Edit tour

Windows Analysis Report
https://raveisnet-my.sharepoint.com/:b:/g/personal/charles_magyar_raveis_com/EXcQ7jfjoRRElVGCYOzbRHgB-DdV8LhSQTAdk06dppgodw?email=Charles.Magyar%40Raveis.com&e=4%3alGbSIk&fromShare=true&at=9

Overview

General Information

Sample URL:	https://raveisnet-my.sharepoint.com/:b:/g/personal/charles_magyar_raveis_com/EXcQ7jfjoRRElVGCYOzbRHgB-DdV8LhSQTAdk06dppgodw?email=Charles.Magyar%40Raveis.com&e=4%3alGbSIk&fromShare=true&at=9
Analysis ID:	1431585
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

No high impact signatures.

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5472 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5436 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 --field-trial-handle=2304,i,13728218226947553562,16425673572567539754,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6452 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://raveisnet-my.sharepoint.com/:b:/g/personal/charles_magyar_raveis_com/EXcQ7jfjoRRElVGCYOzbRHgB-DdV8LhSQTAdk06dppgodw?email=Charles.Magyar%40Raveis.com&e=4%3alGbSIk&fromShare=true&at=9" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown	HTTPS traffic detected: 23.46.200.91:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.46.200.91:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49761 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172

Source: global traffic	HTTP traffic detected: GET /:b:/g/personal/charles_magyar_raveis_com/EXcQ7jfjoRRElVGCYOzbRHgB-DdV8LhSQTAdk06dppgodw?email=Charles.Magyar%40Raveis.com&e=4%3alGbSIk&fromShare=true&at=9 HTTP/1.1Host: raveisnet-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/1033/styles/corev15.css?rev=34APf%2FlfLRHu1iumf2MGdw%3D%3DTAG84 HTTP/1.1Host: raveisnet-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://raveisnet-my.sharepoint.com/:b:/g/personal/charles_magyar_raveis_com/EXcQ7jfjoRRElVGCYOzbRHgB-DdV8LhSQTAdk06dppgodw?email=Charles.Magyar%40Raveis.com&e=4%3alGbSIk&fromShare=true&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG84 HTTP/1.1Host: raveisnet-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://raveisnet-my.sharepoint.com/:b:/g/personal/charles_magyar_raveis_com/EXcQ7jfjoRRElVGCYOzbRHgB-DdV8LhSQTAdk06dppgodw?email=Charles.Magyar%40Raveis.com&e=4%3alGbSIk&fromShare=true&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=xEqMoQOETTWMkBfcAWgApwdEfMw5b8zV-FBRbSC_BI7OlAW61jtIaNtZGa1g2Qexvqy-SEbjBo7HnbR9mikPFn3qzFNVmNVCXVjf5pGtC929OBVnazUyYZc9euNQFAh-iED9b558EzZ0Ru52fT_uR5IapADF7SfSQReGp7zyiObGjp3pp-eo8wF8YVTD8_sc0&t=74258c30 HTTP/1.1Host: raveisnet-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://raveisnet-my.sharepoint.com/:b:/g/personal/charles_magyar_raveis_com/EXcQ7jfjoRRElVGCYOzbRHgB-DdV8LhSQTAdk06dppgodw?email=Charles.Magyar%40Raveis.com&e=4%3alGbSIk&fromShare=true&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=DlDfgwQ2DzbnMNaMjJ_0MDdFzPzlWxf1bNrwdohlz2hAXm6ihePXqlvxPKpUJZUyY5I4qv_uR_9JK8uj2Q3JDwgf9zkWbP5Lt0328gLJDp_xcqVxlNnh_b9glFy_QP3mUYvd5gqh6B9UWQf6zWHpaazOuEwSlV_D4a2Vk-uoIzyFi8dwTLOrpmhINshBwRSx0&t=74258c30 HTTP/1.1Host: raveisnet-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://raveisnet-my.sharepoint.com/:b:/g/personal/charles_magyar_raveis_com/EXcQ7jfjoRRElVGCYOzbRHgB-DdV8LhSQTAdk06dppgodw?email=Charles.Magyar%40Raveis.com&e=4%3alGbSIk&fromShare=true&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=48l9qh1Q6oqBGuYhK1eo1iGwX-BmcL3p-RVpszMUh3BYQaWavbmuJCl-Yf5sX-Vkgl-HjMy9FgTqHdsdQEPh_CDRj6SGwrgAOK-1iDYxP1Y1&t=638459572569584809 HTTP/1.1Host: raveisnet-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://raveisnet-my.sharepoint.com/:b:/g/personal/charles_magyar_raveis_com/EXcQ7jfjoRRElVGCYOzbRHgB-DdV8LhSQTAdk06dppgodw?email=Charles.Magyar%40Raveis.com&e=4%3alGbSIk&fromShare=true&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1Host: raveisnet-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://raveisnet-my.sharepoint.com/:b:/g/personal/charles_magyar_raveis_com/EXcQ7jfjoRRElVGCYOzbRHgB-DdV8LhSQTAdk06dppgodw?email=Charles.Magyar%40Raveis.com&e=4%3alGbSIk&fromShare=true&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1Host: raveisnet-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pszvDRwZX+ZhWSL&MD=KKdG9bt7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pszvDRwZX+ZhWSL&MD=KKdG9bt7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: raveisnet-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: chromecache_67.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.24803.12007/1033/initstrings.js
Source: chromecache_67.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.24803.12007/blank.js
Source: chromecache_67.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.24803.12007/init.js
Source: chromecache_67.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.24803.12007/theming.js

