Edit tour

Windows Analysis Report
https://outlook.office365.com/owa/?viewmodel=ReadMessageItem&InternetMessageID=%3cMN2PR15MB265581B72BCA78783AC3110FE1122%40MN2PR15MB2655.namprd15.prod.outlook.com%3e

Overview

General Information

Sample URL:	https://outlook.office365.com/owa/?viewmodel=ReadMessageItem&InternetMessageID=%3cMN2PR15MB265581B72BCA78783AC3110FE1122%40MN2PR15MB2655.namprd15.prod.outlook.com%3e
Analysis ID:	1430595
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found iframes

HTML body contains low number of good links

HTML title does not match URL

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6784 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 3476 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2204,i,3844797713669142651,5628405617170372951,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 876 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://outlook.office365.com/owa/?viewmodel=ReadMessageItem&InternetMessageID=%3cMN2PR15MB265581B72BCA78783AC3110FE1122%40MN2PR15MB2655.namprd15.prod.outlook.com%3e" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=57884ebc-20ed-69b7-9f1b-a865892114a4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba&state=VYtBbsIwEEWT9ixhF-MZe2yzQFVCQWIRVHEDOx4qRBKjkJYrcGyyYcHi_cXTf3mWZZ8zHzO5nCezRjm9IqlQKzCOQJOwmqM5YSgDBi51K20ZjLKls0TUOsJV8PncPvJluvvl1_-Z732K3K2P7GPDt5v_5f3E_WI_TDwOPL3c97pQbXPAnyNQU6MhclBbrDeVddapaqMA5G4LgFho-XYUg--vYwQS1zFFkf6mLqWLaFNfKH4C&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=57884ebc-20ed-69b7-9f1b-a865892114a4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba&state=VYtBbsIwEEWT9ixhF-MZe2yzQFVCQWIRVHEDOx4qRBKjkJYrcGyyYcHi_cXTf3mWZZ8zHzO5nCezRjm9IqlQKzCOQJOwmqM5YSgDBi51K20ZjLKls0TUOsJV8PncPvJluvvl1_-Z732K3K2P7GPDt5v_5f3E_WI_TDwOPL3c97pQbXPAnyNQU6MhclBbrDeVddapaqMA5G4LgFho-XYUg--vYwQS1zFFkf6mLqWLaFNfKH4C&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=57884ebc-20ed-69b7-9f1b-a865892114a4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba&state=VYtBbsIwEEWT9ixhF-MZe2yzQFVCQWIRVHEDOx4qRBKjkJYrcGyyYcHi_cXTf3mWZZ8zHzO5nCezRjm9IqlQKzCOQJOwmqM5YSgDBi51K20ZjLKls0TUOsJV8PncPvJluvvl1_-Z732K3K2P7GPDt5v_5f3E_WI_TDwOPL3c97pQbXPAnyNQU6MhclBbrDeVddapaqMA5G4LgFho-XYUg--vYwQS1zFFkf6mLqWLaFNfKH4C&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=4b25dd10-2516-35d5-28c7-714815154269&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032708125745.ca9a9b3d-f749-4636-97af-6af497f38b4b&state=DcsxEoAwCABBouNzMDEQCM8hOrSWfl-Kve4KAOxpS6VlQIUm22jUtc2rD-Vx3m5uix4MZUMWEjT1QPFg06C5eJV8j_p-Xn8	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=4b25dd10-2516-35d5-28c7-714815154269&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032708125745.ca9a9b3d-f749-4636-97af-6af497f38b4b&state=DcsxEoAwCABBouNzMDEQCM8hOrSWfl-Kve4KAOxpS6VlQIUm22jUtc2rD-Vx3m5uix4MZUMWEjT1QPFg06C5eJV8j_p-Xn8	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=dc4c82b9-9f23-cb47-45c1-7118250deb8a&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032910138037.88e29f78-8fc3-4242-b15d-d448bcaba0ce&state=Dcs7FoAwCABBos_jYAgQQ46Tb2vp9aWY7TYAwOkOF8gD5RHTmkm4JkpiJOU2W1x3MbQ9BJWVsac8capaH603Giv4e8X3a_EH	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=dc4c82b9-9f23-cb47-45c1-7118250deb8a&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032910138037.88e29f78-8fc3-4242-b15d-d448bcaba0ce&state=Dcs7FoAwCABBos_jYAgQQ46Tb2vp9aWY7TYAwOkOF8gD5RHTmkm4JkpiJOU2W1x3MbQ9BJWVsac8capaH603Giv4e8X3a_EH	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=45c0d02e-1ce4-6188-0c2e-73e3fe1a59d4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495033088601045.a6c12ca3-8d3d-4db1-9119-3cb548f36fb3&state=Dcs7EoAwCEVRouNyMOAjkSwnn7G1dPtSnNvdRER72EKSCN0Vbq0IIO5VVKycvU69Zgf7wmJbQ7mpNsYcxfxBfQZSvEd-v55_	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=45c0d02e-1ce4-6188-0c2e-73e3fe1a59d4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495033088601045.a6c12ca3-8d3d-4db1-9119-3cb548f36fb3&state=Dcs7EoAwCEVRouNyMOAjkSwnn7G1dPtSnNvdRER72EKSCN0Vbq0IIO5VVKycvU69Zgf7wmJbQ7mpNsYcxfxBfQZSvEd-v55_	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=57884ebc-20ed-69b7-9f1b-a865892114a4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba&state=VYtBbsIwEEWT9ixhF-MZe2yzQFVCQWIRVHEDOx4qRBKjkJYrcGyyYcHi_cXTf3mWZZ8zHzO5nCezRjm9IqlQKzCOQJOwmqM5YSgDBi51K20ZjLKls0TUOsJV8PncPvJluvvl1_-Z732K3K2P7GPDt5v_5f3E_WI_TDwOPL3c97pQbXPAnyNQU6MhclBbrDeVddapaqMA5G4LgFho-XYUg--vYwQS1zFFkf6mLqWLaFNfKH4C	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=57884ebc-20ed-69b7-9f1b-a865892114a4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba&state=VYtBbsIwEEWT9ixhF-MZe2yzQFVCQWIRVHEDOx4qRBKjkJYrcGyyYcHi_cXTf3mWZZ8zHzO5nCezRjm9IqlQKzCOQJOwmqM5YSgDBi51K20ZjLKls0TUOsJV8PncPvJluvvl1_-Z732K3K2P7GPDt5v_5f3E_WI_TDwOPL3c97pQbXPAnyNQU6MhclBbrDeVddapaqMA5G4LgFho-XYUg--vYwQS1zFFkf6mLqWLaFNfKH4C&sso_reload=true	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=4b25dd10-2516-35d5-28c7-714815154269&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032708125745.ca9a9b3d-f749-4636-97af-6af497f38b4b&state=DcsxEoAwCABBouNzMDEQCM8hOrSWfl-Kve4KAOxpS6VlQIUm22jUtc2rD-Vx3m5uix4MZUMWEjT1QPFg06C5eJV8j_p-Xn8	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=dc4c82b9-9f23-cb47-45c1-7118250deb8a&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032910138037.88e29f78-8fc3-4242-b15d-d448bcaba0ce&state=Dcs7FoAwCABBos_jYAgQQ46Tb2vp9aWY7TYAwOkOF8gD5RHTmkm4JkpiJOU2W1x3MbQ9BJWVsac8capaH603Giv4e8X3a_EH	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=45c0d02e-1ce4-6188-0c2e-73e3fe1a59d4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495033088601045.a6c12ca3-8d3d-4db1-9119-3cb548f36fb3&state=Dcs7EoAwCEVRouNyMOAjkSwnn7G1dPtSnNvdRER72EKSCN0Vbq0IIO5VVKycvU69Zgf7wmJbQ7mpNsYcxfxBfQZSvEd-v55_	HTTP Parser: Number of links: 0

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=57884ebc-20ed-69b7-9f1b-a865892114a4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba&state=VYtBbsIwEEWT9ixhF-MZe2yzQFVCQWIRVHEDOx4qRBKjkJYrcGyyYcHi_cXTf3mWZZ8zHzO5nCezRjm9IqlQKzCOQJOwmqM5YSgDBi51K20ZjLKls0TUOsJV8PncPvJluvvl1_-Z732K3K2P7GPDt5v_5f3E_WI_TDwOPL3c97pQbXPAnyNQU6MhclBbrDeVddapaqMA5G4LgFho-XYUg--vYwQS1zFFkf6mLqWLaFNfKH4C	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=57884ebc-20ed-69b7-9f1b-a865892114a4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba&state=VYtBbsIwEEWT9ixhF-MZe2yzQFVCQWIRVHEDOx4qRBKjkJYrcGyyYcHi_cXTf3mWZZ8zHzO5nCezRjm9IqlQKzCOQJOwmqM5YSgDBi51K20ZjLKls0TUOsJV8PncPvJluvvl1_-Z732K3K2P7GPDt5v_5f3E_WI_TDwOPL3c97pQbXPAnyNQU6MhclBbrDeVddapaqMA5G4LgFho-XYUg--vYwQS1zFFkf6mLqWLaFNfKH4C&sso_reload=true	HTTP Parser: Title: Sign in to Outlook does not match URL
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=4b25dd10-2516-35d5-28c7-714815154269&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032708125745.ca9a9b3d-f749-4636-97af-6af497f38b4b&state=DcsxEoAwCABBouNzMDEQCM8hOrSWfl-Kve4KAOxpS6VlQIUm22jUtc2rD-Vx3m5uix4MZUMWEjT1QPFg06C5eJV8j_p-Xn8	HTTP Parser: Title: Sign in to Outlook does not match URL
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=dc4c82b9-9f23-cb47-45c1-7118250deb8a&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032910138037.88e29f78-8fc3-4242-b15d-d448bcaba0ce&state=Dcs7FoAwCABBos_jYAgQQ46Tb2vp9aWY7TYAwOkOF8gD5RHTmkm4JkpiJOU2W1x3MbQ9BJWVsac8capaH603Giv4e8X3a_EH	HTTP Parser: Title: Sign in to Outlook does not match URL
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=45c0d02e-1ce4-6188-0c2e-73e3fe1a59d4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495033088601045.a6c12ca3-8d3d-4db1-9119-3cb548f36fb3&state=Dcs7EoAwCEVRouNyMOAjkSwnn7G1dPtSnNvdRER72EKSCN0Vbq0IIO5VVKycvU69Zgf7wmJbQ7mpNsYcxfxBfQZSvEd-v55_	HTTP Parser: Title: Sign in to Outlook does not match URL

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=57884ebc-20ed-69b7-9f1b-a865892114a4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba&state=VYtBbsIwEEWT9ixhF-MZe2yzQFVCQWIRVHEDOx4qRBKjkJYrcGyyYcHi_cXTf3mWZZ8zHzO5nCezRjm9IqlQKzCOQJOwmqM5YSgDBi51K20ZjLKls0TUOsJV8PncPvJluvvl1_-Z732K3K2P7GPDt5v_5f3E_WI_TDwOPL3c97pQbXPAnyNQU6MhclBbrDeVddapaqMA5G4LgFho-XYUg--vYwQS1zFFkf6mLqWLaFNfKH4C&sso_reload=true	HTTP Parser: <input type="password" .../> found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=4b25dd10-2516-35d5-28c7-714815154269&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032708125745.ca9a9b3d-f749-4636-97af-6af497f38b4b&state=DcsxEoAwCABBouNzMDEQCM8hOrSWfl-Kve4KAOxpS6VlQIUm22jUtc2rD-Vx3m5uix4MZUMWEjT1QPFg06C5eJV8j_p-Xn8	HTTP Parser: <input type="password" .../> found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=dc4c82b9-9f23-cb47-45c1-7118250deb8a&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032910138037.88e29f78-8fc3-4242-b15d-d448bcaba0ce&state=Dcs7FoAwCABBos_jYAgQQ46Tb2vp9aWY7TYAwOkOF8gD5RHTmkm4JkpiJOU2W1x3MbQ9BJWVsac8capaH603Giv4e8X3a_EH	HTTP Parser: <input type="password" .../> found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=45c0d02e-1ce4-6188-0c2e-73e3fe1a59d4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495033088601045.a6c12ca3-8d3d-4db1-9119-3cb548f36fb3&state=Dcs7EoAwCEVRouNyMOAjkSwnn7G1dPtSnNvdRER72EKSCN0Vbq0IIO5VVKycvU69Zgf7wmJbQ7mpNsYcxfxBfQZSvEd-v55_	HTTP Parser: <input type="password" .../> found

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=57884ebc-20ed-69b7-9f1b-a865892114a4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba&state=VYtBbsIwEEWT9ixhF-MZe2yzQFVCQWIRVHEDOx4qRBKjkJYrcGyyYcHi_cXTf3mWZZ8zHzO5nCezRjm9IqlQKzCOQJOwmqM5YSgDBi51K20ZjLKls0TUOsJV8PncPvJluvvl1_-Z732K3K2P7GPDt5v_5f3E_WI_TDwOPL3c97pQbXPAnyNQU6MhclBbrDeVddapaqMA5G4LgFho-XYUg--vYwQS1zFFkf6mLqWLaFNfKH4C	HTTP Parser: No favicon
Source: https://outlook.office365.com/owa/prefetch.aspx	HTTP Parser: No favicon
Source: https://outlook.office365.com/owa/prefetch.aspx	HTTP Parser: No favicon

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=57884ebc-20ed-69b7-9f1b-a865892114a4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba&state=VYtBbsIwEEWT9ixhF-MZe2yzQFVCQWIRVHEDOx4qRBKjkJYrcGyyYcHi_cXTf3mWZZ8zHzO5nCezRjm9IqlQKzCOQJOwmqM5YSgDBi51K20ZjLKls0TUOsJV8PncPvJluvvl1_-Z732K3K2P7GPDt5v_5f3E_WI_TDwOPL3c97pQbXPAnyNQU6MhclBbrDeVddapaqMA5G4LgFho-XYUg--vYwQS1zFFkf6mLqWLaFNfKH4C	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=57884ebc-20ed-69b7-9f1b-a865892114a4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba&state=VYtBbsIwEEWT9ixhF-MZe2yzQFVCQWIRVHEDOx4qRBKjkJYrcGyyYcHi_cXTf3mWZZ8zHzO5nCezRjm9IqlQKzCOQJOwmqM5YSgDBi51K20ZjLKls0TUOsJV8PncPvJluvvl1_-Z732K3K2P7GPDt5v_5f3E_WI_TDwOPL3c97pQbXPAnyNQU6MhclBbrDeVddapaqMA5G4LgFho-XYUg--vYwQS1zFFkf6mLqWLaFNfKH4C&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=57884ebc-20ed-69b7-9f1b-a865892114a4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba&state=VYtBbsIwEEWT9ixhF-MZe2yzQFVCQWIRVHEDOx4qRBKjkJYrcGyyYcHi_cXTf3mWZZ8zHzO5nCezRjm9IqlQKzCOQJOwmqM5YSgDBi51K20ZjLKls0TUOsJV8PncPvJluvvl1_-Z732K3K2P7GPDt5v_5f3E_WI_TDwOPL3c97pQbXPAnyNQU6MhclBbrDeVddapaqMA5G4LgFho-XYUg--vYwQS1zFFkf6mLqWLaFNfKH4C&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=57884ebc-20ed-69b7-9f1b-a865892114a4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba&state=VYtBbsIwEEWT9ixhF-MZe2yzQFVCQWIRVHEDOx4qRBKjkJYrcGyyYcHi_cXTf3mWZZ8zHzO5nCezRjm9IqlQKzCOQJOwmqM5YSgDBi51K20ZjLKls0TUOsJV8PncPvJluvvl1_-Z732K3K2P7GPDt5v_5f3E_WI_TDwOPL3c97pQbXPAnyNQU6MhclBbrDeVddapaqMA5G4LgFho-XYUg--vYwQS1zFFkf6mLqWLaFNfKH4C&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=4b25dd10-2516-35d5-28c7-714815154269&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032708125745.ca9a9b3d-f749-4636-97af-6af497f38b4b&state=DcsxEoAwCABBouNzMDEQCM8hOrSWfl-Kve4KAOxpS6VlQIUm22jUtc2rD-Vx3m5uix4MZUMWEjT1QPFg06C5eJV8j_p-Xn8	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=4b25dd10-2516-35d5-28c7-714815154269&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032708125745.ca9a9b3d-f749-4636-97af-6af497f38b4b&state=DcsxEoAwCABBouNzMDEQCM8hOrSWfl-Kve4KAOxpS6VlQIUm22jUtc2rD-Vx3m5uix4MZUMWEjT1QPFg06C5eJV8j_p-Xn8	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=dc4c82b9-9f23-cb47-45c1-7118250deb8a&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032910138037.88e29f78-8fc3-4242-b15d-d448bcaba0ce&state=Dcs7FoAwCABBos_jYAgQQ46Tb2vp9aWY7TYAwOkOF8gD5RHTmkm4JkpiJOU2W1x3MbQ9BJWVsac8capaH603Giv4e8X3a_EH	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=dc4c82b9-9f23-cb47-45c1-7118250deb8a&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032910138037.88e29f78-8fc3-4242-b15d-d448bcaba0ce&state=Dcs7FoAwCABBos_jYAgQQ46Tb2vp9aWY7TYAwOkOF8gD5RHTmkm4JkpiJOU2W1x3MbQ9BJWVsac8capaH603Giv4e8X3a_EH	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=45c0d02e-1ce4-6188-0c2e-73e3fe1a59d4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495033088601045.a6c12ca3-8d3d-4db1-9119-3cb548f36fb3&state=Dcs7EoAwCEVRouNyMOAjkSwnn7G1dPtSnNvdRER72EKSCN0Vbq0IIO5VVKycvU69Zgf7wmJbQ7mpNsYcxfxBfQZSvEd-v55_	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=45c0d02e-1ce4-6188-0c2e-73e3fe1a59d4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495033088601045.a6c12ca3-8d3d-4db1-9119-3cb548f36fb3&state=Dcs7EoAwCEVRouNyMOAjkSwnn7G1dPtSnNvdRER72EKSCN0Vbq0IIO5VVKycvU69Zgf7wmJbQ7mpNsYcxfxBfQZSvEd-v55_	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=57884ebc-20ed-69b7-9f1b-a865892114a4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba&state=VYtBbsIwEEWT9ixhF-MZe2yzQFVCQWIRVHEDOx4qRBKjkJYrcGyyYcHi_cXTf3mWZZ8zHzO5nCezRjm9IqlQKzCOQJOwmqM5YSgDBi51K20ZjLKls0TUOsJV8PncPvJluvvl1_-Z732K3K2P7GPDt5v_5f3E_WI_TDwOPL3c97pQbXPAnyNQU6MhclBbrDeVddapaqMA5G4LgFho-XYUg--vYwQS1zFFkf6mLqWLaFNfKH4C	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=57884ebc-20ed-69b7-9f1b-a865892114a4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba&state=VYtBbsIwEEWT9ixhF-MZe2yzQFVCQWIRVHEDOx4qRBKjkJYrcGyyYcHi_cXTf3mWZZ8zHzO5nCezRjm9IqlQKzCOQJOwmqM5YSgDBi51K20ZjLKls0TUOsJV8PncPvJluvvl1_-Z732K3K2P7GPDt5v_5f3E_WI_TDwOPL3c97pQbXPAnyNQU6MhclBbrDeVddapaqMA5G4LgFho-XYUg--vYwQS1zFFkf6mLqWLaFNfKH4C&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=57884ebc-20ed-69b7-9f1b-a865892114a4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba&state=VYtBbsIwEEWT9ixhF-MZe2yzQFVCQWIRVHEDOx4qRBKjkJYrcGyyYcHi_cXTf3mWZZ8zHzO5nCezRjm9IqlQKzCOQJOwmqM5YSgDBi51K20ZjLKls0TUOsJV8PncPvJluvvl1_-Z732K3K2P7GPDt5v_5f3E_WI_TDwOPL3c97pQbXPAnyNQU6MhclBbrDeVddapaqMA5G4LgFho-XYUg--vYwQS1zFFkf6mLqWLaFNfKH4C&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=57884ebc-20ed-69b7-9f1b-a865892114a4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba&state=VYtBbsIwEEWT9ixhF-MZe2yzQFVCQWIRVHEDOx4qRBKjkJYrcGyyYcHi_cXTf3mWZZ8zHzO5nCezRjm9IqlQKzCOQJOwmqM5YSgDBi51K20ZjLKls0TUOsJV8PncPvJluvvl1_-Z732K3K2P7GPDt5v_5f3E_WI_TDwOPL3c97pQbXPAnyNQU6MhclBbrDeVddapaqMA5G4LgFho-XYUg--vYwQS1zFFkf6mLqWLaFNfKH4C&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=4b25dd10-2516-35d5-28c7-714815154269&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032708125745.ca9a9b3d-f749-4636-97af-6af497f38b4b&state=DcsxEoAwCABBouNzMDEQCM8hOrSWfl-Kve4KAOxpS6VlQIUm22jUtc2rD-Vx3m5uix4MZUMWEjT1QPFg06C5eJV8j_p-Xn8	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=4b25dd10-2516-35d5-28c7-714815154269&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032708125745.ca9a9b3d-f749-4636-97af-6af497f38b4b&state=DcsxEoAwCABBouNzMDEQCM8hOrSWfl-Kve4KAOxpS6VlQIUm22jUtc2rD-Vx3m5uix4MZUMWEjT1QPFg06C5eJV8j_p-Xn8	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=dc4c82b9-9f23-cb47-45c1-7118250deb8a&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032910138037.88e29f78-8fc3-4242-b15d-d448bcaba0ce&state=Dcs7FoAwCABBos_jYAgQQ46Tb2vp9aWY7TYAwOkOF8gD5RHTmkm4JkpiJOU2W1x3MbQ9BJWVsac8capaH603Giv4e8X3a_EH	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=dc4c82b9-9f23-cb47-45c1-7118250deb8a&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032910138037.88e29f78-8fc3-4242-b15d-d448bcaba0ce&state=Dcs7FoAwCABBos_jYAgQQ46Tb2vp9aWY7TYAwOkOF8gD5RHTmkm4JkpiJOU2W1x3MbQ9BJWVsac8capaH603Giv4e8X3a_EH	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=45c0d02e-1ce4-6188-0c2e-73e3fe1a59d4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495033088601045.a6c12ca3-8d3d-4db1-9119-3cb548f36fb3&state=Dcs7EoAwCEVRouNyMOAjkSwnn7G1dPtSnNvdRER72EKSCN0Vbq0IIO5VVKycvU69Zgf7wmJbQ7mpNsYcxfxBfQZSvEd-v55_	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=45c0d02e-1ce4-6188-0c2e-73e3fe1a59d4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495033088601045.a6c12ca3-8d3d-4db1-9119-3cb548f36fb3&state=Dcs7EoAwCEVRouNyMOAjkSwnn7G1dPtSnNvdRER72EKSCN0Vbq0IIO5VVKycvU69Zgf7wmJbQ7mpNsYcxfxBfQZSvEd-v55_	HTTP Parser: No <meta name="copyright".. found

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49766 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49805 version: TLS 1.2

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49766 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64

Source: global traffic	HTTP traffic detected: GET /owa/?viewmodel=ReadMessageItem&InternetMessageID=%3cMN2PR15MB265581B72BCA78783AC3110FE1122%40MN2PR15MB2655.namprd15.prod.outlook.com%3e HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_4aBF4cdky--I3Cpch7JoPw2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_0lriinjhzchre9aqecvmpg2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /owa/prefetch.aspx HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ClientId=21005DA175D0486FB6CC7306B18DB8F9; OIDC=1; OpenIdConnect.nonce.v3.8lrqHfJIjxeKmLsEWTYt18TbOGRQMKZy88ZOq-mt830=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba; X-OWA-RedirectHistory=ArLym14BGS7xXtlj3Ag
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/appbackgrounds/49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc2e13.jpg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/appbackgrounds/49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc2e13.jpg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_presetpasswordsplitter_f7fbb7540d7be2ae771b.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_account_msa_3b879963b4f70829fd7a25cbc9519792.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_account_aad_a8332c62695d74843a11daf39a74e552.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_account_msa_3b879963b4f70829fd7a25cbc9519792.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_account_aad_a8332c62695d74843a11daf39a74e552.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /owa/ HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ClientId=21005DA175D0486FB6CC7306B18DB8F9; OIDC=1; OpenIdConnect.nonce.v3.8lrqHfJIjxeKmLsEWTYt18TbOGRQMKZy88ZOq-mt830=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba; X-OWA-RedirectHistory=ArLym14BGS7xXtlj3Ag
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_l2bvdjfwt697xziuhxpwsg2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /owa/prefetch.aspx HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ClientId=21005DA175D0486FB6CC7306B18DB8F9; OIDC=1; OpenIdConnect.nonce.v3.8lrqHfJIjxeKmLsEWTYt18TbOGRQMKZy88ZOq-mt830=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba; OpenIdConnect.nonce.v3.N3qRrA14YiorlN6zmhaE1YEQyahs_lsaF3ZixY0HMvg=638495032708125745.ca9a9b3d-f749-4636-97af-6af497f38b4b; X-OWA-RedirectHistory=ArLym14Bi7Ztb9lj3Ag\|ArLym14BGS7xXtlj3Ag
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /owa/ HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ClientId=21005DA175D0486FB6CC7306B18DB8F9; OIDC=1; OpenIdConnect.nonce.v3.8lrqHfJIjxeKmLsEWTYt18TbOGRQMKZy88ZOq-mt830=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba; OpenIdConnect.nonce.v3.N3qRrA14YiorlN6zmhaE1YEQyahs_lsaF3ZixY0HMvg=638495032708125745.ca9a9b3d-f749-4636-97af-6af497f38b4b; X-OWA-RedirectHistory=ArLym14Bi7Ztb9lj3Ag\|ArLym14BGS7xXtlj3Ag
Source: global traffic	HTTP traffic detected: GET /owa/prefetch.aspx HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ClientId=21005DA175D0486FB6CC7306B18DB8F9; OIDC=1; OpenIdConnect.nonce.v3.8lrqHfJIjxeKmLsEWTYt18TbOGRQMKZy88ZOq-mt830=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba; OpenIdConnect.nonce.v3.N3qRrA14YiorlN6zmhaE1YEQyahs_lsaF3ZixY0HMvg=638495032708125745.ca9a9b3d-f749-4636-97af-6af497f38b4b; OpenIdConnect.nonce.v3.yp0b6NYJo5LnwyKCb7pn701jVtoj966VUs7Jnw8kSZU=638495032910138037.88e29f78-8fc3-4242-b15d-d448bcaba0ce; X-OWA-RedirectHistory=ArLym14Btcp1e9lj3Ag\|ArLym14Bi7Ztb9lj3Ag\|ArLym14BGS7xXtlj3Ag
Source: global traffic	HTTP traffic detected: GET /owa/ HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ClientId=21005DA175D0486FB6CC7306B18DB8F9; OIDC=1; OpenIdConnect.nonce.v3.8lrqHfJIjxeKmLsEWTYt18TbOGRQMKZy88ZOq-mt830=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba; OpenIdConnect.nonce.v3.N3qRrA14YiorlN6zmhaE1YEQyahs_lsaF3ZixY0HMvg=638495032708125745.ca9a9b3d-f749-4636-97af-6af497f38b4b; OpenIdConnect.nonce.v3.yp0b6NYJo5LnwyKCb7pn701jVtoj966VUs7Jnw8kSZU=638495032910138037.88e29f78-8fc3-4242-b15d-d448bcaba0ce; X-OWA-RedirectHistory=ArLym14Btcp1e9lj3Ag\|ArLym14Bi7Ztb9lj3Ag\|ArLym14BGS7xXtlj3Ag
Source: global traffic	HTTP traffic detected: GET /owa/prefetch.aspx HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ClientId=21005DA175D0486FB6CC7306B18DB8F9; OIDC=1; OpenIdConnect.nonce.v3.8lrqHfJIjxeKmLsEWTYt18TbOGRQMKZy88ZOq-mt830=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba; OpenIdConnect.nonce.v3.N3qRrA14YiorlN6zmhaE1YEQyahs_lsaF3ZixY0HMvg=638495032708125745.ca9a9b3d-f749-4636-97af-6af497f38b4b; OpenIdConnect.nonce.v3.yp0b6NYJo5LnwyKCb7pn701jVtoj966VUs7Jnw8kSZU=638495032910138037.88e29f78-8fc3-4242-b15d-d448bcaba0ce; OpenIdConnect.nonce.v3.z4ilhCBFtC7tvpRUskPgo-WTXWKcoaqKj88CsoASsXA=638495033088601045.a6c12ca3-8d3d-4db1-9119-3cb548f36fb3; X-OWA-RedirectHistory=ArLym14B1esYhtlj3Ag\|ArLym14Btcp1e9lj3Ag\|ArLym14Bi7Ztb9lj3Ag\|ArLym14BGS7xXtlj3Ag

Source: unknown

DNS traffic detected: queries for: outlook.office365.com

Source: chromecache_90.2.dr	String found in binary or memory: http://github.com/jquery/globalize
Source: chromecache_81.2.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_81.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_81.2.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_74.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_74.2.dr	String found in binary or memory: https://login.windows-ppe.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49805 version: TLS 1.2

Source: classification engine

Classification label: clean2.win@24/84@24/10

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2204,i,3844797713669142651,5628405617170372951,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://outlook.office365.com/owa/?viewmodel=ReadMessageItem&InternetMessageID=%3cMN2PR15MB265581B72BCA78783AC3110FE1122%40MN2PR15MB2655.namprd15.prod.outlook.com%3e"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2204,i,3844797713669142651,5628405617170372951,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://outlook.office365.com/owa/?viewmodel=ReadMessageItem&InternetMessageID=%3cMN2PR15MB265581B72BCA78783AC3110FE1122%40MN2PR15MB2655.namprd15.prod.outlook.com%3e	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ooc-g2.tm-4.office.com	52.96.69.2	true	false	high
part-0013.t-0009.t-msedge.net	13.107.246.41	true	false	unknown
cs1100.wpc.omegacdn.net	152.199.4.44	true	false	unknown
www.google.com	64.233.185.104	true	false	high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
LYH-efz.ms-acdc.office.com	52.96.165.34	true	false	high
windowsupdatebg.s.llnwi.net	69.164.42.0	true	false	unknown
identity.nel.measure.office.net	unknown	unknown	false	high
r4.res.office365.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	unknown
login.microsoftonline.com	unknown	unknown	false	high
outlook.office365.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=45c0d02e-1ce4-6188-0c2e-73e3fe1a59d4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495033088601045.a6c12ca3-8d3d-4db1-9119-3cb548f36fb3&state=Dcs7EoAwCEVRouNyMOAjkSwnn7G1dPtSnNvdRER72EKSCN0Vbq0IIO5VVKycvU69Zgf7wmJbQ7mpNsYcxfxBfQZSvEd-v55_	false		high
https://outlook.office365.com/owa/prefetch.aspx	false		high
https://outlook.office365.com/owa/?viewmodel=ReadMessageItem&InternetMessageID=%3cMN2PR15MB265581B72BCA78783AC3110FE1122%40MN2PR15MB2655.namprd15.prod.outlook.com%3e	false		high
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=dc4c82b9-9f23-cb47-45c1-7118250deb8a&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032910138037.88e29f78-8fc3-4242-b15d-d448bcaba0ce&state=Dcs7FoAwCABBos_jYAgQQ46Tb2vp9aWY7TYAwOkOF8gD5RHTmkm4JkpiJOU2W1x3MbQ9BJWVsac8capaH603Giv4e8X3a_EH	false		high
https://outlook.office365.com/owa/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://github.com/jquery/globalize	chromecache_90.2.dr	false	high
http://knockoutjs.com/	chromecache_81.2.dr	false	high
https://login.microsoftonline.com	chromecache_74.2.dr	false	high
http://www.opensource.org/licenses/mit-license.php)	chromecache_81.2.dr	false	high
https://github.com/douglascrockford/JSON-js	chromecache_81.2.dr	false	high
https://login.windows-ppe.net	chromecache_74.2.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.41	part-0013.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.199.4.44	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
52.96.189.2	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.96.165.34	LYH-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.96.69.2	ooc-g2.tm-4.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.96.222.178	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
64.233.185.104	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.6

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430595
Start date and time:	2024-04-23 23:06:28 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://outlook.office365.com/owa/?viewmodel=ReadMessageItem&InternetMessageID=%3cMN2PR15MB265581B72BCA78783AC3110FE1122%40MN2PR15MB2655.namprd15.prod.outlook.com%3e
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean2.win@24/84@24/10
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://outlook.office365.com/owa/ Browse: https://outlook.office365.com/owa/ Browse: https://outlook.office365.com/owa/

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.215.94, 142.250.105.84, 142.250.105.113, 142.250.105.102, 142.250.105.139, 142.250.105.101, 142.250.105.138, 142.250.105.100, 34.104.35.123, 40.126.28.23, 40.126.28.21, 40.126.7.35, 40.126.28.19, 40.126.28.20, 40.126.28.18, 40.126.28.14, 40.126.28.22, 23.50.120.17, 23.50.120.10, 40.126.28.13, 40.126.7.32, 23.1.33.143, 23.1.33.140, 74.125.138.95, 74.125.136.95, 64.233.176.95, 142.250.105.95, 142.251.15.95, 142.250.9.95, 64.233.185.95, 172.253.124.95, 172.217.215.95, 64.233.177.95, 173.194.219.95, 20.12.23.50, 192.229.211.108, 69.164.42.0, 20.3.187.198, 72.21.81.240, 20.242.39.171, 64.233.185.94, 40.126.29.5, 40.126.29.15, 40.126.29.10, 40.126.29.14, 40.126.29.6, 40.126.29.13, 20.190.157.11, 40.126.29.12, 23.40.205.67, 23.40.205.73, 23.40.205.41, 23.40.205.35, 23.40.205.59, 23.40.205.48, 23.40.205.66, 23.40.205.58, 23.40.205.9
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, a767.dspw65.akamai.net, ak.privatelink.msidentity.com, a1894.dscb.akamai.net, wu.azureedge.net, clients2.google.com, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, login.mso.msidentity.com, glb.sls.prod.dcat.dsp.trafficmanager.net, e40491.dscg.akamaiedge.net, client.wns.windows.com, prdv4a.aadg.msidentity.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, aadcdnoriginwus2.azureedge.net, www.tm.ak.prd.aadg.akadns.net, www.tm.v4.a.prd.aadg.akadns.net, wu.ec.azureedge.net, ctldl.windowsupdate.com, aadcdn.msauth.net, wu-bg-shim.trafficmanager.net, firstparty-azurefd-prod.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, fe3.del
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: https://outlook.office365.com/owa/?viewmodel=ReadMessageItem&InternetMessageID=%3cMN2PR15MB265581B72BCA78783AC3110FE1122%40MN2PR15MB2655.namprd15.prod.outlook.com%3e

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 223759
Category:	downloaded
Size (bytes):	54325
Entropy (8bit):	7.996017457525811
Encrypted:	true
SSDEEP:	768:MBOXdNQNgHZp9Ga0EqoitKVFF9dMVtakANyFeDpz3ZSgaDpk4JGUISrX+pk7RU/P:bDQNg5pFneONYu9ZpfUv7+m7aITS2Du
MD5:	799F880143F17E47C4EFDBB3FF35A54C
SHA1:	8CECC74EB422322F78EDE1111F175A28725CCA9F
SHA-256:	EA70CC2977F4DEB5236041A7A0628FA671FB8AD20A5E9E3FD6885A11359EF2FE
SHA-512:	46E811AA3D03023596B47DB39B6FABCC1A4B7388C7F0A187A4C23B024695593702A70227F5B770174A258A265A48D4F87EF01281210229E51022E9BC6948214B
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js
Preview:	...........k{.F.0.}...gF.L."..eR..v.y.O....g...............~...@....f<...F./...u...;............x.y.C...y...sx.....^=}.....N.W.I.Y$.....".w....$..\|..a...+.7O.eg.gW..2...8..2)J..<^f.:.4..;....<}.....ZK.......5..,;iV&Q...9......;U:....$....DyVd....Q...N......N..".;.,//.8...X..ZP7......&shpA...a.I.C\U0i.&K..}m..1..9.N.u....^.'I/:......r...a^Ee.f..oq..e'..y..U..;...T(...<L..;X.."..8-}.^L.._w.....f.w..V.x.kK..K../.A..[....oE....G..ao0...\........Qv.7..eX..70.....\|.s.}.#...:..t...$.}=....s..g.}Q..........SO.....p.%..v..\|.Fo.. ..,e.......=;;..7....J#......{7o....;.........<..?.....G._..}..(..k?....2.......J.E.z.^.O.....}...XWe.....O...,C...+......O.r..he.............$Y.;..?).y....&.$..u..m.~.Z...2./..\|9..(.m....W.8.?QO}.....]....Y..z..=..2........>..8...87.&..ajn.m.E.,.<...n.t..`......\|..s7..v.w.z....d{...m.^..Y..AA...,C^...:0.~A.]....,...........6xR..8.p,./?..~v.+../c..Z...$.....Ysg....U....H....._q....o..acC...fpv.fb.....\|.?.-V

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2, software=paint.net 4.2.9], baseline, precision 8, 50x28, components 3
Category:	downloaded
Size (bytes):	987
Entropy (8bit):	6.922003634904799
Encrypted:	false
SSDEEP:	24:PJjxEK0nWpBzo0XxDuLHeOWXG4OZ7DAJuLHenX3D+VRmK9cR+w/b:lxEX4OuERAVwR/QP/b
MD5:	E58AAFC980614A9CD7796BEA7B5EA8F0
SHA1:	D4CAC92DCDE0CAF7C571E6D791101DA94FDBD2CA
SHA-256:	8B34A475187302935336BF43A2BF2A4E0ADB9A1E87953EA51F6FCF0EF52A4A1D
SHA-512:	2DAC06596A11263DF1CFAB03EDA26D0A67B9A4C3BAA6FB6129CDBF0A157C648F5B0F5859B5CA689EFDF80F946BF4D854BA2B2C66877C5CE3897D72148741FCC9
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/appbackgrounds/49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg
Preview:	......JFIF.....H.H.....fExif..MM..................>...........F.(...........1.........N.......H.......H....paint.net 4.2.9....C....................................................................C.........................................................................2..!............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......[.4..lz.....K.S..p.>.9.r9j..'.\.qrW..mo...X9ZV<./x...EX...m.Prj..A.EtG...K..mr....Lc.T.8...nlY.V.{6...R...]..(.y...)^.5V.IVO.W.B.19.R\...f.U.....'..S:..k.6..).f.n._3*....}.y.8.EusH..y.`.mA...W.}...bL..:..b.<f..(lH#R....v._...........9N~S..

