1 200 OK Cache-Control: public Content-Length: 9984 Content-Type: application/x-javascript Content-Encoding: gzip Expires: Sat, 19 Apr 2025 19:34:50 GMT Last-Modified: Fri, 19 Apr 2024 19:34:50 GMT P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-AspNet-Version: 4.0.30319 SPRequestDuration: 8 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 61BE314FCE654CC2A1761F053FEFEE03 Ref B: ATL331000106029 Ref C: 2024-04-19T19:34:50Z Date: Fri, 19 Apr 2024 19:34:50 GMT Connection: close
2024-04-19 19:34:51 UTC	443	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e5 7d 6b 73 db 48 92 e0 f7 89 98 ff 40 61 7b 65 62 55 86 e4 de bd b8 08 d2 68 85 5e 9e d6 9e 5f 61 cb d3 33 21 6b 15 05 a0 48 42 02 01 1a 00 6d ab 25 fe b2 fb b0 3f 69 ff c2 65 d6 0b 55 40 81 a4 e4 9e bd 8b b8 89 1e 99 a8 77 65 66 65 66 65 66 55 fd d7 ff fe cf fd fd e7 4f fe df 9f ff b4 bf 3f 38 29 16 77 65 3a 9d d5 83 e1 89 3f 78 93 c6 65 51 15 93 1a d2 cb 45 51 d2 3a 2d f2 60 70 94 65 03 5e a8 1a 94 ac 62 e5 57 96 04 58 fb 07 fb d6 bd 1d dd d0 ef bf b1 e8 55 51 ce ab e0 a6 fa f3 9f 2e ee 16 2c b8 2e d9 34 ad 6a 56 7e 8c cb 74 51 0f bd be f2 1e b9 b4 f3 60 f0 8c a7 db c9 1f 59 99 d2 2c fd 5d cc aa 9b ff 96 d5 df 8a f2 d6 91 73 52 cc 17 45 ce f2 fa 4d 91 b0 0c 0b 5c f9 63 3e 48 35 c6 b7 74 ce aa 05 8d d9 d0 fb 78 57 05 6a 74 Data Ascii: }ksH@a{ebUh^_a3!kHBm%?ieU@wefefefUO?8)we:?xeQEQ:-`pe^bWXUQ.,.4jV~tQ`Y,]sREM\c>H5txWjt
2024-04-19 19:34:51 UTC	8192	IN	Data Raw: e5 af 34 4f 32 96 84 13 9a 55 cc cc d0 34 03 30 a0 e7 35 9b 57 21 7d 78 b8 5f 69 ca aa 60 19 54 2c 8c 56 1b 47 dd a6 11 dd 62 2f ba 74 09 81 6a 3e a0 de c2 3c d7 28 28 a7 b4 be bc 2c b4 22 55 6f 35 58 7d 0e 40 51 45 aa 62 fe 6b 68 55 14 68 93 8e 0b 3e eb 08 c7 51 7e 3d d9 9c 6b 8c 3f 8e b9 f4 d7 fb 6f e3 30 6b 86 f0 ff 07 9b e1 d4 b8 be 47 4d 95 a2 58 12 d6 e5 92 ad 07 f2 f6 50 5e 47 88 fd d5 04 3d 9e d0 3c 66 59 1f 55 be a7 53 f6 ba a0 09 4b 1c e4 08 c4 48 e2 16 39 3a 2a ac a3 c3 05 9f f4 27 09 93 c8 4a 3d 29 19 4f a5 1d 8e 16 23 47 5b 6d 1c e9 0f 33 30 6b 1c fd c4 6a 96 32 2b ca 69 6d a8 28 4b 6d 33 9f 75 78 76 94 5f cf 70 54 85 34 9f 3e 12 b7 66 8d 2d 91 0b 55 5a d8 3d 65 19 e3 c9 8f 43 af d5 f7 1f 83 5f 35 92 0d 78 52 c5 3a 18 de 5c 55 15 db 6a 52 db Data Ascii: 4O2U405W!}x_i`T,VGb/tj><((,"Uo5X}@QEbkhUh>Q~=k?o0kGMXP^G=<fYUSKH9:*'J=)O#G[m30kj2+im(Km3uxv_pT4>f-UZ=eC_5xR:\UjR
2024-04-19 19:34:51 UTC	1349	IN	Data Raw: 16 6f 5f fb 78 a9 b7 bc c0 63 47 41 ff 84 e6 3c 73 08 74 4f c3 e6 6c 51 9e bc 4a cb aa e6 79 78 4e 44 5d 1f 2e cf 9b ea 3b 35 e4 02 3f 4b d2 1a 8b b5 af 02 49 c2 4e 91 71 27 c5 b8 89 70 40 05 02 d4 40 8e 80 98 c5 f8 fa e6 c4 8f e4 74 9b 4c c6 3d b6 37 f9 da 84 23 e6 a3 73 ef 34 bf 03 5d aa fe b1 be 44 e7 90 da 51 2e cd e3 67 c4 61 a2 b0 4e 52 a8 2b 7c 74 9c de fe e7 9f f6 a7 04 cf f4 60 65 eb 44 51 e7 42 64 a2 bd 54 2d 25 7c 43 84 86 a8 ce 7c b1 4b 30 f4 c4 a6 07 23 51 c5 ce 81 ae 04 1a 08 3e 94 ad 37 f2 96 5d 03 df 54 76 6d 47 9a 23 f4 ad 9b a7 5c 9d f4 29 7c 56 4f be 8c d3 4d 4c 8d b3 0a 9d 7b 21 ab 62 73 0b 92 30 41 d8 0d b4 0d 10 7c 4b 6e 17 81 0d a7 af 1e 0b de a2 bb 0e d7 90 ad 29 f5 c5 01 00 21 d8 bb 19 c6 15 fd 1a 11 80 3c eb 08 b5 8b b2 d4 b2 6c Data Ascii: o_xcGA<stOlQJyxND].;5?KINq'p@@tL=7#s4]DQ.gaNR+\|t`eDQBdT-%\|C\|K0#Q>7]TvmG#\)\|VOML{!bs0A\|Kn)!