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 23.46.200.91:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.46.200.91:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49761 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@16/27@6/4

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 --field-trial-handle=2304,i,13728218226947553562,16425673572567539754,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://raveisnet-my.sharepoint.com/:b:/g/personal/charles_magyar_raveis_com/EXcQ7jfjoRRElVGCYOzbRHgB-DdV8LhSQTAdk06dppgodw?email=Charles.Magyar%40Raveis.com&e=4%3alGbSIk&fromShare=true&at=9"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 --field-trial-handle=2304,i,13728218226947553562,16425673572567539754,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://raveisnet-my.sharepoint.com/:b:/g/personal/charles_magyar_raveis_com/EXcQ7jfjoRRElVGCYOzbRHgB-DdV8LhSQTAdk06dppgodw?email=Charles.Magyar%40Raveis.com&e=4%3alGbSIk&fromShare=true&at=9	0%	Avira URL Cloud	safe
https://raveisnet-my.sharepoint.com/:b:/g/personal/charles_magyar_raveis_com/EXcQ7jfjoRRElVGCYOzbRHgB-DdV8LhSQTAdk06dppgodw?email=Charles.Magyar%40Raveis.com&e=4%3alGbSIk&fromShare=true&at=9	0%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://raveisnet-my.sharepoint.com/_layouts/15/1033/styles/corev15.css?rev=34APf%2FlfLRHu1iumf2MGdw%3D%3DTAG84	0%	Avira URL Cloud	safe
https://raveisnet-my.sharepoint.com/_layouts/15/images/favicon.ico?rev=47	0%	Avira URL Cloud	safe
https://raveisnet-my.sharepoint.com/_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG84	0%	Avira URL Cloud	safe
https://raveisnet-my.sharepoint.com/ScriptResource.axd?d=xEqMoQOETTWMkBfcAWgApwdEfMw5b8zV-FBRbSC_BI7OlAW61jtIaNtZGa1g2Qexvqy-SEbjBo7HnbR9mikPFn3qzFNVmNVCXVjf5pGtC929OBVnazUyYZc9euNQFAh-iED9b558EzZ0Ru52fT_uR5IapADF7SfSQReGp7zyiObGjp3pp-eo8wF8YVTD8_sc0&t=74258c30	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
dual-spo-0005.spo-msedge.net	13.107.136.10	true	false	unknown
www.google.com	108.177.122.147	true	false	high
raveisnet-my.sharepoint.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://raveisnet-my.sharepoint.com/:b:/g/personal/charles_magyar_raveis_com/EXcQ7jfjoRRElVGCYOzbRHgB-DdV8LhSQTAdk06dppgodw?email=Charles.Magyar%40Raveis.com&e=4%3alGbSIk&fromShare=true&at=9	false		unknown
https://raveisnet-my.sharepoint.com/_layouts/15/1033/styles/corev15.css?rev=34APf%2FlfLRHu1iumf2MGdw%3D%3DTAG84	false	Avira URL Cloud: safe	unknown
https://raveisnet-my.sharepoint.com/_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG84	false	Avira URL Cloud: safe	unknown
https://raveisnet-my.sharepoint.com/ScriptResource.axd?d=xEqMoQOETTWMkBfcAWgApwdEfMw5b8zV-FBRbSC_BI7OlAW61jtIaNtZGa1g2Qexvqy-SEbjBo7HnbR9mikPFn3qzFNVmNVCXVjf5pGtC929OBVnazUyYZc9euNQFAh-iED9b558EzZ0Ru52fT_uR5IapADF7SfSQReGp7zyiObGjp3pp-eo8wF8YVTD8_sc0&t=74258c30	false	Avira URL Cloud: safe	unknown
https://raveisnet-my.sharepoint.com/_layouts/15/images/favicon.ico?rev=47	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
108.177.122.147	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431585
Start date and time:	2024-04-25 13:34:25 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://raveisnet-my.sharepoint.com/:b:/g/personal/charles_magyar_raveis_com/EXcQ7jfjoRRElVGCYOzbRHgB-DdV8LhSQTAdk06dppgodw?email=Charles.Magyar%40Raveis.com&e=4%3alGbSIk&fromShare=true&at=9
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@16/27@6/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 173.194.219.94, 142.250.9.101, 142.250.9.113, 142.250.9.100, 142.250.9.139, 142.250.9.138, 142.250.9.102, 64.233.176.84, 34.104.35.123, 23.209.37.35, 23.209.37.27, 23.209.37.25, 23.209.37.18, 23.209.37.9, 23.209.37.33, 23.209.37.8, 23.209.37.19, 23.209.37.42, 72.21.81.240, 192.229.211.108, 172.253.124.94
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, e40491.dscd.akamaiedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, res-1.cdn.office.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, 194019-ipv4v6e.farm.dprodmgd105.sharepointonline.com.akadns.net, update.googleapis.com, clients.l.google.com, res-1.cdn.office.net-c.edgekey.net, res-1.cdn.office.net-c.edgekey.net.globalredir.akadns.net
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