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 223759
Category:	downloaded
Size (bytes):	54318
Entropy (8bit):	7.995006031600911
Encrypted:	true
SSDEEP:	1536:GPYhFQ0hY97NgEQMoCG/D6oAPSZGh7Xifaz8TAiQzsr:Gn37ih787GA8Ei+sr
MD5:	3F98A175D5232F665BEFFC23352D7176
SHA1:	8413FCCF22CEBAAED144736F5415F09EFD45CE48
SHA-256:	C6D80B97A3828280862163C72A94F5902F10D927FA1F6BDEAB5479B94F04F5AC
SHA-512:	93D0C9BBB7B204AE18A2392F137DC02B71A9E5352EC24267C2CEBAE5C286EEB68BCABF73F3F4B6DA1DF1D49E3998F6190D843144CD1ACDD5B4AA707CDF7CC24D
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js
Preview:	...........k{.F.0.}...gF.L."..eR..v.y.O....g...............~...@....f<...F./...u...;............x.y.C...y...sx.....^=}.....N.W.I.Y$.....".w....$..\|..a...+.7O.eg.gW..2...8..2)J..<^f.:.4..;....<}.....ZK.......5..,;iV&Q...9......;U:....$....DyVd....Q...N......N..".;.,//.8...X..ZP7......&shpA...a.I.C\U0i.&K..}m..1..9.N.u....^.'I/:......r...a^Ee.f..oq..e'..y..U..;...T(...<L..;X.."..8-}.^L.._w.....f.w..V.x.kK..K../.A..[....oE....G..ao0...\........Qv.7..eX..70.....\|.s.}.#...:..t...$.}=....s..g.}Q..........SO.....p.%..v..\|.Fo.. ..,e.......=;;..7....E.F8+7.K?.n.y'.rw.........x~...=?.?...z~.?....<...(H./.....V.....yx.?.O.>l...E..c]..n.?..>......%<.....?....w........../.2.^...d........1b...4~.)\W....k-.n.0..._..8....qZ..^...D=...~..w...^g.........*.r.......d.O............a....R.)O.[v...C......2.....s..y...o6...6...z}8d....e<+..y.cs....X...v.O...p.....3.v.~D..IAo.<.....,H..9.xx....h.....B\.f.a.&..V...no"MJ.R...6...Y.....F<...9....s`..Q...X

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	662286
Entropy (8bit):	5.315860951951661
Encrypted:	false
SSDEEP:	12288:YfmmzLJTD/JilMGk4hBR310FaHHxpJy7qVfb4cSPo:Yfm+T7US7SR310FaHHTJy7qJ4rPo
MD5:	12204899D75FC019689A92ED57559B94
SHA1:	CCF6271C6565495B18C1CED2F7273D5875DBFB1F
SHA-256:	39DAFD5ACA286717D9515F24CF9BE0C594DFD1DDF746E6973B1CE5DE8B2DD21B
SHA-512:	AA397E6ABD4C54538E42CCEDA8E3AA64ACE76E50B231499C20E88CF09270AECD704565BC9BD3B27D90429965A0233F99F27697F66829734FF02511BD096CF030
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.43/scripts/boot.worldwide.2.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.2.mouse.js'] = (new Date()).getTime();.._y.lC=function(){};_y.lC.registerInterface("_y.lC");_y.jw=function(){};_y.jw.registerInterface("_y.jw");_y.lA=function(){};_y.lA.registerInterface("_y.lA");var IDelayedSendEvent=function(){};IDelayedSendEvent.registerInterface("IDelayedSendEvent");var IIsShowingComposeInReadingPaneEvent=function(){};IIsShowingComposeInReadingPaneEvent.registerInterface("IIsShowingComposeInReadingPaneEvent");var ISendFailedO365Event=function(){};ISendFailedO365Event.registerInterface("ISendFailedO365Event");var ISendFailureRemoveO365Event=function(){};ISendFailureRemoveO365Event.registerInterface("ISendFailureRemoveO365Event");_y.gw=function(){};_y.gw.registerInterface("_y.gw");_y.iB=function(){};_y.iB.registerInterface("_y.iB");_y.ih=function(){};_y.ih.registerInterface("_y.ih");_y.jy=function(){};_y.jy.regis

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	36
Entropy (8bit):	4.503258334775644
Encrypted:	false
SSDEEP:	3:Eq62iczBr9ks:EqdiczBys
MD5:	06B313E93DD76909460FBFC0CD98CB6B
SHA1:	C4F9B2BBD840A4328F85F54873C434336A193888
SHA-256:	B4532478707B495D0BB1C21C314AEF959DD1A5E0F66E52DAD5FC332C8B697CBA
SHA-512:	EFD7E8195D9C126883C71FED3EFEDE55916848B784F8434ED2677DF5004436F7EDE9F80277CB4675C4DEB8F243B2705A3806B412FAA8842E039E9DC467C11645
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSFwmCAmly1gHbXRIFDdFbUVISBQ1Xevf9?alt=proto
Preview:	ChgKDQ3RW1FSGgQIVhgCIAEKBw1Xevf9GgA=

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 444357
Category:	downloaded
Size (bytes):	121259
Entropy (8bit):	7.997406222796355
Encrypted:	true
SSDEEP:	1536:YfwluSACBAwNjnVCN2xrnCBjWmIYnJFFiNnybf8DkmN2jTl2Lx2OBQmBcy5wIorC:w/S7ht4ONJJ2jZqxdmy/GzYr
MD5:	5B2E3B2B1A706C0101B503B72F0A9B6F
SHA1:	4611FB4775572B46A5A14A6B12A52B558831A18D
SHA-256:	D40DCDEAA08322A4EB75A7C4B2CD80675D5A75D4542A98B4C3E4992A810E9778
SHA-512:	73A01455BC664165BEF6B89916FD9EA013C276DB8A5F0309D07E6BC8C4AAFCFB5F17177BA846676D04AACB18060FE9375C4C2FA13F9B0A704A2458E5C5ED74C5
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_4aBF4cdky--I3Cpch7JoPw2.js
Preview:	............{.8.......f.cw...Wl..Y.U..$..Iw.2.d.v.%.$.1..o?.$%J.SU.{w.}.S.H... .......O.....2..\.T..../g..+.............F..7.^\.x>....3....0.x..F.0...Wf.o..~e...J...(..9I\.8.Bc./.T...+;J.gW.:..6o..P...o..1..a.9.b.....G..."pYTyy.....Da.N.J...=C#....M..;b..%.I.%......!E.15.[...:..P.........8_...L..ou..ie..\|.IXy.....x.`Z...bj......I.a.,z...~%..B.....:.....L#;@...`..i......cTt.V.fs...L..8..s...R./^...*.?.0h...+.f...6:......d...>M..q1.;.......C.'.....G...?c^....\-...q8..@.u.b.,..+..!`_.....qry.?]..<>mM.......R........l..uO...q.G...c..;...~.sX.Y0M....g.w.>....'a.6g.G;.....9.b.;0.U[.j....w..........JM..Vc.;...V..wU...TYew...?5....va8...i...$.......\.l...j?EC.h.&U....E,YDA...Na!..T..$k..[..2..j./.1,D}LdY=..a.>\|k....NE/.A...}..&. ..7%#..o(a.S....e!P8..UK.#.n.{..@.I....uVva.....$z#...[..CX......l.}...Q.......\.n...........Z...LK.~.\|."...D;u{>......T$.C..^\|%..'U....k2=...)Y! )..+.Y.#%........C..?2.r_....%'>.....^.3V..H..zSF..%C..G..`

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (59783), with CRLF line terminators
Category:	downloaded
Size (bytes):	663451
Entropy (8bit):	5.3635307555313165
Encrypted:	false
SSDEEP:	12288:YhqblwQ9eTw/suNyIzaJS/pWYawUWufSxwDr2o/5YP1B:Yhqblt9e8/sMzaJS/pWYawUWufSxwDrW
MD5:	761CE9E68C8D14F49B8BF1A0257B69D6
SHA1:	8CF5D714D35EFFA54F3686065CB62CCE028E2C77
SHA-256:	BEAA65AD34340E61E9E701458E2CCFF8F9073FDEBBC3593A2C7EC8AFEACB69C1
SHA-512:	CEC948666FBA0F56D3DA27A931033C3A581C9C00FEC4D3DDCF41324525B5B5321AE3AB89581ECC7F497DE85EF684AB277C8A2DB393D526416CEB76C91A1B9263
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/scripts/boot.worldwide.0.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.0.mouse.js'] = (new Date()).getTime();../* Empty file */;Function.__typeName="Function";Function.__class=!0;Function.createCallback=function(n,t){return function(){var r=arguments.length;if(r>0){for(var u=[],i=0;i<r;i++)u[i]=arguments[i];u[r]=t;return n.apply(this,u)}return n.call(this,t)}};Function.prototype.bind=Function.prototype.bind\|\|function(n){if(typeof this!="function")throw new TypeError("bind(): we can only bind to functions");var u=Array.prototype.slice.call(arguments,1),r=this,t=function(){},i=function(){return r.apply(this instanceof t?this:n,u.concat(Array.prototype.slice.call(arguments)))};this.prototype&&(t.prototype=this.prototype);i.prototype=new t;return i};Function.createDelegate=function(n,t){return function(){return t.apply(n,arguments)}};Function.emptyFunction=Function.emptyMethod=function(){};Error.__typeNam

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 4730
Category:	downloaded
Size (bytes):	1663
Entropy (8bit):	7.885618370455321
Encrypted:	false
SSDEEP:	24:XndDDa31rxQxPmrqVVDZ6Ug5CEO25X6kRcalJYCIE88hUauWrfUBdw4Bmgx0HliC:XdDAre3Vd6UgBHJtRvYihUtBd1hUV
MD5:	921569786EBE648793E6BC01848CBF9A
SHA1:	4CE5A811E7BA990F34E607669919E5634E996BB1
SHA-256:	BD7A3F40B3821D20AEC3566B4EA6CD3DD82687456CC445B5423F4671CEC273BD
SHA-512:	97EC2AFA0B65DB3B397FB6FB74E900D763ECAB6FBE658510AA09F3AC08821C24E51CEF77BCDF417E440F67954C88E37679F851D25E4DCD1C67C7BE998584CE08
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_presetpasswordsplitter_f7fbb7540d7be2ae771b.js
Preview:	...........W[o.6.~.`...$....I..kZ#.:.I`P..D"......;.%.r..m1`....s...;.jOw....{...._....dx...........7..c....)2f1.\|.TAD.'B..C!S!..E.....d,EB..H.%.Z..).J..bNhNF.O.^.w...........t...p.Y....Z...W@2..$.)...R(1.DB.l.NT..e......M.B....O.F2.....Ge....Ehpl..O....1.0h.#x...@....e.D...Y.....'..(...C.Q.j....93......&K....S.P.L$.&.;,..H...v1y`U..aI.@ld...E.Bljk....h.B...M.R.J...........Z..[.M..f......l.S...+.....\|..]...e..........2^..g.]).."..0...7p......e..G.Ie.x..4. ...{.P......E.O35.........Aw...U....z3.....4...G..R\|....G...iW....1X.....-.U....L.]....yD5u....D.Sl&.J.:.Y/-.._....p....G.P.:.T].s..C...3.L.C...[.X.....h.ws]..u/..\|$.!v...n._E.}.3&2U5z..C.[.)..+.JS.=J.m.r...H'..'f....,.gH..4...a....Bt...8............9../x8..c........z.......+GJ.L.2.+ _.(.........?..[.9.R^.V.XNN...\k3..GT...}.58KU/.u;..F..`~....N#.k,..P....rD.Pd\.0...a..[......~.hv......z}...S>q.......[.f...;.D.....m4":n...6t:M_./,.W\|9..p.G..LmU.]..............c.8....8DM).

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	17453
Entropy (8bit):	3.890509953257612
Encrypted:	false
SSDEEP:	192:P7FRTHQpmA3ZkXOL25cYty7l6UWUjMJBSab/vR+yzP:P/cpmgkF5+JWUjMp40P
MD5:	7916A894EBDE7D29C2CC29B267F1299F
SHA1:	78345CA08F9E2C3C2CC9B318950791B349211296
SHA-256:	D8F5AB3E00202FD3B45BE1ACD95D677B137064001E171BC79B06826D98F1E1D3
SHA-512:	2180ABE47FBF76E2E0608AB3A4659C1B7AB027004298D81960DC575CC2E912ECCA8C131C6413EBBF46D2AAA90E392EB00E37AED7A79CDC0AC71BA78D828A84C7
Malicious:	false
Reputation:	low
Preview:	.....Phttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta>

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	660449
Entropy (8bit):	5.4121922690110535
Encrypted:	false
SSDEEP:	12288:3PUKyvwjOOvwZ1ARuxntuicBh8hS11dsUA:yvjZ+/pIUA
MD5:	D9E3D2CE0228D2A5079478AAE5759698
SHA1:	412F45951C6AEDA5F3DF2C52533171FC7BDD5961
SHA-256:	7041D585609800051E4F451792AEC2B8BD06A4F2D29ED6F5AD8841AAE5107502
SHA-512:	06700C65BEF4002EBFBFF9D856C12E8D71F408BACA2D2103DDE1C28319B6BD3859FA9D289D8AEB6DD484E802040F6EE537F31F97B4B60A6B120A6882C992207A
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/scripts/boot.worldwide.3.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.3.mouse.js'] = (new Date()).getTime();..;_n.a.jR=function(n){return n.dS()};_n.a.jZ=function(n){return n.eh()};_n.a.jP=function(n){return n.cC()};_n.a.jQ=function(n){return n.ca()};_n.a.hZ=function(n){return n.dO};_n.a.jU=function(n){return n.ed()};_n.a.jT=function(n){return n.ea()};_n.a.kb=function(n){return n.ej()};_n.a.hM=function(n){return 300};_n.a.fh=function(n){return n.V};_n.a.jV=function(n){return n.bI()};_n.a.ie=function(n){return n.mh()};_n.a.km=function(n){return n.bl()};_n.a.ka=function(n){return n.ei()};_n.a.ko=function(n){return n.cV()};_n.a.eX=function(n){return _y.E.isInstanceOfType(n)?n.y:null};_n.a.jN=function(n){return n.c()};_n.a.gm=function(n){return n.b()};_n.a.jM=function(n){return n.b()};_n.a.ib=function(n){return n.jM()};_n.a.iq=function(n){return n.bG};_n.a.iX=function(n){return _n.V.isInstanceOfType(n)?n

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (994), with no line terminators
Category:	downloaded
Size (bytes):	994
Entropy (8bit):	4.934955158256183
Encrypted:	false
SSDEEP:	12:U8Chx3fpler8DDMv1+I+zpcuVkicq32EXgBA5e2KMLT:JC3G0z1Ddf2NGe2KG
MD5:	E2110B813F02736A4726197271108119
SHA1:	D7AC10CC425A7B67BF16DDA0AAEF1FEB00A79857
SHA-256:	6D1BE7ED96DD494447F348986317FAF64728CCF788BE551F2A621B31DDC929AC
SHA-512:	E79CF6DB777D62690DB9C975B5494085C82E771936DB614AF9C75DB7CE4B6CA0A224B7DFB858437EF1E33C6026D772BE9DBBB064828DB382A4703CB34ECEF1CF
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/resources/images/0/sprite1.mouse.css
Preview:	.image-loading_blackbg-gif{background:url('loading_blackbg.gif');width:16px;height:16px}.image-loading_whitebg-gif{background:url('loading_whitebg.gif');width:16px;height:16px}.image-thinking16_blue-gif{background:url('thinking16_blue.gif');width:16px;height:16px}.image-thinking16_grey-gif{background:url('thinking16_grey.gif');width:16px;height:16px}.image-thinking16_white-gif{background:url('thinking16_white.gif');width:16px;height:16px}.image-thinking24-gif{background:url('thinking24.gif');width:24px;height:24px}.image-thinking32_blue-gif{background:url('thinking32_blue.gif');width:32px;height:32px}.image-thinking32_grey-gif{background:url('thinking32_grey.gif');width:32px;height:32px}.image-thinking32_white-gif{background:url('thinking32_white.gif');width:32px;height:32px}.image-clear1x1-gif{width:1px;height:1px;background:url('sprite1.mouse.png') -0 -0}.csimg{padding:0;border:none;background-repeat:no-repeat;-webkit-touch-callout:none}span.csimg{-ms-high-contrast-adjust:none}

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 55071
Category:	downloaded
Size (bytes):	15799
Entropy (8bit):	7.985179973188672
Encrypted:	false
SSDEEP:	384:UwXl87i4naaFtPESJ2DWOq1IcQS0SL7EOONPk:UwXW7i4naTSOAszOG8
MD5:	978A6C1AA934E5B1C5320D515FD25662
SHA1:	64636EF3E1AD607F095DBA6CB01447AC133B483D
SHA-256:	D1963B1837F4087E988FD18BB4CF25B38D61D675C4B6A6FC01158BD39945F10A
SHA-512:	411A51CC19890DC5B27E4800E5BB4BFB4D0E3DC076010C6AB8B10396524F4C996D86420888AF3A1632D5FB281CEB4373C18B0EEFC9F8A84AA59D295450393DA7
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_l2bvdjfwt697xziuhxpwsg2.js
Preview:	...........}Ms#G.....uh.O=.>...4..p.O$...P.IF4.".K....1..5.......7.\|.....S6..w8?......9...B.AwUeeeeeefee..f.Oc/._..G.............{..._..%.q..q........j<.w..O.7..."pgbV.C..k.T`..X....'v....<p....I.'..k<j@Ai..NP.6<..j..N.....0.......=..ox/+...9.sB..p.q.ai...?.....qw.D.X..b..?.bOD.x.B1..X..`.N..b..E...%JWg..x8.ys..:...I.....b1...q.......[..a..7q..N........._..4....&.. ........m&6.F.\.@.e.B..`.'.....0............]/.........`..iZ6......./f8..BCz_...i....MQ>..E,/x>v......{.........._.........Z.rP+......e..R.\.Z.u..3@./.oJ7.'.......%.;.WP.9.b..z._..b....0......X...Ro^k.lI..t..K7~.ep.`.)......'."".."....../..S....M..B5nEc2..g..m..\|f.{...pbi(.0.@[_Lc.Z.....U`./!..@.....p.-..kQ@T..8...-...0.....AX.D.?...".....5.NE..\...VQa.....,......?..M.0......_<......C..fOq..bz'..z/BF.;&.K......%.....g........f!..^.:Z...g...j...7.._........S.2/.2.n.....>.<P!!.Bv..J........e!d....B.Ra$.......N........> f.C.....^.D.-.e.c+...............!....$.9x...{.....p~._.0.

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2, software=paint.net 4.2.9], baseline, precision 8, 50x28, components 3
Category:	dropped
Size (bytes):	987
Entropy (8bit):	6.922003634904799
Encrypted:	false
SSDEEP:	24:PJjxEK0nWpBzo0XxDuLHeOWXG4OZ7DAJuLHenX3D+VRmK9cR+w/b:lxEX4OuERAVwR/QP/b
MD5:	E58AAFC980614A9CD7796BEA7B5EA8F0
SHA1:	D4CAC92DCDE0CAF7C571E6D791101DA94FDBD2CA
SHA-256:	8B34A475187302935336BF43A2BF2A4E0ADB9A1E87953EA51F6FCF0EF52A4A1D
SHA-512:	2DAC06596A11263DF1CFAB03EDA26D0A67B9A4C3BAA6FB6129CDBF0A157C648F5B0F5859B5CA689EFDF80F946BF4D854BA2B2C66877C5CE3897D72148741FCC9
Malicious:	false
Reputation:	low
Preview:	......JFIF.....H.H.....fExif..MM..................>...........F.(...........1.........N.......H.......H....paint.net 4.2.9....C....................................................................C.........................................................................2..!............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......[.4..lz.....K.S..p.>.9.r9j..'.\.qrW..mo...X9ZV<./x...EX...m.Prj..A.EtG...K..mr....Lc.T.8...nlY.V.{6...R...]..(.y...)^.5V.IVO.W.B.19.R\...f.U.....'..S:..k.6..).f.n._3*....}.y.8.EusH..y.`.mA...W.}...bL..:..b.<f..(lH#R....v._...........9N~S..

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 600 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	132
Entropy (8bit):	4.945787382366693
Encrypted:	false
SSDEEP:	3:yionv//thPnFuXf8Lts7CX9/gm6Kp0syxtuIdsvFQAahUMZ/jp:6v/lhPBR/C+aNuqsvFQA0UMpp
MD5:	3EDA15637AFEAC6078F56C9DCC9BBDB8
SHA1:	97B900884183CB8CF99BA069EEDC280C599C1B74
SHA-256:	68C66D144855BA2BC8B8BEE88BB266047367708C1E281A21B9D729B1FBD23429
SHA-512:	06B21827589FCAF63B085DB2D662737B24A39A697FF9138BDF188408647C3E90784B355F2B8390160CA487992C033CE735599271EE35873E1941812AB6C34B52
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/resources/images/0/sprite1.mouse.png
Preview:	.PNG........IHDR...X..........x......sRGB.........gAMA......a.....pHYs..........o.d....IDATHK..1......Om.O ...j.a...\BW....IEND.B`.

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113084
Category:	downloaded
Size (bytes):	20314
Entropy (8bit):	7.979540464295058
Encrypted:	false
SSDEEP:	384:ekqQ8rNFEhCgMyL2iww6oIR8mWG+Pu9Z5IM6mxqrghTvUty7T9Q:9CGEiL/w7R8DW9Z5B6AasTv37T9Q
MD5:	92A840DC3D177339DAE03FEDF22A22B5
SHA1:	C1C9A6E6442388D07A9D9D72C12DA25094D6920F
SHA-256:	4A986BA8875F22A0EABC356112A6790F90E114ADB72EAEC4632E03812EC1EDE4
SHA-512:	98C705395DD249501D8069A03E0068BC9CCF4F2D139BEC63A00564C69CD21C05CB25CF56BA7B40822963737989D5048AD310E20D6022E84346C982CFCEF79E11
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css
Preview:	...........}ks.6.....\.R;.J.H=-WR;..&>g^53.G.R[.DY<C..$e.WG..... )...{+'g...l............bw_f7.:x..<x.-.V5)/wE..Y...gy.0.(.-o.e.\|..._..I.....?<{.!x...W..._..^..p..E..'..Y...<.....]..6(. ..D.....Y.......:.ve.?..!..\|t...].+.......a.......\|.P...u.H.d.d.r.c[..~.L..n.-.}e.H3...r..^..iP.u..z.....)..Z.jx..C'......u..{.C...N.o.m~..F(b..f.....h..O.....6....kr.......n2m M$.R..R..i{.~.....n.dKY..#.Kn.4..G...O..l.#.a=..iU..].S.2.wY..O.\|...Z.A....].uU.._%U.<...pp..u=.....C.R..S.....0...A<......&...W..'o.T.."..jO..^+.....DiW.b..7i..7..........lKe.0.~B0.....zQu#...YB.,.{.&.6..G.6..._...J.i.?.LS$( .^.{..u.-.0....K....M&j..s.yB..+....^.)...7e.....]..eFI_.kRX.B......D[.4......+.u=>....R.`QEK...R..d...*S.. ,c5RKBK(......][..eF{T.....6...".....Uk:..S.0Ro.}B.dwJZ}U..S.F.....&.&.~\|......{..Ep.>x..._....}p..=.}...v...7?}...g..1&.......}...^...o.x.>x...../.^....._.........w.v./.........BA...{J..w..$?.}w....?zO.r..5...7.gl..z...g.?.{....R.......yGj

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113657
Category:	downloaded
Size (bytes):	35813
Entropy (8bit):	7.9933603091137355
Encrypted:	true
SSDEEP:	768:GuwXn8kBZAqgpsnCq63v9K6eodOamRz3YkdBSqwSsg84Yk5RFB6:Jc8kBBnChQodOamRz3YQFSLk3q
MD5:	57911010756C90D58754C91EF1EE2765
SHA1:	BAA48FEF4866D7DAFD9F59417745EE838F0E63CA
SHA-256:	87C5385BA17F84CC25FB7BBE1EDB4169BC702842BD74B758ACDC130986D55BC2
SHA-512:	FF5A7B638CD9117C89C277F6846506D41768D3A30F81B63768379294160AEE89F0D60E853F938D28A654226E18FE3389808ECCDA7D106F76EBE95A53A00DD560
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57.js
Preview:	...........{..8.(.........,.-.......gglu.. .m..I....~..oRv......i.(....P(......k............o.6>.\|..d..........O...V..}.G..4......9.l..F.mDI.f.4...o,..EA.1...F1g..,...E..Gy...,No6.@..l....n..;....P.fQ...ty...b#I.(d.A2!j1$..m....6n.Q8.x..Y...b#c!....\|.p..w#..F..i..s.Gc..b..9U.k......&@pJ..'40J......e.$.k.L(b...F.n.+..nO..6@n...A.&.,LVa......Y......V..o..% ....,......:..e.-XR. <FE.w..b..P......r.b.["~..!.....y.......V...4.;M..Y.X.{.......0].N..,.r`=...Mv....;...k....w.1p.q...(.u.3....;).. }...s....'....c...o.d....Ax.W..._...?.9...........3..MWI..3.p3..u.m$~Vo:n.'.8..!5h....y...6=7...hz.......f.-.).......Nc..:...g...~.8..4.....0P......$.=.a....#._..3.t..7Q...-....6..j.\|....5-...B...}.VQ.&/...e.XeI.C../.y...{...1...Y..g..`'..F..h.o.]SHW...,..Ac_%y...M..u.O..U..`.&...Y.}....Tu..z..iv.....5..M.q.. .Bz.,..oSS.%..y.....gS1s.(.........%,fE.m.@~.4.........7.x.$0mQ..o....J.J^....~......u!.~Z.iw.b...Q~).=..Tq.:.7HH.E.&6.D`.(..Cxmf.(o...^y_.v.{..K<Y.5.

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2345), with CRLF line terminators
Category:	downloaded
Size (bytes):	2347
Entropy (8bit):	5.290031538794594
Encrypted:	false
SSDEEP:	48:gCgF0+kNL5iQ6+GhB+SYWzGuesAFcsGJOzgO6FIEv+sj+M++sx+suse+swsosmC0:gC3Na5+GX+Ti2XsYE2sqAsosushswsoB
MD5:	E86EF8B6111E5FB1D1665BCDC90888C9
SHA1:	994BF7651CB967CD9053056AF2D69ACB74DB7F29
SHA-256:	3410242720DE50B090D07A23AEE2DAD879B31D36F2615732962EC4CFA8A9D458
SHA-512:	2486B491681EE91A9CD1ECC9AA011A3FB34B48358C5D7A4D503A5357BC5CE4CA22999F918D40AC60A3063940D5F326FC7E4E5713D89D5C102DE68824E371B3AB
Malicious:	false
Reputation:	low
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(n,t){for(var e in t)n[e]=t[e]}(this,function(n){function t(i){if(e[i])return e[i].exports;var s=e[i]={exports:{},id:i,loaded:!1};return n[i].call(s.exports,s,s.exports,t),s.loaded=!0,s.exports}var e={};return t.m=n,t.c=e,t.p="",t(0)}([function(n,t){function e(n){for(var t=g[c],e=0,i=t.length;e<i;++e)if(t[e]===n)return!0;return!1}function i(n){if(!n)return null;for(var t=n+"=",e=document.cookie.split(";"),i=0,s=e.length;i<s;i++){var o=e[i].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===o.indexOf(t))return o.substring(t.length)}return null}function s(n,t,e){if(n)for(var i=n.split(":"),s=null,o=0,a=i.length;o<a;++o){var l=null,c=i[o].split("$");if(0===o&&(s=parseInt(c.shift()),!s))return;var p=c.length;if(p>=1){var f=r(s,c[0]);if(!f\|\|e[f])continue;l={signInName:f,idp:"msa",isSignedIn:!0}}if(p>=3&&(l.firstName=r(s,c[1]),l.lastName=r(s,c[2])),p>=4){var g=c[3],m=g.split("\|");l.otherHashedAliases=m}if(p>=5){var h=parseInt(c[4],16);h&&(l.

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 379
Category:	dropped
Size (bytes):	254
Entropy (8bit):	7.066074991728423
Encrypted:	false
SSDEEP:	6:XtS8G99k8e6my4IIFqXUJ59lDFCnhUGlZX8My/dOtrE:XAH99kRX1YQBDFCnDXdWYtrE
MD5:	847A4212B99B9076EE39328B24CD30AF
SHA1:	73F15078CF1D396485F644A79B6E25EF0637685D
SHA-256:	29DC0C26C372805325EB7EB926769E832A60B47BEF96A66436EC3EC05CD6128E
SHA-512:	9AF77E9ED8BD9A39A47F36AAC2D01B5AF5D56C04CD933427DF95CC80904D7EE7AC3F7F9443D8AEF236CC84FB4DC4CC335AF0BF8F9BC0C13D720187096D149220
Malicious:	false
Reputation:	low
Preview:	..........mP.n. ...D.xY0.\..{. 7...y.F!.....T..Y.Y..n...q^.[O}..w.SJ.j..3.....%)....x.f.K}..}\.=E.D....!.n.......Ma..G.=+.%.w..WX...9.A...........X...V...bOB&2.H....15{.fT...V-.#..m..f...V2<...~....l%4.....Ie.TL69.....vW.....v.3.v.O..}..{...

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	660449
Entropy (8bit):	5.4121922690110535
Encrypted:	false
SSDEEP:	12288:3PUKyvwjOOvwZ1ARuxntuicBh8hS11dsUA:yvjZ+/pIUA
MD5:	D9E3D2CE0228D2A5079478AAE5759698
SHA1:	412F45951C6AEDA5F3DF2C52533171FC7BDD5961
SHA-256:	7041D585609800051E4F451792AEC2B8BD06A4F2D29ED6F5AD8841AAE5107502
SHA-512:	06700C65BEF4002EBFBFF9D856C12E8D71F408BACA2D2103DDE1C28319B6BD3859FA9D289D8AEB6DD484E802040F6EE537F31F97B4B60A6B120A6882C992207A
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.43/scripts/boot.worldwide.3.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.3.mouse.js'] = (new Date()).getTime();..;_n.a.jR=function(n){return n.dS()};_n.a.jZ=function(n){return n.eh()};_n.a.jP=function(n){return n.cC()};_n.a.jQ=function(n){return n.ca()};_n.a.hZ=function(n){return n.dO};_n.a.jU=function(n){return n.ed()};_n.a.jT=function(n){return n.ea()};_n.a.kb=function(n){return n.ej()};_n.a.hM=function(n){return 300};_n.a.fh=function(n){return n.V};_n.a.jV=function(n){return n.bI()};_n.a.ie=function(n){return n.mh()};_n.a.km=function(n){return n.bl()};_n.a.ka=function(n){return n.ei()};_n.a.ko=function(n){return n.cV()};_n.a.eX=function(n){return _y.E.isInstanceOfType(n)?n.y:null};_n.a.jN=function(n){return n.c()};_n.a.gm=function(n){return n.b()};_n.a.jM=function(n){return n.b()};_n.a.ib=function(n){return n.jM()};_n.a.iq=function(n){return n.bG};_n.a.iX=function(n){return _n.V.isInstanceOfType(n)?n

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	17453
Entropy (8bit):	3.890509953257612
Encrypted:	false
SSDEEP:	192:P7FRTHQpmA3ZkXOL25cYty7l6UWUjMJBSab/vR+yzP:P/cpmgkF5+JWUjMp40P
MD5:	7916A894EBDE7D29C2CC29B267F1299F
SHA1:	78345CA08F9E2C3C2CC9B318950791B349211296
SHA-256:	D8F5AB3E00202FD3B45BE1ACD95D677B137064001E171BC79B06826D98F1E1D3
SHA-512:	2180ABE47FBF76E2E0608AB3A4659C1B7AB027004298D81960DC575CC2E912ECCA8C131C6413EBBF46D2AAA90E392EB00E37AED7A79CDC0AC71BA78D828A84C7
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc2e13.jpg
Preview:	.....Phttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta>

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	659798
Entropy (8bit):	5.352921769071548
Encrypted:	false
SSDEEP:	12288:nEMsQrWEWbnByixmwgXZewhYcFiG4DUIxo:nEMsJpBJgHKcFQNo
MD5:	9786D38346567E5E93C7D03B06E3EA2D
SHA1:	23EF8C59C5C9AA5290865933B29C9C56AB62E3B0
SHA-256:	263307E3FE285C85CB77CF5BA69092531CE07B7641BF316EF496DCB5733AF76C
SHA-512:	4962CDF483281AB39D339A7DA105A88ADDB9C210C9E36EA5E36611D7135D19FEC8B3C9DBA3E97ABB36D580F194F1860813071FD6CBEDE85D3E88952D099D6805
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/scripts/boot.worldwide.1.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.1.mouse.js'] = (new Date()).getTime();..;_a.d.G=function(n,t){this.b=n;this.a=t};_a.d.G.prototype={b:0,a:0};_a.fo=function(n){this.s=n};_a.fo.prototype={s:null,t:null,i:function(){return this.s.currentTarget},e:function(){return this.t?this.t.x:this.s.pageX},f:function(){return this.t?this.t.y:this.s.pageY},o:function(){return this.s.relatedTarget},b:function(){return this.s.target},n:function(){return this.s.timeStamp\|\|+new Date},a:function(){var n=this.s.which;!n&&_a.o.a().K&&this.s.type==="keypress"&&(n=this.u());return n},u:function(){return this.s.keyCode},m:function(){return this.s.originalEvent},j:function(){return this.s.type},k:function(){return this.s.originalEvent.touches},q:function(){return this.s.isDefaultPrevented()},g:function(){return this.s.shiftKey},h:function(){return _j.G.a().P?this.s.metaKey:this.s.ctrlKey},l:

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (45563)
Category:	downloaded
Size (bytes):	141339
Entropy (8bit):	5.431048966728945
Encrypted:	false
SSDEEP:	1536:5FZ5ELQbTPRUbx3jog/MhTJvRkmYWp0BSYmvIxdL/Bpns0Vgt2CTJm0wTxFojd9q:jEArg/M1Nn3vIPzDk80ZjT0qcePg3
MD5:	0A1A5BA009FB1F25E3F3D036D8CF26CE
SHA1:	8E9E6A11CED0807252C34DCA1D8C7C2390D1A5CA
SHA-256:	94153F2A6DAAE35DFCB61DC987E2D4310B7CA021E36375E87D8B8C641C0C6121
SHA-512:	018FA3AD6DCC5DD17258334C2AD5BD0CE4E6AC278A340EE9F0147EC3084B56D0BC5F7224DAF950E89B53828FF57737E1DB1539DCE2B3E7967FE40971677CDFB4
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */!function(e){function n(n){for(var t,r,i=n[0],a=n[1],s=0,u=[];s<i.length;s++)

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	232394
Entropy (8bit):	5.54543362321178
Encrypted:	false
SSDEEP:	1536:yldzLx/ivZfjbOv/LBbLeXeKEXK81KKVKKdKbSK0cKcyKf75DMkvqBCWcDAPf4bT:Ux/ivZfjbOv/LBbLMTq9cDw4bLl1We/
MD5:	AF8D946B64D139A380CF3A1C27BDBEB0
SHA1:	C76845B6FFEAF14450795C550260EB618ABD60AB
SHA-256:	37619B16288166CC76403F0B7DF6586349B2D5628DE00D5850C815D019B17904
SHA-512:	C5CFB514F993310676E834C8A5477576BD57C82A8665387F9909BA0D4C3C2DE693E738ACAA74E7B4CA20894EA2FEEA5CF9A2428767D03FE1DE9C84538FDC3EE9
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.43/resources/styles/0/boot.worldwide.mouse.css
Preview:	.feedbackList{-webkit-animation-duration:.17s;-moz-animation-duration:.17s;animation-duration:.17s;-webkit-animation-name:feedbackListFrames;-moz-animation-name:feedbackListFrames;animation-name:feedbackListFrames;-webkit-animation-fill-mode:both;-moz-animation-fill-mode:both;animation-fill-mode:both}@-webkit-keyframes feedbackListFrames{from{-webkit-transform:scale(1,1);transform:scale(1,1);-webkit-animation-timing-function:cubic-bezier(.33,0,.67,1);animation-timing-function:cubic-bezier(.33,0,.67,1)}to{-webkit-transform:scale(1.03,1.03);transform:scale(1.03,1.03)}}@-moz-keyframes feedbackListFrames{from{-moz-transform:scale(1,1);transform:scale(1,1);-moz-animation-timing-function:cubic-bezier(.33,0,.67,1);animation-timing-function:cubic-bezier(.33,0,.67,1)}to{-moz-transform:scale(1.03,1.03);transform:scale(1.03,1.03)}}@keyframes feedbackListFrames{from{-webkit-transform:scale(1,1);-moz-transform:scale(1,1);transform:scale(1,1);-webkit-animation-timing-function:cubic-bezier(.33,0,.67,

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5139
Entropy (8bit):	7.865234009830226
Encrypted:	false
SSDEEP:	96:oX2DsRVNYc82nTGTirCPqKO1gDPFjDiwK3aM5yO/bUlVV6JKo5N9jIMw7RLW1ZHb:ofRgc82nTprQsgDNDP7QgVVoH9+kMK9
MD5:	8B36337037CFF88C3DF203BB73D58E41
SHA1:	1ADA36FA207B8B96B2A5F55078BFE2A97ACEAD0E
SHA-256:	E4E1E65871749D18AEA150643C07E0AAB2057DA057C6C57EC1C3C43580E1C898
SHA-512:	97D8CC97C4577631D8D58C0D9276EE55E4B80128080220F77E01E45385C20FE55D208122A8DFA5DADCB87543B1BC291B98DBBA44E8A2BA90D17C638C15D48793
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...V...H.............tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:DB120779422011EA9888910153D3A5E6" xmpMM:DocumentID="xmp.did:DB12077A422011EA9888910153D3A5E6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DB120777422011EA9888910153D3A5E6" stRef:documentID="xmp.did:DB120778422011EA9888910153D3A5E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>P.WI....IDATx..]]l.......(.5.K0P..0...E.qT..J X)F.(5X....J.}(m.R5.Q...RUEUPU~.....qp@.b......L...k.m"0......"c.3

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	downloaded
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	659798
Entropy (8bit):	5.352921769071548
Encrypted:	false
SSDEEP:	12288:nEMsQrWEWbnByixmwgXZewhYcFiG4DUIxo:nEMsJpBJgHKcFQNo
MD5:	9786D38346567E5E93C7D03B06E3EA2D
SHA1:	23EF8C59C5C9AA5290865933B29C9C56AB62E3B0
SHA-256:	263307E3FE285C85CB77CF5BA69092531CE07B7641BF316EF496DCB5733AF76C
SHA-512:	4962CDF483281AB39D339A7DA105A88ADDB9C210C9E36EA5E36611D7135D19FEC8B3C9DBA3E97ABB36D580F194F1860813071FD6CBEDE85D3E88952D099D6805
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.43/scripts/boot.worldwide.1.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.1.mouse.js'] = (new Date()).getTime();..;_a.d.G=function(n,t){this.b=n;this.a=t};_a.d.G.prototype={b:0,a:0};_a.fo=function(n){this.s=n};_a.fo.prototype={s:null,t:null,i:function(){return this.s.currentTarget},e:function(){return this.t?this.t.x:this.s.pageX},f:function(){return this.t?this.t.y:this.s.pageY},o:function(){return this.s.relatedTarget},b:function(){return this.s.target},n:function(){return this.s.timeStamp\|\|+new Date},a:function(){var n=this.s.which;!n&&_a.o.a().K&&this.s.type==="keypress"&&(n=this.u());return n},u:function(){return this.s.keyCode},m:function(){return this.s.originalEvent},j:function(){return this.s.type},k:function(){return this.s.originalEvent.touches},q:function(){return this.s.isDefaultPrevented()},g:function(){return this.s.shiftKey},h:function(){return _j.G.a().P?this.s.metaKey:this.s.ctrlKey},l:

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1378
Category:	downloaded
Size (bytes):	628
Entropy (8bit):	7.6610853322771
Encrypted:	false
SSDEEP:	12:X6/EjXb5e1vpPDySPLiDB/3YLZzrlDuLRndk6l3WZi1epo7IyhadSH8Ib1yfuI:X6cP5e3dgYLMk69Ii1epryt/Md
MD5:	6F68E9881DF18F8E251AB57D5786239B
SHA1:	C0F7A01A288752833390FC330995F25488BCE8EC
SHA-256:	B33E30351B2F4EF67D53D2C6DBE189A4D572425037E4F1264A0190DC4A820845
SHA-512:	B33DFF67480DF940FA0565B231E02F26840DCB5135A4A2FF3C310AA062D3D4B456FA9C8C6E2BC59EC76B515EA1B36D574A5701771BCEE7CEE97B99EF60A803C6
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_account_aad_a8332c62695d74843a11daf39a74e552.svg
Preview:	..........m.Mo.0.....]%F..6...rX.;..&i..].&HZ...#%...B..4.W$.....>....v8...f....g.O/.3k....ms.o....m...a8.......u..4>.]....r~8...%.....x.m.y].....u.>..7....l.]....i..fC.[O..z.)..r..........g!(.+....4.P9.0@.......R.......^q.I[..7.....Q;...6.N....a.d.%....:...6FE.}.......}s.`LV..Q.U. 8..}..y.&..I..a.\.8%..kgoo.Q6...>.5.8..!.....".t9].v.B) `.G6.V.E\..AJQU.7...J.oS..........@......l.....{.r..KP@......9YD..U......&..:..d......+/...(..:.S_...S......n..z.a...,.,&VB......eJR)...R.H3])>....9O.........KDi.O..#...-?D.1..N.p....h.#.Z.[/..!.h..$..S..Phdqd....}.....E>g..q5..J.T......u.....i.b...