<l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49717	13.107.136.10	443	6184	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 19:34:51 UTC	779	OUT	GET /WebResource.axd?d=l4QTkVK95fJZZGIRCQ1xtLafoQawd_OPBYaPMXggEwAEGEhd8Ol3EzJ4Wb9xck9XCKKgOPhT8HcuQrSxRF0SYoUXIp6QR_W2k22Cacsy-fM1&t=638449966421100877 HTTP/1.1 Host: visusewer-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://visusewer-my.sharepoint.com/:b:/g/personal/andrewj_visu-sewer_com/EVRAxCWP2AROv6Avc61UgjEBiCCPFuGZSfuR7U720Gontw?e=vqq7tt Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 19:34:51 UTC	702	IN	HTTP/1.1 200 OK Cache-Control: public Content-Length: 23063 Content-Type: application/x-javascript Expires: Sat, 19 Apr 2025 11:19:54 GMT Last-Modified: Sun, 03 Mar 2024 01:17:22 GMT P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-AspNet-Version: 4.0.30319 SPRequestDuration: 3 SPIisLatency: 0 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 39AEE95CD1644AC4A36FC0F27814D006 Ref B: ATL331000107025 Ref C: 2024-04-19T19:34:51Z Date: Fri, 19 Apr 2024 19:34:51 GMT Connection: close
2024-04-19 19:34:51 UTC	3062	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 57 65 62 46 6f 72 6d 5f 50 6f 73 74 42 61 63 6b 4f 70 74 69 6f 6e 73 28 65 76 65 6e 74 54 61 72 67 65 74 2c 20 65 76 65 6e 74 41 72 67 75 6d 65 6e 74 2c 20 76 61 6c 69 64 61 74 69 6f 6e 2c 20 76 61 6c 69 64 61 74 69 6f 6e 47 72 6f 75 70 2c 20 61 63 74 69 6f 6e 55 72 6c 2c 20 74 72 61 63 6b 46 6f 63 75 73 2c 20 63 6c 69 65 6e 74 53 75 62 6d 69 74 29 20 7b 0d 0a 20 20 20 20 74 68 69 73 2e 65 76 65 6e 74 54 61 72 67 65 74 20 3d 20 65 76 65 6e 74 54 61 72 67 65 74 3b 0d 0a 20 20 20 20 74 68 69 73 2e 65 76 65 6e 74 41 72 67 75 6d 65 6e 74 20 3d 20 65 76 65 6e 74 41 72 67 75 6d 65 6e 74 3b 0d 0a 20 20 20 20 74 68 69 73 2e 76 61 6c 69 64 61 74 69 6f 6e 20 3d 20 76 61 6c 69 64 61 74 69 6f 6e 3b 0d 0a 20 20 20 20 74 68 69 73 2e 76 61 6c Data Ascii: function WebForm_PostBackOptions(eventTarget, eventArgument, validation, validationGroup, actionUrl, trackFocus, clientSubmit) { this.eventTarget = eventTarget; this.eventArgument = eventArgument; this.validation = validation; this.val
2024-04-19 19:34:51 UTC	8192	IN	Data Raw: 6c 46 69 72 73 74 41 76 61 69 6c 61 62 6c 65 53 6c 6f 74 28 5f 5f 70 65 6e 64 69 6e 67 43 61 6c 6c 62 61 63 6b 73 2c 20 63 61 6c 6c 62 61 63 6b 29 3b 0d 0a 20 20 20 20 69 66 20 28 21 75 73 65 41 73 79 6e 63 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 69 66 20 28 5f 5f 73 79 6e 63 68 72 6f 6e 6f 75 73 43 61 6c 6c 42 61 63 6b 49 6e 64 65 78 20 21 3d 20 2d 31 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 5f 5f 70 65 6e 64 69 6e 67 43 61 6c 6c 62 61 63 6b 73 5b 5f 5f 73 79 6e 63 68 72 6f 6e 6f 75 73 43 61 6c 6c 42 61 63 6b 49 6e 64 65 78 5d 20 3d 20 6e 75 6c 6c 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 5f 5f 73 79 6e 63 68 72 6f 6e 6f 75 73 43 61 6c 6c 42 61 63 6b 49 6e 64 65 78 20 3d 20 63 61 6c 6c 62 61 63 6b 49 6e 64 65 78 3b 0d 0a Data Ascii: lFirstAvailableSlot(__pendingCallbacks, callback); if (!useAsync) { if (__synchronousCallBackIndex != -1) { __pendingCallbacks[__synchronousCallBackIndex] = null; } __synchronousCallBackIndex = callbackIndex;