Chrome Cache Entry: 54

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 102804
Category:	downloaded
Size (bytes):	25609
Entropy (8bit):	7.992070293592458
Encrypted:	true
SSDEEP:	768:65FO8CctusRS+4iLLuVC9Vri5MLPMTleAD5:8FbxwsR/4iAz5MbMl5
MD5:	B62553925BD98826C60457D2EB6B9A46
SHA1:	84DBBB6D9B36A587C21B5A56B1D9E587E33BA943
SHA-256:	C58166FE4DF4BA8F25A960C21451EAF841D97F6F552F104E43431C9DB1C2E2CC
SHA-512:	7B6872144AE308224FF671A1EC63F040A40115888790CF6834AD85D517471CE5DAD3EC297EE751FB196B55118A181017151F7F06FCE0F2F26FF94E8EEC070033
Malicious:	false
Reputation:	low
URL:	https://raveisnet-my.sharepoint.com/ScriptResource.axd?d=xEqMoQOETTWMkBfcAWgApwdEfMw5b8zV-FBRbSC_BI7OlAW61jtIaNtZGa1g2Qexvqy-SEbjBo7HnbR9mikPFn3qzFNVmNVCXVjf5pGtC929OBVnazUyYZc9euNQFAh-iED9b558EzZ0Ru52fT_uR5IapADF7SfSQReGp7zyiObGjp3pp-eo8wF8YVTD8_sc0&t=74258c30
Preview:	............r.I.(.>f..d..B6. )U/.(....mGRuw.... I..B..X...<.O..p}.=#.P.>s.Y...D,..........................'.......;.'..2.Uu5.C..%..v.M&;T...u1.T.=...m....'_z.......4.&?~.__....".db00..IR..\|.(tj6+.y.$.L.$..."..FIx3+..tG%.7...N.'..........A9....9;.O...j...Y\|8.........LW........h&.%WW...\|\.Q..Tr....$\..?-&....}O...w..$R}....W.k.+.._..q...P..dR......`^.j]0.L..9......)...."...I....,.K..j...`1.a9-.`..-p..O..t...\|Bo..Uu.~.t...uB9S.J.o..Fe<.....A.SM.....d>.].HO..Qx...ao....a.J..h6K..q7.N.n'..Ga78....v..n...>..0.I.X?...$=...x..H..&.V.+.h..GyTJ....AT...x.Jl...X..t.H4...$9..^u....r9rq3.._..a...^I.{{.Ch....@.l.....@..BW.[..8~6.U3].I#....8....H`...4..I..6...I...Q1...W^]>...P.KJ.L......A...>.@hf.M...RP..)m.F...Wp{.!.R.".j.....!soO..]k...a."eo.S,...G\|n.\|!F[..O../.aR...$.\..4.N.-p1..}...2...r\a[`e.E..{H..?.....J.ak.Y...P......DP.d.?...<..Y.8....%d...@..e.....exc..g...b.....<z....7*8!...n..wG0.C..f..Y5....qE..p....2.rH-..r.S........q..R.$Q^q....!....