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	662286
Entropy (8bit):	5.315860951951661
Encrypted:	false
SSDEEP:	12288:YfmmzLJTD/JilMGk4hBR310FaHHxpJy7qVfb4cSPo:Yfm+T7US7SR310FaHHTJy7qJ4rPo
MD5:	12204899D75FC019689A92ED57559B94
SHA1:	CCF6271C6565495B18C1CED2F7273D5875DBFB1F
SHA-256:	39DAFD5ACA286717D9515F24CF9BE0C594DFD1DDF746E6973B1CE5DE8B2DD21B
SHA-512:	AA397E6ABD4C54538E42CCEDA8E3AA64ACE76E50B231499C20E88CF09270AECD704565BC9BD3B27D90429965A0233F99F27697F66829734FF02511BD096CF030
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/scripts/boot.worldwide.2.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.2.mouse.js'] = (new Date()).getTime();.._y.lC=function(){};_y.lC.registerInterface("_y.lC");_y.jw=function(){};_y.jw.registerInterface("_y.jw");_y.lA=function(){};_y.lA.registerInterface("_y.lA");var IDelayedSendEvent=function(){};IDelayedSendEvent.registerInterface("IDelayedSendEvent");var IIsShowingComposeInReadingPaneEvent=function(){};IIsShowingComposeInReadingPaneEvent.registerInterface("IIsShowingComposeInReadingPaneEvent");var ISendFailedO365Event=function(){};ISendFailedO365Event.registerInterface("ISendFailedO365Event");var ISendFailureRemoveO365Event=function(){};ISendFailureRemoveO365Event.registerInterface("ISendFailureRemoveO365Event");_y.gw=function(){};_y.gw.registerInterface("_y.gw");_y.iB=function(){};_y.iB.registerInterface("_y.iB");_y.ih=function(){};_y.ih.registerInterface("_y.ih");_y.jy=function(){};_y.jy.regis

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (994), with no line terminators
Category:	downloaded
Size (bytes):	994
Entropy (8bit):	4.934955158256183
Encrypted:	false
SSDEEP:	12:U8Chx3fpler8DDMv1+I+zpcuVkicq32EXgBA5e2KMLT:JC3G0z1Ddf2NGe2KG
MD5:	E2110B813F02736A4726197271108119
SHA1:	D7AC10CC425A7B67BF16DDA0AAEF1FEB00A79857
SHA-256:	6D1BE7ED96DD494447F348986317FAF64728CCF788BE551F2A621B31DDC929AC
SHA-512:	E79CF6DB777D62690DB9C975B5494085C82E771936DB614AF9C75DB7CE4B6CA0A224B7DFB858437EF1E33C6026D772BE9DBBB064828DB382A4703CB34ECEF1CF
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.43/resources/images/0/sprite1.mouse.css
Preview:	.image-loading_blackbg-gif{background:url('loading_blackbg.gif');width:16px;height:16px}.image-loading_whitebg-gif{background:url('loading_whitebg.gif');width:16px;height:16px}.image-thinking16_blue-gif{background:url('thinking16_blue.gif');width:16px;height:16px}.image-thinking16_grey-gif{background:url('thinking16_grey.gif');width:16px;height:16px}.image-thinking16_white-gif{background:url('thinking16_white.gif');width:16px;height:16px}.image-thinking24-gif{background:url('thinking24.gif');width:24px;height:24px}.image-thinking32_blue-gif{background:url('thinking32_blue.gif');width:32px;height:32px}.image-thinking32_grey-gif{background:url('thinking32_grey.gif');width:32px;height:32px}.image-thinking32_white-gif{background:url('thinking32_white.gif');width:32px;height:32px}.image-clear1x1-gif{width:1px;height:1px;background:url('sprite1.mouse.png') -0 -0}.csimg{padding:0;border:none;background-repeat:no-repeat;-webkit-touch-callout:none}span.csimg{-ms-high-contrast-adjust:none}

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	232394
Entropy (8bit):	5.54543362321178
Encrypted:	false
SSDEEP:	1536:yldzLx/ivZfjbOv/LBbLeXeKEXK81KKVKKdKbSK0cKcyKf75DMkvqBCWcDAPf4bT:Ux/ivZfjbOv/LBbLMTq9cDw4bLl1We/
MD5:	AF8D946B64D139A380CF3A1C27BDBEB0
SHA1:	C76845B6FFEAF14450795C550260EB618ABD60AB
SHA-256:	37619B16288166CC76403F0B7DF6586349B2D5628DE00D5850C815D019B17904
SHA-512:	C5CFB514F993310676E834C8A5477576BD57C82A8665387F9909BA0D4C3C2DE693E738ACAA74E7B4CA20894EA2FEEA5CF9A2428767D03FE1DE9C84538FDC3EE9
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/resources/styles/0/boot.worldwide.mouse.css
Preview:	.feedbackList{-webkit-animation-duration:.17s;-moz-animation-duration:.17s;animation-duration:.17s;-webkit-animation-name:feedbackListFrames;-moz-animation-name:feedbackListFrames;animation-name:feedbackListFrames;-webkit-animation-fill-mode:both;-moz-animation-fill-mode:both;animation-fill-mode:both}@-webkit-keyframes feedbackListFrames{from{-webkit-transform:scale(1,1);transform:scale(1,1);-webkit-animation-timing-function:cubic-bezier(.33,0,.67,1);animation-timing-function:cubic-bezier(.33,0,.67,1)}to{-webkit-transform:scale(1.03,1.03);transform:scale(1.03,1.03)}}@-moz-keyframes feedbackListFrames{from{-moz-transform:scale(1,1);transform:scale(1,1);-moz-animation-timing-function:cubic-bezier(.33,0,.67,1);animation-timing-function:cubic-bezier(.33,0,.67,1)}to{-moz-transform:scale(1.03,1.03);transform:scale(1.03,1.03)}}@keyframes feedbackListFrames{from{-webkit-transform:scale(1,1);-moz-transform:scale(1,1);transform:scale(1,1);-webkit-animation-timing-function:cubic-bezier(.33,0,.67,

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (59783), with CRLF line terminators
Category:	downloaded
Size (bytes):	663451
Entropy (8bit):	5.3635307555313165
Encrypted:	false
SSDEEP:	12288:YhqblwQ9eTw/suNyIzaJS/pWYawUWufSxwDr2o/5YP1B:Yhqblt9e8/sMzaJS/pWYawUWufSxwDrW
MD5:	761CE9E68C8D14F49B8BF1A0257B69D6
SHA1:	8CF5D714D35EFFA54F3686065CB62CCE028E2C77
SHA-256:	BEAA65AD34340E61E9E701458E2CCFF8F9073FDEBBC3593A2C7EC8AFEACB69C1
SHA-512:	CEC948666FBA0F56D3DA27A931033C3A581C9C00FEC4D3DDCF41324525B5B5321AE3AB89581ECC7F497DE85EF684AB277C8A2DB393D526416CEB76C91A1B9263
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.43/scripts/boot.worldwide.0.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.0.mouse.js'] = (new Date()).getTime();../* Empty file */;Function.__typeName="Function";Function.__class=!0;Function.createCallback=function(n,t){return function(){var r=arguments.length;if(r>0){for(var u=[],i=0;i<r;i++)u[i]=arguments[i];u[r]=t;return n.apply(this,u)}return n.call(this,t)}};Function.prototype.bind=Function.prototype.bind\|\|function(n){if(typeof this!="function")throw new TypeError("bind(): we can only bind to functions");var u=Array.prototype.slice.call(arguments,1),r=this,t=function(){},i=function(){return r.apply(this instanceof t?this:n,u.concat(Array.prototype.slice.call(arguments)))};this.prototype&&(t.prototype=this.prototype);i.prototype=new t;return i};Function.createDelegate=function(n,t){return function(){return t.apply(n,arguments)}};Function.emptyFunction=Function.emptyMethod=function(){};Error.__typeNam

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 444227
Category:	downloaded
Size (bytes):	121212
Entropy (8bit):	7.9972852524966695
Encrypted:	true
SSDEEP:	1536:iD6XUiMe8qYwKDImT4zkhRc8JbmxMwGysvrO/Q0wjsFUUXbBHfy18nZIH9JxhmTK:wHHDZT33eAvrn0wjsm8Z0otE
MD5:	0868DA2DD5EFFED92904047439E49D48
SHA1:	D760173E5E6B25461B0D2A0B32D384FE659B2338
SHA-256:	8C41E973CB5EE0194EBF3BAA0716EEEB57EED53552F042E200190E3C37F08CFD
SHA-512:	9F430A42D5380D12C553255A324E347A37337E659D623F50314CF47FE52889FD4120F8DD2895DE3327ED97B65DE4E78C982DA966A3F5253286AB0DE0260817CB
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js
Preview:	...........m{.8....~.......%..J....Te;.3q..wS.<.D;..W..2.......e......X$H. .. .~.i....T........MexZ..\|v}\.....\.o.N...l.....O.?`..;v..U.....?t.x..N.....}'.L.hVI.Xe.G.27M...Ph..R..b.r...k..V.....O..J....~?..0J}.U.......VY...+....P...8J.IZ....'h$Y@z........2....Q...R.P3.....'..'.Q..:.G..\|...2Q....$...."..4..F..}..?.V.n......:@.[.i....O.b.T"..+D..q...9.$.ke.;!.\6...Lc.f,Lu .....?..".3..4..Y.cK.?...K6.T.L..Q.3.T....7...Y.Y.i:O....~.....h......I.u..:.}....r...8.W.1`P9.f....T....%.?..K....4?N.........."t...-..JX..+..O.._....o.;=.?....w...Q=`.4}8H..j...&w.p......F.....d...I.......W....:....[./..~@+5....."...V..wU..)TYe....?5......;........Vk..Jt.^.t.^6Z..:...!..I...j1K.qX..u.S......1.^.V.....Lk.Z..B.....,..z.;..G`..y..T`.tz...[5..q.*...E}K.[.b.&........Z...t..s..RO....m....s.IQ...+...Re....T...ag.0.F...T.}<].<Nt........ ..k..5..X....El_..w..\|..VC=...H$F..~r%..'U..!.k1=.e.)y!`)....Y.c%.....{.Kx.........s...dZ....^:3V..H..\|Sz.1%C..G..a2:v

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1378
Category:	dropped
Size (bytes):	628
Entropy (8bit):	7.6610853322771
Encrypted:	false
SSDEEP:	12:X6/EjXb5e1vpPDySPLiDB/3YLZzrlDuLRndk6l3WZi1epo7IyhadSH8Ib1yfuI:X6cP5e3dgYLMk69Ii1epryt/Md
MD5:	6F68E9881DF18F8E251AB57D5786239B
SHA1:	C0F7A01A288752833390FC330995F25488BCE8EC
SHA-256:	B33E30351B2F4EF67D53D2C6DBE189A4D572425037E4F1264A0190DC4A820845
SHA-512:	B33DFF67480DF940FA0565B231E02F26840DCB5135A4A2FF3C310AA062D3D4B456FA9C8C6E2BC59EC76B515EA1B36D574A5701771BCEE7CEE97B99EF60A803C6
Malicious:	false
Reputation:	low
Preview:	..........m.Mo.0.....]%F..6...rX.;..&i..].&HZ...#%...B..4.W$.....>....v8...f....g.O/.3k....ms.o....m...a8.......u..4>.]....r~8...%.....x.m.y].....u.>..7....l.]....i..fC.[O..z.)..r..........g!(.+....4.P9.0@.......R.......^q.I[..7.....Q;...6.N....a.d.%....:...6FE.}.......}s.`LV..Q.U. 8..}..y.&..I..a.\.8%..kgoo.Q6...>.5.8..!.....".t9].v.B) `.G6.V.E\..AJQU.7...J.oS..........@......l.....{.r..KP@......9YD..U......&..:..d......+/...(..:.S_...S......n..z.a...,.,&VB......eJR)...R.H3])>....9O.........KDi.O..#...-?D.1..N.p....h.#.Z.[/..!.h..$..S..Phdqd....}.....E>g..q5..J.T......u.....i.b...

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 55037
Category:	downloaded
Size (bytes):	15776
Entropy (8bit):	7.985965830535592
Encrypted:	false
SSDEEP:	384:UwXl87i4naaFtPESJ2DWOq1IcQS0SL7EOONbPHG:UwXW7i4naTSOAszOGb/G
MD5:	098D00E9154C1A4848DA016205C19CE9
SHA1:	E25940FD37302594D14B1884D70F75261059F26D
SHA-256:	2BF70F1B03D3739907578441359DD07F2BE363C0AA052895C6C163D176F41393
SHA-512:	43536DD060C282950C183F582D2D734088B7D551B4B3E6BF1DE4A826D3EA442CAB271FC2041520397E01FCCC45FBDFA09259CE075AC7BFB09764823F23EB0D2A
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_0lriinjhzchre9aqecvmpg2.js
Preview:	...........}Ms#G.....uh.O=.>...4..p.O$...P.IF4.".K....1..5.......7.\|.....S6..w8?......9...B.AwUeeeeeefee..f.Oc/._..G.............{..._..%.q..q........j<.w..O.7..."pgbV.C..k.T`..X....'v....<p....I.'..k<j@Ai..NP.6<..j..N.....0.......=..ox/+...9.sB..p.q.ai...?.....qw.D.X..b..?.bOD.x.B1..X..`.N..b..E...%JWg..x8.ys..:...I.....b1...q.......[..a..7q..N........._..4....&.. ........m&6.F.\.@.e.B..`.'.....0............]/.........`..iZ6......./f8..BCz_...i....MQ>..E,/x>v......{.........._.........Z.rP+......e..R.\.Z.u..3@./.oJ7.'.......%.;.WP.9.b..z._..b....0......X...Ro^k.lI..t..K7~.ep.`.)......'."".."....../..S....M..B5nEc2..g..m..\|f.{...pbi(.0.@[_Lc.Z.....U`./!..@.....p.-..kQ@T..8...-...0.....AX.D.?...".....5.NE..\...VQa.....,......?..M.0......_<......C..fOq..bz'..z/BF.;&.K......%.....g........f!..^.:Z...g...j...7.._........S.2/.2.n.....>.<P!!.Bv..J........e!d....B.Ra$.......N........> f.C.....^.D.-.e.c+...............!....$.9x...{.....p~._.0.

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 600 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	132
Entropy (8bit):	4.945787382366693
Encrypted:	false
SSDEEP:	3:yionv//thPnFuXf8Lts7CX9/gm6Kp0syxtuIdsvFQAahUMZ/jp:6v/lhPBR/C+aNuqsvFQA0UMpp
MD5:	3EDA15637AFEAC6078F56C9DCC9BBDB8
SHA1:	97B900884183CB8CF99BA069EEDC280C599C1B74
SHA-256:	68C66D144855BA2BC8B8BEE88BB266047367708C1E281A21B9D729B1FBD23429
SHA-512:	06B21827589FCAF63B085DB2D662737B24A39A697FF9138BDF188408647C3E90784B355F2B8390160CA487992C033CE735599271EE35873E1941812AB6C34B52
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.43/resources/images/0/sprite1.mouse.png
Preview:	.PNG........IHDR...X..........x......sRGB.........gAMA......a.....pHYs..........o.d....IDATHK..1......Om.O ...j.a...\BW....IEND.B`.

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 379
Category:	downloaded
Size (bytes):	254
Entropy (8bit):	7.066074991728423
Encrypted:	false
SSDEEP:	6:XtS8G99k8e6my4IIFqXUJ59lDFCnhUGlZX8My/dOtrE:XAH99kRX1YQBDFCnDXdWYtrE
MD5:	847A4212B99B9076EE39328B24CD30AF
SHA1:	73F15078CF1D396485F644A79B6E25EF0637685D
SHA-256:	29DC0C26C372805325EB7EB926769E832A60B47BEF96A66436EC3EC05CD6128E
SHA-512:	9AF77E9ED8BD9A39A47F36AAC2D01B5AF5D56C04CD933427DF95CC80904D7EE7AC3F7F9443D8AEF236CC84FB4DC4CC335AF0BF8F9BC0C13D720187096D149220
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_account_msa_3b879963b4f70829fd7a25cbc9519792.svg
Preview:	..........mP.n. ...D.xY0.\..{. 7...y.F!.....T..Y.Y..n...q^.[O}..w.SJ.j..3.....%)....x.f.K}..}\.=E.D....!.n.......Ma..G.=+.%.w..WX...9.A...........X...V...bOB&2.H....15{.fT...V-.#..m..f...V2<...~....l%4.....Ie.TL69.....vW.....v.3.v.O..}..{...

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	low
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113657
Category:	downloaded
Size (bytes):	35807
Entropy (8bit):	7.994448207898337
Encrypted:	true
SSDEEP:	768:GeGIpaEdiOh6SlRpX1j6M+m6TRvY9YIiLcIA4WHioUx5vib:hGIp0ARDj686lg9OkHcxs
MD5:	FCF71472EFC9E614B10DFD499805F729
SHA1:	CF1FA991F9F08068F8F5F4D188D741BF5C2B7722
SHA-256:	23FF9B1A108B620EB12123003F37200042B120F3A554D3772B55F6366BDD4652
SHA-512:	B01F793C888C512F4BD1252EBA17A30C16BE3EC5E5A48BBBDD8F724EDCAEB2FD810439050A3097C27DAFDD1DE9235B39B7CF45D5341CC43A942F3F529891F379
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js
Preview:	...........{..8.(.........,.-.......gglu.. .m..I....~..oRv......i.(....P(......k............o.6>.\|..d..........O...V..}.G..4......9.l..F.mDI.f.4...o,..EA.1...F1g..,...E..Gy...,No6.@..l....n..;....P.fQ...ty...b#I.(d.A2!j1$..m....6n.Q8.x..Y...b#c!....\|.p..w#..F..i..s.Gc..b..9U.k......&@pJ..'40J......e.$.k.L(b...F.n.+..nO..6@n...A.&.,LVa......Y......V..o..% ....,......:..e.-XR. <FE.w..b..P......r.b.["~..!.....y.......V...4.;M..Y.X.{.......0].N..,.r`=...Mv....;...k....w.1p.q...(.u.3....;).. }...s....'....c...o.d....Ax.W..._...?.9...........3..MWI..3.p3..u.m$~Vo:n.'.8..!5h....y...6=7...hz.......f.-.).......Nc..:..u.g...~.8..4.....0P......$.=.a....#._..3.t..7Q...-....6..j.\|....5-...B...}.VQ.&/...e.XeI.C../.y...{...1...Y..g..`'..F..h.o.]SHW...,..Ac_%y...M..u.O..U..`.&...Y.}....Tu..z..iv.....5..M.q.. .Bz.,..oSS.%..y.....gS1s.(.........%,fE.m.@~.4.........7.x.$0mQ..o....J.J^....~......u!.~Z.iw.b...Q~).=..Tq.:.7HH.E.&6.D`.(..Cxmf.(o...^y_.v.{..K<Y.5.

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5139
Entropy (8bit):	7.865234009830226
Encrypted:	false
SSDEEP:	96:oX2DsRVNYc82nTGTirCPqKO1gDPFjDiwK3aM5yO/bUlVV6JKo5N9jIMw7RLW1ZHb:ofRgc82nTprQsgDNDP7QgVVoH9+kMK9
MD5:	8B36337037CFF88C3DF203BB73D58E41
SHA1:	1ADA36FA207B8B96B2A5F55078BFE2A97ACEAD0E
SHA-256:	E4E1E65871749D18AEA150643C07E0AAB2057DA057C6C57EC1C3C43580E1C898
SHA-512:	97D8CC97C4577631D8D58C0D9276EE55E4B80128080220F77E01E45385C20FE55D208122A8DFA5DADCB87543B1BC291B98DBBA44E8A2BA90D17C638C15D48793
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png
Preview:	.PNG........IHDR...V...H.............tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:DB120779422011EA9888910153D3A5E6" xmpMM:DocumentID="xmp.did:DB12077A422011EA9888910153D3A5E6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DB120777422011EA9888910153D3A5E6" stRef:documentID="xmp.did:DB120778422011EA9888910153D3A5E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>P.WI....IDATx..]]l.......(.5.K0P..0...E.qT..J X)F.(5X....J.}(m.R5.Q...RUEUPU~.....qp@.b......L...k.m"0......"c.3