2024-04-19 19:34:51 UTC	4550	IN	Data Raw: 61 6c 6c 62 61 63 6b 28 72 65 73 70 6f 6e 73 65 2e 73 75 62 73 74 72 69 6e 67 28 73 65 70 61 72 61 74 6f 72 49 6e 64 65 78 20 2b 20 76 61 6c 69 64 61 74 69 6f 6e 46 69 65 6c 64 4c 65 6e 67 74 68 20 2b 20 31 29 2c 20 63 61 6c 6c 62 61 63 6b 4f 62 6a 65 63 74 2e 63 6f 6e 74 65 78 74 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 7d 0d 0a 7d 0d 0a 66 75 6e 63 74 69 6f 6e 20 57 65 62 46 6f 72 6d 5f 46 69 6c 6c 46 69 72 73 74 41 76 61 69 6c 61 62 6c 65 53 6c 6f 74 28 61 72 72 61 79 2c 20 65 6c 65 6d 65 6e 74 29 20 7b 0d 0a 20 20 20 20 76 61 72 20 69 3b 0d 0a 20 20 20 20 66 6f 72 20 28 69 20 3d 20 30 3b 20 69 20 3c 20 61 72 72 61 79 2e 6c 65 6e 67 74 Data Ascii: allback(response.substring(separatorIndex + validationFieldLength + 1), callbackObject.context); } } } }}function WebForm_FillFirstAvailableSlot(array, element) { var i; for (i = 0; i < array.lengt
2024-04-19 19:34:51 UTC	7259	IN	Data Raw: 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 69 66 20 28 64 65 66 61 75 6c 74 42 75 74 74 6f 6e 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 57 65 62 46 6f 72 6d 5f 53 69 6d 75 6c 61 74 65 43 6c 69 63 6b 28 64 65 66 61 75 6c 74 42 75 74 74 6f 6e 2c 20 65 76 65 6e 74 29 3b 0d 0a 20 20 20 20 20 20 20 20 7d 20 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 72 65 74 75 72 6e 20 74 72 75 65 3b 0d 0a 7d 0d 0a 66 75 6e 63 74 69 6f 6e 20 57 65 62 46 6f 72 6d 5f 47 65 74 53 63 72 6f 6c 6c 58 28 29 20 7b 0d 0a 20 20 20 20 69 66 20 28 5f 5f 6e 6f 6e 4d 53 44 4f 4d 42 72 6f 77 73 65 72 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 70 61 67 65 58 4f 66 66 73 65 74 3b 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 65 6c 73 Data Ascii: } if (defaultButton) { return WebForm_SimulateClick(defaultButton, event); } } return true;}function WebForm_GetScrollX() { if (__nonMSDOMBrowser) { return window.pageXOffset; } els

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49723	13.107.136.10	443	6184	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 19:34:52 UTC	729	OUT	GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1 Host: visusewer-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://visusewer-my.sharepoint.com/:b:/g/personal/andrewj_visu-sewer_com/EVRAxCWP2AROv6Avc61UgjEBiCCPFuGZSfuR7U720Gontw?e=vqq7tt Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 19:34:52 UTC	679	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 7886 Content-Type: image/x-icon Last-Modified: Sat, 13 Apr 2024 02:47:19 GMT Accept-Ranges: bytes ETag: "80d5cbe64c8dda1:0" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" SPRequestDuration: 5 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 9E431DFDA96341A7A9849B4197078727 Ref B: ATL331000101027 Ref C: 2024-04-19T19:34:52Z Date: Fri, 19 Apr 2024 19:34:51 GMT Connection: close
2024-04-19 19:34:52 UTC	342	IN	Data Raw: 00 00 01 00 03 00 20 20 00 00 01 00 20 00 a8 10 00 00 36 00 00 00 18 18 00 00 01 00 20 00 88 09 00 00 de 10 00 00 10 10 00 00 01 00 20 00 68 04 00 00 66 1a 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 c6 37 30 d0 c6 37 af d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 af d0 c6 37 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6 hf( @ 7077777770
2024-04-19 19:34:52 UTC	7544	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 c6 37 50 d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 c6 37 10 d0 c6 37 ef d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ef d0 c6 37 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 7P77777777777P77777777777777