Chrome Cache Entry: 55

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	downloaded
Size (bytes):	7886
Entropy (8bit):	3.9482833105763633
Encrypted:	false
SSDEEP:	48:gubb4a2MNTgopLqyhFTv07EVc91JbV5FIXH0wp53O:Bbb4a5NTX1c9L6E
MD5:	0B60F3C9E4DA6E807E808DA7360F24F2
SHA1:	9AFC7ABB910DE855EFB426206E547574A1E074B7
SHA-256:	ADDEEDEEEF393B6B1BE5BBB099B656DCD797334FF972C495CCB09CFCB1A78341
SHA-512:	1328363987ABBAD1B927FC95F0A3D5646184EF69D66B42F32D1185EE06603AE1A574FAC64472FB6E349C2CE99F9B54407BA72B2908CA7AB01D023EC2F47E7E80
Malicious:	false
Reputation:	low
URL:	https://raveisnet-my.sharepoint.com/_layouts/15/images/favicon.ico?rev=47
Preview:	...... .... .....6......... ............... .h...f...(... ...@..... ...........................................................................70..7...7...7...7...7...7...70..............................................................................................7`..7...7...7...7...7...7...7...7...7`......................................................................................7P..7...7...7...7...7...7...7...7...7...7...7P..............................................................................7...7...7...7...7...7...7...7...7...7...7...7...7...7...........................................................................7`..7...7...7...7...7...7...7...7...7...7...7...7...7`..........................................................................,...,...,...,...,...,...,.......7...7...7...7...7...7...........................................................................'...'...'...'...'...'...'...'...2...7...7...7...7...,....................`..........................

Chrome Cache Entry: 56

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	341066
Entropy (8bit):	5.443375828823808
Encrypted:	false
SSDEEP:	6144:UXVJjsUJaW86hPIjcfbO47IunpizIcxdS+MI4Ny6qF+HNJdWLWnAboc3lexR1YhZ:UXVJjsUPl0ugzIy
MD5:	EFEB871818309724FD070A6A8D671D7A
SHA1:	67943BB03EE683FE52BB7E1ED92FE3571620E27D
SHA-256:	8F274EEDB58E8D89D24E39C136519103AEE399BD59334ED60DF228A80839CA0E
SHA-512:	2976FB4CFBD1202EF0E050094F2E9B181A53DB93ED5F16DCC3A5798CDC8F6149270040D5A9D093E652410CB66BF9604593DB4914D356AC3818169EDA6D0EED22
Malicious:	false
Reputation:	low
URL:	https://res-1.cdn.office.net/bld/_layouts/15/16.0.24803.12007/init.js
Preview:	function $_global_init(){if("undefined"==typeof g_all_modules)g_all_modules={};g_all_modules["init.js"]={version:{rmj:16,rmm:0,rup:24803,rpr:12007}};if(-1!=navigator.userAgent.indexOf("ProfilerMark")&&"function"==typeof msWriteProfilerMark)spWriteProfilerMark=function(a){window.msWriteProfilerMark(a)};typeof spWriteProfilerMark=="function"&&spWriteProfilerMark("perfMarkBegin_init.js");if(typeof OffSwitch=="undefined"){OffSwitch={__namespace:true};OffSwitch_module_def()}if(typeof RuntimeErrors=="undefined"){RuntimeErrors={__namespace:true};RuntimeErrors_module_def()}if(typeof Verify=="undefined"){Verify={__namespace:true};Verify_module_def()}if(typeof Define=="undefined"){Define={__namespace:true};Define_module_def()}if(typeof BrowserDetection=="undefined"){BrowserDetection={__namespace:true};BrowserDetection_module_def()}(function(){b.prototype={firefox:undefined,firefox36up:undefined,firefox3up:undefined,firefox4up:undefined,ie:undefined,ie55up:undefined,ie5up:undefined,ie7down:undefi