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 23:07:14.681170940 CEST	49673	443	192.168.2.6	173.222.162.64
Apr 23, 2024 23:07:14.681185007 CEST	49674	443	192.168.2.6	173.222.162.64
Apr 23, 2024 23:07:14.993654966 CEST	49672	443	192.168.2.6	173.222.162.64
Apr 23, 2024 23:07:22.701267004 CEST	49716	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:22.701344967 CEST	443	49716	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:22.701431990 CEST	49716	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:22.701783895 CEST	49717	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:22.701859951 CEST	443	49717	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:22.701940060 CEST	49717	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:22.702008009 CEST	49716	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:22.702054977 CEST	443	49716	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:22.702280045 CEST	49717	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:22.702312946 CEST	443	49717	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:22.821060896 CEST	49719	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:22.821177959 CEST	443	49719	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:22.821317911 CEST	49719	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:22.822107077 CEST	49719	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:22.822140932 CEST	443	49719	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:23.089277029 CEST	443	49716	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:23.091371059 CEST	443	49717	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:23.099196911 CEST	49717	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:23.099250078 CEST	443	49717	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:23.099394083 CEST	49716	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:23.099457026 CEST	443	49716	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:23.100966930 CEST	443	49717	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:23.101052046 CEST	49717	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:23.101087093 CEST	443	49717	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:23.101140976 CEST	49717	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:23.103101969 CEST	443	49716	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:23.103192091 CEST	49716	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:23.103220940 CEST	443	49716	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:23.103269100 CEST	49716	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:23.103492975 CEST	49717	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:23.103616953 CEST	443	49717	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:23.105437994 CEST	49716	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:23.105643034 CEST	443	49716	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:23.105792999 CEST	49717	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:23.105817080 CEST	443	49717	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:23.148386002 CEST	49717	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:23.148396969 CEST	49716	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:23.148452044 CEST	443	49716	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:23.197855949 CEST	49716	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:23.220985889 CEST	443	49719	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:23.221065998 CEST	49719	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:23.228466988 CEST	49719	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:23.228483915 CEST	443	49719	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:23.228894949 CEST	443	49719	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:23.233319998 CEST	49719	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:23.233392000 CEST	49719	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:23.233397007 CEST	443	49719	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:23.233810902 CEST	49719	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:23.264384985 CEST	443	49717	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:23.264415979 CEST	443	49717	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:23.264439106 CEST	443	49717	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:23.264532089 CEST	49717	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:23.264539003 CEST	443	49717	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:23.264600039 CEST	49717	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:23.273257017 CEST	49717	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:23.273309946 CEST	443	49717	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:23.276120901 CEST	443	49719	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:23.357007027 CEST	443	49719	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:23.357141972 CEST	443	49719	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:23.357201099 CEST	49719	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:23.364558935 CEST	49719	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:23.364609957 CEST	443	49719	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:24.212938070 CEST	49721	443	192.168.2.6	64.233.185.104
Apr 23, 2024 23:07:24.213006973 CEST	443	49721	64.233.185.104	192.168.2.6
Apr 23, 2024 23:07:24.213100910 CEST	49721	443	192.168.2.6	64.233.185.104
Apr 23, 2024 23:07:24.214051962 CEST	49721	443	192.168.2.6	64.233.185.104
Apr 23, 2024 23:07:24.214087009 CEST	443	49721	64.233.185.104	192.168.2.6
Apr 23, 2024 23:07:24.291307926 CEST	49673	443	192.168.2.6	173.222.162.64
Apr 23, 2024 23:07:24.291344881 CEST	49674	443	192.168.2.6	173.222.162.64
Apr 23, 2024 23:07:24.367458105 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:24.367501020 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:24.367559910 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:24.367902040 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:24.367916107 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:24.445576906 CEST	443	49721	64.233.185.104	192.168.2.6
Apr 23, 2024 23:07:24.448156118 CEST	49721	443	192.168.2.6	64.233.185.104
Apr 23, 2024 23:07:24.448199987 CEST	443	49721	64.233.185.104	192.168.2.6
Apr 23, 2024 23:07:24.449826002 CEST	443	49721	64.233.185.104	192.168.2.6
Apr 23, 2024 23:07:24.449904919 CEST	49721	443	192.168.2.6	64.233.185.104
Apr 23, 2024 23:07:24.452193022 CEST	49721	443	192.168.2.6	64.233.185.104
Apr 23, 2024 23:07:24.452281952 CEST	443	49721	64.233.185.104	192.168.2.6
Apr 23, 2024 23:07:24.492957115 CEST	49721	443	192.168.2.6	64.233.185.104
Apr 23, 2024 23:07:24.492983103 CEST	443	49721	64.233.185.104	192.168.2.6
Apr 23, 2024 23:07:24.539180994 CEST	49721	443	192.168.2.6	64.233.185.104
Apr 23, 2024 23:07:24.601491928 CEST	49672	443	192.168.2.6	173.222.162.64
Apr 23, 2024 23:07:24.703546047 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:24.703810930 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:24.703823090 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:24.705677032 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:24.705748081 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.025861025 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.026175976 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.026181936 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.051752090 CEST	49723	443	192.168.2.6	184.31.62.93
Apr 23, 2024 23:07:25.051795959 CEST	443	49723	184.31.62.93	192.168.2.6
Apr 23, 2024 23:07:25.051911116 CEST	49723	443	192.168.2.6	184.31.62.93
Apr 23, 2024 23:07:25.057068110 CEST	49723	443	192.168.2.6	184.31.62.93
Apr 23, 2024 23:07:25.057085037 CEST	443	49723	184.31.62.93	192.168.2.6
Apr 23, 2024 23:07:25.068161011 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.070846081 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.070877075 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.113101959 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.134917021 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.135121107 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.135140896 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.135183096 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.135189056 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.135201931 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.135221958 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.135251999 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.135260105 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.135309935 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.135348082 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.135348082 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.135387897 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.135437012 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.135453939 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.135468960 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.135508060 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.181128025 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.241329908 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.241369963 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.241410017 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.241411924 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.241460085 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.241472960 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.241578102 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.241581917 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.241605997 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.241636992 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.241650105 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.241664886 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.241673946 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.241714954 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.241739035 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.241786003 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.241830111 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.241858006 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.241863966 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.241894007 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.241913080 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.281824112 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.281874895 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.281910896 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.281948090 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.281985998 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.282006979 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.286236048 CEST	443	49723	184.31.62.93	192.168.2.6
Apr 23, 2024 23:07:25.286336899 CEST	49723	443	192.168.2.6	184.31.62.93
Apr 23, 2024 23:07:25.293356895 CEST	49723	443	192.168.2.6	184.31.62.93
Apr 23, 2024 23:07:25.293373108 CEST	443	49723	184.31.62.93	192.168.2.6
Apr 23, 2024 23:07:25.293819904 CEST	443	49723	184.31.62.93	192.168.2.6
Apr 23, 2024 23:07:25.337055922 CEST	49723	443	192.168.2.6	184.31.62.93
Apr 23, 2024 23:07:25.347697020 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.347742081 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.347798109 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.347820044 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.347853899 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.347875118 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.347976923 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.348022938 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.348057032 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.348088980 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.348130941 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.348130941 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.348210096 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.348278046 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.348284960 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.348351955 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.348527908 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.348529100 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.348581076 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.373368025 CEST	49722	443	192.168.2.6	152.199.4.44
Apr 23, 2024 23:07:25.373409986 CEST	443	49722	152.199.4.44	192.168.2.6
Apr 23, 2024 23:07:25.473670006 CEST	49723	443	192.168.2.6	184.31.62.93
Apr 23, 2024 23:07:25.520112991 CEST	443	49723	184.31.62.93	192.168.2.6
Apr 23, 2024 23:07:25.580641985 CEST	443	49723	184.31.62.93	192.168.2.6
Apr 23, 2024 23:07:25.580799103 CEST	443	49723	184.31.62.93	192.168.2.6
Apr 23, 2024 23:07:25.580889940 CEST	49723	443	192.168.2.6	184.31.62.93
Apr 23, 2024 23:07:25.581011057 CEST	49723	443	192.168.2.6	184.31.62.93
Apr 23, 2024 23:07:25.581037998 CEST	443	49723	184.31.62.93	192.168.2.6
Apr 23, 2024 23:07:25.581049919 CEST	49723	443	192.168.2.6	184.31.62.93
Apr 23, 2024 23:07:25.581058025 CEST	443	49723	184.31.62.93	192.168.2.6
Apr 23, 2024 23:07:25.632306099 CEST	49727	443	192.168.2.6	184.31.62.93
Apr 23, 2024 23:07:25.632373095 CEST	443	49727	184.31.62.93	192.168.2.6
Apr 23, 2024 23:07:25.632467985 CEST	49727	443	192.168.2.6	184.31.62.93
Apr 23, 2024 23:07:25.638072014 CEST	49727	443	192.168.2.6	184.31.62.93
Apr 23, 2024 23:07:25.638086081 CEST	443	49727	184.31.62.93	192.168.2.6
Apr 23, 2024 23:07:25.861979008 CEST	443	49727	184.31.62.93	192.168.2.6
Apr 23, 2024 23:07:25.862070084 CEST	49727	443	192.168.2.6	184.31.62.93
Apr 23, 2024 23:07:25.864960909 CEST	49727	443	192.168.2.6	184.31.62.93
Apr 23, 2024 23:07:25.864974022 CEST	443	49727	184.31.62.93	192.168.2.6
Apr 23, 2024 23:07:25.865854979 CEST	443	49727	184.31.62.93	192.168.2.6
Apr 23, 2024 23:07:25.899044991 CEST	49727	443	192.168.2.6	184.31.62.93
Apr 23, 2024 23:07:25.940116882 CEST	443	49727	184.31.62.93	192.168.2.6
Apr 23, 2024 23:07:25.977732897 CEST	443	49706	173.222.162.64	192.168.2.6
Apr 23, 2024 23:07:25.977885008 CEST	49706	443	192.168.2.6	173.222.162.64
Apr 23, 2024 23:07:26.069947004 CEST	443	49727	184.31.62.93	192.168.2.6
Apr 23, 2024 23:07:26.070108891 CEST	443	49727	184.31.62.93	192.168.2.6
Apr 23, 2024 23:07:26.070188046 CEST	49727	443	192.168.2.6	184.31.62.93
Apr 23, 2024 23:07:26.079294920 CEST	49727	443	192.168.2.6	184.31.62.93
Apr 23, 2024 23:07:26.079317093 CEST	443	49727	184.31.62.93	192.168.2.6
Apr 23, 2024 23:07:26.362906933 CEST	49729	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:26.362936974 CEST	443	49729	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:26.363009930 CEST	49729	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:26.363157034 CEST	49730	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:26.363185883 CEST	443	49730	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:26.363246918 CEST	49730	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:26.363358974 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:26.363383055 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:26.363485098 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:26.363691092 CEST	49729	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:26.363717079 CEST	443	49729	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:26.363878965 CEST	49730	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:26.363892078 CEST	443	49730	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:26.364079952 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:26.364094973 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:26.694746971 CEST	443	49730	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:26.695055008 CEST	49730	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:26.695080042 CEST	443	49730	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:26.696146965 CEST	443	49730	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:26.696212053 CEST	49730	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:26.698441029 CEST	443	49729	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:26.698652983 CEST	49729	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:26.698688984 CEST	443	49729	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:26.700407028 CEST	443	49729	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:26.700480938 CEST	49729	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:26.703660965 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:26.703917027 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:26.703927994 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:26.705722094 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:26.705790043 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:26.787015915 CEST	49730	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:26.787161112 CEST	443	49730	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:26.787632942 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:26.787903070 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:26.788419008 CEST	49729	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:26.788693905 CEST	443	49729	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:26.789000034 CEST	49730	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:26.789011002 CEST	443	49730	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:26.789663076 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:26.789683104 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:26.789918900 CEST	49729	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:26.789937019 CEST	443	49729	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:26.839310884 CEST	49730	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:26.839323044 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:26.839334965 CEST	49729	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.009202003 CEST	443	49730	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.009227991 CEST	443	49730	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.009236097 CEST	443	49730	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.009249926 CEST	443	49730	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.009257078 CEST	443	49730	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.009264946 CEST	443	49730	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.009315968 CEST	49730	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.009336948 CEST	443	49730	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.009388924 CEST	49730	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.009390116 CEST	443	49730	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.009428978 CEST	49730	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.011459112 CEST	443	49729	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.011518955 CEST	443	49729	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.011538982 CEST	443	49729	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.011579990 CEST	443	49729	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.011585951 CEST	49729	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.011611938 CEST	443	49729	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.011631966 CEST	443	49729	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.011692047 CEST	49729	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.011692047 CEST	49729	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.011718988 CEST	443	49729	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.012072086 CEST	443	49729	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.012125969 CEST	49729	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.016554117 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.016617060 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.016639948 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.016679049 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.016683102 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.016710997 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.016714096 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.016729116 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.016735077 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.016753912 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.016797066 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.016900063 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.016943932 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.016977072 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.016987085 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.017030954 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.017030954 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.116519928 CEST	49729	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.116528988 CEST	443	49729	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.118232965 CEST	49730	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.118258953 CEST	443	49730	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.122793913 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.122864962 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.122883081 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.122896910 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.122926950 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.122947931 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.123141050 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.123183966 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.123205900 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.123214006 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.123259068 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.158742905 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.158799887 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.158827066 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.158833981 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.158888102 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.229466915 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.229520082 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.229554892 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.229571104 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.229623079 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.230040073 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.230098963 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.230108976 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.230129957 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.230143070 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.230163097 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.230180025 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.230252981 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.230310917 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.230318069 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.230416059 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.230462074 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.242746115 CEST	49731	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.242764950 CEST	443	49731	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.493912935 CEST	49734	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.493946075 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.494178057 CEST	49734	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.495764971 CEST	49734	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.495774984 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.603503942 CEST	49735	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:07:27.603538990 CEST	443	49735	52.96.69.2	192.168.2.6
Apr 23, 2024 23:07:27.603686094 CEST	49735	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:07:27.604696989 CEST	49735	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:07:27.604712963 CEST	443	49735	52.96.69.2	192.168.2.6
Apr 23, 2024 23:07:27.824410915 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.824851990 CEST	49734	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.824903011 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.828279018 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.828353882 CEST	49734	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.829231024 CEST	49734	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.829317093 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.829411030 CEST	49734	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.876130104 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.883407116 CEST	49734	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.883418083 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:27.925359011 CEST	49734	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:27.978615999 CEST	443	49735	52.96.69.2	192.168.2.6
Apr 23, 2024 23:07:27.979270935 CEST	49735	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:07:27.979285955 CEST	443	49735	52.96.69.2	192.168.2.6
Apr 23, 2024 23:07:27.980402946 CEST	443	49735	52.96.69.2	192.168.2.6
Apr 23, 2024 23:07:27.980473042 CEST	49735	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:07:27.980484962 CEST	443	49735	52.96.69.2	192.168.2.6
Apr 23, 2024 23:07:27.980547905 CEST	49735	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:07:27.981462002 CEST	49735	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:07:27.981524944 CEST	443	49735	52.96.69.2	192.168.2.6
Apr 23, 2024 23:07:27.981858969 CEST	49735	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:07:27.981869936 CEST	443	49735	52.96.69.2	192.168.2.6
Apr 23, 2024 23:07:28.024137974 CEST	49735	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:07:28.145788908 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.145859957 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.145879984 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.145900011 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.145939112 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.145958900 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.146040916 CEST	49734	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.146040916 CEST	49734	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.146042109 CEST	49734	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.146042109 CEST	49734	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.146116972 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.146152020 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.146172047 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.146202087 CEST	49734	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.146202087 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.146224976 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.146234989 CEST	49734	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.146270990 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.146337986 CEST	49734	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.146353006 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.146409035 CEST	49734	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.184829950 CEST	443	49735	52.96.69.2	192.168.2.6
Apr 23, 2024 23:07:28.184900045 CEST	443	49735	52.96.69.2	192.168.2.6
Apr 23, 2024 23:07:28.184967995 CEST	49735	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:07:28.184995890 CEST	443	49735	52.96.69.2	192.168.2.6
Apr 23, 2024 23:07:28.185270071 CEST	49735	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:07:28.185273886 CEST	443	49735	52.96.69.2	192.168.2.6
Apr 23, 2024 23:07:28.185331106 CEST	49735	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:07:28.186209917 CEST	49735	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:07:28.186230898 CEST	443	49735	52.96.69.2	192.168.2.6
Apr 23, 2024 23:07:28.251516104 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.251583099 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.251632929 CEST	49734	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.251667023 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.251703024 CEST	49734	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.251718998 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.251723051 CEST	49734	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.251750946 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.251805067 CEST	49734	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.251955032 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.252058983 CEST	49734	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.253765106 CEST	49734	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.253796101 CEST	443	49734	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.911007881 CEST	49736	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.911057949 CEST	443	49736	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.911125898 CEST	49736	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.911418915 CEST	49736	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.911437988 CEST	443	49736	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.912619114 CEST	49737	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.912656069 CEST	443	49737	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.912708998 CEST	49737	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.912913084 CEST	49737	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.912933111 CEST	443	49737	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.953069925 CEST	49738	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.953110933 CEST	443	49738	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.953174114 CEST	49738	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.965183020 CEST	49739	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.965223074 CEST	443	49739	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.965305090 CEST	49739	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.965837955 CEST	49740	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.965902090 CEST	443	49740	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.965979099 CEST	49740	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.966828108 CEST	49741	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.966919899 CEST	443	49741	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.967010021 CEST	49741	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.968463898 CEST	49741	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.968493938 CEST	443	49741	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.968782902 CEST	49740	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.968811989 CEST	443	49740	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.968990088 CEST	49739	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.969005108 CEST	443	49739	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:28.969187975 CEST	49738	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:28.969202995 CEST	443	49738	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.244419098 CEST	443	49736	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.246099949 CEST	443	49737	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.286818981 CEST	49737	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.286818027 CEST	49736	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.299906015 CEST	443	49740	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.302917957 CEST	443	49741	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.306281090 CEST	443	49738	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.306984901 CEST	443	49739	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.335685015 CEST	49739	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.335700989 CEST	443	49739	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.340022087 CEST	49738	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.340038061 CEST	443	49738	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.340050936 CEST	443	49739	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.340133905 CEST	49739	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.340655088 CEST	49741	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.340718031 CEST	443	49741	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.340745926 CEST	49740	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.340801954 CEST	443	49740	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.341039896 CEST	49737	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.341048956 CEST	443	49737	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.341166019 CEST	49736	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.341190100 CEST	443	49736	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.341569901 CEST	49739	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.341757059 CEST	443	49739	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.341758966 CEST	443	49740	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.341823101 CEST	49740	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.342293978 CEST	443	49741	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.342370987 CEST	49741	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.342547894 CEST	443	49737	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.342747927 CEST	443	49736	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.343586922 CEST	49740	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.343672037 CEST	443	49740	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.343914986 CEST	443	49738	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.343981981 CEST	49738	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.344249964 CEST	49736	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.344489098 CEST	443	49736	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.344595909 CEST	49737	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.344796896 CEST	443	49737	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.345191002 CEST	49741	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.345309019 CEST	443	49741	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.345333099 CEST	49739	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.345343113 CEST	443	49739	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.345814943 CEST	49738	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.345993996 CEST	443	49738	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.346309900 CEST	49740	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.346328020 CEST	443	49740	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.346370935 CEST	49736	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.346508980 CEST	49737	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.346573114 CEST	49741	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.346590042 CEST	443	49741	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.346723080 CEST	49738	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.346729040 CEST	443	49738	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.392134905 CEST	443	49736	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.392152071 CEST	443	49737	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.393470049 CEST	49739	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.393486977 CEST	49740	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.393995047 CEST	49741	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.394119978 CEST	49738	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.459162951 CEST	443	49737	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.459270954 CEST	443	49737	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.459400892 CEST	443	49737	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.459412098 CEST	49737	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.459497929 CEST	49737	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.462980032 CEST	49737	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.462999105 CEST	443	49737	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.463674068 CEST	49744	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.463706017 CEST	443	49744	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.463782072 CEST	49744	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.465538979 CEST	49744	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.465549946 CEST	443	49744	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.480490923 CEST	443	49736	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.480530024 CEST	443	49736	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.480621099 CEST	49736	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.480659008 CEST	443	49736	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.480684996 CEST	443	49736	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.480726957 CEST	49736	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.485028982 CEST	49736	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.485049009 CEST	443	49736	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.518430948 CEST	443	49738	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.518539906 CEST	443	49738	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.518585920 CEST	49738	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.519673109 CEST	49738	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.519695997 CEST	443	49738	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.539082050 CEST	443	49739	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.539787054 CEST	443	49739	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.539846897 CEST	49739	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.550635099 CEST	49739	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.550664902 CEST	443	49739	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.623507023 CEST	443	49741	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.623584986 CEST	443	49741	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.623608112 CEST	443	49741	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.623625040 CEST	443	49741	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.623677969 CEST	443	49741	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.623697996 CEST	443	49741	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.623766899 CEST	49741	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.623766899 CEST	49741	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.623766899 CEST	49741	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.623804092 CEST	443	49741	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.623848915 CEST	49741	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.623862028 CEST	49741	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.623898983 CEST	443	49741	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.623944044 CEST	49741	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.653692961 CEST	49745	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.653794050 CEST	443	49745	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.653877020 CEST	49745	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.654088020 CEST	49746	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.654126883 CEST	443	49746	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.654175043 CEST	49746	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.654388905 CEST	49747	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.654454947 CEST	443	49747	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.654520035 CEST	49747	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.665792942 CEST	49747	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.665828943 CEST	443	49747	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.666166067 CEST	49746	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.666193008 CEST	443	49746	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.666330099 CEST	49745	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.666371107 CEST	443	49745	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.671941996 CEST	49741	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.671960115 CEST	443	49741	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.729765892 CEST	443	49740	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.729876041 CEST	443	49740	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.729902029 CEST	443	49740	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.729933977 CEST	443	49740	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.729949951 CEST	49740	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.729953051 CEST	443	49740	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.729976892 CEST	49740	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.729979038 CEST	443	49740	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.729995966 CEST	49740	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.730009079 CEST	443	49740	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.730014086 CEST	49740	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.730031967 CEST	49740	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.730070114 CEST	49740	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.730123043 CEST	443	49740	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.730179071 CEST	49740	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.730202913 CEST	443	49740	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.730276108 CEST	443	49740	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.730330944 CEST	49740	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.749614954 CEST	49740	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.749641895 CEST	443	49740	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.798059940 CEST	443	49744	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.839879036 CEST	49744	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:29.991153955 CEST	443	49746	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.998917103 CEST	443	49747	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:29.999187946 CEST	443	49745	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.036272049 CEST	49744	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.036314964 CEST	443	49744	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.037105083 CEST	49745	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.037142038 CEST	443	49745	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.037206888 CEST	49747	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.037235022 CEST	443	49747	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.037522078 CEST	49746	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.037554026 CEST	443	49746	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.037761927 CEST	443	49744	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.039254904 CEST	443	49746	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.039316893 CEST	49746	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.041074038 CEST	443	49747	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.041160107 CEST	49747	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.041522980 CEST	49744	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.041704893 CEST	443	49744	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.041863918 CEST	443	49745	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.041960001 CEST	49745	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.042395115 CEST	49746	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.042511940 CEST	443	49746	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.043304920 CEST	49747	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.043503046 CEST	443	49747	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.044455051 CEST	49745	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.044675112 CEST	443	49745	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.044879913 CEST	49744	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.045120955 CEST	49746	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.045139074 CEST	443	49746	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.045222044 CEST	49747	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.045236111 CEST	443	49747	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.045262098 CEST	49745	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.045279026 CEST	443	49745	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.075444937 CEST	49748	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:30.075480938 CEST	443	49748	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:30.075635910 CEST	49748	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:30.076826096 CEST	49748	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:30.076836109 CEST	443	49748	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:30.085634947 CEST	49747	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.088128090 CEST	443	49744	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.088179111 CEST	49745	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.089669943 CEST	49746	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.103281975 CEST	49749	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.103380919 CEST	443	49749	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.103470087 CEST	49749	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.103898048 CEST	49749	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.103935003 CEST	443	49749	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.108599901 CEST	49750	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.108634949 CEST	443	49750	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.108692884 CEST	49750	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.108953953 CEST	49750	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.108972073 CEST	443	49750	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.111073017 CEST	49751	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.111113071 CEST	443	49751	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.111181974 CEST	49751	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.111417055 CEST	49751	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.111437082 CEST	443	49751	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.205981970 CEST	443	49746	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.206024885 CEST	443	49746	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.206070900 CEST	49746	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.206108093 CEST	443	49746	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.206129074 CEST	443	49746	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.206187963 CEST	49746	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.215596914 CEST	443	49747	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.215665102 CEST	443	49747	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.215687990 CEST	443	49747	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.215734959 CEST	49747	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.215786934 CEST	443	49747	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.215821028 CEST	49747	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.215842962 CEST	443	49747	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.215904951 CEST	49747	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.216471910 CEST	443	49745	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.216593027 CEST	443	49745	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.216659069 CEST	49745	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.264292955 CEST	443	49744	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.264355898 CEST	443	49744	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.264405012 CEST	443	49744	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.264425039 CEST	443	49744	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.264434099 CEST	49744	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.264461994 CEST	443	49744	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.264491081 CEST	49744	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.264516115 CEST	49744	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.264561892 CEST	443	49744	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.264614105 CEST	443	49744	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.264632940 CEST	49744	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.264640093 CEST	443	49744	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.264669895 CEST	49744	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.264688015 CEST	49744	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.264719009 CEST	443	49744	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.264775991 CEST	49744	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.264780998 CEST	443	49744	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.264822006 CEST	49744	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.264873981 CEST	443	49744	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.264926910 CEST	49744	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.433964014 CEST	443	49750	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.437676907 CEST	443	49749	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.443892002 CEST	443	49751	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.467123985 CEST	443	49748	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:30.467210054 CEST	49748	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:30.471118927 CEST	49748	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:30.471128941 CEST	443	49748	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:30.471935034 CEST	443	49748	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:30.474263906 CEST	49751	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.474302053 CEST	443	49751	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.474602938 CEST	49749	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.474657059 CEST	443	49749	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.474699974 CEST	49750	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.474713087 CEST	443	49750	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.475100994 CEST	443	49750	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.475986004 CEST	443	49749	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.478081942 CEST	443	49751	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.478153944 CEST	49751	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.479489088 CEST	49750	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.479558945 CEST	443	49750	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.480789900 CEST	49751	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.480969906 CEST	443	49751	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.481297970 CEST	49749	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.481482029 CEST	443	49749	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.481703043 CEST	49750	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.481831074 CEST	49751	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.481844902 CEST	443	49751	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.481991053 CEST	49749	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.488152981 CEST	49748	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:30.488219023 CEST	49748	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:30.488224030 CEST	443	49748	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:30.488548040 CEST	49748	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:30.498284101 CEST	49745	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.498375893 CEST	443	49745	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.500503063 CEST	49746	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.500538111 CEST	443	49746	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.502722025 CEST	49744	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.502734900 CEST	443	49744	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.526057959 CEST	49751	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.528136015 CEST	443	49750	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.528136015 CEST	443	49749	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.536123991 CEST	443	49748	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:30.545175076 CEST	49747	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.545233965 CEST	443	49747	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.612138033 CEST	443	49748	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:30.612515926 CEST	443	49748	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:30.612613916 CEST	49748	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:30.649252892 CEST	443	49750	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.649353981 CEST	443	49750	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.649482012 CEST	49750	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.760274887 CEST	443	49749	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.760335922 CEST	443	49749	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.760397911 CEST	443	49749	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.760426044 CEST	443	49749	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.760441065 CEST	49749	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.760488033 CEST	443	49749	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.760520935 CEST	49749	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.760524035 CEST	443	49749	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.760552883 CEST	49749	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.760569096 CEST	443	49749	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.760684967 CEST	443	49749	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.760742903 CEST	49749	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.765347004 CEST	443	49751	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.765405893 CEST	443	49751	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.765429020 CEST	443	49751	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.765461922 CEST	443	49751	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.765484095 CEST	443	49751	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.765505075 CEST	443	49751	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.765503883 CEST	49751	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.765538931 CEST	443	49751	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.765559912 CEST	49751	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.765559912 CEST	49751	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.765588045 CEST	49751	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.765609026 CEST	443	49751	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.765662909 CEST	49751	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:30.765671968 CEST	443	49751	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.765760899 CEST	443	49751	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:30.766179085 CEST	49751	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:31.216892958 CEST	49748	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:31.216938019 CEST	443	49748	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:31.266540051 CEST	49750	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:31.266568899 CEST	443	49750	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:31.267386913 CEST	49751	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:31.267421961 CEST	443	49751	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:31.267591953 CEST	49749	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:31.267632961 CEST	443	49749	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:34.433175087 CEST	443	49721	64.233.185.104	192.168.2.6
Apr 23, 2024 23:07:34.433346033 CEST	443	49721	64.233.185.104	192.168.2.6
Apr 23, 2024 23:07:34.435184002 CEST	49721	443	192.168.2.6	64.233.185.104
Apr 23, 2024 23:07:34.442476988 CEST	49721	443	192.168.2.6	64.233.185.104
Apr 23, 2024 23:07:34.442521095 CEST	443	49721	64.233.185.104	192.168.2.6
Apr 23, 2024 23:07:37.738715887 CEST	49706	443	192.168.2.6	173.222.162.64
Apr 23, 2024 23:07:37.738857985 CEST	49706	443	192.168.2.6	173.222.162.64
Apr 23, 2024 23:07:37.739445925 CEST	49766	443	192.168.2.6	173.222.162.64
Apr 23, 2024 23:07:37.739489079 CEST	443	49766	173.222.162.64	192.168.2.6
Apr 23, 2024 23:07:37.739550114 CEST	49766	443	192.168.2.6	173.222.162.64
Apr 23, 2024 23:07:37.739867926 CEST	49766	443	192.168.2.6	173.222.162.64
Apr 23, 2024 23:07:37.739886045 CEST	443	49766	173.222.162.64	192.168.2.6
Apr 23, 2024 23:07:37.891655922 CEST	443	49706	173.222.162.64	192.168.2.6
Apr 23, 2024 23:07:37.891748905 CEST	443	49706	173.222.162.64	192.168.2.6
Apr 23, 2024 23:07:38.065495014 CEST	443	49766	173.222.162.64	192.168.2.6
Apr 23, 2024 23:07:38.065597057 CEST	49766	443	192.168.2.6	173.222.162.64
Apr 23, 2024 23:07:40.793359041 CEST	49768	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:40.793395996 CEST	443	49768	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:40.793711901 CEST	49768	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:40.794091940 CEST	49769	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:40.794136047 CEST	443	49769	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:40.794203043 CEST	49769	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:40.794601917 CEST	49770	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:40.794626951 CEST	443	49770	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:40.794730902 CEST	49770	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:40.795047045 CEST	49768	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:40.795062065 CEST	443	49768	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:40.795284033 CEST	49769	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:40.795295954 CEST	443	49769	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:40.795547009 CEST	49770	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:40.795562029 CEST	443	49770	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.121011972 CEST	443	49770	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.121282101 CEST	443	49769	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.122962952 CEST	443	49768	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.123455048 CEST	49769	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.123481035 CEST	443	49769	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.123857975 CEST	49770	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.123888969 CEST	443	49770	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.123940945 CEST	443	49769	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.124043941 CEST	49768	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.124057055 CEST	443	49768	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.124516010 CEST	443	49768	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.124552011 CEST	49769	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.124663115 CEST	443	49769	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.125082970 CEST	443	49770	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.125152111 CEST	49770	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.125953913 CEST	49768	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.126022100 CEST	443	49768	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.127192974 CEST	49770	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.127249956 CEST	443	49770	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.127358913 CEST	49769	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.127480984 CEST	49768	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.127685070 CEST	49770	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.127695084 CEST	443	49770	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.168124914 CEST	443	49769	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.172116995 CEST	443	49768	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.180435896 CEST	49770	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.333362103 CEST	443	49770	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.333389044 CEST	443	49770	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.333448887 CEST	49770	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.333451033 CEST	443	49770	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.333492994 CEST	49770	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.334541082 CEST	443	49768	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.334572077 CEST	443	49768	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.334616899 CEST	49768	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.334633112 CEST	443	49768	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.334650993 CEST	443	49768	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.334693909 CEST	49768	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.335532904 CEST	49770	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.335556984 CEST	443	49770	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.339682102 CEST	49768	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.339701891 CEST	443	49768	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.345494986 CEST	49771	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.345541000 CEST	443	49771	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.345735073 CEST	49771	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.346434116 CEST	49771	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.346451044 CEST	443	49771	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.347028971 CEST	49772	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.347079039 CEST	443	49772	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.347148895 CEST	49772	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.347434998 CEST	49772	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.347449064 CEST	443	49772	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.629683971 CEST	49773	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:41.629724026 CEST	443	49773	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:41.629793882 CEST	49773	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:41.630592108 CEST	49773	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:41.630608082 CEST	443	49773	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:41.655235052 CEST	443	49769	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.655267000 CEST	443	49769	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.655330896 CEST	49769	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.655350924 CEST	443	49769	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.655373096 CEST	443	49769	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.655431032 CEST	49769	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.656419039 CEST	49769	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.656440020 CEST	443	49769	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.670691967 CEST	443	49771	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.671013117 CEST	49771	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.671044111 CEST	443	49771	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.671451092 CEST	443	49772	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.671544075 CEST	443	49771	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.671765089 CEST	49772	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.671799898 CEST	443	49772	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.672153950 CEST	443	49772	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.672177076 CEST	49771	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.672290087 CEST	443	49771	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.672616959 CEST	49772	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.672687054 CEST	443	49772	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.672791004 CEST	49771	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.672868967 CEST	49772	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.716124058 CEST	443	49772	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.720124006 CEST	443	49771	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.884047985 CEST	443	49772	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.884072065 CEST	443	49772	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.884149075 CEST	443	49771	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.884155035 CEST	49772	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.884216070 CEST	443	49772	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.884238005 CEST	443	49771	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.884306908 CEST	49771	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.884330988 CEST	443	49772	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.884341955 CEST	443	49771	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.884366989 CEST	443	49771	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.884397030 CEST	49772	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.884397984 CEST	49771	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.884449005 CEST	49771	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.888446093 CEST	49772	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.888477087 CEST	443	49772	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.889733076 CEST	49771	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.889760017 CEST	443	49771	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.933609009 CEST	49774	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.933660984 CEST	443	49774	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.933839083 CEST	49774	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.934446096 CEST	49774	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.934458017 CEST	443	49774	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.935236931 CEST	49775	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.935342073 CEST	443	49775	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:41.935426950 CEST	49775	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.935759068 CEST	49775	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:41.935794115 CEST	443	49775	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.006438971 CEST	443	49773	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:42.006561995 CEST	49773	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:42.011485100 CEST	49773	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:42.011502028 CEST	443	49773	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:42.011823893 CEST	443	49773	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:42.015950918 CEST	49773	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:42.016011953 CEST	49773	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:42.016016960 CEST	443	49773	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:42.016148090 CEST	49773	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:42.060127974 CEST	443	49773	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:42.139204025 CEST	443	49773	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:42.139302015 CEST	443	49773	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:42.139430046 CEST	49773	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:42.139723063 CEST	49773	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:42.139751911 CEST	443	49773	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:42.259900093 CEST	443	49775	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.260251999 CEST	49775	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:42.260287046 CEST	443	49775	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.260787964 CEST	443	49775	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.261214018 CEST	49775	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:42.261311054 CEST	443	49775	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.261401892 CEST	49775	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:42.264554977 CEST	443	49774	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.264878035 CEST	49774	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:42.264909983 CEST	443	49774	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.266031981 CEST	443	49774	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.266350985 CEST	49774	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:42.266472101 CEST	49774	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:42.266479969 CEST	443	49774	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.266537905 CEST	443	49774	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.304135084 CEST	443	49775	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.320236921 CEST	49774	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:42.474670887 CEST	443	49775	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.474796057 CEST	443	49775	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.474904060 CEST	49775	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:42.476963997 CEST	443	49774	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.477154016 CEST	443	49774	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.477209091 CEST	49774	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:42.478115082 CEST	49775	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:42.478161097 CEST	443	49775	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.482563019 CEST	49774	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:42.482588053 CEST	443	49774	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.487247944 CEST	49776	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:42.487303019 CEST	443	49776	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.487391949 CEST	49776	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:42.487773895 CEST	49777	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:42.487812996 CEST	443	49777	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.488018036 CEST	49777	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:42.488147020 CEST	49776	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:42.488181114 CEST	443	49776	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.488384008 CEST	49777	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:42.488404036 CEST	443	49777	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.813838005 CEST	443	49776	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.814232111 CEST	49776	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:42.814296961 CEST	443	49776	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.814881086 CEST	443	49776	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.815234900 CEST	49776	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:42.815344095 CEST	443	49776	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.815366030 CEST	49776	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:42.815546989 CEST	443	49777	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.815740108 CEST	49777	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:42.815773010 CEST	443	49777	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.816129923 CEST	443	49777	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.816406012 CEST	49777	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:42.816467047 CEST	443	49777	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.816500902 CEST	49777	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:42.860163927 CEST	443	49777	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.860192060 CEST	443	49776	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:42.866802931 CEST	49776	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:42.869158983 CEST	49777	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:43.027476072 CEST	443	49776	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:43.028402090 CEST	443	49776	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:43.028491020 CEST	49776	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:43.028561115 CEST	443	49777	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:43.028650045 CEST	443	49777	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:43.032665968 CEST	49777	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:43.038199902 CEST	49777	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:43.038230896 CEST	443	49777	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:43.042252064 CEST	49776	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:43.042303085 CEST	443	49776	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:50.742645025 CEST	49778	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:50.742691040 CEST	443	49778	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:50.742755890 CEST	49778	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:50.744268894 CEST	49778	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:50.744282961 CEST	443	49778	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:50.746917963 CEST	49716	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:50.792119980 CEST	443	49716	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:50.927546978 CEST	443	49716	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:50.927589893 CEST	443	49716	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:50.927632093 CEST	443	49716	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:50.927649021 CEST	443	49716	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:50.927665949 CEST	443	49716	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:50.927665949 CEST	49716	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:50.927701950 CEST	443	49716	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:50.927721977 CEST	49716	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:50.927746058 CEST	49716	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:50.927861929 CEST	443	49716	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:50.927953959 CEST	443	49716	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:50.927999973 CEST	49716	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:50.929044008 CEST	49716	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:50.929064989 CEST	443	49716	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:51.117959976 CEST	443	49778	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:51.118326902 CEST	49778	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:51.118365049 CEST	443	49778	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:51.118710995 CEST	443	49778	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:51.119041920 CEST	49778	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:51.119097948 CEST	443	49778	52.96.165.34	192.168.2.6
Apr 23, 2024 23:07:51.166949987 CEST	49778	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:07:51.874907017 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:51.874942064 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:51.875144958 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:51.877576113 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:51.877585888 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:51.912975073 CEST	49780	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:51.913024902 CEST	443	49780	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:51.913122892 CEST	49780	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:51.913680077 CEST	49780	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:51.913692951 CEST	443	49780	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.201438904 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.201721907 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.201744080 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.202409029 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.203320026 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.203404903 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.203501940 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.238950968 CEST	443	49780	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.244117022 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.245168924 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.249865055 CEST	49780	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.249897003 CEST	443	49780	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.250386953 CEST	443	49780	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.251240015 CEST	49780	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.251316071 CEST	443	49780	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.251424074 CEST	49780	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.296114922 CEST	443	49780	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.306123972 CEST	49780	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.521217108 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.521245003 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.521255970 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.521301031 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.521343946 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.521351099 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.521384954 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.521400928 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.521400928 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.521450996 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.521542072 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.521564007 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.521594048 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.521599054 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.521637917 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.521662951 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.560699940 CEST	443	49780	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.560728073 CEST	443	49780	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.560734987 CEST	443	49780	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.560756922 CEST	443	49780	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.560770988 CEST	443	49780	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.560777903 CEST	443	49780	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.560801029 CEST	49780	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.560872078 CEST	443	49780	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.560904026 CEST	443	49780	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.560908079 CEST	49780	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.560944080 CEST	49780	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.560944080 CEST	49780	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.565442085 CEST	49780	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.565480947 CEST	443	49780	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.627495050 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.627557039 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.627602100 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.627660036 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.627693892 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.627717018 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.627737045 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.627790928 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.627815962 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.627827883 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.627860069 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.627897024 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.627926111 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.627969027 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.628005981 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.628021955 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.628052950 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.628073931 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.734076977 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.734132051 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.734184980 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.734219074 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.734251022 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.734257936 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.734392881 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.734441042 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.734461069 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.734467983 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.734496117 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.734513044 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.734556913 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.734615088 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.734621048 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.734724045 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.734766006 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.766089916 CEST	49779	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.766119957 CEST	443	49779	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.880326986 CEST	49781	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.880387068 CEST	443	49781	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.880453110 CEST	49781	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.880697966 CEST	49781	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:52.880712986 CEST	443	49781	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:52.955950022 CEST	49782	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:07:52.956011057 CEST	443	49782	52.96.69.2	192.168.2.6
Apr 23, 2024 23:07:52.956072092 CEST	49782	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:07:52.956302881 CEST	49782	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:07:52.956315041 CEST	443	49782	52.96.69.2	192.168.2.6
Apr 23, 2024 23:07:53.210185051 CEST	443	49781	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:53.210478067 CEST	49781	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:53.210498095 CEST	443	49781	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:53.210963011 CEST	443	49781	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:53.211561918 CEST	49781	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:53.211644888 CEST	443	49781	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:53.211731911 CEST	49781	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:53.252124071 CEST	443	49781	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:53.333836079 CEST	443	49782	52.96.69.2	192.168.2.6
Apr 23, 2024 23:07:53.335767031 CEST	49782	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:07:53.335807085 CEST	443	49782	52.96.69.2	192.168.2.6
Apr 23, 2024 23:07:53.337027073 CEST	443	49782	52.96.69.2	192.168.2.6
Apr 23, 2024 23:07:53.341368914 CEST	49782	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:07:53.341634989 CEST	443	49782	52.96.69.2	192.168.2.6
Apr 23, 2024 23:07:53.341686964 CEST	49782	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:07:53.383802891 CEST	49782	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:07:53.383836031 CEST	443	49782	52.96.69.2	192.168.2.6
Apr 23, 2024 23:07:53.516505957 CEST	443	49782	52.96.69.2	192.168.2.6
Apr 23, 2024 23:07:53.516542912 CEST	443	49782	52.96.69.2	192.168.2.6
Apr 23, 2024 23:07:53.516619921 CEST	49782	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:07:53.516671896 CEST	443	49782	52.96.69.2	192.168.2.6
Apr 23, 2024 23:07:53.516731024 CEST	49782	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:07:53.516963005 CEST	443	49782	52.96.69.2	192.168.2.6
Apr 23, 2024 23:07:53.517031908 CEST	443	49782	52.96.69.2	192.168.2.6
Apr 23, 2024 23:07:53.517085075 CEST	49782	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:07:53.531603098 CEST	49782	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:07:53.531639099 CEST	443	49782	52.96.69.2	192.168.2.6
Apr 23, 2024 23:07:53.534162045 CEST	443	49781	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:53.534229040 CEST	443	49781	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:53.534281015 CEST	443	49781	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:53.534296989 CEST	49781	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:53.534326077 CEST	443	49781	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:53.534349918 CEST	49781	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:53.534365892 CEST	49781	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:53.534473896 CEST	443	49781	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:53.534521103 CEST	443	49781	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:53.534533978 CEST	49781	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:53.534552097 CEST	443	49781	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:53.534563065 CEST	49781	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:53.534579992 CEST	49781	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:53.534598112 CEST	49781	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:53.639934063 CEST	443	49781	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:53.640001059 CEST	443	49781	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:53.640039921 CEST	49781	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:53.640065908 CEST	443	49781	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:53.640094995 CEST	49781	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:53.640150070 CEST	49781	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:53.640168905 CEST	443	49781	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:53.640336037 CEST	443	49781	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:53.640368938 CEST	49781	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:53.640428066 CEST	49781	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:53.640959978 CEST	49781	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:53.640979052 CEST	443	49781	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:53.641004086 CEST	49781	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:53.641094923 CEST	49781	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:53.708265066 CEST	49784	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:53.708359957 CEST	443	49784	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:53.708761930 CEST	49784	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:53.709285021 CEST	49784	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:53.709312916 CEST	443	49784	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:54.034538984 CEST	443	49784	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:54.036653042 CEST	49784	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:54.036674976 CEST	443	49784	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:54.037081957 CEST	443	49784	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:54.037579060 CEST	49784	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:54.037579060 CEST	49784	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:54.037617922 CEST	443	49784	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:54.037673950 CEST	443	49784	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:54.077200890 CEST	49784	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:54.361536026 CEST	443	49784	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:54.361596107 CEST	443	49784	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:54.361618042 CEST	443	49784	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:54.361656904 CEST	443	49784	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:54.361701012 CEST	49784	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:54.361705065 CEST	443	49784	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:54.361737013 CEST	443	49784	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:54.361757040 CEST	49784	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:54.361767054 CEST	49784	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:54.361778975 CEST	443	49784	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:54.361804008 CEST	49784	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:54.361812115 CEST	443	49784	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:54.361836910 CEST	49784	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:54.361838102 CEST	443	49784	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:54.361876011 CEST	49784	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:54.361881971 CEST	443	49784	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:54.361906052 CEST	49784	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:54.361942053 CEST	49784	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:54.400331974 CEST	443	49784	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:54.400476933 CEST	49784	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:54.400507927 CEST	443	49784	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:54.400541067 CEST	443	49784	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:54.400621891 CEST	49784	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:54.403703928 CEST	49784	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:07:54.403734922 CEST	443	49784	13.107.246.41	192.168.2.6
Apr 23, 2024 23:07:57.215848923 CEST	443	49766	173.222.162.64	192.168.2.6
Apr 23, 2024 23:07:57.215919971 CEST	49766	443	192.168.2.6	173.222.162.64
Apr 23, 2024 23:07:57.266426086 CEST	49788	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:57.266479015 CEST	443	49788	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:57.266551971 CEST	49788	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:57.267117977 CEST	49788	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:57.267131090 CEST	443	49788	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:57.645081043 CEST	443	49788	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:57.645515919 CEST	49788	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:57.651655912 CEST	49788	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:57.651673079 CEST	443	49788	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:57.651976109 CEST	443	49788	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:57.654943943 CEST	49788	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:57.655055046 CEST	49788	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:57.655062914 CEST	443	49788	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:57.655411005 CEST	49788	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:57.696125031 CEST	443	49788	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:57.778650999 CEST	443	49788	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:57.778765917 CEST	443	49788	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:57.780178070 CEST	49788	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:57.780217886 CEST	443	49788	52.159.127.243	192.168.2.6
Apr 23, 2024 23:07:57.780240059 CEST	49788	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:57.780240059 CEST	49788	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:07:57.780250072 CEST	443	49788	52.159.127.243	192.168.2.6
Apr 23, 2024 23:08:10.712577105 CEST	49792	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:08:10.712624073 CEST	443	49792	52.96.165.34	192.168.2.6
Apr 23, 2024 23:08:10.712680101 CEST	49792	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:08:10.714791059 CEST	49792	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:08:10.714811087 CEST	443	49792	52.96.165.34	192.168.2.6
Apr 23, 2024 23:08:10.741626024 CEST	49778	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:08:10.788115025 CEST	443	49778	52.96.165.34	192.168.2.6
Apr 23, 2024 23:08:11.078412056 CEST	443	49792	52.96.165.34	192.168.2.6
Apr 23, 2024 23:08:11.078696012 CEST	49792	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:08:11.078725100 CEST	443	49792	52.96.165.34	192.168.2.6
Apr 23, 2024 23:08:11.079099894 CEST	443	49792	52.96.165.34	192.168.2.6
Apr 23, 2024 23:08:11.079478979 CEST	49792	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:08:11.079550982 CEST	443	49792	52.96.165.34	192.168.2.6
Apr 23, 2024 23:08:11.118930101 CEST	443	49778	52.96.165.34	192.168.2.6
Apr 23, 2024 23:08:11.118957996 CEST	443	49778	52.96.165.34	192.168.2.6
Apr 23, 2024 23:08:11.118973017 CEST	443	49778	52.96.165.34	192.168.2.6
Apr 23, 2024 23:08:11.118984938 CEST	443	49778	52.96.165.34	192.168.2.6
Apr 23, 2024 23:08:11.118997097 CEST	443	49778	52.96.165.34	192.168.2.6
Apr 23, 2024 23:08:11.119005919 CEST	49778	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:08:11.119029045 CEST	443	49778	52.96.165.34	192.168.2.6
Apr 23, 2024 23:08:11.119056940 CEST	49778	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:08:11.119079113 CEST	49778	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:08:11.119252920 CEST	443	49778	52.96.165.34	192.168.2.6
Apr 23, 2024 23:08:11.119314909 CEST	443	49778	52.96.165.34	192.168.2.6
Apr 23, 2024 23:08:11.119352102 CEST	49778	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:08:11.122567892 CEST	49778	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:08:11.122590065 CEST	443	49778	52.96.165.34	192.168.2.6
Apr 23, 2024 23:08:11.125274897 CEST	49792	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:08:11.810070038 CEST	49794	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:08:11.810136080 CEST	443	49794	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:11.810193062 CEST	49794	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:08:11.810576916 CEST	49794	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:08:11.810594082 CEST	443	49794	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:12.047811031 CEST	49795	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:08:12.047864914 CEST	443	49795	52.96.69.2	192.168.2.6
Apr 23, 2024 23:08:12.047924042 CEST	49795	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:08:12.048154116 CEST	49795	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:08:12.048173904 CEST	443	49795	52.96.69.2	192.168.2.6
Apr 23, 2024 23:08:12.140047073 CEST	443	49794	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:12.140676975 CEST	49794	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:08:12.140712976 CEST	443	49794	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:12.141211987 CEST	443	49794	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:12.141637087 CEST	49794	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:08:12.141746044 CEST	443	49794	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:12.181781054 CEST	49794	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:08:12.415967941 CEST	443	49795	52.96.69.2	192.168.2.6
Apr 23, 2024 23:08:12.416522980 CEST	49795	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:08:12.416543961 CEST	443	49795	52.96.69.2	192.168.2.6
Apr 23, 2024 23:08:12.417046070 CEST	443	49795	52.96.69.2	192.168.2.6
Apr 23, 2024 23:08:12.417481899 CEST	49795	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:08:12.417563915 CEST	443	49795	52.96.69.2	192.168.2.6
Apr 23, 2024 23:08:12.417805910 CEST	49795	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:08:12.464112997 CEST	443	49795	52.96.69.2	192.168.2.6
Apr 23, 2024 23:08:12.556879997 CEST	443	49795	52.96.69.2	192.168.2.6
Apr 23, 2024 23:08:12.556934118 CEST	443	49795	52.96.69.2	192.168.2.6
Apr 23, 2024 23:08:12.557013988 CEST	49795	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:08:12.557046890 CEST	443	49795	52.96.69.2	192.168.2.6
Apr 23, 2024 23:08:12.557099104 CEST	443	49795	52.96.69.2	192.168.2.6
Apr 23, 2024 23:08:12.557154894 CEST	49795	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:08:12.724075079 CEST	49795	443	192.168.2.6	52.96.69.2
Apr 23, 2024 23:08:12.724107027 CEST	443	49795	52.96.69.2	192.168.2.6
Apr 23, 2024 23:08:13.290524960 CEST	49796	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:08:13.290566921 CEST	443	49796	52.159.127.243	192.168.2.6
Apr 23, 2024 23:08:13.290647030 CEST	49796	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:08:13.291456938 CEST	49796	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:08:13.291466951 CEST	443	49796	52.159.127.243	192.168.2.6
Apr 23, 2024 23:08:13.682400942 CEST	443	49796	52.159.127.243	192.168.2.6
Apr 23, 2024 23:08:13.682506084 CEST	49796	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:08:13.693944931 CEST	49796	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:08:13.693978071 CEST	443	49796	52.159.127.243	192.168.2.6
Apr 23, 2024 23:08:13.694767952 CEST	443	49796	52.159.127.243	192.168.2.6
Apr 23, 2024 23:08:13.696736097 CEST	49796	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:08:13.696805000 CEST	49796	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:08:13.696809053 CEST	443	49796	52.159.127.243	192.168.2.6
Apr 23, 2024 23:08:13.696968079 CEST	49796	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:08:13.740134954 CEST	443	49796	52.159.127.243	192.168.2.6
Apr 23, 2024 23:08:13.820890903 CEST	443	49796	52.159.127.243	192.168.2.6
Apr 23, 2024 23:08:13.821007967 CEST	443	49796	52.159.127.243	192.168.2.6
Apr 23, 2024 23:08:13.821078062 CEST	49796	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:08:13.821224928 CEST	49796	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:08:13.821239948 CEST	443	49796	52.159.127.243	192.168.2.6
Apr 23, 2024 23:08:17.028470993 CEST	443	49794	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:17.028695107 CEST	443	49794	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:17.028747082 CEST	49794	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:08:17.188396931 CEST	49794	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:08:17.188441992 CEST	443	49794	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:24.123337984 CEST	49799	443	192.168.2.6	64.233.185.104
Apr 23, 2024 23:08:24.123394966 CEST	443	49799	64.233.185.104	192.168.2.6
Apr 23, 2024 23:08:24.123529911 CEST	49799	443	192.168.2.6	64.233.185.104
Apr 23, 2024 23:08:24.124052048 CEST	49799	443	192.168.2.6	64.233.185.104
Apr 23, 2024 23:08:24.124064922 CEST	443	49799	64.233.185.104	192.168.2.6
Apr 23, 2024 23:08:24.341422081 CEST	443	49799	64.233.185.104	192.168.2.6
Apr 23, 2024 23:08:24.345475912 CEST	49799	443	192.168.2.6	64.233.185.104
Apr 23, 2024 23:08:24.345496893 CEST	443	49799	64.233.185.104	192.168.2.6
Apr 23, 2024 23:08:24.345868111 CEST	443	49799	64.233.185.104	192.168.2.6
Apr 23, 2024 23:08:24.346373081 CEST	49799	443	192.168.2.6	64.233.185.104
Apr 23, 2024 23:08:24.346429110 CEST	443	49799	64.233.185.104	192.168.2.6
Apr 23, 2024 23:08:24.397916079 CEST	49799	443	192.168.2.6	64.233.185.104
Apr 23, 2024 23:08:28.791181087 CEST	49792	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:08:28.832169056 CEST	443	49792	52.96.165.34	192.168.2.6
Apr 23, 2024 23:08:28.889600992 CEST	49801	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:08:28.889651060 CEST	443	49801	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:28.889708996 CEST	49801	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:08:28.890587091 CEST	49801	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:08:28.890610933 CEST	443	49801	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:28.891144037 CEST	49802	443	192.168.2.6	52.96.189.2
Apr 23, 2024 23:08:28.891176939 CEST	443	49802	52.96.189.2	192.168.2.6
Apr 23, 2024 23:08:28.891230106 CEST	49802	443	192.168.2.6	52.96.189.2
Apr 23, 2024 23:08:28.891401052 CEST	49802	443	192.168.2.6	52.96.189.2
Apr 23, 2024 23:08:28.891415119 CEST	443	49802	52.96.189.2	192.168.2.6
Apr 23, 2024 23:08:28.948379993 CEST	443	49792	52.96.165.34	192.168.2.6
Apr 23, 2024 23:08:28.948442936 CEST	443	49792	52.96.165.34	192.168.2.6
Apr 23, 2024 23:08:28.948482037 CEST	443	49792	52.96.165.34	192.168.2.6
Apr 23, 2024 23:08:28.948487043 CEST	49792	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:08:28.948509932 CEST	443	49792	52.96.165.34	192.168.2.6
Apr 23, 2024 23:08:28.948546886 CEST	49792	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:08:28.948559046 CEST	443	49792	52.96.165.34	192.168.2.6
Apr 23, 2024 23:08:28.948894978 CEST	443	49792	52.96.165.34	192.168.2.6
Apr 23, 2024 23:08:28.948941946 CEST	49792	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:08:28.950496912 CEST	49792	443	192.168.2.6	52.96.165.34
Apr 23, 2024 23:08:28.950510979 CEST	443	49792	52.96.165.34	192.168.2.6
Apr 23, 2024 23:08:29.221370935 CEST	443	49801	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:29.221690893 CEST	49801	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:08:29.221718073 CEST	443	49801	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:29.222918034 CEST	443	49801	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:29.223350048 CEST	49801	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:08:29.223596096 CEST	443	49801	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:29.263525009 CEST	443	49802	52.96.189.2	192.168.2.6
Apr 23, 2024 23:08:29.263972044 CEST	49802	443	192.168.2.6	52.96.189.2
Apr 23, 2024 23:08:29.263988018 CEST	443	49802	52.96.189.2	192.168.2.6
Apr 23, 2024 23:08:29.264369965 CEST	443	49802	52.96.189.2	192.168.2.6
Apr 23, 2024 23:08:29.265054941 CEST	49802	443	192.168.2.6	52.96.189.2
Apr 23, 2024 23:08:29.265106916 CEST	443	49802	52.96.189.2	192.168.2.6
Apr 23, 2024 23:08:29.275481939 CEST	49801	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:08:29.306008101 CEST	49802	443	192.168.2.6	52.96.189.2
Apr 23, 2024 23:08:29.661290884 CEST	49803	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:08:29.661333084 CEST	443	49803	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:29.661381006 CEST	49803	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:08:29.661822081 CEST	49803	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:08:29.661837101 CEST	443	49803	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:29.944684029 CEST	49804	443	192.168.2.6	52.96.222.178
Apr 23, 2024 23:08:29.944734097 CEST	443	49804	52.96.222.178	192.168.2.6
Apr 23, 2024 23:08:29.944853067 CEST	49804	443	192.168.2.6	52.96.222.178
Apr 23, 2024 23:08:29.947845936 CEST	49804	443	192.168.2.6	52.96.222.178
Apr 23, 2024 23:08:29.947886944 CEST	443	49804	52.96.222.178	192.168.2.6
Apr 23, 2024 23:08:29.987710953 CEST	443	49803	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:29.988899946 CEST	49803	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:08:29.988934040 CEST	443	49803	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:29.989345074 CEST	443	49803	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:29.991066933 CEST	49803	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:08:29.991157055 CEST	443	49803	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:30.036587000 CEST	49803	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:08:30.315221071 CEST	443	49804	52.96.222.178	192.168.2.6
Apr 23, 2024 23:08:30.315665960 CEST	49804	443	192.168.2.6	52.96.222.178
Apr 23, 2024 23:08:30.315732956 CEST	443	49804	52.96.222.178	192.168.2.6
Apr 23, 2024 23:08:30.317054033 CEST	443	49804	52.96.222.178	192.168.2.6
Apr 23, 2024 23:08:30.320288897 CEST	49804	443	192.168.2.6	52.96.222.178
Apr 23, 2024 23:08:30.320288897 CEST	49804	443	192.168.2.6	52.96.222.178
Apr 23, 2024 23:08:30.320338964 CEST	443	49804	52.96.222.178	192.168.2.6
Apr 23, 2024 23:08:30.320493937 CEST	443	49804	52.96.222.178	192.168.2.6
Apr 23, 2024 23:08:30.371113062 CEST	49804	443	192.168.2.6	52.96.222.178
Apr 23, 2024 23:08:30.506031990 CEST	443	49804	52.96.222.178	192.168.2.6
Apr 23, 2024 23:08:30.506094933 CEST	443	49804	52.96.222.178	192.168.2.6
Apr 23, 2024 23:08:30.506207943 CEST	49804	443	192.168.2.6	52.96.222.178
Apr 23, 2024 23:08:30.506294966 CEST	443	49804	52.96.222.178	192.168.2.6
Apr 23, 2024 23:08:30.506330967 CEST	443	49804	52.96.222.178	192.168.2.6
Apr 23, 2024 23:08:30.506474972 CEST	49804	443	192.168.2.6	52.96.222.178
Apr 23, 2024 23:08:30.507788897 CEST	49804	443	192.168.2.6	52.96.222.178
Apr 23, 2024 23:08:30.507834911 CEST	443	49804	52.96.222.178	192.168.2.6
Apr 23, 2024 23:08:34.106138945 CEST	443	49801	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:34.106314898 CEST	443	49801	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:34.106381893 CEST	49801	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:08:34.344248056 CEST	443	49799	64.233.185.104	192.168.2.6
Apr 23, 2024 23:08:34.344429970 CEST	443	49799	64.233.185.104	192.168.2.6
Apr 23, 2024 23:08:34.344489098 CEST	49799	443	192.168.2.6	64.233.185.104
Apr 23, 2024 23:08:34.660969973 CEST	49801	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:08:34.661014080 CEST	443	49801	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:34.661175013 CEST	49799	443	192.168.2.6	64.233.185.104
Apr 23, 2024 23:08:34.661211014 CEST	443	49799	64.233.185.104	192.168.2.6
Apr 23, 2024 23:08:34.878082991 CEST	443	49803	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:34.878175020 CEST	443	49803	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:34.878254890 CEST	49803	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:08:35.188029051 CEST	49803	443	192.168.2.6	13.107.246.41
Apr 23, 2024 23:08:35.188122034 CEST	443	49803	13.107.246.41	192.168.2.6
Apr 23, 2024 23:08:35.770992994 CEST	49805	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:08:35.771044970 CEST	443	49805	52.159.127.243	192.168.2.6
Apr 23, 2024 23:08:35.771127939 CEST	49805	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:08:35.772131920 CEST	49805	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:08:35.772151947 CEST	443	49805	52.159.127.243	192.168.2.6
Apr 23, 2024 23:08:36.163321972 CEST	443	49805	52.159.127.243	192.168.2.6
Apr 23, 2024 23:08:36.163408995 CEST	49805	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:08:36.165791035 CEST	49805	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:08:36.165808916 CEST	443	49805	52.159.127.243	192.168.2.6
Apr 23, 2024 23:08:36.166575909 CEST	443	49805	52.159.127.243	192.168.2.6
Apr 23, 2024 23:08:36.212956905 CEST	49805	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:08:36.252266884 CEST	49805	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:08:36.252340078 CEST	49805	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:08:36.252379894 CEST	443	49805	52.159.127.243	192.168.2.6
Apr 23, 2024 23:08:36.252510071 CEST	49805	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:08:36.296178102 CEST	443	49805	52.159.127.243	192.168.2.6
Apr 23, 2024 23:08:36.377077103 CEST	443	49805	52.159.127.243	192.168.2.6
Apr 23, 2024 23:08:36.377317905 CEST	443	49805	52.159.127.243	192.168.2.6
Apr 23, 2024 23:08:36.377371073 CEST	49805	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:08:36.377523899 CEST	49805	443	192.168.2.6	52.159.127.243
Apr 23, 2024 23:08:36.377547026 CEST	443	49805	52.159.127.243	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 23:07:20.458256006 CEST	53	57656	1.1.1.1	192.168.2.6
Apr 23, 2024 23:07:20.580533981 CEST	53	51257	1.1.1.1	192.168.2.6
Apr 23, 2024 23:07:21.212289095 CEST	53	50504	1.1.1.1	192.168.2.6
Apr 23, 2024 23:07:22.592853069 CEST	63487	53	192.168.2.6	1.1.1.1
Apr 23, 2024 23:07:22.593087912 CEST	59158	53	192.168.2.6	1.1.1.1
Apr 23, 2024 23:07:22.699662924 CEST	53	63487	1.1.1.1	192.168.2.6
Apr 23, 2024 23:07:22.700587034 CEST	53	59158	1.1.1.1	192.168.2.6
Apr 23, 2024 23:07:23.288086891 CEST	55592	53	192.168.2.6	1.1.1.1
Apr 23, 2024 23:07:23.288741112 CEST	63287	53	192.168.2.6	1.1.1.1
Apr 23, 2024 23:07:24.072092056 CEST	55898	53	192.168.2.6	1.1.1.1
Apr 23, 2024 23:07:24.074248075 CEST	49645	53	192.168.2.6	1.1.1.1
Apr 23, 2024 23:07:24.178572893 CEST	53	55898	1.1.1.1	192.168.2.6
Apr 23, 2024 23:07:24.180860996 CEST	53	49645	1.1.1.1	192.168.2.6
Apr 23, 2024 23:07:24.258877039 CEST	63327	53	192.168.2.6	1.1.1.1
Apr 23, 2024 23:07:24.259449959 CEST	64629	53	192.168.2.6	1.1.1.1
Apr 23, 2024 23:07:24.365914106 CEST	53	63327	1.1.1.1	192.168.2.6
Apr 23, 2024 23:07:24.366431952 CEST	53	64629	1.1.1.1	192.168.2.6
Apr 23, 2024 23:07:26.218270063 CEST	59276	53	192.168.2.6	1.1.1.1
Apr 23, 2024 23:07:26.219012022 CEST	60870	53	192.168.2.6	1.1.1.1
Apr 23, 2024 23:07:27.494899988 CEST	59508	53	192.168.2.6	1.1.1.1
Apr 23, 2024 23:07:27.495443106 CEST	52958	53	192.168.2.6	1.1.1.1
Apr 23, 2024 23:07:27.601989985 CEST	53	59508	1.1.1.1	192.168.2.6
Apr 23, 2024 23:07:27.602395058 CEST	53	52958	1.1.1.1	192.168.2.6
Apr 23, 2024 23:07:28.910032034 CEST	61372	53	192.168.2.6	1.1.1.1
Apr 23, 2024 23:07:28.910296917 CEST	51297	53	192.168.2.6	1.1.1.1
Apr 23, 2024 23:07:29.075339079 CEST	53	51361	1.1.1.1	192.168.2.6
Apr 23, 2024 23:07:38.533405066 CEST	53	56510	1.1.1.1	192.168.2.6
Apr 23, 2024 23:07:39.419409037 CEST	55931	53	192.168.2.6	1.1.1.1
Apr 23, 2024 23:07:39.419574022 CEST	58424	53	192.168.2.6	1.1.1.1
Apr 23, 2024 23:07:39.526113987 CEST	53	55931	1.1.1.1	192.168.2.6
Apr 23, 2024 23:07:39.526374102 CEST	53	58424	1.1.1.1	192.168.2.6
Apr 23, 2024 23:07:57.644280910 CEST	53	62773	1.1.1.1	192.168.2.6
Apr 23, 2024 23:08:19.671104908 CEST	53	51061	1.1.1.1	192.168.2.6
Apr 23, 2024 23:08:20.171401978 CEST	53	58337	1.1.1.1	192.168.2.6
Apr 23, 2024 23:08:28.750260115 CEST	52692	53	192.168.2.6	1.1.1.1
Apr 23, 2024 23:08:28.750638008 CEST	57552	53	192.168.2.6	1.1.1.1
Apr 23, 2024 23:08:28.751044989 CEST	61694	53	192.168.2.6	1.1.1.1
Apr 23, 2024 23:08:28.751162052 CEST	57407	53	192.168.2.6	1.1.1.1
Apr 23, 2024 23:08:28.857868910 CEST	53	52692	1.1.1.1	192.168.2.6
Apr 23, 2024 23:08:28.857898951 CEST	53	57552	1.1.1.1	192.168.2.6
Apr 23, 2024 23:08:29.659447908 CEST	53933	53	192.168.2.6	1.1.1.1
Apr 23, 2024 23:08:29.659796000 CEST	64309	53	192.168.2.6	1.1.1.1
Apr 23, 2024 23:08:29.766469955 CEST	53	53933	1.1.1.1	192.168.2.6
Apr 23, 2024 23:08:29.766494036 CEST	53	64309	1.1.1.1	192.168.2.6
Apr 23, 2024 23:08:29.835825920 CEST	65194	53	192.168.2.6	1.1.1.1
Apr 23, 2024 23:08:29.836230993 CEST	51385	53	192.168.2.6	1.1.1.1
Apr 23, 2024 23:08:29.942270041 CEST	53	65194	1.1.1.1	192.168.2.6
Apr 23, 2024 23:08:29.943649054 CEST	53	51385	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 23, 2024 23:07:22.592853069 CEST	192.168.2.6	1.1.1.1	0x58a3	Standard query (0)	outlook.office365.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:22.593087912 CEST	192.168.2.6	1.1.1.1	0xad64	Standard query (0)	outlook.office365.com	65	IN (0x0001)	false
Apr 23, 2024 23:07:23.288086891 CEST	192.168.2.6	1.1.1.1	0xd63f	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:23.288741112 CEST	192.168.2.6	1.1.1.1	0xb31a	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
Apr 23, 2024 23:07:24.072092056 CEST	192.168.2.6	1.1.1.1	0xf7e0	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:24.074248075 CEST	192.168.2.6	1.1.1.1	0x9679	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 23, 2024 23:07:24.258877039 CEST	192.168.2.6	1.1.1.1	0x6997	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:24.259449959 CEST	192.168.2.6	1.1.1.1	0xca22	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Apr 23, 2024 23:07:26.218270063 CEST	192.168.2.6	1.1.1.1	0x8c2a	Standard query (0)	identity.nel.measure.office.net	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:26.219012022 CEST	192.168.2.6	1.1.1.1	0x8dd6	Standard query (0)	identity.nel.measure.office.net	65	IN (0x0001)	false
Apr 23, 2024 23:07:27.494899988 CEST	192.168.2.6	1.1.1.1	0xfec4	Standard query (0)	outlook.office365.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:27.495443106 CEST	192.168.2.6	1.1.1.1	0xf051	Standard query (0)	outlook.office365.com	65	IN (0x0001)	false
Apr 23, 2024 23:07:28.910032034 CEST	192.168.2.6	1.1.1.1	0x3ce	Standard query (0)	r4.res.office365.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:28.910296917 CEST	192.168.2.6	1.1.1.1	0x65e5	Standard query (0)	r4.res.office365.com	65	IN (0x0001)	false
Apr 23, 2024 23:07:39.419409037 CEST	192.168.2.6	1.1.1.1	0x4de4	Standard query (0)	outlook.office365.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:39.419574022 CEST	192.168.2.6	1.1.1.1	0x9817	Standard query (0)	outlook.office365.com	65	IN (0x0001)	false
Apr 23, 2024 23:08:28.750260115 CEST	192.168.2.6	1.1.1.1	0xf9b2	Standard query (0)	outlook.office365.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:08:28.750638008 CEST	192.168.2.6	1.1.1.1	0xefb7	Standard query (0)	outlook.office365.com	65	IN (0x0001)	false
Apr 23, 2024 23:08:28.751044989 CEST	192.168.2.6	1.1.1.1	0x725f	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:08:28.751162052 CEST	192.168.2.6	1.1.1.1	0x8209	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
Apr 23, 2024 23:08:29.659447908 CEST	192.168.2.6	1.1.1.1	0x8509	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:08:29.659796000 CEST	192.168.2.6	1.1.1.1	0x5f6a	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Apr 23, 2024 23:08:29.835825920 CEST	192.168.2.6	1.1.1.1	0x19ff	Standard query (0)	outlook.office365.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:08:29.836230993 CEST	192.168.2.6	1.1.1.1	0xc3c	Standard query (0)	outlook.office365.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 23, 2024 23:07:22.699662924 CEST	1.1.1.1	192.168.2.6	0x58a3	No error (0)	outlook.office365.com	ooc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:07:22.699662924 CEST	1.1.1.1	192.168.2.6	0x58a3	No error (0)	ooc-g2.tm-4.office.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:07:22.699662924 CEST	1.1.1.1	192.168.2.6	0x58a3	No error (0)	outlook.ms-acdc.office.com	LYH-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:07:22.699662924 CEST	1.1.1.1	192.168.2.6	0x58a3	No error (0)	LYH-efz.ms-acdc.office.com		52.96.165.34	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:22.699662924 CEST	1.1.1.1	192.168.2.6	0x58a3	No error (0)	LYH-efz.ms-acdc.office.com		52.96.119.82	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:22.699662924 CEST	1.1.1.1	192.168.2.6	0x58a3	No error (0)	LYH-efz.ms-acdc.office.com		52.96.165.178	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:22.699662924 CEST	1.1.1.1	192.168.2.6	0x58a3	No error (0)	LYH-efz.ms-acdc.office.com		52.96.222.178	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:22.700587034 CEST	1.1.1.1	192.168.2.6	0xad64	No error (0)	outlook.office365.com	ooc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:07:22.700587034 CEST	1.1.1.1	192.168.2.6	0xad64	No error (0)	ooc-g2.tm-4.office.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:07:22.700587034 CEST	1.1.1.1	192.168.2.6	0xad64	No error (0)	outlook.ms-acdc.office.com	LYH-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:07:23.394898891 CEST	1.1.1.1	192.168.2.6	0xd63f	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:07:23.395647049 CEST	1.1.1.1	192.168.2.6	0xb31a	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:07:24.178572893 CEST	1.1.1.1	192.168.2.6	0xf7e0	No error (0)	www.google.com		64.233.185.104	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:24.178572893 CEST	1.1.1.1	192.168.2.6	0xf7e0	No error (0)	www.google.com		64.233.185.105	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:24.178572893 CEST	1.1.1.1	192.168.2.6	0xf7e0	No error (0)	www.google.com		64.233.185.99	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:24.178572893 CEST	1.1.1.1	192.168.2.6	0xf7e0	No error (0)	www.google.com		64.233.185.106	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:24.178572893 CEST	1.1.1.1	192.168.2.6	0xf7e0	No error (0)	www.google.com		64.233.185.103	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:24.178572893 CEST	1.1.1.1	192.168.2.6	0xf7e0	No error (0)	www.google.com		64.233.185.147	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:24.180860996 CEST	1.1.1.1	192.168.2.6	0x9679	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 23, 2024 23:07:24.365914106 CEST	1.1.1.1	192.168.2.6	0x6997	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:07:24.365914106 CEST	1.1.1.1	192.168.2.6	0x6997	No error (0)	cs1100.wpc.omegacdn.net		152.199.4.44	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:24.366431952 CEST	1.1.1.1	192.168.2.6	0xca22	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:07:26.325005054 CEST	1.1.1.1	192.168.2.6	0x8c2a	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:07:26.326539993 CEST	1.1.1.1	192.168.2.6	0x8dd6	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:07:26.361617088 CEST	1.1.1.1	192.168.2.6	0xf479	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:07:26.361617088 CEST	1.1.1.1	192.168.2.6	0xf479	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:26.361617088 CEST	1.1.1.1	192.168.2.6	0xf479	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:27.601989985 CEST	1.1.1.1	192.168.2.6	0xfec4	No error (0)	outlook.office365.com	ooc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:07:27.601989985 CEST	1.1.1.1	192.168.2.6	0xfec4	No error (0)	ooc-g2.tm-4.office.com		52.96.69.2	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:27.601989985 CEST	1.1.1.1	192.168.2.6	0xfec4	No error (0)	ooc-g2.tm-4.office.com		52.96.111.34	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:27.601989985 CEST	1.1.1.1	192.168.2.6	0xfec4	No error (0)	ooc-g2.tm-4.office.com		52.96.109.162	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:27.601989985 CEST	1.1.1.1	192.168.2.6	0xfec4	No error (0)	ooc-g2.tm-4.office.com		52.96.58.98	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:27.601989985 CEST	1.1.1.1	192.168.2.6	0xfec4	No error (0)	ooc-g2.tm-4.office.com		40.97.190.18	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:27.601989985 CEST	1.1.1.1	192.168.2.6	0xfec4	No error (0)	ooc-g2.tm-4.office.com		52.96.111.114	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:27.601989985 CEST	1.1.1.1	192.168.2.6	0xfec4	No error (0)	ooc-g2.tm-4.office.com		52.96.15.2	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:27.601989985 CEST	1.1.1.1	192.168.2.6	0xfec4	No error (0)	ooc-g2.tm-4.office.com		52.96.183.34	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:27.602395058 CEST	1.1.1.1	192.168.2.6	0xf051	No error (0)	outlook.office365.com	ooc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:07:29.017752886 CEST	1.1.1.1	192.168.2.6	0x65e5	No error (0)	r4.res.office365.com	r4.res.office365.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:07:29.018309116 CEST	1.1.1.1	192.168.2.6	0x3ce	No error (0)	r4.res.office365.com	r4.res.office365.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:07:29.579967022 CEST	1.1.1.1	192.168.2.6	0x24e3	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:07:29.579967022 CEST	1.1.1.1	192.168.2.6	0x24e3	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:29.579967022 CEST	1.1.1.1	192.168.2.6	0x24e3	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:35.774830103 CEST	1.1.1.1	192.168.2.6	0xe139	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:07:35.774830103 CEST	1.1.1.1	192.168.2.6	0xe139	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:37.124772072 CEST	1.1.1.1	192.168.2.6	0xfe3c	No error (0)	windowsupdatebg.s.llnwi.net		69.164.42.0	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:39.526113987 CEST	1.1.1.1	192.168.2.6	0x4de4	No error (0)	outlook.office365.com	ooc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:07:39.526113987 CEST	1.1.1.1	192.168.2.6	0x4de4	No error (0)	ooc-g2.tm-4.office.com		52.96.122.82	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:39.526113987 CEST	1.1.1.1	192.168.2.6	0x4de4	No error (0)	ooc-g2.tm-4.office.com		52.96.104.50	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:39.526113987 CEST	1.1.1.1	192.168.2.6	0x4de4	No error (0)	ooc-g2.tm-4.office.com		52.96.37.210	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:39.526113987 CEST	1.1.1.1	192.168.2.6	0x4de4	No error (0)	ooc-g2.tm-4.office.com		52.96.119.82	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:39.526113987 CEST	1.1.1.1	192.168.2.6	0x4de4	No error (0)	ooc-g2.tm-4.office.com		52.96.97.130	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:39.526113987 CEST	1.1.1.1	192.168.2.6	0x4de4	No error (0)	ooc-g2.tm-4.office.com		52.96.28.178	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:39.526113987 CEST	1.1.1.1	192.168.2.6	0x4de4	No error (0)	ooc-g2.tm-4.office.com		52.96.165.146	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:39.526113987 CEST	1.1.1.1	192.168.2.6	0x4de4	No error (0)	ooc-g2.tm-4.office.com		52.96.185.210	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:07:39.526374102 CEST	1.1.1.1	192.168.2.6	0x9817	No error (0)	outlook.office365.com	ooc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:08:28.857868910 CEST	1.1.1.1	192.168.2.6	0xf9b2	No error (0)	outlook.office365.com	ooc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:08:28.857868910 CEST	1.1.1.1	192.168.2.6	0xf9b2	No error (0)	ooc-g2.tm-4.office.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:08:28.857868910 CEST	1.1.1.1	192.168.2.6	0xf9b2	No error (0)	outlook.ms-acdc.office.com	LYH-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:08:28.857868910 CEST	1.1.1.1	192.168.2.6	0xf9b2	No error (0)	LYH-efz.ms-acdc.office.com		52.96.189.2	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:08:28.857868910 CEST	1.1.1.1	192.168.2.6	0xf9b2	No error (0)	LYH-efz.ms-acdc.office.com		52.96.184.18	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:08:28.857868910 CEST	1.1.1.1	192.168.2.6	0xf9b2	No error (0)	LYH-efz.ms-acdc.office.com		52.96.184.50	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:08:28.857868910 CEST	1.1.1.1	192.168.2.6	0xf9b2	No error (0)	LYH-efz.ms-acdc.office.com		52.96.165.226	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:08:28.857898951 CEST	1.1.1.1	192.168.2.6	0xefb7	No error (0)	outlook.office365.com	ooc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:08:28.858052969 CEST	1.1.1.1	192.168.2.6	0x478d	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:08:28.858052969 CEST	1.1.1.1	192.168.2.6	0x478d	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:08:28.858052969 CEST	1.1.1.1	192.168.2.6	0x478d	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:08:28.858093977 CEST	1.1.1.1	192.168.2.6	0x8209	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:08:28.858263969 CEST	1.1.1.1	192.168.2.6	0x725f	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:08:29.766469955 CEST	1.1.1.1	192.168.2.6	0x8509	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:08:29.766469955 CEST	1.1.1.1	192.168.2.6	0x8509	No error (0)	cs1100.wpc.omegacdn.net		152.199.4.44	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:08:29.766494036 CEST	1.1.1.1	192.168.2.6	0x5f6a	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:08:29.942270041 CEST	1.1.1.1	192.168.2.6	0x19ff	No error (0)	outlook.office365.com	ooc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:08:29.942270041 CEST	1.1.1.1	192.168.2.6	0x19ff	No error (0)	ooc-g2.tm-4.office.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:08:29.942270041 CEST	1.1.1.1	192.168.2.6	0x19ff	No error (0)	outlook.ms-acdc.office.com	LYH-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:08:29.942270041 CEST	1.1.1.1	192.168.2.6	0x19ff	No error (0)	LYH-efz.ms-acdc.office.com		52.96.222.178	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:08:29.942270041 CEST	1.1.1.1	192.168.2.6	0x19ff	No error (0)	LYH-efz.ms-acdc.office.com		52.96.165.146	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:08:29.942270041 CEST	1.1.1.1	192.168.2.6	0x19ff	No error (0)	LYH-efz.ms-acdc.office.com		52.96.165.194	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:08:29.942270041 CEST	1.1.1.1	192.168.2.6	0x19ff	No error (0)	LYH-efz.ms-acdc.office.com		52.96.165.178	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:08:29.943649054 CEST	1.1.1.1	192.168.2.6	0xc3c	No error (0)	outlook.office365.com	ooc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:08:29.943649054 CEST	1.1.1.1	192.168.2.6	0xc3c	No error (0)	ooc-g2.tm-4.office.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:08:29.943649054 CEST	1.1.1.1	192.168.2.6	0xc3c	No error (0)	outlook.ms-acdc.office.com	LYH-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