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49725	23.60.84.144	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 19:34:52 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-19 19:34:53 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0758) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=127721 Date: Fri, 19 Apr 2024 19:34:53 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49727	23.60.84.144	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 19:34:53 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-19 19:34:53 UTC	456	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0778) X-CID: 11 Cache-Control: public, max-age=127756 Date: Fri, 19 Apr 2024 19:34:53 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-19 19:34:53 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49728	13.107.136.10	443	6184	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 19:34:53 UTC	388	OUT	GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1 Host: visusewer-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 19:34:53 UTC	679	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 7886 Content-Type: image/x-icon Last-Modified: Sat, 13 Apr 2024 02:47:19 GMT Accept-Ranges: bytes ETag: "80d5cbe64c8dda1:0" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" SPRequestDuration: 4 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: F04727CC51B34A6FA9F5C87A2C0DCE28 Ref B: ATL331000104053 Ref C: 2024-04-19T19:34:53Z Date: Fri, 19 Apr 2024 19:34:53 GMT Connection: close
2024-04-19 19:34:53 UTC	198	IN	Data Raw: 00 00 01 00 03 00 20 20 00 00 01 00 20 00 a8 10 00 00 36 00 00 00 18 18 00 00 01 00 20 00 88 09 00 00 de 10 00 00 10 10 00 00 01 00 20 00 68 04 00 00 66 1a 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 c6 37 30 d0 c6 37 af d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 af d0 c6 37 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6 hf( @ 7077777770
2024-04-19 19:34:53 UTC	7688	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 c6 37 60 d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 c6 37 50 d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 7`777777777`7P77777777777P

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49733	23.1.237.91	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 19:35:03 UTC	2148	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2484 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1713555271032&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
2024-04-19 19:35:03 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-04-19 19:35:03 UTC	2483	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-04-19 19:35:03 UTC	480	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 8631B4872EF0478083C0F1DFECAEC8E8 Ref B: LAX311000108007 Ref C: 2024-04-19T19:35:03Z Date: Fri, 19 Apr 2024 19:35:03 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.57ed0117.1713555303.12f64b60

Target ID:	0
Start time:	21:34:41
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	21:34:45
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2044,i,16513738988315491278,1890450464409074882,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	21:34:48
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://visusewer-my.sharepoint.com/:b:/g/personal/andrewj_visu-sewer_com/EVRAxCWP2AROv6Avc61UgjEBiCCPFuGZSfuR7U720Gontw?e=vqq7tt"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://visusewer-my.sharepoint.com/:b:/g/personal/andrewj_visu-sewer_com/EVRAxCWP2AROv6Avc61UgjEBiCCPFuGZSfuR7U720Gontw?e=vqq7tt

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

Windows Analysis Report
https://visusewer-my.sharepoint.com/:b:/g/personal/andrewj_visu-sewer_com/EVRAxCWP2AROv6Avc61UgjEBiCCPFuGZSfuR7U720Gontw?e=vqq7tt