outlook.office365.com

https:

aadcdn.msftauth.net

aadcdn.msauth.net

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49717	52.96.165.34	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:23 UTC	799	OUT	GET /owa/?viewmodel=ReadMessageItem&InternetMessageID=%3cMN2PR15MB265581B72BCA78783AC3110FE1122%40MN2PR15MB2655.namprd15.prod.outlook.com%3e HTTP/1.1 Host: outlook.office365.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:23 UTC	6773	IN	HTTP/1.1 302 Content-Length: 930 Content-Type: text/html; charset=utf-8 Location: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=57884ebc-20ed-69b7-9f1b-a865892114a4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba&state=VYtBbsIwEEWT9ixhF-MZe2yzQFVCQWIRVHEDOx4qRBKjkJYrcGyyYcHi_cXTf3mWZZ8zHzO5nCezRjm9IqlQKzCOQJOwmqM5YSgDBi51K20ZjLKls0TUOsJV8PncPvJluvvl1_-Z732K3K2P7GPDt5v_5f3E_WI_TDwOPL3c97pQbXPAnyNQU6MhclBbrDeVddapaqMA5G4LgFho-XYUg--vYwQS1zFFkf6mLqWLaFNfKH4C Server: Microsoft-IIS/10.0 request-id: 57884ebc-20ed-69b7-9f1b-a865892114a4 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-CalculatedFETarget: SA9P221CU001.internal.outlook.com X-BackEndHttpStatus: 302 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: ClientId=21005DA175D0486FB6CC7306B18DB8F9; expires=Wed, 23-Apr-2025 21:07:23 GMT; path=/;SameSite=None; secure Set-Cookie: ClientId=21005DA175D0486FB6CC7306B18DB8F9; expires=Wed, 23-Apr-2025 21:07:23 GMT; path=/;SameSite=None; secure Set-Cookie: OIDC=1; expires=Wed, 23-Oct-2024 21:07:23 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: RoutingKeyCookie=; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OpenIdConnect.nonce.v3.8lrqHfJIjxeKmLsEWTYt18TbOGRQMKZy88ZOq-mt830=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba; expires=Tue, 23-Apr-2024 22:07:23 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: HostSwitchPrg=; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OptInPrg=; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: SuiteServiceProxyKey=; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: ClientId=21005DA175D0486FB6CC7306B18DB8F9; expires=Wed, 23-Apr-2025 21:07:23 GMT; path=/;SameSite=None; secure Set-Cookie: OIDC=1; expires=Wed, 23-Oct-2024 21:07:23 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: RoutingKeyCookie=; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OpenIdConnect.nonce.v3.8lrqHfJIjxeKmLsEWTYt18TbOGRQMKZy88ZOq-mt830=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba; expires=Tue, 23-Apr-2024 22:07:23 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: HostSwitchPrg=; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: OptInPrg=; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: SuiteServiceProxyKey=; expires=Sat, 23-Apr-1994 21:07:23 GMT; path=/; secure Set-Cookie: X-OWA-RedirectHistory=ArLym14BGS7xXtlj3Ag; expires=Wed, 24-Apr-2024 03:09:23 GMT; path=/;SameSite=None; secure; HttpOnly X-CalculatedBETarget: SA0PR03MB5610.namprd03.prod.outlook.com X-BackEndHttpStatus: 302 X-RUM-Validated: 1 X-RUM-NotUpdateQueriedPath: 1 X-RUM-NotUpdateQueriedDbCopy: 1 X-Content-Type-Options: nosniff X-BeSku: WCS6 X-OWA-DiagnosticsInfo: 1;0;0 X-IIDs: 0 X-BackEnd-Begin: 2024-04-23T21:07:23.168 X-BackEnd-End: 2024-04-23T21:07:23.168 X-DiagInfo: SA0PR03MB5610 X-BEServer: SA0PR03MB5610 X-UA-Compatible: IE=EmulateIE7 X-Proxy-RoutingCorrectness: 1 X-Proxy-BackendServerStatus: 302 X-FEProxyInfo: BN9PR03CA0152.NAMPRD03.PROD.OUTLOOK.COM X-FEEFZInfo: LYH X-FEServer: SA9P221CA0027 Report-To: {"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=LYH&RemoteIP=89.187.171.0"}],"include_subdomains":true} NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} X-FirstHopCafeEFZ: LYH X-FEServer: BN9PR03CA0152 Date: Tue, 23 Apr 2024 21:07:22 GMT Connection: close
2024-04-23 21:07:23 UTC	930	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 2f 63 6f 6d 6d 6f 6e 2f 6f 61 75 74 68 32 2f 61 75 74 68 6f 72 69 7a 65 3f 63 6c 69 65 6e 74 5f 69 64 3d 30 30 30 30 30 30 30 32 2d 30 30 30 30 2d 30 66 66 31 2d 63 65 30 30 2d 30 30 30 30 30 30 30 30 30 30 30 30 26 61 6d 70 3b 72 65 64 69 72 65 63 74 5f 75 72 69 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 6f 75 74 6c 6f 6f 6b 2e 6f 66 66 69 63 65 33 36 35 2e 63 6f 6d 25 32 66 6f 77 61 25 32 66 26 61 6d 70 3b 72 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&r

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49719	52.159.127.243	443

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:23 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 50 56 63 4c 66 55 5a 76 74 30 32 49 4a 43 45 2f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 63 35 30 66 37 66 61 36 33 31 63 31 62 39 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: PVcLfUZvt02IJCE/.1Context: fc50f7fa631c1b90
2024-04-23 21:07:23 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-23 21:07:23 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 50 56 63 4c 66 55 5a 76 74 30 32 49 4a 43 45 2f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 63 35 30 66 37 66 61 36 33 31 63 31 62 39 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 6c 62 2b 57 67 59 4e 43 38 55 37 6b 51 50 4a 79 72 44 31 34 53 77 45 71 2f 55 47 65 57 78 34 7a 74 51 6b 6b 30 53 57 61 66 59 30 6d 78 4d 34 46 4d 2f 56 61 6f 56 4d 51 53 65 36 50 68 52 57 4b 30 68 2f 4c 6a 30 52 35 5a 56 68 35 61 71 57 4c 37 31 49 64 33 51 32 50 48 75 56 47 69 55 70 6a 54 5a 47 53 69 38 66 42 4c 6f 4c 77 Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: PVcLfUZvt02IJCE/.2Context: fc50f7fa631c1b90<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQlb+WgYNC8U7kQPJyrD14SwEq/UGeWx4ztQkk0SWafY0mxM4FM/VaoVMQSe6PhRWK0h/Lj0R5ZVh5aqWL71Id3Q2PHuVGiUpjTZGSi8fBLoLw
2024-04-23 21:07:23 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 50 56 63 4c 66 55 5a 76 74 30 32 49 4a 43 45 2f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 63 35 30 66 37 66 61 36 33 31 63 31 62 39 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: PVcLfUZvt02IJCE/.3Context: fc50f7fa631c1b90<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-23 21:07:23 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-23 21:07:23 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4b 34 57 38 38 65 43 66 6d 30 32 66 42 37 55 43 43 55 48 45 4b 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: K4W88eCfm02fB7UCCUHEKA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49722	152.199.4.44	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:25 UTC	635	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:25 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 1048943 Cache-Control: public, max-age=31536000 Content-MD5: 2vlVvyES905PeLIYeo1r7w== Content-Type: application/x-javascript Date: Tue, 23 Apr 2024 21:07:25 GMT Etag: 0x8DC4DBF5E20DC85 Last-Modified: Tue, 26 Mar 2024 18:05:49 GMT Server: ECAcc (agc/7F29) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 0776f3ba-701e-0068-1d37-8c4015000000 x-ms-version: 2009-09-19 Content-Length: 141339 Connection: close
2024-04-23 21:07:25 UTC	16383	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-04-23 21:07:25 UTC	16383	IN	Data Raw: 75 74 65 64 53 74 79 6c 65 28 65 2c 6e 75 6c 6c 29 3a 65 2e 63 75 72 72 65 6e 74 53 74 79 6c 65 3f 65 2e 63 75 72 72 65 6e 74 53 74 79 6c 65 3a 7b 7d 7d 2c 68 69 73 74 6f 72 79 3a 7b 70 75 73 68 53 74 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 5f 2e 69 73 48 69 73 74 6f 72 79 53 75 70 70 6f 72 74 65 64 28 29 26 26 64 2e 68 69 73 74 6f 72 79 2e 70 75 73 68 53 74 61 74 65 28 65 2c 6e 29 7d 2c 72 65 70 6c 61 63 65 53 74 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 5f 2e 69 73 48 69 73 74 6f 72 79 53 75 70 70 6f 72 74 65 64 28 29 26 26 64 2e 68 69 73 74 6f 72 79 2e 72 65 70 6c 61 63 65 53 74 61 74 65 28 65 2c 6e 29 7d 7d 2c 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 2c 72 29 7b 65 2e 61 64 Data Ascii: utedStyle(e,null):e.currentStyle?e.currentStyle:{}},history:{pushState:function(e,n){_.isHistorySupported()&&d.history.pushState(e,n)},replaceState:function(e,n){_.isHistorySupported()&&d.history.replaceState(e,n)}},addEventListener:function(e,n,t,r){e.ad
2024-04-23 21:07:25 UTC	16383	IN	Data Raw: 5f 53 4d 53 3a 22 38 30 30 34 33 34 45 31 22 2c 50 50 5f 45 5f 49 4e 4c 49 4e 45 4c 4f 47 49 4e 5f 49 4e 56 41 4c 49 44 5f 41 4c 54 3a 22 38 30 30 34 33 34 45 32 22 2c 50 50 5f 45 5f 50 52 45 56 49 4f 55 53 5f 50 41 53 53 57 4f 52 44 3a 22 38 30 30 34 31 30 31 33 22 2c 50 50 5f 45 5f 48 49 50 5f 56 41 4c 49 44 41 54 49 4f 4e 5f 57 52 4f 4e 47 3a 22 38 30 30 34 35 35 30 35 22 2c 50 50 5f 45 5f 48 49 50 5f 56 41 4c 49 44 41 54 49 4f 4e 5f 45 52 52 4f 52 5f 46 41 54 41 4c 3a 22 38 30 30 34 35 35 33 37 22 2c 50 50 5f 45 5f 48 49 50 5f 56 41 4c 49 44 41 54 49 4f 4e 5f 45 52 52 4f 52 5f 55 4e 41 55 54 48 45 4e 54 49 43 41 54 45 44 3a 22 38 30 30 34 35 35 33 38 22 2c 50 50 5f 45 5f 48 49 50 5f 56 41 4c 49 44 41 54 49 4f 4e 5f 45 52 52 4f 52 5f 4f 54 48 45 52 3a Data Ascii: _SMS:"800434E1",PP_E_INLINELOGIN_INVALID_ALT:"800434E2",PP_E_PREVIOUS_PASSWORD:"80041013",PP_E_HIP_VALIDATION_WRONG:"80045505",PP_E_HIP_VALIDATION_ERROR_FATAL:"80045537",PP_E_HIP_VALIDATION_ERROR_UNAUTHENTICATED:"80045538",PP_E_HIP_VALIDATION_ERROR_OTHER:
2024-04-23 21:07:25 UTC	16383	IN	Data Raw: 3d 5b 5d 3b 69 66 28 65 29 66 6f 72 28 76 61 72 20 6f 3d 30 2c 69 3d 65 2e 6c 65 6e 67 74 68 3b 6f 3c 69 3b 6f 2b 2b 29 72 2e 70 75 73 68 28 6e 2e 63 61 6c 6c 28 74 2c 65 5b 6f 5d 2c 6f 29 29 3b 72 65 74 75 72 6e 20 72 7d 2c 6a 62 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 76 61 72 20 72 3d 5b 5d 3b 69 66 28 65 29 66 6f 72 28 76 61 72 20 6f 3d 30 2c 69 3d 65 2e 6c 65 6e 67 74 68 3b 6f 3c 69 3b 6f 2b 2b 29 6e 2e 63 61 6c 6c 28 74 2c 65 5b 6f 5d 2c 6f 29 26 26 72 2e 70 75 73 68 28 65 5b 6f 5d 29 3b 72 65 74 75 72 6e 20 72 7d 2c 4e 62 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 6e 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 65 2e 70 75 73 68 2e 61 70 70 6c 79 28 65 2c 6e 29 3b 65 6c 73 65 20 66 6f 72 28 76 61 72 20 74 3d 30 2c 72 Data Ascii: =[];if(e)for(var o=0,i=e.length;o<i;o++)r.push(n.call(t,e[o],o));return r},jb:function(e,n,t){var r=[];if(e)for(var o=0,i=e.length;o<i;o++)n.call(t,e[o],o)&&r.push(e[o]);return r},Nb:function(e,n){if(n instanceof Array)e.push.apply(e,n);else for(var t=0,r
2024-04-23 21:07:25 UTC	16383	IN	Data Raw: 3b 72 65 74 75 72 6e 21 21 65 7d 2c 53 2e 5a 61 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 28 65 5b 54 5d 3d 3d 3d 50 5b 54 5d 7c 7c 65 5b 54 5d 3d 3d 3d 53 2e 6f 2e 66 6e 5b 54 5d 26 26 65 2e 4e 63 29 7d 2c 53 2e 62 28 22 6f 62 73 65 72 76 61 62 6c 65 22 2c 53 2e 74 61 29 2c 53 2e 62 28 22 69 73 4f 62 73 65 72 76 61 62 6c 65 22 2c 53 2e 4f 29 2c 53 2e 62 28 22 69 73 57 72 69 74 65 61 62 6c 65 4f 62 73 65 72 76 61 62 6c 65 22 2c 53 2e 5a 61 29 2c 53 2e 62 28 22 69 73 57 72 69 74 61 62 6c 65 4f 62 73 65 72 76 61 62 6c 65 22 2c 53 2e 5a 61 29 2c 53 2e 62 28 22 6f 62 73 65 72 76 61 62 6c 65 2e 66 6e 22 2c 50 29 2c 53 2e 4c 28 50 2c 22 70 65 65 6b 22 2c 50 2e 76 29 2c 53 2e 4c 28 Data Ascii: ;return!!e},S.Za=function(e){return"function"==typeof e&&(e[T]===P[T]\|\|e[T]===S.o.fn[T]&&e.Nc)},S.b("observable",S.ta),S.b("isObservable",S.O),S.b("isWriteableObservable",S.Za),S.b("isWritableObservable",S.Za),S.b("observable.fn",P),S.L(P,"peek",P.v),S.L(
2024-04-23 21:07:25 UTC	16383	IN	Data Raw: 6e 75 6c 6c 2c 65 29 2e 62 69 6e 64 69 6e 67 43 6f 6e 74 65 78 74 46 6f 72 44 65 73 63 65 6e 64 61 6e 74 73 29 2c 74 26 26 21 62 5b 53 2e 61 2e 52 28 6e 29 5d 26 26 64 28 74 2c 6e 29 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 6e 2c 74 29 7b 76 61 72 20 6f 2c 69 3d 53 2e 61 2e 67 2e 55 62 28 65 2c 45 2c 7b 7d 29 2c 73 3d 69 2e 68 64 3b 69 66 28 21 6e 29 7b 69 66 28 73 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 59 6f 75 20 63 61 6e 6e 6f 74 20 61 70 70 6c 79 20 62 69 6e 64 69 6e 67 73 20 6d 75 6c 74 69 70 6c 65 20 74 69 6d 65 73 20 74 6f 20 74 68 65 20 73 61 6d 65 20 65 6c 65 6d 65 6e 74 2e 22 29 3b 69 2e 68 64 3d 21 30 7d 69 66 28 73 7c 7c 28 69 2e 63 6f 6e 74 65 78 74 3d 74 29 2c 69 2e 5a 62 7c 7c 28 69 2e 5a 62 3d 7b 7d 29 2c 6e 26 26 22 66 75 6e 63 74 69 Data Ascii: null,e).bindingContextForDescendants),t&&!b[S.a.R(n)]&&d(t,n)}function p(e,n,t){var o,i=S.a.g.Ub(e,E,{}),s=i.hd;if(!n){if(s)throw Error("You cannot apply bindings multiple times to the same element.");i.hd=!0}if(s\|\|(i.context=t),i.Zb\|\|(i.Zb={}),n&&"functi
2024-04-23 21:07:25 UTC	16383	IN	Data Raw: 75 6c 6c 2c 5b 65 2c 22 63 68 61 6e 67 65 22 5d 29 2c 28 6c 7c 7c 53 2e 53 2e 59 61 28 29 29 26 26 53 2e 69 2e 6d 61 28 65 2c 53 2e 69 2e 48 29 2c 53 2e 61 2e 77 64 28 65 29 2c 75 26 26 32 30 3c 4d 61 74 68 2e 61 62 73 28 75 2d 65 2e 73 63 72 6f 6c 6c 54 6f 70 29 26 26 28 65 2e 73 63 72 6f 6c 6c 54 6f 70 3d 75 29 7d 7d 2c 53 2e 63 2e 6f 70 74 69 6f 6e 73 2e 24 62 3d 53 2e 61 2e 67 2e 5a 28 29 2c 53 2e 63 2e 73 65 6c 65 63 74 65 64 4f 70 74 69 6f 6e 73 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 66 75 6e 63 74 69 6f 6e 20 72 28 29 7b 76 61 72 20 72 3d 6e 28 29 2c 6f 3d 5b 5d 3b 53 2e 61 2e 44 28 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 6f 70 74 69 6f 6e 22 29 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b Data Ascii: ull,[e,"change"]),(l\|\|S.S.Ya())&&S.i.ma(e,S.i.H),S.a.wd(e),u&&20<Math.abs(u-e.scrollTop)&&(e.scrollTop=u)}},S.c.options.$b=S.a.g.Z(),S.c.selectedOptions={init:function(e,n,t){function r(){var r=n(),o=[];S.a.D(e.getElementsByTagName("option"),(function(e){
2024-04-23 21:07:25 UTC	16383	IN	Data Raw: 70 65 72 2c 64 3d 6f 2e 4b 65 79 43 6f 64 65 3b 66 75 6e 63 74 69 6f 6e 20 66 28 65 29 7b 65 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 3f 65 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3a 65 2e 72 65 74 75 72 6e 56 61 6c 75 65 3d 21 31 7d 6e 2e 61 70 70 6c 79 45 78 74 65 6e 73 69 6f 6e 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 2c 74 3d 31 2c 6f 3d 7b 7d 3b 65 2e 63 6f 6d 70 6f 6e 65 6e 74 73 2e 6c 6f 61 64 65 72 73 2e 75 6e 73 68 69 66 74 28 7b 6c 6f 61 64 43 6f 6d 70 6f 6e 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 29 7b 65 2e 63 6f 6d 70 6f 6e 65 6e 74 73 2e 64 65 66 61 75 6c 74 4c 6f 61 64 65 72 2e 6c 6f 61 64 43 6f 6d 70 6f 6e 65 6e 74 28 6e 2c 74 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 69 3b 74 2e 65 Data Ascii: per,d=o.KeyCode;function f(e){e.preventDefault?e.preventDefault():e.returnValue=!1}n.applyExtensions=function(e){var n,t=1,o={};e.components.loaders.unshift({loadComponent:function(n,t,r){e.components.defaultLoader.loadComponent(n,t,(function(n){var i;t.e
2024-04-23 21:07:25 UTC	10275	IN	Data Raw: 69 6e 52 65 71 75 65 73 74 28 65 2c 61 29 7d 7d 65 2e 65 76 65 6e 74 44 61 74 61 3d 61 7d 66 75 6e 63 74 69 6f 6e 20 43 28 65 2c 6e 2c 74 2c 72 2c 6f 29 7b 75 2e 74 72 61 63 65 45 6e 64 52 65 71 75 65 73 74 28 65 2c 6e 2c 74 2c 72 2c 6f 29 7d 66 75 6e 63 74 69 6f 6e 20 77 28 65 2c 6e 29 7b 76 61 72 20 74 3d 7b 7d 3b 72 65 74 75 72 6e 20 65 26 26 28 74 2e 78 68 72 5f 73 74 61 74 75 73 3d 65 2e 73 74 61 74 75 73 29 2c 74 2e 74 65 78 74 53 74 61 74 75 73 3d 6e 2c 74 7d 6e 2e 45 72 72 6f 72 73 3d 5b 5d 2c 6e 2e 4a 73 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6f 2c 61 2c 73 2c 75 2c 63 2c 6c 29 7b 76 61 72 20 66 3d 21 28 21 61 26 26 21 73 29 2c 70 3d 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 2c 68 3d 65 2e 75 72 6c 3b 66 75 6e 63 74 69 6f 6e Data Ascii: inRequest(e,a)}}e.eventData=a}function C(e,n,t,r,o){u.traceEndRequest(e,n,t,r,o)}function w(e,n){var t={};return e&&(t.xhr_status=e.status),t.textStatus=n,t}n.Errors=[],n.Json=function(e,o,a,s,u,c,l){var f=!(!a&&!s),p=(new Date).getTime(),h=e.url;function

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49723	184.31.62.93	443

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:25 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-23 21:07:25 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/079C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Cache-Control: public, max-age=35793 Date: Tue, 23 Apr 2024 21:07:25 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49727	184.31.62.93	443

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:25 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-23 21:07:26 UTC	804	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0778) X-CID: 11 X-CCC: US X-Azure-Ref-OriginShield: Ref A: 52EA27DBDE0C4533B819423583F6692E Ref B: CH1AA2040902052 Ref C: 2023-07-09T23:10:08Z X-MSEdge-Ref: Ref A: 528BB8D443C042AA9AEA4EC3F75C7762 Ref B: CHI30EDGE0111 Ref C: 2023-07-09T23:11:11Z Content-Type: application/octet-stream X-Azure-Ref: 01uvbYwAAAACkqWtaEMjWQL/4cpisZkorTUVNMzBFREdFMDgxMQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=35739 Date: Tue, 23 Apr 2024 21:07:26 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-23 21:07:26 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49730	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:26 UTC	658	OUT	GET /ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:27 UTC	781	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:26 GMT Content-Type: text/css Content-Length: 20314 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 27 Dec 2023 18:18:12 GMT ETag: 0x8DC07082FBB8D2B x-ms-request-id: c313eadd-401e-000a-792a-95eb8b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210726Z-16f56cb894fq656zwwgapudkng00000001dg000000003x59 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 21:07:27 UTC	15603	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 7d 6b 73 e3 36 b2 e8 f7 f9 15 5c a7 52 3b ce 4a 8c 48 3d 2d 57 52 3b 99 cc 26 3e 67 5e 35 33 d9 47 a5 52 5b b4 44 59 3c 43 89 ba 24 65 8f 57 47 ff fd e2 8d 06 d0 20 29 8f b3 d9 7b 2b 27 67 13 0b dd 6c 00 dd 8d 06 1a e8 06 be fe ea 0f c1 f3 62 77 5f 66 37 eb 3a 78 fa fc 3c 78 95 2d ca a2 2a 56 35 29 2f 77 45 99 d4 59 b1 0d 83 67 79 1e 30 a4 2a 28 d3 2a 2d 6f d3 65 18 7c f5 f5 d7 5f fd e1 49 bf fb ff 05 ef 3f 3c 7b f7 21 78 f3 97 e0 c3 8f 57 ef be 0f de 92 5f ff 08 5e bf f9 70 f5 fc 45 d0 99 ca 93 27 1f d6 59 15 ac b2 3c 0d c8 7f af 93 2a 5d 06 c5 36 28 ca 20 db 2e 44 ab d3 2a d8 90 7f 97 59 92 07 ab b2 d8 04 f5 3a 0d 76 65 f1 3f e9 82 f4 21 cf aa 9a 7c 74 9d e6 c5 5d f0 94 90 2b 97 c1 db a4 ac ef 83 ab b7 e7 61 f0 81 e0 16 Data Ascii: }ks6\R;JH=-WR;&>g^53GR[DY<C$eWG ){+'glbw_f7:x<x-V5)/wEYgy0(-oe\|_I?<{!xW_^pE'Y<]6( .D*Y:ve?!\|t]+a
2024-04-23 21:07:27 UTC	4711	IN	Data Raw: e7 bc b1 e2 92 61 7d df b0 68 ac ab 2c aa b1 88 da cb c6 22 89 f4 a2 b1 42 53 1e da 58 e7 55 1e b5 fb a5 96 31 c6 85 9c 5c 95 58 0f 77 34 04 a7 bc ef e9 bc 62 55 e4 cb 9d 46 11 60 f2 34 8a 20 ba 0a e1 1d 2d b3 ba 41 d4 6a 33 50 25 58 6c a8 15 02 68 eb 56 83 ba b5 a0 21 5d f4 aa e1 60 30 5e 26 13 b7 4f 5a e3 0c 32 50 fb 10 40 6b 9f fc 5a d9 82 86 f5 c9 a7 ad bc 4f 0f 53 c6 3e 8f 75 ef 81 fb bb e5 60 13 bf d0 d1 86 c0 d4 70 43 60 72 bc 81 ca 0c ee 7b ca cd 06 61 90 56 01 34 34 b4 0d 0f 13 81 b8 e1 dc 70 52 d0 d3 64 f3 b6 df 8a 2c 1c d2 a7 e1 c5 ec 1c b9 2b 18 00 b1 42 22 26 de 7d 9d 59 8d 1f 8e 83 89 00 6e 65 8f 64 aa a2 fc c3 d8 65 70 5f b6 f7 9c 65 7e ea 83 9d 2c f7 31 10 e4 08 df ce 47 c4 df 33 f4 3c 40 c9 2e 2b 17 af 8a ce 37 c9 36 db ed 73 c6 5e f7 a6 Data Ascii: a}h,"BSXU1\Xw4bUF`4 -Aj3P%XlhV!]`0^&OZ2P@kZOS>u`pC`r{aV44pRd,+B"&}Ynedep_e~,1G3<@.+76s^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49731	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:26 UTC	635	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_4aBF4cdky--I3Cpch7JoPw2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:27 UTC	813	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:26 GMT Content-Type: application/x-javascript Content-Length: 121259 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 05 Apr 2024 02:22:39 GMT ETag: 0x8DC55174443A770 x-ms-request-id: 15c7005c-101e-0053-386e-95fbab000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210726Z-16f56cb894fw8vlhmrv3c1axyc00000001bg0000000087pf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 21:07:27 UTC	15571	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e4 bd fb 7b e3 38 8e 00 f8 fb fd 15 8e 66 2e 63 77 14 97 e5 57 6c a5 d5 59 e7 55 95 ed 24 ce c4 49 77 ef a6 32 f9 64 89 76 d4 91 25 af 24 e7 31 8e f7 6f 3f 00 24 25 4a 96 53 55 b3 7b 77 df 7d d7 bb 53 b1 48 f0 05 82 20 00 82 e0 a7 9f b6 fe 8f ca 4f 95 dd ef ff af 32 ba 19 5c df 54 86 a7 95 9b 2f 67 d7 c7 95 2b f8 fa 8f ca e5 f0 e6 ec e8 e4 fb eb c1 46 f1 7f 37 8f 5e 5c 99 78 3e ab c0 df b1 1d 33 b7 12 06 95 30 aa 78 81 13 46 f3 30 b2 13 16 57 66 f0 6f e4 d9 7e 65 12 85 b3 4a f2 c8 2a f3 28 fc 93 39 49 5c f1 bd 38 81 42 63 e6 87 2f 95 2a 54 17 b9 95 2b 3b 4a de 2a 67 57 b5 3a d4 cf a0 36 6f ea 05 50 da 09 e7 6f f0 fb 31 a9 04 61 e2 39 ac 62 07 2e d5 e6 c3 47 10 b3 ca 22 70 59 54 79 79 f4 9c c7 ca 85 e7 44 61 1c 4e 92 4a c4 1c Data Ascii: {8f.cwWlYU$Iw2dv%$1o?$%JSU{w}SH O2\T/g+F7^\x>30xF0Wfo~eJ(9I\8Bc/T+;J*gW:6oPo1a9b.G"pYTyyDaNJ
2024-04-23 21:07:27 UTC	16384	IN	Data Raw: 04 02 06 06 dc f5 70 00 bb 0e 56 15 fa 9a be 7c f6 d8 0b da 06 7d 73 c9 57 d2 6f 69 42 d9 ea f6 d6 79 26 ea 79 22 68 03 22 26 2e bd 7c c0 55 93 00 f2 d1 e9 78 95 dd 31 40 46 83 33 9d 90 a3 26 5a 0e 81 d6 64 7d 66 52 6d b5 fb 35 1d 3d d3 1f a3 30 c0 17 71 b7 42 55 f9 f0 2e ec 57 ba d7 02 1b c3 af 01 7f 7c 9e 1c d9 53 8a 8f df df 25 6d d5 cb ef cd 54 7f b4 46 58 77 8a 0d 30 ce 53 3a ac cd 3a 45 ef 88 f9 c3 17 24 9b 69 7f f9 ef bf 5c 30 94 99 50 96 7a 38 1f c1 37 8f 16 c6 5c 6b 29 c2 54 f1 37 82 21 67 ce 9f 21 e5 07 19 08 89 11 a4 84 fe 80 f9 69 f8 81 ec 59 03 51 a5 7c c1 34 0f 26 12 0b 4d 53 40 0b ce 8c b0 0b 97 61 82 41 f2 48 d7 a2 10 52 f4 f3 ea f7 63 d3 c0 bb ec 8f 18 69 03 1f d5 e5 f1 c8 a4 4d 41 86 0d c1 98 1b 59 e0 10 92 1a 2f 60 cf 1d f8 9e 1d 53 c8 Data Ascii: pV\|}sWoiBy&y"h"&.\|Ux1@F3&Zd}fRm5=0qBU.W\|S%mTFXw0S::E$i\0Pz87\k)T7!g!iYQ\|4&MS@aAHRciMAY/`S
2024-04-23 21:07:27 UTC	16384	IN	Data Raw: 5e 7b b9 59 8a 01 9c fd ed 38 c0 b7 b6 f8 3c 0e 30 9d 95 1c aa 27 81 0a fa 22 a9 ef 10 39 b6 ea f7 ba 78 e9 27 a5 a8 2f e1 ca 4b 2c 52 1f ec 29 3c 5b de f0 97 57 5e 6e 9c 43 11 12 71 84 0f 64 ba 9d 44 a3 b6 a3 7e ed 32 57 8e bc 86 72 78 6c 78 7c 00 ae 7d 19 0b 14 ec 2a 1e 43 db 79 ae 84 f3 04 f1 be 52 15 0a 11 6a 93 49 57 e7 e8 f9 7c 6d 6d 0d 7d 9f 4b 24 07 55 43 90 ed 87 13 05 f4 a3 1a aa 7a 5c 41 66 88 cd 1d 95 51 93 d4 46 72 fa 21 7b 05 85 12 92 ec 52 5e 5e 07 8c 98 7c 46 c1 19 fc 93 5f 01 9a 43 41 8a a4 57 58 1d 95 fc 03 0b ee 00 e9 49 c9 13 b1 bc 27 14 76 02 f1 f0 0c 65 57 da fd 0e 20 3c 90 84 0a 0f 31 3b 7e ed 71 ab 80 e0 c0 5f ed 75 bd 98 d8 15 5d 12 e4 b6 a1 40 14 05 9d 49 fd 88 dd 85 79 19 0a 04 c8 91 c9 5c 93 6d 7d 51 d3 c9 40 cd 82 06 e5 f6 82 Data Ascii: ^{Y8<0'"9x'/K,R)<[W^nCqdD~2Wrxlx\|}*CyRjIW\|mm}K$UCz\AfQFr!{R^^\|F_CAWXI'veW <1;~q_u]@Iy\m}Q@
2024-04-23 21:07:27 UTC	16384	IN	Data Raw: 8f 01 05 23 f7 77 93 0c 1e 65 80 76 93 fc 1e 00 92 42 5e b0 27 00 c0 a8 8f 33 f3 b9 46 e5 48 8a df a7 d1 28 ce ef b7 59 7b 15 f6 31 1a dd 45 f7 99 83 c6 9a 78 28 01 07 61 0e f9 76 f8 a0 55 a6 da 2d bf 97 a6 48 8d c2 2f 3e 32 f0 83 d1 c1 76 8b ec 1a 29 c0 3c 2d 3c dd ac 13 ba 59 71 bf 62 8e 48 f2 df 41 14 4a 43 cc 51 5f b9 c3 b9 e9 87 39 ff da a3 23 46 3f 87 3d b6 f1 fc b1 c7 40 eb 38 d8 67 85 52 47 7a c7 75 b8 5c e6 55 b3 f0 0c e2 cb bb 97 b1 2c 63 20 cb 8e 88 18 88 fb 26 ef df 04 ad 72 0c ca 90 74 d8 63 44 08 79 1b ae 1c 8c 1a 9c 57 0c b8 a9 66 a1 bc f7 c0 1c d5 0c f5 fc e4 54 d4 d4 24 68 2b 0d 66 64 b1 b9 55 1d 61 2a 58 5a 6b 93 b1 f5 3a fe f6 a8 b5 13 73 36 c4 93 e4 81 fb 77 9e 7f 17 fc ce 1f 52 0e 72 17 3e fc 6e 03 71 11 9c 86 0f d2 fe ed ec 1c c3 8b Data Ascii: #wevB^'3FH(Y{1Ex(avU-H/>2v)<-<YqbHAJCQ_9#F?=@8gRGzu\U,c &rtcDyWfT$h+fdUa*XZk:s6wRr>nq
2024-04-23 21:07:27 UTC	16384	IN	Data Raw: c9 28 ab a1 80 7d e5 be 1d 49 5a b6 b5 ef 36 48 bb 63 29 bd 5d 43 e8 c0 d7 f7 e7 c2 2e 82 24 5f f7 61 8d 51 98 1c 2a fb f1 37 aa 98 c3 d6 42 a7 e7 44 01 55 1e a3 96 a6 d9 72 39 54 0d 67 cc 16 11 72 61 47 6e a9 f7 2f 34 8e 75 83 41 62 fe 4c a1 1b b5 f1 de 35 ac 51 06 49 01 d4 ac 22 f3 46 4a 85 08 9c 04 61 b0 3e 60 c4 e9 e4 65 29 69 78 e3 d3 f0 cc 1d ac ad 85 92 c8 0f a6 81 82 84 d8 ec 8c ee 65 80 59 cc 95 d1 35 20 91 46 f4 f6 f7 79 1f 87 12 64 1c 3e 5c 89 c3 96 eb 5c 5d a7 0a b0 82 16 ca 06 16 0d 2a 65 5e 7e 91 ac 21 69 91 b8 6a 8c 1e b7 61 98 1d 2b e2 0f 03 41 b1 47 fd 35 11 ca b9 fa 19 7e 21 5e 82 f6 c4 c4 44 fb d0 79 ac fb ec 5d 07 17 cf 27 0f 0f 1b 1e 7d 6a ed 62 6d 63 a0 7b 98 bd 0c 26 6c f6 c0 8d 28 28 bc 99 08 b5 00 12 06 38 c7 d4 21 91 7a ed 1a 7c Data Ascii: (}IZ6Hc)]C.$_aQ7BDUr9TgraGn/4uAbL5QI"FJa>`e)ixeY5 Fyd>\\]e^~!ija+AG5~!^Dy]'}jbmc{&l((8!z\|
2024-04-23 21:07:27 UTC	16384	IN	Data Raw: d2 89 ec 14 c6 71 90 c5 2c 10 b6 c5 64 0c a1 b5 17 51 e8 d8 49 1a c5 7e e0 d9 16 67 96 07 dd 24 06 a6 67 2e 3a 13 22 4e b9 73 cb 7d 82 d5 6e 0c ea d9 91 1f 4a 28 29 42 84 10 bd 29 34 59 91 49 cb 71 33 c8 8f cc 8f f8 7e 3a 4b 3c 1b aa 5e ec 0a 88 73 a8 c7 2e 70 1b 4c 50 30 61 b9 01 0b 63 77 3f eb 64 34 23 cb 0f 33 61 45 71 04 25 c5 b1 53 c9 5c 11 3b 99 6b 5b 8e c3 3d 58 06 fb e9 2c b1 21 16 dc 14 aa 44 c8 05 38 b8 25 18 83 25 e0 07 a4 b2 40 4f be dd 36 cb 6a 37 46 33 8a 63 d8 a3 2e 4c 98 48 78 31 73 1d c1 63 c9 a5 6b 65 41 40 42 72 3f f4 e4 25 16 68 34 62 69 e6 63 4d 2c 1f 82 c9 e1 2c f6 3c d2 9e 03 08 f6 fd 4c 9d d1 8c 52 1f e4 93 49 2f b2 c0 c6 dd d0 b2 bd c8 66 98 4d b0 58 61 59 ce 5e 38 b9 e3 27 8e 23 20 f3 32 32 0b 6d 2b 86 24 77 98 b0 3d 3b 82 7c 8f Data Ascii: q,dQI~g$g.:"Ns}nJ()B)4YIq3~:K<^s.pLP0acw?d4#3aEq%S\;k[=X,!D8%%@O6j7F3c.LHx1sckeA@Br?%h4bicM,,<LRI/fMXaY^8'# 22m+$w=;\|
2024-04-23 21:07:27 UTC	16384	IN	Data Raw: 18 6c 2c f6 9b ef 1f 7c 0d 88 f3 e2 8c 6e 09 ca 4b 76 9e e6 a7 97 6d 74 b9 be 6d 45 8d 1c 88 56 2b 7f 92 3d 82 69 c1 d7 75 71 f3 72 a3 b1 f4 1b c5 24 ff 7b ee 78 7d f7 9e 81 d1 d1 65 7b 5f d0 49 30 7d cf 88 93 51 2f 5f 18 93 bf 90 56 f9 bb 05 b3 dc 6e 51 41 0e bb 72 21 68 39 5f 3f 0f da 21 38 9a 99 f6 2b 2b a7 19 15 8d 6f cb 09 dc 66 f7 dc 46 1f dd 1f 3f bb b6 8e fa f9 fa 2f 54 6a e6 35 cb a8 b3 c4 17 df 7f 11 b2 7c bb 28 2e 4e ca e2 e9 af 92 5f 2e 56 bc 42 eb 9f 3f df 8e ce d8 bc a9 19 fd f5 0b f1 ff 2f 42 dd a6 f1 db d1 b5 01 fb 4b 53 f4 57 85 9f cd b2 d5 9d 27 1b db aa be ff 11 31 e2 e4 42 4a 91 5e 9e 5f ec 5d 9c b7 30 a7 34 dd 7c 85 f2 fc 0f 8f 77 7b 94 90 ff f1 5a ed 70 c8 e6 0f 60 c3 fe 06 91 3f 5f 85 99 f2 2a 9f ca f2 26 d2 6e 41 15 be 32 37 f9 6f Data Ascii: l,\|nKvmtmEV+=iuqr${x}e{_I0}Q/_VnQAr!h9_?!8++ofF?/Tj5\|(.N_.VB?/BKSW'1BJ^_]04\|w{Zp`?_*&nA27o
2024-04-23 21:07:27 UTC	7384	IN	Data Raw: fc 2d 85 d6 bf 02 d1 ef ff 5d a3 67 31 c7 c1 fe e1 e0 88 7d 4b 51 0e 9b 95 b7 d0 3b 2d 42 59 54 73 07 dc 89 88 c3 c1 d3 14 f5 f1 f0 18 06 b4 7f bf c1 2d ae 97 78 e0 be 4f b4 b0 34 28 ed ba c4 41 83 fd 4b a2 cd fd 28 d8 9f 11 2d a5 ec 6b ff 86 68 3e e7 51 fb 1f a1 7e 95 71 ed bf 03 f4 57 b9 d6 fe 29 d4 bf a6 2b f1 d0 9d cf d1 74 b5 1f 6b 21 13 9e f2 27 d9 dd 53 84 fd b2 17 f5 07 18 c7 98 0f b9 c7 06 1b f7 fb 03 d8 00 e3 5e 16 6b 6e dc bf cb 67 3c 93 07 8f e3 04 ea d9 f9 0d 66 87 a0 f0 0c eb 60 81 4c 01 67 00 26 8c 4c 6b 4f 31 d3 d5 57 0e dd fe 8e ae a1 44 40 b3 2c 90 c1 7b fe 15 36 6a e4 3d fc e9 8b fc c7 ed 2d 19 70 64 bd 82 cd fa 7a f1 77 72 73 57 40 e6 c6 dc 83 82 43 45 81 42 b8 68 f0 db 7e fa 39 ca fc cb 1e ff 39 c0 1b 7c fd af be 9b 92 ce c7 c1 01 4c Data Ascii: -]g1}KQ;-BYTs-xO4(AK(-kh>Q~qW)+tk!'S^kng<f`Lg&LkO1WD@,{6j=-pdzwrsW@CEBh~99\|L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49729	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:26 UTC	654	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_0lriinjhzchre9aqecvmpg2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:27 UTC	812	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:26 GMT Content-Type: application/x-javascript Content-Length: 15776 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Tue, 02 Apr 2024 21:29:16 GMT ETag: 0x8DC535BF32A6F5D x-ms-request-id: 675ab5ec-101e-006f-0f6f-952ea3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210726Z-16f56cb894f4hxjjs88cmwhuqs00000001c00000000088ux x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 21:07:27 UTC	15572	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 dd 7d 4d 73 23 47 b2 d8 dd bf 02 8b 75 68 86 4f 3d 10 3e f8 89 11 34 06 01 70 06 4f 24 00 01 e0 50 0a 49 46 34 81 22 d8 4b a0 1b af bb 31 1c 2e 35 8e bd f9 f0 0e be da 37 1f 7c f2 d1 17 df fd 53 36 e2 f9 77 38 3f aa aa ab ba 1b 00 39 d2 d3 ee b3 42 c1 41 77 55 65 65 65 65 65 65 66 65 65 ff e1 66 ed 4f 63 2f f0 5f 8a bd 47 f5 bb 10 bc f4 f7 1e bd 9b 97 de 8f fe cf 7b a1 88 d7 a1 5f c0 df 25 f1 71 15 84 71 f4 fa 83 1b 16 e2 06 be 6a 3c ca 77 f5 c7 4f 8e 37 ab fb ce 22 70 67 62 56 ff 43 e5 d3 6b d9 54 60 d3 a9 bb 58 bc 8c 15 04 27 76 92 df c1 1e 3c 70 b3 c6 1f ca 49 c1 27 ec c6 6b 3c 6a 40 41 69 d9 10 4e 50 9a 36 3c f8 bb 6a 14 8b 4e f0 b2 bc f7 e9 e5 8f c9 30 9c c0 f1 00 f9 97 d5 3d c2 d2 6f 78 2f 2b 00 1f fe 39 d8 73 42 f8 e7 Data Ascii: }Ms#GuhO=>4pO$PIF4"K1.57\|S6w8?9BAwUeeeeeefeefOc/_G{_%qqj<wO7"pgbVCkT`X'v<pI'k<j@AiNP6<jN0=ox/+9sB
2024-04-23 21:07:27 UTC	204	IN	Data Raw: 21 98 40 24 97 c9 36 a2 5f 15 07 4d 2a 25 19 68 eb c1 2f c7 3d 42 39 4a 78 bc 4f 4b 2b 91 9c 07 b0 2f 4c 81 26 9d 0f 74 e6 0c f3 4f bf 26 4a f4 f1 15 55 c5 13 28 b5 26 81 7f 1e b8 78 67 08 34 d4 bc ca ca 3e b2 2b a3 83 8b 34 3c 10 46 7e fc 84 4e 30 23 1e 2b 07 60 c6 88 fd 67 b5 d5 d6 01 65 7b c3 db cf 3b 7b 4f 61 6d dd 36 45 00 78 99 5d 5d 1f 7a 0f 82 51 64 da cf b9 f7 6e 44 41 58 da 92 af ec a3 26 bf a5 a5 85 7b 72 df 77 7f 67 97 56 43 9e 4d 69 cb 63 db ca 0e 74 8d e1 26 e3 dc 2f 57 77 8e d3 68 98 ea b4 fa 9c 4e bf bd 18 75 b9 51 f5 d3 a7 9f f7 1c ce 0c 5a 9a 4c 1a 7f 28 bf fe 7f 60 2d 23 9e fd d6 00 00 Data Ascii: !@$6_M*%h/=B9JxOK+/L&tO&JU(&xg4>+4<F~N0#+`ge{;{Oam6Ex]]zQdnDAX&{rwgVCMict&/WwhNuQZL(`-#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49734	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:27 UTC	618	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:28 UTC	812	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:27 GMT Content-Type: application/x-javascript Content-Length: 54318 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 28 Mar 2024 21:22:21 GMT ETag: 0x8DC4F6D2782F92A x-ms-request-id: 1230f1e6-c01e-006a-406f-95a9a9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210727Z-16f56cb894f4g6rbudmdpega90000000014g00000000p7mh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 21:07:28 UTC	15572	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ec bd 6b 7b db 46 92 30 fa 7d 7f 05 85 67 46 06 4c 90 22 a9 8b 65 52 10 c7 76 92 79 bd 4f 12 fb d8 ce bc 67 8f cc c9 03 81 a0 84 98 02 b8 b8 d8 d6 88 dc df 7e aa aa ef 40 83 92 af c9 66 3c bb b1 88 46 a3 2f d5 dd d5 75 af bd fb 3b ff d1 b9 df e9 dd fd 7f 9d 97 af 1e bd 78 d5 79 f6 43 e7 d5 ff 79 fa e2 bb ce 73 78 fa af ce cf cf 5e 3d 7d f2 fd dd db c1 4e f1 bf 57 97 49 d1 59 24 cb b8 03 7f cf c3 22 9e 77 b2 b4 93 e5 9d 24 8d b2 7c 95 e5 61 19 17 9d 2b f8 37 4f c2 65 67 91 67 57 9d f2 32 ee ac f2 ec b7 38 2a 8b ce 32 29 4a f8 e8 3c 5e 66 ef 3a 2e 34 97 cf 3b cf c3 bc bc ee 3c 7d ee f5 a1 fd 18 5a 4b 2e 92 14 be 8e b2 d5 35 fc be 2c 3b 69 56 26 51 dc 09 d3 39 b5 b6 84 87 b4 88 3b 55 3a 8f f3 ce bb cb 24 ba ec fc 94 44 79 56 64 Data Ascii: k{F0}gFL"eRvyOg~@f<F/u;xyCysx^=}NWIY$"w$\|a+7OeggW28*2)J<^f:.4;<}ZK.5,;iV&Q9;U:$DyVd
2024-04-23 21:07:28 UTC	16384	IN	Data Raw: ee f1 db af d2 5f 8f f5 77 de dc 88 1f e4 95 05 4d 84 8d fd f5 21 1e 6b 84 f3 ea a9 30 85 40 d4 f4 35 13 66 96 42 33 ac 63 90 d2 34 a8 34 5c 17 c8 31 ad 89 10 98 41 cf 1d ac 27 d3 16 eb 49 66 37 39 36 6a e6 1e 9a 39 8b 9a ac 07 55 9d 9e 95 6c 10 cf 4d f8 ce 9a 65 85 4c 97 13 1d d1 d7 ac 98 f1 db 2c 33 f6 66 8b a1 ac dd 18 96 b0 03 f7 a4 33 16 ef 33 ba d0 e1 7e 36 8c c6 5b 84 cd f4 a5 66 55 60 f1 38 11 17 bf cd 37 83 48 03 66 fb 1c 93 12 8c 3b 60 a0 2e 6c 0a d4 f8 10 d5 61 43 6f 9c 6b 0e 18 cc 3d ca 17 ea c4 8d 3e d6 c7 d7 4d 8a 7f bb 0f cc 76 33 7d ab 07 4c 5e 9f b5 dd 19 21 6f 75 02 c8 95 94 19 30 30 89 65 0d ea b3 da 42 ba ef 6f 27 dd ef 4a d5 a2 3f 0c 31 19 44 cc 6e 67 32 b8 e5 b4 b9 d7 1b c4 5b dd 06 d2 9c 52 b2 65 4a 07 8d 29 19 87 5a 12 2b 79 43 d0 Data Ascii: _wM!k0@5fB3c44\1A'If796j9UlMeL,3f33~6[fU`87Hf;`.laCok=>Mv3}L^!ou00eBo'J?1Dng2[ReJ)Z+yC
2024-04-23 21:07:28 UTC	16384	IN	Data Raw: f4 05 45 5a 39 a3 01 4a aa 9d cc 68 1a 14 38 a8 b9 03 12 11 9b c5 ab 6d 58 97 46 d1 83 47 47 b4 f2 e8 b8 8e 72 f4 df 6f 92 0c db 87 b9 bc 0c 54 6e 6b 6c 47 1c 71 b0 25 2e 6c 37 a9 4a 69 c3 5e 6d cb fc a6 7c 51 dc bf ac 75 a5 00 11 76 ef 72 90 d7 94 63 f9 fa 1d 1f e5 ee aa bc ba 30 92 8c 6b 0b 5a a4 a5 25 83 97 92 df fb 94 d4 99 2b d8 52 77 37 16 f3 a9 42 71 73 fe d6 ab e8 e7 1b 86 ee 6f 31 5e d2 a5 67 85 28 07 32 44 cc 29 4d cc 57 d9 17 e5 eb f0 92 ca a5 a7 ed 84 34 ba 8e df 7b 05 9d bb c0 85 9c bf 63 f1 b9 a3 6f 7e 8d 16 9e 06 64 e9 95 78 65 83 2c bd 12 4f 75 69 d3 7a ef 95 2f 4e 9a d3 11 94 69 7f 3d 28 93 6b 24 67 fc c6 fe 7d 90 fd 7f 17 db eb ba 99 80 e2 76 7b 6b ad 6d 93 2f b7 b6 fd 02 3b 5b 6a 4b 83 a9 ad 6a 8d 63 71 4b 99 7f b9 d1 ad db d3 e5 9f 36 Data Ascii: EZ9Jh8mXFGGroTnklGq%.l7Ji^m\|Quvrc0kZ%+Rw7Bqso1^g(2D)MW4{co~dxe,Ouiz/Ni=(k$g}v{km/;[jKjcqK6
2024-04-23 21:07:28 UTC	5978	IN	Data Raw: eb 7e 57 6f 5d 03 e4 bb fe bd 31 61 61 7d 92 1c fc c6 80 78 52 70 a9 01 29 54 61 64 80 49 1d 85 a8 6b 7a be 30 70 47 23 6c 9e 34 af 86 b3 e9 c1 69 f1 e0 2f 1b 1a 76 0b 7d 16 b1 94 b7 fd c0 87 37 f0 7a 67 87 2d d1 c8 d2 0a bf e0 2e a0 06 b1 fb 67 56 7f 71 45 67 3b 0e 93 65 cc 23 17 d8 a0 b4 94 ec b9 5a 3a 66 45 f2 2a ab 76 1a cd ce 97 26 fc f3 4b 5e db 0d d6 56 21 2f 68 68 18 50 5a 54 7a e7 a7 02 d7 79 4f db 0b e8 bd 80 a7 a5 92 2c 73 bd 3f bc 7f f9 2c bb 9a 65 29 d9 fa ab 49 d1 a0 4d d2 1a be fa 85 53 fa 44 0f f9 b3 22 2e c3 79 39 e9 f4 8f 7a e7 51 11 1f 1e 08 7d 53 2c 16 2b 4b 56 b3 6a cc df 50 b7 e1 7d 7c f1 e2 d3 8c 44 03 af 71 2e 54 93 44 da 4f 69 27 a2 25 1b d7 d3 f2 2d 12 36 b8 4e d2 71 76 bd 0d 47 ec b9 b2 bd cd cc 84 ae 68 90 37 f8 a7 18 b6 7d 41 Data Ascii: ~Wo]1aa}xRp)TadIkz0pG#l4i/v}7zg-.gVqEg;e#Z:fE*v&K^V!/hhPZTzyO,s?,e)IMSD".y9zQ}S,+KVjP}\|Dq.TDOi'%-6NqvGh7}A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49735	52.96.69.2	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:27 UTC	936	OUT	GET /owa/prefetch.aspx HTTP/1.1 Host: outlook.office365.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ClientId=21005DA175D0486FB6CC7306B18DB8F9; OIDC=1; OpenIdConnect.nonce.v3.8lrqHfJIjxeKmLsEWTYt18TbOGRQMKZy88ZOq-mt830=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba; X-OWA-RedirectHistory=ArLym14BGS7xXtlj3Ag
2024-04-23 21:07:28 UTC	1555	IN	HTTP/1.1 200 OK Cache-Control: private, no-store Content-Length: 2745 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 request-id: d132bd3d-c029-977b-fc94-751a181a7cb4 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-CalculatedFETarget: SJ0PR05CU007.internal.outlook.com X-BackEndHttpStatus: 200 Set-Cookie: OWAPF=v:15.20.7472.44&l:mouse; path=/; secure; HttpOnly X-CalculatedBETarget: SJ0PR19MB4414.namprd19.prod.outlook.com X-BackEndHttpStatus: 200 X-RUM-Validated: 1 X-RUM-NotUpdateQueriedPath: 1 X-RUM-NotUpdateQueriedDbCopy: 1 X-Content-Type-Options: nosniff X-BeSku: WCS6 X-OWA-Version: 15.20.7472.44 X-OWA-DiagnosticsInfo: 1;0;0 X-IIDs: 0 X-BackEnd-Begin: 2024-04-23T21:07:28.085 X-BackEnd-End: 2024-04-23T21:07:28.085 X-DiagInfo: SJ0PR19MB4414 X-BEServer: SJ0PR19MB4414 X-UA-Compatible: IE=EmulateIE7 X-Proxy-RoutingCorrectness: 1 X-Proxy-BackendServerStatus: 200 X-FEProxyInfo: MN2PR19CA0025.NAMPRD19.PROD.OUTLOOK.COM X-FEEFZInfo: MNZ X-FEServer: SJ0PR05CA0181 Report-To: {"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=MNZ&RemoteIP=89.187.171.0"}],"include_subdomains":true} NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} X-FirstHopCafeEFZ: MNZ X-FEServer: MN2PR19CA0025 Date: Tue, 23 Apr 2024 21:07:28 GMT Connection: close
2024-04-23 21:07:28 UTC	2745	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 72 65 66 65 74 63 68 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0d 0a 0d 0a 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 6f 66 66 69 63 65 33 36 35 69 63 6f 6e 73 27 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 72 63 3a 20 75 72 6c 28 27 68 74 74 70 73 3a 2f Data Ascii: <!DOCTYPE html><html><head> <title>Prefetch</title> <meta http-equiv="x-ua-compatible" content="IE=Edge"> <style> @font-face { font-family: 'office365icons'; src: url('https:/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49739	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:29 UTC	672	OUT	GET /shared/1.0/content/images/appbackgrounds/49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:29 UTC	755	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:29 GMT Content-Type: image/jpeg Content-Length: 987 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:42 GMT ETag: 0x8DB5C3F457E15E1 x-ms-request-id: d0fc0239-f01e-0061-1cb8-958cbe000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210729Z-16f56cb894fq656zwwgapudkng00000001ag00000000aaaf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 21:07:29 UTC	987	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 66 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 04 01 1a 00 05 00 00 00 01 00 00 00 3e 01 1b 00 05 00 00 00 01 00 00 00 46 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 10 00 00 00 4e 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 70 61 69 6e 74 2e 6e 65 74 20 34 2e 32 2e 39 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a Data Ascii: JFIFHHfExifMM*>F(1NHHpaint.net 4.2.9CC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49740	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:29 UTC	666	OUT	GET /shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc2e13.jpg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:29 UTC	743	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:29 GMT Content-Type: image/jpeg Content-Length: 17453 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:42 GMT ETag: 0x8DB5C3F4584F323 x-ms-request-id: 3d78d514-e01e-0068-78c2-95ffad000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210729Z-16f56cb894fh72f9qnnhkssykg000000017g00000000pmbs x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-23 21:07:29 UTC	15641	IN	Data Raw: ff d8 ff e1 09 50 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e Data Ascii: Phttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syn
2024-04-23 21:07:29 UTC	1812	IN	Data Raw: 14 40 00 00 50 00 00 04 00 00 05 00 45 00 00 05 00 00 01 00 05 50 00 00 04 00 00 05 1f ff d3 db c0 6d cd 05 45 00 00 00 04 50 1c 8a 02 00 00 00 00 04 48 aa 0e 45 15 10 00 00 00 00 00 04 82 80 90 50 10 00 04 01 44 14 51 14 10 51 11 05 01 05 40 00 00 00 00 15 40 00 00 00 40 54 50 42 28 00 00 00 00 00 00 00 02 80 00 00 00 20 00 02 a2 8a 00 00 00 00 0a 02 00 00 00 02 28 00 8a 80 00 a0 02 0a 08 a8 28 08 a0 00 02 80 a8 22 80 88 a0 2a 28 00 02 00 28 20 a2 08 28 08 00 02 88 00 0a 82 80 8a 00 00 8a 00 00 08 00 00 02 00 00 00 0a 00 a8 a8 a0 82 a2 00 00 00 8a 00 a0 02 00 02 80 20 00 00 00 00 80 00 00 22 a0 a0 20 00 2a 2a 00 02 8a 80 8a 20 82 88 00 00 00 0a 00 a0 00 00 08 02 a8 8a 02 00 28 00 80 02 80 02 00 00 02 82 2a 28 00 02 80 00 00 8a 00 02 80 00 00 20 02 80 00 Data Ascii: @PEPmEPHEPDQQ@@@TPB( (("(( ( " * (*(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49736	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:29 UTC	660	OUT	GET /shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:29 UTC	755	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:29 GMT Content-Type: image/png Content-Length: 5139 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:45 GMT ETag: 0x8DB5C3F475BAFC0 x-ms-request-id: 7bb1bfc9-e01e-002c-58ad-9580b4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210729Z-16f56cb894fhc4lbn16aaspyen00000001b000000000a2pu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 21:07:29 UTC	5139	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 56 00 00 00 48 08 06 00 00 00 ad 04 dd dc 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 25 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 38 20 37 39 2e 31 36 34 30 33 36 2c 20 32 30 31 39 2f 30 38 2f 31 33 2d 30 31 3a 30 36 3a 35 37 20 20 Data Ascii: PNGIHDRVHtEXtSoftwareAdobe ImageReadyqe<%iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49737	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:29 UTC	663	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:29 UTC	779	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:29 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4911527F x-ms-request-id: e1b72844-a01e-0014-092d-95f9b4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210729Z-16f56cb894fs282r0ebn0f4ra400000001fg0000000003hp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 21:07:29 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49741	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:29 UTC	649	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:29 UTC	744	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:29 GMT Content-Type: image/x-icon Content-Length: 17174 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Sun, 18 Oct 2020 03:02:03 GMT ETag: 0x8D8731230C851A6 x-ms-request-id: d959b9ac-701e-003d-51d2-921b94000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210729Z-16f7b4795d4xckz44h8yg7a8u800000005g000000000b6ha x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 21:07:29 UTC	15640	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-04-23 21:07:29 UTC	1534	IN	Data Raw: 01 80 00 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 Data Ascii: ( @{L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49738	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:29 UTC	663	OUT	GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:29 UTC	778	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:29 GMT Content-Type: image/svg+xml Content-Length: 621 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:49 GMT ETag: 0x8DB5C3F49ED96E0 x-ms-request-id: c8148d51-601e-0060-6c1d-95a7bc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210729Z-16f56cb894fh72f9qnnhkssykg00000001b0000000004ws2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 21:07:29 UTC	621	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 7d 55 4d 6f 22 31 0c fd 2b a3 d9 ab 93 c9 f7 47 3b 20 cd 9e 38 6c af 1c b8 4d 0b 05 24 0a 55 19 41 57 ab fe f7 b5 93 a0 55 61 58 0d d8 60 27 ef 3d db 09 b4 c7 d3 ba fa 7c db ed 8f 93 7a 33 0c ef 0f 4d 73 3e 9f f9 59 f3 c3 c7 ba 51 42 88 06 57 d4 d5 79 bb 1c 36 93 da 84 ba da ac b6 eb cd 90 3f 9f b6 ab f3 cf c3 e7 a4 16 95 a8 4c c0 57 3d 6d 97 ab d7 e3 b4 3d 0e bf 77 ab 29 ef ff bc 6e 77 bb 87 fd 61 bf 7a fc e2 cf f9 db 0f 23 e8 79 fc 6a 9b bc ac 6d f2 a6 8f d5 cb 50 bd ec fa 23 ca e9 ef b1 36 d3 f6 bd 1f 36 97 75 cf 75 b5 9c d4 4f 46 80 56 dc fa 30 37 62 a6 d5 5c bb 99 0a 73 ad 66 ca cc 55 e0 de b9 4e 0a ee 42 84 e2 04 3e 12 64 04 2d 7a 0c a5 78 89 32 cb ad f1 4c 72 0b 52 72 29 dc c5 e5 ac e2 4a 46 cc 7a 19 3b 4c 68 af a1 b8 Data Ascii: }UMo"1+G; 8lM$UAWUaX`'=\|z3Ms>YQBWy6?LW=m=w)nwaz#yjmP#66uuOFV07b\sfUNB>d-zx2LrRr)JFz;Lh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49744	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:30 UTC	624	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:30 UTC	818	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:30 GMT Content-Type: application/x-javascript Content-Length: 35807 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 28 Mar 2024 21:22:22 GMT ETag: 0x8DC4F6D2855897D x-ms-request-id: 144b246a-101e-003b-7f6e-95e198000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210730Z-16f56cb894frt5xthgg03udhpc00000001bg00000000dt9a x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-23 21:07:30 UTC	15566	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e4 bd 7b 7f db 38 92 28 fa ff f9 14 b6 a6 c7 11 db b4 2c ea 2d db 8c c7 f1 a3 93 99 a4 93 cd a3 67 67 6c 75 86 a2 20 89 6d 8a 94 49 ca 8f c4 de cf 7e ab 0a 6f 52 76 92 d9 b3 e7 dc df bd 99 69 9a 28 14 0a 85 02 50 28 14 0a d4 ee cf 9b ff 6b e3 e7 8d 9d ef ff b7 f1 e1 e3 d1 fb 8f 1b 6f cf 36 3e be 7c f5 fe 64 e3 1d a4 fe b1 f1 eb db 8f af 8e 4f bf 9f 0e 56 8a ff 7d 9c 47 f9 c6 34 8a d9 06 fc 1d 07 39 9b 6c a4 c9 46 9a 6d 44 49 98 66 cb 34 0b 0a 96 6f 2c e0 99 45 41 bc 31 cd d2 c5 46 31 67 1b cb 2c fd 83 85 45 be 11 47 79 01 85 c6 2c 4e 6f 36 ea 40 2e 9b 6c bc 0b b2 e2 6e e3 d5 3b a7 01 f4 19 50 8b 66 51 02 a5 c3 74 79 07 ef f3 62 23 49 8b 28 64 1b 41 32 21 6a 31 24 92 9c 6d ac 92 09 cb 36 6e e6 51 38 df 78 13 85 59 9a a7 d3 62 Data Ascii: {8(,-gglu mI~oRvi(P(ko6>\|dOV}G49lFmDIf4o,EA1F1g,EGy,No6@.ln;PfQtyb#I(dA2!j1$m6nQ8xYb
2024-04-23 21:07:30 UTC	16384	IN	Data Raw: 4f af f8 09 26 49 9f 9a c9 ac 2f db 7b 3d 01 4b 6c c0 ad 5c 66 c9 c2 fe 50 de 71 12 52 09 48 4e bd bc f2 11 45 bc 58 21 ba a2 47 46 d5 87 97 e6 af 5f 11 4f 73 f3 f7 af 86 84 a3 31 06 1c 43 e5 d3 a0 c4 43 e7 b5 9f 64 a7 9c b5 d7 b5 cb a7 d7 6d 09 5b e7 3c 25 32 eb 0d 1f ca b2 bf ed 4e 37 11 f3 b9 f8 9d 1f 1c 80 1f a2 99 fa e2 23 d9 37 b9 01 08 15 60 2a 21 2d 09 b9 b6 21 fa f4 8d 27 8d 80 ec 80 43 d4 91 7a 5b a4 af 4a 00 f5 19 6a 26 d2 72 22 d0 8e d0 fc ce dc 44 a4 d5 05 cb 29 07 a8 50 6b 3a fe 00 80 b9 24 74 38 c8 fc 22 1c b1 5e fe fc 03 7d 77 95 ff 1c 97 1c 6a d4 b3 08 5e 3b 28 17 41 3e 97 73 98 36 b7 f9 c2 fe 92 32 d5 5c ee d0 45 24 e9 b7 05 40 7d c4 21 e0 49 e5 02 0b 45 5a 05 72 85 ea e6 ce 87 b7 67 1f f5 08 24 c4 74 5a e8 31 c8 21 b1 e1 ed 9f 0a 88 d4 Data Ascii: O&I/{=Kl\fPqRHNEX!GF_Os1CCdm[<%2N7#7`*!-!'Cz[Jj&r"D)Pk:$t8"^}wj^;(A>s62\E$@}!IEZrg$tZ1!
2024-04-23 21:07:30 UTC	3857	IN	Data Raw: dd 70 91 8d f3 87 61 00 dd ff 3a f4 d7 77 e3 1a 46 42 66 4c 17 cd cb 3d 86 54 93 33 e4 69 3e 41 20 99 a1 3a 91 6e 8f 2f 05 1f ca 6d 37 d1 44 fb 64 33 57 21 db 53 92 9a 56 e6 56 5f cc cc b0 a0 c3 cd 13 45 b4 ef b2 20 ad 33 4a 9a e0 a2 2a 96 2b 7c 66 c5 f8 96 33 d4 94 d1 79 70 64 d4 79 07 c6 18 d6 fa a7 34 05 2e ec 8d 85 fb 57 b8 78 f8 bc b5 8f 3e c7 44 4f 8e 32 38 7d ac fd a3 da 1b 27 70 de d4 3a 47 6f 9c 2d e2 f2 64 32 63 b8 0c 88 8b c7 0b 7d 7f c7 af ac 18 ae a0 6a 96 40 68 9b 6a 39 b9 e7 01 e4 ce 8f 49 b7 8d d1 2d 45 d7 f0 8b 8b b0 a1 a7 3d b3 fd d6 3b 82 8e 00 63 57 ee f4 ac 4f 7c 9f 4f a5 bc af 6c 75 25 4b 30 78 2a ce 00 48 95 68 dd 1e 24 c6 5b 2c 9f 3d 95 dc d9 59 48 71 3b da c7 0a 1b 2f 05 07 45 9d b7 42 fd 4c 3b 54 15 e9 66 50 a0 96 7a 7f dc db 24 Data Ascii: pa:wFBfL=T3i>A :n/m7Dd3W!SVV_E 3J+\|f3ypdy4.Wx>DO28}'p:Go-d2c}j@hj9I-E=;cWO\|Olu%K0xHh$[,=YHq;/EBL;TfPz$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49746	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:30 UTC	418	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:30 UTC	785	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:30 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4911527F x-ms-request-id: e1b72844-a01e-0014-092d-95f9b4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210730Z-16f56cb894f2bgjg7qau3rrudn00000001a000000000qh8f x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 21:07:30 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49747	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:30 UTC	415	OUT	GET /shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:30 UTC	755	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:30 GMT Content-Type: image/png Content-Length: 5139 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:45 GMT ETag: 0x8DB5C3F475BAFC0 x-ms-request-id: 7bb1bfc9-e01e-002c-58ad-9580b4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210730Z-16f56cb894frt5xthgg03udhpc00000001h0000000001w1r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 21:07:30 UTC	5139	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 56 00 00 00 48 08 06 00 00 00 ad 04 dd dc 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 25 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 38 20 37 39 2e 31 36 34 30 33 36 2c 20 32 30 31 39 2f 30 38 2f 31 33 2d 30 31 3a 30 36 3a 35 37 20 20 Data Ascii: PNGIHDRVHtEXtSoftwareAdobe ImageReadyqe<%iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49745	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:30 UTC	418	OUT	GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:30 UTC	805	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:30 GMT Content-Type: image/svg+xml Content-Length: 621 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:49 GMT ETag: 0x8DB5C3F49ED96E0 x-ms-request-id: c8148d51-601e-0060-6c1d-95a7bc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210730Z-16f56cb894fmjg64h30ef49wcc00000001gg0000000039e1 x-fd-int-roxy-purgeid: 4554691 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 21:07:30 UTC	621	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 7d 55 4d 6f 22 31 0c fd 2b a3 d9 ab 93 c9 f7 47 3b 20 cd 9e 38 6c af 1c b8 4d 0b 05 24 0a 55 19 41 57 ab fe f7 b5 93 a0 55 61 58 0d d8 60 27 ef 3d db 09 b4 c7 d3 ba fa 7c db ed 8f 93 7a 33 0c ef 0f 4d 73 3e 9f f9 59 f3 c3 c7 ba 51 42 88 06 57 d4 d5 79 bb 1c 36 93 da 84 ba da ac b6 eb cd 90 3f 9f b6 ab f3 cf c3 e7 a4 16 95 a8 4c c0 57 3d 6d 97 ab d7 e3 b4 3d 0e bf 77 ab 29 ef ff bc 6e 77 bb 87 fd 61 bf 7a fc e2 cf f9 db 0f 23 e8 79 fc 6a 9b bc ac 6d f2 a6 8f d5 cb 50 bd ec fa 23 ca e9 ef b1 36 d3 f6 bd 1f 36 97 75 cf 75 b5 9c d4 4f 46 80 56 dc fa 30 37 62 a6 d5 5c bb 99 0a 73 ad 66 ca cc 55 e0 de b9 4e 0a ee 42 84 e2 04 3e 12 64 04 2d 7a 0c a5 78 89 32 cb ad f1 4c 72 0b 52 72 29 dc c5 e5 ac e2 4a 46 cc 7a 19 3b 4c 68 af a1 b8 Data Ascii: }UMo"1+G; 8lM$UAWUaX`'=\|z3Ms>YQBWy6?LW=m=w)nwaz#yjmP#66uuOFV07b\sfUNB>d-zx2LrRr)JFz;Lh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49750	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:30 UTC	427	OUT	GET /shared/1.0/content/images/appbackgrounds/49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:30 UTC	734	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:30 GMT Content-Type: image/jpeg Content-Length: 987 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:42 GMT ETag: 0x8DB5C3F457E15E1 x-ms-request-id: d0fc0239-f01e-0061-1cb8-958cbe000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210730Z-16f56cb894fq656zwwgapudkng00000001bg000000007r6a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 21:07:30 UTC	987	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 66 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 04 01 1a 00 05 00 00 00 01 00 00 00 3e 01 1b 00 05 00 00 00 01 00 00 00 46 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 10 00 00 00 4e 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 70 61 69 6e 74 2e 6e 65 74 20 34 2e 32 2e 39 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a Data Ascii: JFIFHHfExifMM*>F(1NHHpaint.net 4.2.9CC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49751	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:30 UTC	404	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:30 UTC	744	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:30 GMT Content-Type: image/x-icon Content-Length: 17174 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Sun, 18 Oct 2020 03:02:03 GMT ETag: 0x8D8731230C851A6 x-ms-request-id: d959b9ac-701e-003d-51d2-921b94000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210730Z-16f7b4795d4zv6vn3f4pau5h6400000005bg000000009s0p x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 21:07:30 UTC	15640	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-04-23 21:07:30 UTC	1534	IN	Data Raw: 01 80 00 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 Data Ascii: ( @{L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49749	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:30 UTC	421	OUT	GET /shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc2e13.jpg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:30 UTC	763	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:30 GMT Content-Type: image/jpeg Content-Length: 17453 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:42 GMT ETag: 0x8DB5C3F4584F323 x-ms-request-id: 3d78d514-e01e-0068-78c2-95ffad000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210730Z-16f56cb894fff7nsaw34vw5a9w000000017000000000psvw x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-23 21:07:30 UTC	15621	IN	Data Raw: ff d8 ff e1 09 50 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e Data Ascii: Phttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syn
2024-04-23 21:07:30 UTC	1832	IN	Data Raw: 45 41 44 01 40 00 04 11 40 00 01 00 14 01 40 00 00 10 01 40 14 40 00 00 50 00 00 04 00 00 05 00 45 00 00 05 00 00 01 00 05 50 00 00 04 00 00 05 1f ff d3 db c0 6d cd 05 45 00 00 00 04 50 1c 8a 02 00 00 00 00 04 48 aa 0e 45 15 10 00 00 00 00 00 04 82 80 90 50 10 00 04 01 44 14 51 14 10 51 11 05 01 05 40 00 00 00 00 15 40 00 00 00 40 54 50 42 28 00 00 00 00 00 00 00 02 80 00 00 00 20 00 02 a2 8a 00 00 00 00 0a 02 00 00 00 02 28 00 8a 80 00 a0 02 0a 08 a8 28 08 a0 00 02 80 a8 22 80 88 a0 2a 28 00 02 00 28 20 a2 08 28 08 00 02 88 00 0a 82 80 8a 00 00 8a 00 00 08 00 00 02 00 00 00 0a 00 a8 a8 a0 82 a2 00 00 00 8a 00 a0 02 00 02 80 20 00 00 00 00 80 00 00 22 a0 a0 20 00 2a 2a 00 02 8a 80 8a 20 82 88 00 00 00 0a 00 a0 00 00 08 02 a8 8a 02 00 28 00 80 02 80 02 00 Data Ascii: EAD@@@@@PEPmEPHEPDQQ@@@TPB( (("(( ( " * (

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49748	52.159.127.243	443

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:30 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 70 43 66 4b 2f 2b 53 78 72 45 43 54 41 34 56 4e 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 37 33 34 39 37 37 65 31 65 31 65 65 32 61 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: pCfK/+SxrECTA4VN.1Context: 1734977e1e1ee2aa
2024-04-23 21:07:30 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-23 21:07:30 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 70 43 66 4b 2f 2b 53 78 72 45 43 54 41 34 56 4e 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 37 33 34 39 37 37 65 31 65 31 65 65 32 61 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 6c 62 2b 57 67 59 4e 43 38 55 37 6b 51 50 4a 79 72 44 31 34 53 77 45 71 2f 55 47 65 57 78 34 7a 74 51 6b 6b 30 53 57 61 66 59 30 6d 78 4d 34 46 4d 2f 56 61 6f 56 4d 51 53 65 36 50 68 52 57 4b 30 68 2f 4c 6a 30 52 35 5a 56 68 35 61 71 57 4c 37 31 49 64 33 51 32 50 48 75 56 47 69 55 70 6a 54 5a 47 53 69 38 66 42 4c 6f 4c 77 Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: pCfK/+SxrECTA4VN.2Context: 1734977e1e1ee2aa<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQlb+WgYNC8U7kQPJyrD14SwEq/UGeWx4ztQkk0SWafY0mxM4FM/VaoVMQSe6PhRWK0h/Lj0R5ZVh5aqWL71Id3Q2PHuVGiUpjTZGSi8fBLoLw
2024-04-23 21:07:30 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 70 43 66 4b 2f 2b 53 78 72 45 43 54 41 34 56 4e 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 37 33 34 39 37 37 65 31 65 31 65 65 32 61 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: pCfK/+SxrECTA4VN.3Context: 1734977e1e1ee2aa<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-23 21:07:30 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-23 21:07:30 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 66 6c 45 41 6e 37 4a 43 56 6b 79 6e 2f 6a 69 37 38 68 4d 4f 54 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: flEAn7JCVkyn/ji78hMOTA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49769	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:41 UTC	620	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_presetpasswordsplitter_f7fbb7540d7be2ae771b.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:41 UTC	791	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:41 GMT Content-Type: application/x-javascript Content-Length: 1663 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 28 Mar 2024 21:22:22 GMT ETag: 0x8DC4F6D28394798 x-ms-request-id: 27127949-e01e-002c-78c2-9580b4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210741Z-16f56cb894f79wk6x1g9kkehwn00000001cg00000000ap5b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-23 21:07:41 UTC	1663	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e5 57 5b 6f db 36 14 7e ef af 60 b4 87 d8 ad 24 df 93 c6 ad 07 b4 49 bb b4 6b 5a 23 f6 3a 0c 49 60 50 d2 b1 cd 44 22 05 92 b2 e3 a5 f9 ef 3b a4 25 c7 72 9c 2e 6d 31 60 c3 02 c4 b2 c9 73 f9 ce e5 3b a4 6a 4f 77 9e 90 a7 c4 7b fc 1f 19 0c 5f 9d 0e c9 a7 b7 64 78 fc ee f4 88 f4 f1 d7 1f e4 e3 a7 e1 bb c3 37 8f b7 63 9c 9a ff e1 94 29 32 66 31 10 7c 06 54 41 44 04 27 42 12 c6 43 21 53 21 a9 06 45 12 fc 94 8c c6 64 2c 45 42 f4 14 48 2a c5 25 84 5a 91 98 29 8d 4a 01 c4 62 4e 2a 68 4e 46 a4 4f a5 5e 90 77 fd aa 8f f6 01 ad b1 09 e3 a8 1d 8a 74 81 df a7 9a 70 a1 59 08 84 f2 c8 5a 8b f1 07 57 40 32 1e 81 24 f3 29 0b a7 e4 84 85 52 28 31 d6 44 42 08 6c 86 4e 54 86 eb 65 17 2e a1 12 88 02 4d c6 42 ea e9 12 87 4f 06 46 32 b7 aa ac 9b a5 Data Ascii: W[o6~`$IkZ#:I`PD";%r.m1`s;jOw{_dx7c)2f1\|TAD'BC!S!Ed,EBH%Z)JbNhNFO^wtpYZW@2$)R(1DBlNTe.MBOF2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49768	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:41 UTC	668	OUT	GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:41 UTC	734	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:41 GMT Content-Type: image/gif Content-Length: 2672 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:47 GMT ETag: 0x8DB5C3F48EC4154 x-ms-request-id: e098ad9f-c01e-0002-3857-92b39a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210741Z-16f7b4795d4d49mrgyqqa182d000000005m00000000047k3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 21:07:41 UTC	2672	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e 69 18 14 00 21 Data Ascii: GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~i!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49770	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:41 UTC	662	OUT	GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:41 UTC	734	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:41 GMT Content-Type: image/gif Content-Length: 3620 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4904824B x-ms-request-id: 282428d9-c01e-0012-5021-9503b8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210741Z-16f56cb894f4vddwunf4vet99g00000001dg0000000005fd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 21:07:41 UTC	3620	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 0f Data Ascii: GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49771	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:41 UTC	417	OUT	GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:41 UTC	734	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:41 GMT Content-Type: image/gif Content-Length: 3620 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4904824B x-ms-request-id: 282428d9-c01e-0012-5021-9503b8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210741Z-16f56cb894fm2nn6atvm3qhr2s000000017000000000rsqg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 21:07:41 UTC	3620	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 0f Data Ascii: GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49772	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:41 UTC	423	OUT	GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:41 UTC	734	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:41 GMT Content-Type: image/gif Content-Length: 2672 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:47 GMT ETag: 0x8DB5C3F48EC4154 x-ms-request-id: 5901b676-e01e-003c-6525-953096000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210741Z-16f56cb894fgfkq7x5vadqkcdg000000019g00000000k3dw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 21:07:41 UTC	2672	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e 69 18 14 00 21 Data Ascii: GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~i!

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49773	52.159.127.243	443

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:42 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 64 6b 54 58 4e 41 57 70 30 45 75 67 76 70 72 57 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 30 33 65 37 31 64 61 37 37 33 32 63 65 66 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: dkTXNAWp0EugvprW.1Context: 803e71da7732cefc
2024-04-23 21:07:42 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-23 21:07:42 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 64 6b 54 58 4e 41 57 70 30 45 75 67 76 70 72 57 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 30 33 65 37 31 64 61 37 37 33 32 63 65 66 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 6c 62 2b 57 67 59 4e 43 38 55 37 6b 51 50 4a 79 72 44 31 34 53 77 45 71 2f 55 47 65 57 78 34 7a 74 51 6b 6b 30 53 57 61 66 59 30 6d 78 4d 34 46 4d 2f 56 61 6f 56 4d 51 53 65 36 50 68 52 57 4b 30 68 2f 4c 6a 30 52 35 5a 56 68 35 61 71 57 4c 37 31 49 64 33 51 32 50 48 75 56 47 69 55 70 6a 54 5a 47 53 69 38 66 42 4c 6f 4c 77 Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: dkTXNAWp0EugvprW.2Context: 803e71da7732cefc<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQlb+WgYNC8U7kQPJyrD14SwEq/UGeWx4ztQkk0SWafY0mxM4FM/VaoVMQSe6PhRWK0h/Lj0R5ZVh5aqWL71Id3Q2PHuVGiUpjTZGSi8fBLoLw
2024-04-23 21:07:42 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 64 6b 54 58 4e 41 57 70 30 45 75 67 76 70 72 57 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 30 33 65 37 31 64 61 37 37 33 32 63 65 66 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: dkTXNAWp0EugvprW.3Context: 803e71da7732cefc<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-23 21:07:42 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-23 21:07:42 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 71 58 53 65 52 32 57 51 37 55 4b 31 74 38 51 58 64 6f 37 72 67 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: qXSeR2WQ7UK1t8QXdo7rgw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49775	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:42 UTC	667	OUT	GET /shared/1.0/content/images/picker_account_msa_3b879963b4f70829fd7a25cbc9519792.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:42 UTC	799	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:42 GMT Content-Type: image/svg+xml Content-Length: 254 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F496CFFA1 x-ms-request-id: ccb2cbc4-901e-0067-1774-9576b2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210742Z-16f56cb894f6dbs8zd0w00kxw800000001ag000000005396 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 21:07:42 UTC	254	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 6d 50 cb 6e c3 20 10 fc 15 44 af 78 59 30 06 5c d9 96 d2 7b 7f 20 37 cb a1 06 c9 79 c8 46 21 fd fb 9a 90 f6 54 0d 9a 59 98 59 ad 96 6e bb cf e4 71 5e 2e 5b 4f 7d 8c b7 77 ce 53 4a 90 6a b8 ae 33 97 88 c8 f7 04 25 29 9c a2 ef a9 b2 94 78 17 66 1f 4b 7d 0f 2e 7d 5c 1f 3d 45 82 44 d9 fd d0 a1 8b 21 2e 6e 18 b7 cd c5 ad e3 e5 d6 4d 61 9d 16 47 a6 3d 2b 15 25 d3 77 d1 b5 c8 57 58 96 9e be 39 9d 41 f9 d0 dd c6 e8 c9 a9 a7 9f a2 06 a5 58 ad bd 80 56 8e 16 b4 62 4f 42 26 32 0c 48 cb b0 98 02 a1 31 35 7b 09 66 54 1a 1a dd 56 2d 18 23 98 01 6d 0b e5 66 ac 0c b4 56 32 3c fc d3 c7 7e c7 1e cf 0a 6c 25 34 d4 f2 d0 80 d1 ec 49 65 b8 54 4c 36 39 96 df f4 8b b1 98 16 76 57 b4 fb b0 e3 df 76 0a 33 f2 76 f9 4f 87 1f 7d d7 81 14 7b 01 00 00 Data Ascii: mPn DxY0\{ 7yF!TYYnq^.[O}wSJj3%)xfK}.}\=ED!.nMaG=+%wWX9AXVbOB&2H15{fTV-#mfV2<~l%4IeTL69vWv3vO}{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49774	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:42 UTC	667	OUT	GET /shared/1.0/content/images/picker_account_aad_a8332c62695d74843a11daf39a74e552.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:42 UTC	784	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:42 GMT Content-Type: image/svg+xml Content-Length: 628 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4963155C x-ms-request-id: f09df6d2-601e-0018-6126-940dad000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210742Z-16f7b4795d4nbvvttx1cz5p6e4000000064g0000000085tz x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 21:07:42 UTC	628	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 6d 94 4d 6f db 30 0c 86 ff 8a e1 5d 25 46 d4 97 a5 36 09 90 9d 72 58 af 3b f4 e6 26 69 1d c0 5d 8b 26 48 5a 0c fd ef 23 25 ba cb d6 42 f1 e3 98 34 c5 57 24 93 f9 e1 f4 d0 bc 3e 8e bf 0e 8b 76 38 1e 9f af 66 b3 f3 f9 0c 67 07 4f 2f 0f 33 6b 8c 99 d1 1b 6d 73 de 6f 8f c3 a2 f5 a9 6d 86 dd fe 61 38 d6 ef a7 fd ee fc fd e9 75 d1 9a c6 34 3e d1 a7 5d ce b7 bb fb c3 72 7e 38 be 8d bb 25 f4 bf ef f7 e3 78 f5 6d 17 79 5d bf c3 9d 18 bc e1 75 fd 3e 9f d5 37 e7 b3 1a b7 d9 bf 6c c6 5d b3 19 fb 03 69 ea db 66 43 db 5b 4f f7 b7 7a 7f 29 b7 d9 72 fe dc 1f 87 e9 bd bb b6 d9 2e da 1b 67 21 28 f4 2b 04 9f ad aa 34 b4 50 39 af 30 40 f8 e9 12 84 e2 f6 aa 52 dc 1c e8 cd a0 b1 fb c2 8b 5e 71 dc 49 5b f7 95 37 94 a4 83 87 d4 b9 51 3b 1d 07 0b 36 Data Ascii: mMo0]%F6rX;&i]&HZ#%B4W$>v8fgO/3kmsoma8u4>]r~8%xmy]u>7l]ifC[Oz)r.g!(+4P90@R^qI[7Q;6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49776	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:42 UTC	422	OUT	GET /shared/1.0/content/images/picker_account_msa_3b879963b4f70829fd7a25cbc9519792.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:43 UTC	799	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:42 GMT Content-Type: image/svg+xml Content-Length: 254 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F496CFFA1 x-ms-request-id: ccb2cbc4-901e-0067-1774-9576b2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210742Z-16f56cb894fh72f9qnnhkssykg000000016g00000000rgr1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 21:07:43 UTC	254	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 6d 50 cb 6e c3 20 10 fc 15 44 af 78 59 30 06 5c d9 96 d2 7b 7f 20 37 cb a1 06 c9 79 c8 46 21 fd fb 9a 90 f6 54 0d 9a 59 98 59 ad 96 6e bb cf e4 71 5e 2e 5b 4f 7d 8c b7 77 ce 53 4a 90 6a b8 ae 33 97 88 c8 f7 04 25 29 9c a2 ef a9 b2 94 78 17 66 1f 4b 7d 0f 2e 7d 5c 1f 3d 45 82 44 d9 fd d0 a1 8b 21 2e 6e 18 b7 cd c5 ad e3 e5 d6 4d 61 9d 16 47 a6 3d 2b 15 25 d3 77 d1 b5 c8 57 58 96 9e be 39 9d 41 f9 d0 dd c6 e8 c9 a9 a7 9f a2 06 a5 58 ad bd 80 56 8e 16 b4 62 4f 42 26 32 0c 48 cb b0 98 02 a1 31 35 7b 09 66 54 1a 1a dd 56 2d 18 23 98 01 6d 0b e5 66 ac 0c b4 56 32 3c fc d3 c7 7e c7 1e cf 0a 6c 25 34 d4 f2 d0 80 d1 ec 49 65 b8 54 4c 36 39 96 df f4 8b b1 98 16 76 57 b4 fb b0 e3 df 76 0a 33 f2 76 f9 4f 87 1f 7d d7 81 14 7b 01 00 00 Data Ascii: mPn DxY0\{ 7yF!TYYnq^.[O}wSJj3%)xfK}.}\=ED!.nMaG=+%wWX9AXVbOB&2H15{fTV-#mfV2<~l%4IeTL69vWv3vO}{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49777	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:42 UTC	422	OUT	GET /shared/1.0/content/images/picker_account_aad_a8332c62695d74843a11daf39a74e552.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:43 UTC	784	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:42 GMT Content-Type: image/svg+xml Content-Length: 628 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4963155C x-ms-request-id: f09df6d2-601e-0018-6126-940dad000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210742Z-16f7b4795d4hbs9nymf33py59c00000005w0000000004uh5 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 21:07:43 UTC	628	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 6d 94 4d 6f db 30 0c 86 ff 8a e1 5d 25 46 d4 97 a5 36 09 90 9d 72 58 af 3b f4 e6 26 69 1d c0 5d 8b 26 48 5a 0c fd ef 23 25 ba cb d6 42 f1 e3 98 34 c5 57 24 93 f9 e1 f4 d0 bc 3e 8e bf 0e 8b 76 38 1e 9f af 66 b3 f3 f9 0c 67 07 4f 2f 0f 33 6b 8c 99 d1 1b 6d 73 de 6f 8f c3 a2 f5 a9 6d 86 dd fe 61 38 d6 ef a7 fd ee fc fd e9 75 d1 9a c6 34 3e d1 a7 5d ce b7 bb fb c3 72 7e 38 be 8d bb 25 f4 bf ef f7 e3 78 f5 6d 17 79 5d bf c3 9d 18 bc e1 75 fd 3e 9f d5 37 e7 b3 1a b7 d9 bf 6c c6 5d b3 19 fb 03 69 ea db 66 43 db 5b 4f f7 b7 7a 7f 29 b7 d9 72 fe dc 1f 87 e9 bd bb b6 d9 2e da 1b 67 21 28 f4 2b 04 9f ad aa 34 b4 50 39 af 30 40 f8 e9 12 84 e2 f6 aa 52 dc 1c e8 cd a0 b1 fb c2 8b 5e 71 dc 49 5b f7 95 37 94 a4 83 87 d4 b9 51 3b 1d 07 0b 36 Data Ascii: mMo0]%F6rX;&i]&HZ#%B4W$>v8fgO/3kmsoma8u4>]r~8%xmy]u>7l]ifC[Oz)r.g!(+4P90@R^qI[7Q;6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49716	52.96.165.34	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:50 UTC	874	OUT	GET /owa/ HTTP/1.1 Host: outlook.office365.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ClientId=21005DA175D0486FB6CC7306B18DB8F9; OIDC=1; OpenIdConnect.nonce.v3.8lrqHfJIjxeKmLsEWTYt18TbOGRQMKZy88ZOq-mt830=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba; X-OWA-RedirectHistory=ArLym14BGS7xXtlj3Ag
2024-04-23 21:07:50 UTC	6078	IN	HTTP/1.1 302 Content-Length: 785 Content-Type: text/html; charset=utf-8 Location: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=4b25dd10-2516-35d5-28c7-714815154269&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032708125745.ca9a9b3d-f749-4636-97af-6af497f38b4b&state=DcsxEoAwCABBouNzMDEQCM8hOrSWfl-Kve4KAOxpS6VlQIUm22jUtc2rD-Vx3m5uix4MZUMWEjT1QPFg06C5eJV8j_p-Xn8 Server: Microsoft-IIS/10.0 request-id: 4b25dd10-2516-35d5-28c7-714815154269 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-CalculatedFETarget: PH8PR05CU001.internal.outlook.com X-BackEndHttpStatus: 302 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: RoutingKeyCookie=; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OpenIdConnect.nonce.v3.N3qRrA14YiorlN6zmhaE1YEQyahs_lsaF3ZixY0HMvg=638495032708125745.ca9a9b3d-f749-4636-97af-6af497f38b4b; expires=Tue, 23-Apr-2024 22:07:50 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: HostSwitchPrg=; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OptInPrg=; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: SuiteServiceProxyKey=; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: RoutingKeyCookie=; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OpenIdConnect.nonce.v3.N3qRrA14YiorlN6zmhaE1YEQyahs_lsaF3ZixY0HMvg=638495032708125745.ca9a9b3d-f749-4636-97af-6af497f38b4b; expires=Tue, 23-Apr-2024 22:07:50 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: HostSwitchPrg=; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: OptInPrg=; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: SuiteServiceProxyKey=; expires=Sat, 23-Apr-1994 21:07:50 GMT; path=/; secure Set-Cookie: X-OWA-RedirectHistory=ArLym14Bi7Ztb9lj3Ag\|ArLym14BGS7xXtlj3Ag; expires=Wed, 24-Apr-2024 03:09:50 GMT; path=/;SameSite=None; secure; HttpOnly X-CalculatedBETarget: PH0PR03MB6786.namprd03.prod.outlook.com X-BackEndHttpStatus: 302 X-RUM-Validated: 1 X-RUM-NotUpdateQueriedPath: 1 X-RUM-NotUpdateQueriedDbCopy: 1 X-Content-Type-Options: nosniff X-BeSku: WCS7 X-OWA-DiagnosticsInfo: 1;0;0 X-IIDs: 0 X-BackEnd-Begin: 2024-04-23T21:07:50.812 X-BackEnd-End: 2024-04-23T21:07:50.828 X-DiagInfo: PH0PR03MB6786 X-BEServer: PH0PR03MB6786 X-UA-Compatible: IE=EmulateIE7 X-Proxy-RoutingCorrectness: 1 X-Proxy-BackendServerStatus: 302 X-FEProxyInfo: BN9PR03CA0176.NAMPRD03.PROD.OUTLOOK.COM X-FEEFZInfo: LYH X-FEServer: PH8PR05CA0003 Report-To: {"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=LYH&RemoteIP=89.187.171.0"}],"include_subdomains":true} NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} X-FirstHopCafeEFZ: LYH X-FEServer: BN9PR03CA0176 Date: Tue, 23 Apr 2024 21:07:50 GMT Connection: close
2024-04-23 21:07:50 UTC	785	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 2f 63 6f 6d 6d 6f 6e 2f 6f 61 75 74 68 32 2f 61 75 74 68 6f 72 69 7a 65 3f 63 6c 69 65 6e 74 5f 69 64 3d 30 30 30 30 30 30 30 32 2d 30 30 30 30 2d 30 66 66 31 2d 63 65 30 30 2d 30 30 30 30 30 30 30 30 30 30 30 30 26 61 6d 70 3b 72 65 64 69 72 65 63 74 5f 75 72 69 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 6f 75 74 6c 6f 6f 6b 2e 6f 66 66 69 63 65 33 36 35 2e 63 6f 6d 25 32 66 6f 77 61 25 32 66 26 61 6d 70 3b 72 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49779	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:52 UTC	635	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:52 UTC	798	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:52 GMT Content-Type: application/x-javascript Content-Length: 121212 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 27 Mar 2024 20:03:18 GMT ETag: 0x8DC4E98F25B224F x-ms-request-id: fcbbcc8e-e01e-003c-8062-923096000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210752Z-16f7b4795d4zv6vn3f4pau5h6400000005c0000000009hb0 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 21:07:52 UTC	15586	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e4 bd 6d 7b e3 38 8e 00 f8 fd 7e 85 a3 99 cb d8 1d c5 25 f9 dd 4a ab b3 ae bc 54 65 3b 89 33 71 aa bb 77 53 99 3c b2 44 3b ea c8 92 57 92 f3 32 8e f7 b7 1f 00 92 12 65 cb a9 aa d9 bd bb e7 9e eb 9d ad 58 24 48 82 20 08 82 20 08 7e f8 69 e7 ff a8 fc 54 d9 ff fe ff 2a a3 9b c1 f5 4d 65 78 5a b9 f9 7c 76 7d 5c b9 82 af ff a8 5c 0e 6f ce 8e 4e be bf 1e 6c 14 ff ff e6 c1 4f 2a 13 3f 60 15 f8 3b 76 12 e6 55 a2 b0 12 c5 15 3f 74 a3 78 1e c5 4e ca 92 ca 0c fe 8d 7d 27 a8 4c e2 68 56 49 1f 58 65 1e 47 7f 32 37 4d 2a 81 9f a4 50 68 cc 82 e8 b9 52 85 ea 62 af 72 e5 c4 e9 6b e5 ec aa 56 87 fa 19 d4 e6 4f fd 10 4a bb d1 fc 15 7e 3f a4 95 30 4a 7d 97 55 9c d0 a3 da 02 f8 08 13 56 59 84 1e 8b 2b cf 0f be fb 50 b9 f0 dd 38 4a a2 49 5a 89 99 Data Ascii: m{8~%JTe;3qwS<D;W2eX$H ~iTMexZ\|v}\\oNlO?`;vU?txN}'LhVIXeG27M*PhRbrkVOJ~?0J}UVY+P8JIZ
2024-04-23 21:07:52 UTC	16384	IN	Data Raw: b0 ef 62 55 51 a0 e9 cb 27 9f 3d a3 6d 30 b0 96 7c 26 fd 96 25 94 cd 6e 7f 53 66 e2 3e 4f 84 75 40 c2 24 a5 97 0f f8 d6 24 84 7c 74 3a 5e e5 77 0c 50 d0 e0 48 a7 e4 a8 89 96 43 e0 35 59 9f 95 56 9b 2d 34 b0 bd 86 78 37 2c c4 37 73 77 22 75 f3 e1 5f 38 2f 74 af 05 16 86 5f 43 fe 3c 3d 39 b2 67 1c 9f bc bd 49 de aa 97 df 9b a9 fe 68 8d 30 ef 14 1b 60 52 e4 74 98 9b 75 8a ef 91 f0 a7 31 48 37 d3 fe f2 df 7f b9 60 a8 33 a1 2e 75 7f 3e 82 6f 1e 4f 8c 79 f6 52 04 b2 e2 af 08 43 ce 9c 3f 54 ca 0f 32 10 12 63 4c 89 fd 03 e6 67 01 0a f2 87 0f 44 95 f2 8d d3 22 98 48 5c 6b 9a 42 5e 70 61 84 28 5c 46 29 86 d1 a3 bd 16 05 99 a2 9f 57 bf 1f 5b 26 de 65 7f c0 58 1c f8 ec 2e 8f 58 26 6d 0a 32 b0 08 46 e5 c8 43 8b 90 d6 78 01 6b ee 20 f0 9d 84 82 72 cd c6 e8 57 cf 9f 5b Data Ascii: bUQ'=m0\|&%nSf>Ou@$$\|t:^wPHC5YV-4x7,7sw"u_8/t_C<=9gIh0`Rtu1H7`3.u>oOyRC?T2cLgD"H\kB^pa(\F)W[&eX.X&m2FCxk rW[
2024-04-23 21:07:52 UTC	16384	IN	Data Raw: 31 80 37 9e 6f 95 62 00 67 7f 3b 0e f0 ad 2d 3e 8d 03 4c e7 25 87 ea 49 53 05 7d 91 d4 77 88 1c 5b f5 7b 53 3c f7 93 52 d4 97 70 ed 39 16 a9 0f f6 14 9e ad 6e f9 ab 6b cf b7 ce a1 08 89 38 c2 07 32 dd 4e a2 51 e0 a8 5f 6f 98 2b 47 5e 43 39 3c 36 3c 3e 00 d7 be 8c 05 0a 76 15 8f 21 70 9e 2a e1 3c 42 bc af 55 85 42 84 da 64 d2 d5 39 7a 3e df d8 20 df e7 12 c9 41 d5 10 64 fb e1 44 01 fd a8 86 aa 1e 57 90 19 62 73 47 65 d4 24 b5 91 9c 7e c8 5e 41 a1 84 24 bb 94 97 d7 01 23 26 9f 51 70 06 ff e4 57 80 e6 50 90 22 e9 15 56 47 25 ff c0 82 3b 40 7a 52 f2 44 2c ef 09 85 9d 40 3c 3c 43 d9 95 76 bf 03 08 0f 24 a1 c2 43 cc 8e 5f 7b dc 2a 20 38 f0 57 7b 5d 2f 26 76 45 97 04 b9 6d 28 10 45 41 67 52 3f 62 77 69 51 86 02 01 72 64 32 d7 64 5b 5f d4 74 32 50 b3 a0 41 b9 bd Data Ascii: 17obg;->L%IS}w[{S<Rp9nk82NQ_o+G^C9<6<>v!p<BUBd9z> AdDWbsGe$~^A$#&QpWP"VG%;@zRD,@<<Cv$C_{ 8W{]/&vEm(EAgR?bwiQrd2d[_t2PA
2024-04-23 21:07:52 UTC	16384	IN	Data Raw: 64 f0 28 03 b4 9b e4 f7 00 90 14 f2 82 3d 01 00 46 7d 9c b9 cf 35 2a 47 52 fc 3e 8d 46 71 7e bf c3 da ab b0 8f d1 e8 2e ba cf 1c 34 d6 c4 43 09 38 08 73 c8 77 c2 07 ad 32 15 b4 fd 5e 9a 22 35 0a bf f8 c8 c0 0f 46 07 83 36 d9 35 52 80 79 5a 78 ba 59 27 74 b3 e2 7e c5 1c 91 e4 bf 83 28 94 86 98 a3 be 72 87 73 d3 0f 73 fe b5 47 47 8c 7e 0e 7b 6c e3 f9 63 8f 81 d6 71 73 9f 15 4a 1d e9 1d d7 e1 72 99 57 cd c2 33 88 2f ef 5e c6 b2 8c 81 2c 3b 22 62 20 ee 9b bc 7f 13 b4 ca 31 28 43 d2 61 8f 11 21 e4 6d b8 72 30 6a 70 5e 31 e0 96 9a 85 f2 de 03 73 54 33 d4 f3 93 53 51 53 93 a0 ad 34 98 91 c5 e6 56 75 84 a9 60 69 ad 4d c6 d6 eb f8 db a3 d6 4e cc d9 10 4f 92 07 ee df 79 fe 5d f3 77 fe 90 72 90 bb f0 e1 77 1b 88 8b e6 69 f8 20 ed df ce ce 31 bc 78 d6 0f db 73 3f 53 Data Ascii: d(=F}5*GR>Fq~.4C8sw2^"5F65RyZxY't~(rssGG~{lcqsJrW3/^,;"b 1(Ca!mr0jp^1sT3SQS4Vu`iMNOy]wrwi 1xs?S
2024-04-23 21:07:52 UTC	16384	IN	Data Raw: 57 ee db 91 a4 65 5b fb 6e 83 b4 3b 96 d2 db 35 84 0e 7c 7d 7f 2e ec 22 48 f2 75 1f d6 18 85 c9 a1 b2 1f 7f a3 8a 39 6c 2d 74 7a 4e 14 50 e5 31 6a 69 9a 2d 97 43 d5 70 c6 6c 11 21 17 76 e4 96 7a ff 42 e3 58 37 18 24 e6 cf 14 ba 51 1b ef 5d c3 1a 65 90 14 40 cd 2a 32 6f a4 54 88 c0 49 10 06 eb 03 46 9c 4e 5e 96 92 86 37 3e 0d cf dc c1 da 5a 28 89 fc 60 1a 28 48 88 cd ce e8 5e 06 98 c5 5c 19 5d 03 12 69 44 6f 7f 9f f7 71 28 41 c6 e1 c3 95 38 6c b9 ce d5 75 aa 00 2b 68 a1 6c 60 d1 a0 52 e6 e5 17 c9 1a 92 16 89 ab c6 e8 71 1b 86 d9 b1 22 fe 30 10 14 7b d4 5f 13 a1 9c ab 9f e1 17 e2 25 68 4f 4c 4c b4 0f 9d c7 ba cf de 75 70 f1 7c f2 f0 b0 e1 d1 a7 d6 2e d6 36 06 ba 87 d9 cb 60 c2 66 0f dc 88 82 c2 9b 89 50 0b 20 61 80 73 4c 1d 12 a9 d7 ae c1 07 ce 9d 75 2f 7b Data Ascii: We[n;5\|}."Hu9l-tzNP1ji-Cpl!vzBX7$Q]e@*2oTIFN^7>Z(`(H^\]iDoq(A8lu+hl`Rq"0{_%hOLLup\|.6`fP asLu/{
2024-04-23 21:07:52 UTC	16384	IN	Data Raw: 51 e8 d8 49 1a c5 7e e0 d9 16 67 96 07 dd 24 06 a6 67 2e 3a 13 22 4e b9 73 c3 7d 82 d5 6e 0c ea d9 91 1f 4a 28 29 42 84 10 bd 29 34 59 91 49 cb 71 33 c8 8f cc 8f f8 6e 3a 4b 3c 1b aa 5e ec 0a 88 73 a8 c7 2e 70 1b 4c 50 30 61 b9 01 0b 63 77 37 eb 64 34 23 cb 0f 33 61 45 71 04 25 c5 b1 53 c9 5c 11 3b 99 6b 5b 8e c3 3d 58 06 bb e9 2c b1 21 16 dc 14 aa 44 c8 05 38 b8 25 18 83 25 e0 07 a4 b2 40 4f be d9 36 cb 6a 37 46 33 8a 63 d8 a3 2e 4c 98 48 78 31 73 1d c1 63 c9 a5 6b 65 41 40 42 72 37 f4 e4 25 16 68 34 62 69 e6 63 4d 2c 1f 82 c9 e1 2c f6 3c d2 9e 03 08 f6 dd 4c 9d d1 8c 52 1f e4 93 49 2f b2 c0 c6 dd d0 b2 bd c8 66 98 4d b0 58 61 59 ce 4e 38 b9 e3 27 8e 23 20 f3 32 32 0b 6d 2b 86 24 77 98 b0 3d 3b 82 7c 8f bc 30 0e 77 d2 8d d1 8c 62 e1 87 91 6d 05 ae 13 79 Data Ascii: QI~g$g.:"Ns}nJ()B)4YIq3n:K<^s.pLP0acw7d4#3aEq%S\;k[=X,!D8%%@O6j7F3c.LHx1sckeA@Br7%h4bicM,,<LRI/fMXaYN8'# 22m+$w=;\|0wbmy
2024-04-23 21:07:52 UTC	16384	IN	Data Raw: fa 8d 62 92 ff 9a 3b 5e 4f df 33 30 3a ba 6c ef 2b 3a 09 a6 ef 19 71 32 ea e5 2b 63 f2 57 d2 2a 7f b7 60 96 9b 2d 2a c8 61 5b 2e 04 2d e7 db e7 41 5b 04 47 33 d3 7e 65 e5 34 a3 a2 f1 6d 39 81 97 d9 3d 37 d1 47 77 c7 cf ae ac a3 7e b9 fe 73 95 9a 79 cd 32 ea 2c f1 d5 f7 5f 84 2c df 2e 8a b3 a3 b2 78 fc 41 f2 f3 c5 8a 57 68 fd f3 97 db d1 19 9b 37 35 a3 bf 7e 25 fe ff 55 a8 db 34 7e 33 ba 36 60 7f 6d 8a fe a6 f0 b3 59 b6 ba f3 64 63 5b d5 f7 3f 22 46 1c 9d 49 29 d2 f3 d3 b3 9d 8b f3 16 e6 94 a6 9b 6f 50 9e ff e1 f1 6e 87 12 f2 3f 5e ab 2d 0e d9 fc 01 6c d8 df 20 f2 e7 9b 30 53 5e e6 53 59 5e 47 da 2d a8 c2 37 e6 26 ff ed dc 97 3b 54 32 4b 9a fa 6a 5d ab 55 6e 9f 44 a2 bc 68 8d 32 0f e9 00 50 ef 6f 3d eb 4b 1c e9 3a 79 71 fe 9a b6 39 21 77 9d e0 b2 46 7e 54 Data Ascii: b;^O30:l+:q2+cW`-a[.-A[G3~e4m9=7Gw~sy2,_,.xAWh75~%U4~36`mYdc[?"FI)oPn?^-l 0S^SY^G-7&;T2Kj]UnDh2Po=K:yq9!wF~T
2024-04-23 21:07:52 UTC	7322	IN	Data Raw: 1f 07 4f 53 d4 c5 c3 63 98 d0 fe fd 26 b7 b8 5e e2 81 fb 3e 31 42 65 52 c6 b5 42 41 83 fd 4b 62 cc fd 28 d8 9f 11 23 a5 e4 6b ff 86 18 3e a7 51 fb 1f a1 7e 99 70 ed bf 03 f0 97 a9 d6 fe 29 d4 bf a6 3b f1 d0 9d cf d1 74 b5 1f 1b 21 13 9e f2 27 d9 dd 53 1c fb 65 27 ea f6 30 8e 31 9f 72 87 4d 36 ee 76 7b c0 00 e3 4e 16 1b 6e dc bd cb 57 3c 93 27 8f f3 04 ec d9 f9 0d 56 87 a0 f0 0c fb 60 81 44 01 57 00 16 8c 4c 2b 4f 31 d3 d5 57 3e ba fd 1d d3 40 89 80 66 59 20 bd f7 fc 2b 30 6a a4 3d fc e9 8b fc c7 ed 2d e9 71 60 bd 02 66 7d bd f8 91 dc dc 15 23 73 63 ee 41 c1 47 45 07 85 e3 a2 c1 6f bb e9 e7 28 f3 2f 3b fc 67 0f 6f f0 75 bf fa 6e 4a 5a 1f 7b 07 b0 0c 5c b8 dc 8f a9 90 82 e4 16 49 90 97 7c e1 15 60 83 bf 49 e2 e7 f3 c4 ff 88 31 b4 f1 59 e7 97 de e1 bb d9 e9 Data Ascii: OSc&^>1BeRBAKb(#k>Q~p);t!'Se'01rM6v{NnW<'V`DWL+O1W>@fY +0j=-q`f}#scAGEo(/;gounJZ{\I\|`I1Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49780	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:52 UTC	654	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_l2bvdjfwt697xziuhxpwsg2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:52 UTC	797	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:52 GMT Content-Type: application/x-javascript Content-Length: 15799 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 28 Mar 2024 02:23:53 GMT ETag: 0x8DC4ECE1D0444D4 x-ms-request-id: 95b777dd-b01e-0049-4630-95459c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210752Z-16f56cb894f4hxjjs88cmwhuqs000000018g00000000uu5h x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 21:07:52 UTC	15587	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 dd 7d 4d 73 23 47 b2 d8 dd bf 02 8b 75 68 86 4f 3d 10 3e f8 89 11 34 06 01 70 06 4f 24 00 01 e0 50 0a 49 46 34 81 22 d8 4b a0 1b af bb 31 1c 2e 35 8e bd f9 f0 0e be da 37 1f 7c f2 d1 17 df fd 53 36 e2 f9 77 38 3f aa aa ab ba 1b 00 39 d2 d3 ee b3 42 c1 41 77 55 65 65 65 65 65 65 66 65 65 ff e1 66 ed 4f 63 2f f0 5f 8a bd 47 f5 bb 10 bc f4 f7 1e bd 9b 97 de 8f fe cf 7b a1 88 d7 a1 5f c0 df 25 f1 71 15 84 71 f4 fa 83 1b 16 e2 06 be 6a 3c ca 77 f5 c7 4f 8e 37 ab fb ce 22 70 67 62 56 ff 43 e5 d3 6b d9 54 60 d3 a9 bb 58 bc 8c 15 04 27 76 92 df c1 1e 3c 70 b3 c6 1f ca 49 c1 27 ec c6 6b 3c 6a 40 41 69 d9 10 4e 50 9a 36 3c f8 bb 6a 14 8b 4e f0 b2 bc f7 e9 e5 8f c9 30 9c c0 f1 00 f9 97 d5 3d c2 d2 6f 78 2f 2b 00 1f fe 39 d8 73 42 f8 e7 Data Ascii: }Ms#GuhO=>4pO$PIF4"K1.57\|S6w8?9BAwUeeeeeefeefOc/_G{_%qqj<wO7"pgbVCkT`X'v<pI'k<j@AiNP6<jN0=ox/+9sB
2024-04-23 21:07:52 UTC	212	IN	Data Raw: 4c d9 50 88 3d 11 31 a3 82 91 44 92 9b ac 27 fa 55 71 d0 e8 52 b2 83 36 27 fc b6 dc 23 94 e3 1e 80 37 6e 69 ad 92 7b 01 76 8e 29 d0 a4 f3 81 4e a5 61 fe e9 d7 44 09 47 be c4 aa 78 02 e5 da 24 f0 cf 03 17 6f 15 81 0e 9b 57 59 59 50 76 65 74 81 91 0e 08 e2 ca 8f 9f d0 09 e6 cc 63 f5 01 0c 1d b1 ff ac b6 da 7e a0 7c 70 78 3f 7a 67 ef 29 ac ad fb a8 08 00 af bb ab 0b 46 ef 41 74 8a 4c fb 39 f7 de 8d 28 4c 4b db fa 95 7d d4 f5 b7 b4 b4 70 4f 6e 04 ef ef ec d2 6a c8 b3 29 ad 7d 6c 5b d9 81 ae 31 dc 64 9c fb e5 ea ce 71 1a 0d 53 9d 56 9f d3 e9 b7 17 a3 2e 37 aa 7e fa f4 f3 9e c3 b9 43 4b 93 49 e3 0f e5 d7 ff 0f de d8 74 96 1f d7 00 00 Data Ascii: LP=1D'UqR6'#7ni{v)NaDGx$oWYYPvetc~\|px?zg)FAtL9(LK}pOnj)}l[1dqSV.7~CKIt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	49781	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:53 UTC	618	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:53 UTC	797	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:53 GMT Content-Type: application/x-javascript Content-Length: 54325 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 15 Feb 2024 19:13:15 GMT ETag: 0x8DC2E5A2998EB1D x-ms-request-id: 93a23132-b01e-0049-5d1f-93459c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210753Z-16f7b4795d4jwb2qfy3gcz4vrn00000005hg000000008e53 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 21:07:53 UTC	15587	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ec bd 6b 7b db 46 92 30 fa 7d 7f 05 85 67 46 06 4c 90 22 a9 8b 65 52 10 c7 76 92 79 bd 4f 12 fb d8 ce bc 67 8f cc c9 03 81 a0 84 98 02 b8 b8 d8 d6 88 dc df 7e aa aa ef 40 83 92 af c9 66 3c bb b1 88 46 a3 2f d5 dd d5 75 af bd fb 3b ff d1 b9 df e9 dd fd 7f 9d 97 af 1e bd 78 d5 79 f6 43 e7 d5 ff 79 fa e2 bb ce 73 78 fa af ce cf cf 5e 3d 7d f2 fd dd db c1 4e f1 bf 57 97 49 d1 59 24 cb b8 03 7f cf c3 22 9e 77 b2 b4 93 e5 9d 24 8d b2 7c 95 e5 61 19 17 9d 2b f8 37 4f c2 65 67 91 67 57 9d f2 32 ee ac f2 ec b7 38 2a 8b ce 32 29 4a f8 e8 3c 5e 66 ef 3a 2e 34 97 cf 3b cf c3 bc bc ee 3c 7d ee f5 a1 fd 18 5a 4b 2e 92 14 be 8e b2 d5 35 fc be 2c 3b 69 56 26 51 dc 09 d3 39 b5 b6 84 87 b4 88 3b 55 3a 8f f3 ce bb cb 24 ba ec fc 94 44 79 56 64 Data Ascii: k{F0}gFL"eRvyOg~@f<F/u;xyCysx^=}NWIY$"w$\|a+7OeggW28*2)J<^f:.4;<}ZK.5,;iV&Q9;U:$DyVd
2024-04-23 21:07:53 UTC	16384	IN	Data Raw: af 2c 68 22 6c ec af 0f f1 58 23 9c 57 4f 85 29 04 a2 a6 af 99 30 b3 14 9a 61 1d 83 94 a6 41 a5 e1 ba 40 8e 69 4d 84 c0 0c 7a ee 60 3d 99 b6 58 4f 32 bb c9 b1 51 33 f7 d0 cc 59 d4 64 3d a8 ea f4 ac 64 83 78 6e c2 77 d6 2c 2b 64 ba 9c e8 88 be 66 c5 8c df 66 99 b1 37 5b 0c 65 ed c6 b0 84 1d b8 27 9d b1 78 9f d1 85 0e f7 b3 61 34 de 22 6c a6 2f 35 ab 02 8b c7 89 b8 f8 6d be 19 44 1a 30 db e7 98 94 60 dc 01 03 75 61 53 a0 c6 87 a8 0e 1b 7a e3 5c 73 c0 60 ee 51 be 50 27 6e f4 b1 3e be 6e 52 fc db 7d 60 b6 9b e9 5b 3d 60 f2 fa ac ed ce 08 79 ab 13 40 ae a4 cc 80 81 49 2c 6b 50 9f d5 16 d2 7d b4 9d 74 bf 2b 55 8b fe 30 c4 64 10 31 bb 9d c9 e0 96 d3 e6 5e 6f 10 6f 75 1b 48 73 4a c9 96 29 ed 37 a6 64 1c 6a 49 ac e4 0d 41 ab af c5 fa 1e 4e 52 0c de 9d f6 7a ba 5f Data Ascii: ,h"lX#WO)0aA@iMz`=XO2Q3Yd=dxnw,+dff7[e'xa4"l/5mD0`uaSz\s`QP'n>nR}`[=`y@I,kP}t+U0d1^oouHsJ)7djIANRz_
2024-04-23 21:07:53 UTC	16384	IN	Data Raw: 0e 6a ee 80 44 c4 66 f1 6a 1b d6 a5 51 f4 e0 d1 11 ad 3c 3a ae a2 1c fd f7 9b 24 c3 f6 61 2e 2f 03 95 db 1a db 11 47 1c 6c 89 73 db 4d aa 52 da b0 57 db 32 bf 29 5f 14 77 2f 6b 5d 29 40 84 dd b9 1c e4 35 e5 58 be 7e cb 47 b9 bb 2a af 2e 8c 24 e3 da 82 16 69 69 c9 e0 a5 e4 f7 2e 25 75 e6 0a b6 d4 ed 8d c5 7c aa 50 dc 9c bf f5 32 fa f9 9a a1 fb 5b 8c 97 74 e1 59 21 ca 81 0c 11 73 4a 13 f3 55 f6 45 f9 3a bc a4 72 e9 69 3b 21 8d ae e3 f7 5e 42 e7 ce 71 21 e7 6f 59 7c ee e8 9b 5f a1 85 a7 01 59 7a 29 5e da 20 4b 2f c5 13 5d da b4 de 7b e9 8b e3 e6 74 04 65 da 5b 0f ca e4 1a c9 19 bf b1 7f 1f 64 ff df c5 f6 ba 6e 26 a0 b8 dd de 5a 6b db e4 cb ad 6d bf c0 ce 96 da d2 60 6a ab 5a e3 58 dc 52 e6 5f 6e 74 eb f6 74 f9 a7 8d fa af 6c a3 8e ae 2b bf a6 8d 7a b4 de 46 Data Ascii: jDfjQ<:$a./GlsMRW2)_w/k])@5X~G*.$ii.%u\|P2[tY!sJUE:ri;!^Bq!oY\|_Yz)^ K/]{te[dn&Zkm`jZXR_nttl+zF
2024-04-23 21:07:53 UTC	5970	IN	Data Raw: de 98 b0 b0 3e 49 0e 7e 63 40 3c 29 b8 d4 80 14 aa 30 32 c0 a4 8e 42 d4 35 3d 5f 18 b8 a3 11 36 4f 9a 57 c3 d9 74 ef a4 b8 f7 97 0d 0d bb 85 3e 8b 58 ca db be e7 c3 1b 78 bd b3 c3 96 68 64 69 85 5f 70 17 50 83 d8 fd 33 ab 3f bf a4 b3 1d 87 c9 32 e6 91 0b 6c 50 5a 4a f6 5c 2d 1d b3 22 79 95 55 3b 8d 66 e7 4b 13 fe f9 05 af ed 06 6b ab 90 17 34 34 0c 28 2d 2a bd f3 be c0 75 de d3 f6 02 7a 2f e0 69 a9 24 cb 5c ef 0f ef 5e 3c cd 2e 67 59 4a b6 fe 6a 52 34 68 93 b4 86 af 7e e1 84 3e d1 43 fe ac 88 cb 70 5e 4e 3a fd c3 de 59 54 c4 07 f7 85 be 29 16 8b 95 25 ab 59 35 e6 6f a8 db f0 2e 3e 7f fe 69 46 a2 81 57 38 17 aa 49 22 ed a7 b4 13 d1 92 8d eb 69 f9 16 09 1b 5c 25 e9 38 bb da 86 23 f6 4c d9 de 66 66 42 57 34 c8 1b fc 24 86 6d 5f d0 4a a9 01 18 3a 11 3d 65 48 Data Ascii: >I~c@<)02B5=_6OWt>Xxhdi_pP3?2lPZJ\-"yU;fKk44(-*uz/i$\^<.gYJjR4h~>Cp^N:YT)%Y5o.>iFW8I"i\%8#LffBW4$m_J:=eH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	49782	52.96.69.2	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:53 UTC	1080	OUT	GET /owa/prefetch.aspx HTTP/1.1 Host: outlook.office365.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ClientId=21005DA175D0486FB6CC7306B18DB8F9; OIDC=1; OpenIdConnect.nonce.v3.8lrqHfJIjxeKmLsEWTYt18TbOGRQMKZy88ZOq-mt830=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba; OpenIdConnect.nonce.v3.N3qRrA14YiorlN6zmhaE1YEQyahs_lsaF3ZixY0HMvg=638495032708125745.ca9a9b3d-f749-4636-97af-6af497f38b4b; X-OWA-RedirectHistory=ArLym14Bi7Ztb9lj3Ag\|ArLym14BGS7xXtlj3Ag
2024-04-23 21:07:53 UTC	1555	IN	HTTP/1.1 200 OK Cache-Control: private, no-store Content-Length: 2745 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 request-id: 9d9b0d3b-60ec-70c0-0ad3-cfd10af36c65 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-CalculatedFETarget: SA1PR02CU001.internal.outlook.com X-BackEndHttpStatus: 200 Set-Cookie: OWAPF=v:15.20.7472.43&l:mouse; path=/; secure; HttpOnly X-CalculatedBETarget: SN4PR19MB5357.namprd19.prod.outlook.com X-BackEndHttpStatus: 200 X-RUM-Validated: 1 X-RUM-NotUpdateQueriedPath: 1 X-RUM-NotUpdateQueriedDbCopy: 1 X-Content-Type-Options: nosniff X-BeSku: WCS7 X-OWA-Version: 15.20.7472.42 X-OWA-DiagnosticsInfo: 2;0;0 X-IIDs: 0 X-BackEnd-Begin: 2024-04-23T21:07:53.406 X-BackEnd-End: 2024-04-23T21:07:53.421 X-DiagInfo: SN4PR19MB5357 X-BEServer: SN4PR19MB5357 X-UA-Compatible: IE=EmulateIE7 X-Proxy-RoutingCorrectness: 1 X-Proxy-BackendServerStatus: 200 X-FEProxyInfo: MN2PR19CA0013.NAMPRD19.PROD.OUTLOOK.COM X-FEEFZInfo: MNZ X-FEServer: SA1PR02CA0013 Report-To: {"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=MNZ&RemoteIP=89.187.171.0"}],"include_subdomains":true} NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} X-FirstHopCafeEFZ: MNZ X-FEServer: MN2PR19CA0013 Date: Tue, 23 Apr 2024 21:07:53 GMT Connection: close
2024-04-23 21:07:53 UTC	2745	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 72 65 66 65 74 63 68 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0d 0a 0d 0a 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 6f 66 66 69 63 65 33 36 35 69 63 6f 6e 73 27 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 72 63 3a 20 75 72 6c 28 27 68 74 74 70 73 3a 2f Data Ascii: <!DOCTYPE html><html><head> <title>Prefetch</title> <meta http-equiv="x-ua-compatible" content="IE=Edge"> <style> @font-face { font-family: 'office365icons'; src: url('https:/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	49784	13.107.246.41	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:54 UTC	624	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:07:54 UTC	812	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:07:54 GMT Content-Type: application/x-javascript Content-Length: 35813 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 15 Feb 2024 19:13:16 GMT ETag: 0x8DC2E5A29EDB0A1 x-ms-request-id: 0e225e3a-f01e-0035-4d28-954385000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240423T210754Z-16f56cb894fqlhb6ssxt4emkw800000001fg00000000a80k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 21:07:54 UTC	15572	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e4 bd 7b 7f db 38 92 28 fa ff f9 14 b6 a6 c7 11 db b4 2c ea 2d db 8c c7 f1 a3 93 99 a4 93 cd a3 67 67 6c 75 86 a2 20 89 6d 8a 94 49 ca 8f c4 de cf 7e ab 0a 6f 52 76 92 d9 b3 e7 dc df bd 99 69 9a 28 14 0a 85 02 50 28 14 0a d4 ee cf 9b ff 6b e3 e7 8d 9d ef ff b7 f1 e1 e3 d1 fb 8f 1b 6f cf 36 3e be 7c f5 fe 64 e3 1d a4 fe b1 f1 eb db 8f af 8e 4f bf 9f 0e 56 8a ff 7d 9c 47 f9 c6 34 8a d9 06 fc 1d 07 39 9b 6c a4 c9 46 9a 6d 44 49 98 66 cb 34 0b 0a 96 6f 2c e0 99 45 41 bc 31 cd d2 c5 46 31 67 1b cb 2c fd 83 85 45 be 11 47 79 01 85 c6 2c 4e 6f 36 ea 40 2e 9b 6c bc 0b b2 e2 6e e3 d5 3b a7 01 f4 19 50 8b 66 51 02 a5 c3 74 79 07 ef f3 62 23 49 8b 28 64 1b 41 32 21 6a 31 24 92 9c 6d ac 92 09 cb 36 6e e6 51 38 df 78 13 85 59 9a a7 d3 62 Data Ascii: {8(,-gglu mI~oRvi(P(ko6>\|dOV}G49lFmDIf4o,EA1F1g,EGy,No6@.ln;PfQtyb#I(dA2!j1$m6nQ8xYb
2024-04-23 21:07:54 UTC	16384	IN	Data Raw: f4 a9 99 cc fa b2 bd d7 13 b0 c4 06 dc ca 65 96 2c ec 0f e5 1d 27 21 95 80 e4 d4 cb 2b 1f 51 c4 8b 15 a2 2b 7a 64 54 7d 78 69 fe fa 15 f1 34 37 7f ff 6a 48 38 1a 63 c0 31 54 3e 0d 4a 3c 74 5e fb 49 76 ca 59 7b 5d bb 7c 7a dd 96 b0 75 ce 53 22 b3 de f0 a1 2c fb db ee 74 13 31 9f 8b df f9 c1 01 f8 21 9a a9 2f 3e 92 7d 93 1b 80 50 01 a6 12 d2 92 90 6b 1b a2 4f df 78 d2 08 c8 0e 38 44 1d a9 b7 45 fa aa 04 50 9f a1 66 22 2d 27 02 ed 08 cd ef cc 4d 44 5a 5d b0 9c 72 80 0a b5 a6 e3 0f 00 98 4b 42 87 83 cc 2f c2 11 eb e5 cf 3f d0 77 57 f9 cf 71 c9 a1 46 3d 8b e0 b5 83 72 11 e4 73 39 87 69 73 9b 2f ec 2f 29 53 cd e5 0e 5d 44 92 7e 5b 00 d4 47 1c 02 9e 54 2e b0 50 a4 55 20 57 a8 6e ee 7c 78 7b f6 51 8f 40 42 4c a7 85 1e 83 1c 12 1b de fe a9 80 48 bd dd e1 69 48 ee Data Ascii: e,'!+Q+zdT}xi47jH8c1T>J<t^IvY{]\|zuS",t1!/>}PkOx8DEPf"-'MDZ]rKB/?wWqF=rs9is//)S]D~[GT.PU Wn\|x{Q@BLHiH
2024-04-23 21:07:54 UTC	3857	IN	Data Raw: 5a 66 93 fc 61 14 40 f7 bf 8e fc cd dd a4 86 91 90 19 d3 45 f3 72 8f 21 d5 e4 0c 79 9a 4f 10 48 66 a8 4e a4 db e3 4b c1 87 72 bb 6d 34 d5 3e d9 cc 55 c8 ee 9c a4 a6 95 b9 d5 17 33 33 2c e8 70 fb 44 11 ed bb 2c 48 eb 8c 92 a6 b8 a8 8a e5 0a 9f 59 31 be e5 8c 34 65 74 1e 1c 19 75 de 81 31 86 b5 fe 29 4d 81 0b 7b 6d e1 fe 15 2e 1f 3e ef ec 93 cf 31 d1 93 93 0c 4e 1f 1b ff a4 f6 da 09 9c d7 b5 ee c9 6b 67 87 b8 3c 9d ce 19 2e 03 e2 e2 f1 42 df df f1 2b 2b 86 2b a8 9a 25 10 da a6 5a 4e ee 79 00 b9 f3 53 d2 6d 63 74 4b d1 35 fc e2 22 6c e8 e9 c0 6c bf f5 8e a0 23 c0 d8 95 3b 3d eb 13 df e7 53 29 ef 2b 5b 5d c9 12 0c 9e 8a 33 00 52 25 5a b7 87 89 f1 16 cb 67 4f 25 77 f7 16 52 dc ae f6 b1 c2 c6 4b c1 41 51 e7 9d 50 3f d3 0e 55 45 ba 19 14 a8 a5 de 1f f7 36 09 17 Data Ascii: Zfa@Er!yOHfNKrm4>U33,pD,HY14etu1)M{m.>1Nkg<.B+++%ZNySmctK5"ll#;=S)+[]3R%ZgO%wRKAQP?UE6

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49788	52.159.127.243	443

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:07:57 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 77 47 57 7a 6f 46 66 51 4e 6b 43 61 63 47 42 69 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 62 38 62 38 35 38 32 65 31 63 61 65 39 33 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: wGWzoFfQNkCacGBi.1Context: fb8b8582e1cae934
2024-04-23 21:07:57 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-23 21:07:57 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 77 47 57 7a 6f 46 66 51 4e 6b 43 61 63 47 42 69 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 62 38 62 38 35 38 32 65 31 63 61 65 39 33 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 6c 62 2b 57 67 59 4e 43 38 55 37 6b 51 50 4a 79 72 44 31 34 53 77 45 71 2f 55 47 65 57 78 34 7a 74 51 6b 6b 30 53 57 61 66 59 30 6d 78 4d 34 46 4d 2f 56 61 6f 56 4d 51 53 65 36 50 68 52 57 4b 30 68 2f 4c 6a 30 52 35 5a 56 68 35 61 71 57 4c 37 31 49 64 33 51 32 50 48 75 56 47 69 55 70 6a 54 5a 47 53 69 38 66 42 4c 6f 4c 77 Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: wGWzoFfQNkCacGBi.2Context: fb8b8582e1cae934<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQlb+WgYNC8U7kQPJyrD14SwEq/UGeWx4ztQkk0SWafY0mxM4FM/VaoVMQSe6PhRWK0h/Lj0R5ZVh5aqWL71Id3Q2PHuVGiUpjTZGSi8fBLoLw
2024-04-23 21:07:57 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 77 47 57 7a 6f 46 66 51 4e 6b 43 61 63 47 42 69 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 62 38 62 38 35 38 32 65 31 63 61 65 39 33 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: wGWzoFfQNkCacGBi.3Context: fb8b8582e1cae934<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-23 21:07:57 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-23 21:07:57 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 2f 64 64 7a 31 58 4e 68 48 6b 79 6b 2f 35 78 41 2f 71 65 4f 2f 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: /ddz1XNhHkyk/5xA/qeO/A.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	49778	52.96.165.34	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:08:10 UTC	1018	OUT	GET /owa/ HTTP/1.1 Host: outlook.office365.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ClientId=21005DA175D0486FB6CC7306B18DB8F9; OIDC=1; OpenIdConnect.nonce.v3.8lrqHfJIjxeKmLsEWTYt18TbOGRQMKZy88ZOq-mt830=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba; OpenIdConnect.nonce.v3.N3qRrA14YiorlN6zmhaE1YEQyahs_lsaF3ZixY0HMvg=638495032708125745.ca9a9b3d-f749-4636-97af-6af497f38b4b; X-OWA-RedirectHistory=ArLym14Bi7Ztb9lj3Ag\|ArLym14BGS7xXtlj3Ag
2024-04-23 21:08:11 UTC	6099	IN	HTTP/1.1 302 Content-Length: 786 Content-Type: text/html; charset=utf-8 Location: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=dc4c82b9-9f23-cb47-45c1-7118250deb8a&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495032910138037.88e29f78-8fc3-4242-b15d-d448bcaba0ce&state=Dcs7FoAwCABBos_jYAgQQ46Tb2vp9aWY7TYAwOkOF8gD5RHTmkm4JkpiJOU2W1x3MbQ9BJWVsac8capaH603Giv4e8X3a_EH Server: Microsoft-IIS/10.0 request-id: dc4c82b9-9f23-cb47-45c1-7118250deb8a Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-CalculatedFETarget: MW4PR03CU005.internal.outlook.com X-BackEndHttpStatus: 302 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: RoutingKeyCookie=; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OpenIdConnect.nonce.v3.yp0b6NYJo5LnwyKCb7pn701jVtoj966VUs7Jnw8kSZU=638495032910138037.88e29f78-8fc3-4242-b15d-d448bcaba0ce; expires=Tue, 23-Apr-2024 22:08:11 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: HostSwitchPrg=; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OptInPrg=; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: SuiteServiceProxyKey=; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: RoutingKeyCookie=; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OpenIdConnect.nonce.v3.yp0b6NYJo5LnwyKCb7pn701jVtoj966VUs7Jnw8kSZU=638495032910138037.88e29f78-8fc3-4242-b15d-d448bcaba0ce; expires=Tue, 23-Apr-2024 22:08:11 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: HostSwitchPrg=; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: OptInPrg=; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: SuiteServiceProxyKey=; expires=Sat, 23-Apr-1994 21:08:11 GMT; path=/; secure Set-Cookie: X-OWA-RedirectHistory=ArLym14Btcp1e9lj3Ag\|ArLym14Bi7Ztb9lj3Ag\|ArLym14BGS7xXtlj3Ag; expires=Wed, 24-Apr-2024 03:10:11 GMT; path=/;SameSite=None; secure; HttpOnly X-CalculatedBETarget: MW4PR03MB6444.namprd03.PROD.OUTLOOK.COM X-BackEndHttpStatus: 302 X-RUM-Validated: 1 X-RUM-NotUpdateQueriedPath: 1 X-RUM-NotUpdateQueriedDbCopy: 1 X-Content-Type-Options: nosniff X-BeSku: WCS7 X-OWA-DiagnosticsInfo: 1;0;0 X-IIDs: 0 X-BackEnd-Begin: 2024-04-23T21:08:11.013 X-BackEnd-End: 2024-04-23T21:08:11.013 X-DiagInfo: MW4PR03MB6444 X-BEServer: MW4PR03MB6444 X-UA-Compatible: IE=EmulateIE7 X-Proxy-RoutingCorrectness: 1 X-Proxy-BackendServerStatus: 302 X-FEProxyInfo: BN9PR03CA0159.NAMPRD03.PROD.OUTLOOK.COM X-FEEFZInfo: LYH X-FEServer: MW4PR03CA0139 Report-To: {"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=LYH&RemoteIP=89.187.171.0"}],"include_subdomains":true} NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} X-FirstHopCafeEFZ: LYH X-FEServer: BN9PR03CA0159 Date: Tue, 23 Apr 2024 21:08:10 GMT Connection: close
2024-04-23 21:08:11 UTC	786	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 2f 63 6f 6d 6d 6f 6e 2f 6f 61 75 74 68 32 2f 61 75 74 68 6f 72 69 7a 65 3f 63 6c 69 65 6e 74 5f 69 64 3d 30 30 30 30 30 30 30 32 2d 30 30 30 30 2d 30 66 66 31 2d 63 65 30 30 2d 30 30 30 30 30 30 30 30 30 30 30 30 26 61 6d 70 3b 72 65 64 69 72 65 63 74 5f 75 72 69 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 6f 75 74 6c 6f 6f 6b 2e 6f 66 66 69 63 65 33 36 35 2e 63 6f 6d 25 32 66 6f 77 61 25 32 66 26 61 6d 70 3b 72 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	49795	52.96.69.2	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:08:12 UTC	1224	OUT	GET /owa/prefetch.aspx HTTP/1.1 Host: outlook.office365.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ClientId=21005DA175D0486FB6CC7306B18DB8F9; OIDC=1; OpenIdConnect.nonce.v3.8lrqHfJIjxeKmLsEWTYt18TbOGRQMKZy88ZOq-mt830=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba; OpenIdConnect.nonce.v3.N3qRrA14YiorlN6zmhaE1YEQyahs_lsaF3ZixY0HMvg=638495032708125745.ca9a9b3d-f749-4636-97af-6af497f38b4b; OpenIdConnect.nonce.v3.yp0b6NYJo5LnwyKCb7pn701jVtoj966VUs7Jnw8kSZU=638495032910138037.88e29f78-8fc3-4242-b15d-d448bcaba0ce; X-OWA-RedirectHistory=ArLym14Btcp1e9lj3Ag\|ArLym14Bi7Ztb9lj3Ag\|ArLym14BGS7xXtlj3Ag
2024-04-23 21:08:12 UTC	1445	IN	HTTP/1.1 200 OK Cache-Control: private, no-store Content-Length: 2745 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 request-id: e4e83db7-1793-1199-88d4-cf59259d4b29 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-CalculatedBETarget: IA1PR19MB6129.namprd19.prod.outlook.com X-BackEndHttpStatus: 200 Set-Cookie: OWAPF=v:15.20.7472.44&l:mouse; path=/; secure; HttpOnly X-RUM-Validated: 1 X-RUM-NotUpdateQueriedPath: 1 X-RUM-NotUpdateQueriedDbCopy: 1 X-Content-Type-Options: nosniff X-BeSku: WCS7 X-OWA-Version: 15.20.7472.44 X-OWA-DiagnosticsInfo: 1;0;0 X-IIDs: 0 X-BackEnd-Begin: 2024-04-23T21:08:12.484 X-BackEnd-End: 2024-04-23T21:08:12.484 X-DiagInfo: IA1PR19MB6129 X-BEServer: IA1PR19MB6129 X-UA-Compatible: IE=EmulateIE7 X-Proxy-RoutingCorrectness: 1 Report-To: {"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=MNZ&RemoteIP=89.187.171.0"}],"include_subdomains":true} NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} X-Proxy-BackendServerStatus: 200 X-FirstHopCafeEFZ: MNZ X-FEProxyInfo: MN2PR19CA0035.NAMPRD19.PROD.OUTLOOK.COM X-FEEFZInfo: MNZ X-FEServer: MN2PR19CA0035 Date: Tue, 23 Apr 2024 21:08:11 GMT Connection: close
2024-04-23 21:08:12 UTC	2745	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 72 65 66 65 74 63 68 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0d 0a 0d 0a 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 6f 66 66 69 63 65 33 36 35 69 63 6f 6e 73 27 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 72 63 3a 20 75 72 6c 28 27 68 74 74 70 73 3a 2f Data Ascii: <!DOCTYPE html><html><head> <title>Prefetch</title> <meta http-equiv="x-ua-compatible" content="IE=Edge"> <style> @font-face { font-family: 'office365icons'; src: url('https:/

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49796	52.159.127.243	443

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:08:13 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 2b 63 52 70 62 67 6a 47 31 6b 75 73 54 50 74 4a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 62 64 65 37 37 35 34 37 61 31 33 63 65 63 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: +cRpbgjG1kusTPtJ.1Context: ebde77547a13cecd
2024-04-23 21:08:13 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-23 21:08:13 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 2b 63 52 70 62 67 6a 47 31 6b 75 73 54 50 74 4a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 62 64 65 37 37 35 34 37 61 31 33 63 65 63 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 6c 62 2b 57 67 59 4e 43 38 55 37 6b 51 50 4a 79 72 44 31 34 53 77 45 71 2f 55 47 65 57 78 34 7a 74 51 6b 6b 30 53 57 61 66 59 30 6d 78 4d 34 46 4d 2f 56 61 6f 56 4d 51 53 65 36 50 68 52 57 4b 30 68 2f 4c 6a 30 52 35 5a 56 68 35 61 71 57 4c 37 31 49 64 33 51 32 50 48 75 56 47 69 55 70 6a 54 5a 47 53 69 38 66 42 4c 6f 4c 77 Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: +cRpbgjG1kusTPtJ.2Context: ebde77547a13cecd<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQlb+WgYNC8U7kQPJyrD14SwEq/UGeWx4ztQkk0SWafY0mxM4FM/VaoVMQSe6PhRWK0h/Lj0R5ZVh5aqWL71Id3Q2PHuVGiUpjTZGSi8fBLoLw
2024-04-23 21:08:13 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 2b 63 52 70 62 67 6a 47 31 6b 75 73 54 50 74 4a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 62 64 65 37 37 35 34 37 61 31 33 63 65 63 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: +cRpbgjG1kusTPtJ.3Context: ebde77547a13cecd<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-23 21:08:13 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-23 21:08:13 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6b 7a 52 65 47 43 42 66 68 45 57 6a 33 73 4b 42 58 42 66 75 43 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: kzReGCBfhEWj3sKBXBfuCg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	49792	52.96.165.34	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:08:28 UTC	1162	OUT	GET /owa/ HTTP/1.1 Host: outlook.office365.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ClientId=21005DA175D0486FB6CC7306B18DB8F9; OIDC=1; OpenIdConnect.nonce.v3.8lrqHfJIjxeKmLsEWTYt18TbOGRQMKZy88ZOq-mt830=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba; OpenIdConnect.nonce.v3.N3qRrA14YiorlN6zmhaE1YEQyahs_lsaF3ZixY0HMvg=638495032708125745.ca9a9b3d-f749-4636-97af-6af497f38b4b; OpenIdConnect.nonce.v3.yp0b6NYJo5LnwyKCb7pn701jVtoj966VUs7Jnw8kSZU=638495032910138037.88e29f78-8fc3-4242-b15d-d448bcaba0ce; X-OWA-RedirectHistory=ArLym14Btcp1e9lj3Ag\|ArLym14Bi7Ztb9lj3Ag\|ArLym14BGS7xXtlj3Ag
2024-04-23 21:08:28 UTC	6119	IN	HTTP/1.1 302 Content-Length: 786 Content-Type: text/html; charset=utf-8 Location: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=45c0d02e-1ce4-6188-0c2e-73e3fe1a59d4&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638495033088601045.a6c12ca3-8d3d-4db1-9119-3cb548f36fb3&state=Dcs7EoAwCEVRouNyMOAjkSwnn7G1dPtSnNvdRER72EKSCN0Vbq0IIO5VVKycvU69Zgf7wmJbQ7mpNsYcxfxBfQZSvEd-v55_ Server: Microsoft-IIS/10.0 request-id: 45c0d02e-1ce4-6188-0c2e-73e3fe1a59d4 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-CalculatedFETarget: DM6PR06CU002.internal.outlook.com X-BackEndHttpStatus: 302 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: RoutingKeyCookie=; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OpenIdConnect.nonce.v3.z4ilhCBFtC7tvpRUskPgo-WTXWKcoaqKj88CsoASsXA=638495033088601045.a6c12ca3-8d3d-4db1-9119-3cb548f36fb3; expires=Tue, 23-Apr-2024 22:08:28 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: HostSwitchPrg=; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OptInPrg=; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: SuiteServiceProxyKey=; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: RoutingKeyCookie=; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; domain=outlook.office365.com; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OpenIdConnect.nonce.v3.z4ilhCBFtC7tvpRUskPgo-WTXWKcoaqKj88CsoASsXA=638495033088601045.a6c12ca3-8d3d-4db1-9119-3cb548f36fb3; expires=Tue, 23-Apr-2024 22:08:28 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: HostSwitchPrg=; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: OptInPrg=; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: SuiteServiceProxyKey=; expires=Sat, 23-Apr-1994 21:08:28 GMT; path=/; secure Set-Cookie: X-OWA-RedirectHistory=ArLym14B1esYhtlj3Ag\|ArLym14Btcp1e9lj3Ag\|ArLym14Bi7Ztb9lj3Ag\|ArLym14BGS7xXtlj3Ag; expires=Wed, 24-Apr-2024 03:10:28 GMT; path=/;SameSite=None; secure; HttpOnly X-CalculatedBETarget: DM6PR03MB5322.namprd03.prod.outlook.com X-BackEndHttpStatus: 302 X-RUM-Validated: 1 X-RUM-NotUpdateQueriedPath: 1 X-RUM-NotUpdateQueriedDbCopy: 1 X-Content-Type-Options: nosniff X-BeSku: WCS6 X-OWA-DiagnosticsInfo: 1;0;0 X-IIDs: 0 X-BackEnd-Begin: 2024-04-23T21:08:28.860 X-BackEnd-End: 2024-04-23T21:08:28.860 X-DiagInfo: DM6PR03MB5322 X-BEServer: DM6PR03MB5322 X-UA-Compatible: IE=EmulateIE7 X-Proxy-RoutingCorrectness: 1 X-Proxy-BackendServerStatus: 302 X-FEProxyInfo: BN9PR03CA0169.NAMPRD03.PROD.OUTLOOK.COM X-FEEFZInfo: LYH X-FEServer: DM6PR06CA0061 Report-To: {"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=LYH&RemoteIP=89.187.171.0"}],"include_subdomains":true} NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} X-FirstHopCafeEFZ: LYH X-FEServer: BN9PR03CA0169 Date: Tue, 23 Apr 2024 21:08:28 GMT Connection: close
2024-04-23 21:08:28 UTC	786	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 2f 63 6f 6d 6d 6f 6e 2f 6f 61 75 74 68 32 2f 61 75 74 68 6f 72 69 7a 65 3f 63 6c 69 65 6e 74 5f 69 64 3d 30 30 30 30 30 30 30 32 2d 30 30 30 30 2d 30 66 66 31 2d 63 65 30 30 2d 30 30 30 30 30 30 30 30 30 30 30 30 26 61 6d 70 3b 72 65 64 69 72 65 63 74 5f 75 72 69 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 6f 75 74 6c 6f 6f 6b 2e 6f 66 66 69 63 65 33 36 35 2e 63 6f 6d 25 32 66 6f 77 61 25 32 66 26 61 6d 70 3b 72 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	49804	52.96.222.178	443	3476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:08:30 UTC	1368	OUT	GET /owa/prefetch.aspx HTTP/1.1 Host: outlook.office365.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ClientId=21005DA175D0486FB6CC7306B18DB8F9; OIDC=1; OpenIdConnect.nonce.v3.8lrqHfJIjxeKmLsEWTYt18TbOGRQMKZy88ZOq-mt830=638495032431685145.74ed6f2b-b2be-4c07-b637-87555c8529ba; OpenIdConnect.nonce.v3.N3qRrA14YiorlN6zmhaE1YEQyahs_lsaF3ZixY0HMvg=638495032708125745.ca9a9b3d-f749-4636-97af-6af497f38b4b; OpenIdConnect.nonce.v3.yp0b6NYJo5LnwyKCb7pn701jVtoj966VUs7Jnw8kSZU=638495032910138037.88e29f78-8fc3-4242-b15d-d448bcaba0ce; OpenIdConnect.nonce.v3.z4ilhCBFtC7tvpRUskPgo-WTXWKcoaqKj88CsoASsXA=638495033088601045.a6c12ca3-8d3d-4db1-9119-3cb548f36fb3; X-OWA-RedirectHistory=ArLym14B1esYhtlj3Ag\|ArLym14Btcp1e9lj3Ag\|ArLym14Bi7Ztb9lj3Ag\|ArLym14BGS7xXtlj3Ag
2024-04-23 21:08:30 UTC	1555	IN	HTTP/1.1 200 OK Cache-Control: private, no-store Content-Length: 2745 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 request-id: b901ffce-025f-38cc-0656-1368cd97aa5d Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-CalculatedFETarget: PH8PR15CU001.internal.outlook.com X-BackEndHttpStatus: 200 Set-Cookie: OWAPF=v:15.20.7472.44&l:mouse; path=/; secure; HttpOnly X-CalculatedBETarget: PH7PR10MB6508.namprd10.prod.outlook.com X-BackEndHttpStatus: 200 X-RUM-Validated: 1 X-RUM-NotUpdateQueriedPath: 1 X-RUM-NotUpdateQueriedDbCopy: 1 X-Content-Type-Options: nosniff X-BeSku: WCS7 X-OWA-Version: 15.20.7472.44 X-OWA-DiagnosticsInfo: 2;0;0 X-IIDs: 0 X-BackEnd-Begin: 2024-04-23T21:08:30.403 X-BackEnd-End: 2024-04-23T21:08:30.403 X-DiagInfo: PH7PR10MB6508 X-BEServer: PH7PR10MB6508 X-UA-Compatible: IE=EmulateIE7 X-Proxy-RoutingCorrectness: 1 X-Proxy-BackendServerStatus: 200 X-FEProxyInfo: BN0PR10CA0022.NAMPRD10.PROD.OUTLOOK.COM X-FEEFZInfo: LYH X-FEServer: PH8PR15CA0024 Report-To: {"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=LYH&RemoteIP=89.187.171.0"}],"include_subdomains":true} NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} X-FirstHopCafeEFZ: LYH X-FEServer: BN0PR10CA0022 Date: Tue, 23 Apr 2024 21:08:29 GMT Connection: close
2024-04-23 21:08:30 UTC	2745	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 72 65 66 65 74 63 68 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0d 0a 0d 0a 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 6f 66 66 69 63 65 33 36 35 69 63 6f 6e 73 27 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 72 63 3a 20 75 72 6c 28 27 68 74 74 70 73 3a 2f Data Ascii: <!DOCTYPE html><html><head> <title>Prefetch</title> <meta http-equiv="x-ua-compatible" content="IE=Edge"> <style> @font-face { font-family: 'office365icons'; src: url('https:/

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49805	52.159.127.243	443

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:08:36 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 39 74 52 6b 69 35 66 6a 54 45 4b 2f 79 74 54 37 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 32 38 30 35 36 66 33 36 31 65 35 36 35 39 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 9tRki5fjTEK/ytT7.1Context: 628056f361e5659b
2024-04-23 21:08:36 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-23 21:08:36 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 39 74 52 6b 69 35 66 6a 54 45 4b 2f 79 74 54 37 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 32 38 30 35 36 66 33 36 31 65 35 36 35 39 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 6c 62 2b 57 67 59 4e 43 38 55 37 6b 51 50 4a 79 72 44 31 34 53 77 45 71 2f 55 47 65 57 78 34 7a 74 51 6b 6b 30 53 57 61 66 59 30 6d 78 4d 34 46 4d 2f 56 61 6f 56 4d 51 53 65 36 50 68 52 57 4b 30 68 2f 4c 6a 30 52 35 5a 56 68 35 61 71 57 4c 37 31 49 64 33 51 32 50 48 75 56 47 69 55 70 6a 54 5a 47 53 69 38 66 42 4c 6f 4c 77 Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: 9tRki5fjTEK/ytT7.2Context: 628056f361e5659b<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQlb+WgYNC8U7kQPJyrD14SwEq/UGeWx4ztQkk0SWafY0mxM4FM/VaoVMQSe6PhRWK0h/Lj0R5ZVh5aqWL71Id3Q2PHuVGiUpjTZGSi8fBLoLw
2024-04-23 21:08:36 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 39 74 52 6b 69 35 66 6a 54 45 4b 2f 79 74 54 37 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 32 38 30 35 36 66 33 36 31 65 35 36 35 39 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 9tRki5fjTEK/ytT7.3Context: 628056f361e5659b<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-23 21:08:36 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-23 21:08:36 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 64 48 6c 69 57 50 38 41 32 45 4f 47 44 6b 7a 5a 65 62 32 41 41 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: dHliWP8A2EOGDkzZeb2AAA.0Payload parsing failed.

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 6784, Parent PID: 6964

General

Target ID:	0
Start time:	23:07:15
Start date:	23/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 3476, Parent PID: 6784

General

Target ID:	2
Start time:	23:07:18
Start date:	23/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2204,i,3844797713669142651,5628405617170372951,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 876, Parent PID: 6964

General

Target ID:	3
Start time:	23:07:21
Start date:	23/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://outlook.office365.com/owa/?viewmodel=ReadMessageItem&InternetMessageID=%3cMN2PR15MB265581B72BCA78783AC3110FE1122%40MN2PR15MB2655.namprd15.prod.outlook.com%3e"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://outlook.office365.com/owa/?viewmodel=ReadMessageItem&InternetMessageID=%3cMN2PR15MB265581B72BCA78783AC3110FE1122%40MN2PR15MB2655.namprd15.prod.outlook.com%3e

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Windows Analysis Report
https://outlook.office365.com/owa/?viewmodel=ReadMessageItem&InternetMessageID=%3cMN2PR15MB265581B72BCA78783AC3110FE1122%40MN2PR15MB2655.namprd15.prod.outlook.com%3e