Chrome Cache Entry: 57

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	511765
Entropy (8bit):	5.440743624504341
Encrypted:	false
SSDEEP:	12288:z3OkpWeupsTyhEQLQr4ABnIF7wEyAJU7/:z3OkpWeuGTyhEQLQr4ABnIdwEyAm
MD5:	AC8A00D0AF6CF4CE81D72647DBF33973
SHA1:	3BC771C7B0E0B8D8BCF9DF6F8E1265DF4B601C7F
SHA-256:	5A0F296B2C1C80F16E99D79E7E3F2AF78BD6F733BA42DF8CE1E767F55BA3C370
SHA-512:	8EADF11CB271C907519AB701A61970058B0F5EB157EF05C7B6D35F07A5A564E2AB2FAE11507854F79E80830371ECDB86D4ACE38E5E2B4692E0B0DA108FEB043A
Malicious:	false
Reputation:	low
URL:	https://res-1.cdn.office.net/bld/_layouts/15/16.0.24803.12007/core.js
Preview:	function $_global_core(){if("undefined"==typeof g_all_modules)g_all_modules={};g_all_modules["core.js"]={version:{rmj:16,rmm:0,rup:24803,rpr:12007}};typeof spWriteProfilerMark=="function"&&spWriteProfilerMark("perfMarkBegin_core.js");SPAnimation={};SPAnimation.g_Curves=new Array(7);SPAnimation.g_Curves[0]=new SPCurve(0,0,0,0,0,0);SPAnimation.g_Curves[1]=new SPCurve(1,1,0,0,0,0);SPAnimation.g_Curves[2]=new SPCurve(2,2,0,0,0,0);SPAnimation.g_Curves[3]=new SPCurve(3,3,.1,.9,.2,1);SPAnimation.g_Curves[4]=new SPCurve(4,3,.42,0,1,1);SPAnimation.g_Curves[5]=new SPCurve(5,3,0,0,.58,1);SPAnimation.g_Curves[6]=new SPCurve(6,3,.42,0,.58,1);SPKeyFrame.prototype={type:0,curveID:0,startTime:0,endTime:0,startValue:0,endValue:0,relativeTo:0,operationType:0};SPAnimation.Attribute={PositionX:1,PositionY:2,Height:3,Width:4,Opacity:5};SPAnimation.ID={Basic_Show:0,Basic_SlowShow:1,Basic_Fade:2,Basic_Move:3,Basic_Size:4,Content_SlideInFadeInRight:5,Content_SlideInFadeInRightInc:6,Content_SlideOutFadeOutRigh

Chrome Cache Entry: 58

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (456), with no line terminators
Category:	downloaded
Size (bytes):	456
Entropy (8bit):	5.235883090530527
Encrypted:	false
SSDEEP:	6:A+roDEH6IgMbIZc8Z1k8JFPUOIKMPAI0qKIKMPAI0qeCMRTxIj+01KyBui9YDre:A+MYcYkc8Z1JtZASAWCKx2+Wuit
MD5:	E8711BEFA731F473E966F78572096269
SHA1:	DBA9B4A96B866B152766197E5D29746404DFA5BA
SHA-256:	6EA0F3A9E8B6C12A690A415120AEAC2500D1D4342E936DEB2CFB950C60C2F481
SHA-512:	39E382EBC221FC20CDF4A2B672AA1D29FC5220AFAC44F951DE6EAA425BE261225F405F29A8571DC8B7C54B70EC7EF1E5BD9D25C822EA8934172E8D4C551716EC
Malicious:	false
Reputation:	low
URL:	https://res-1.cdn.office.net/bld/_layouts/15/16.0.24803.12007/blank.js
Preview:	function $_global_blank(){if("undefined"==typeof g_all_modules)g_all_modules={};g_all_modules["blank.js"]={version:{rmj:16,rmm:0,rup:24803,rpr:12007}};typeof spWriteProfilerMark=="function"&&spWriteProfilerMark("perfMarkBegin_blank.js");typeof spWriteProfilerMark=="function"&&spWriteProfilerMark("perfMarkEnd_blank.js")}function ULSaew(){var a={};a.ULSTeamName="Microsoft SharePoint Foundation";a.ULSFileName="blank.commentedjs";return a}$_global_blank();

Chrome Cache Entry: 59

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	622
Entropy (8bit):	5.030708856292114
Encrypted:	false
SSDEEP:	12:UXRtEohlWNmONv0MBR0/vUvFa9vN8ESve77Lxukm3auDjqHV:Ofa9n2H8qzxukmKuDjkV
MD5:	B45EDFC9FCDB690CCDA004A8483955E0
SHA1:	BAEDF73329EABB32504CAC640538EE3B6B31819F
SHA-256:	E817BF53005172205995AA07E0021BD8254A0204A1177E925F365E838C32D069
SHA-512:	E2709C77BA686FC58FE528EC2C2CEB6B9C84D045018D77FB9B376359F204FB6B889910B6748C978B4FF9712A7611342DF3C8C59711AA42090219DEC0C83778D2
Malicious:	false
Reputation:	low
URL:	https://raveisnet-my.sharepoint.com/_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG84
Preview:	/* _lcid="1033".._LocalBinding */..#ms-error-header..{..margin:118px 0px 16px;..min-height:50px;..}..#ms-error-gobackcont..{..margin-top:28px;..}..#ms-accessDenied-reqDialog..{..max-width:100%;..}..#ms-error-body..{..background-size:auto;..overflow:auto;..width:830px;..margin-right:auto;..margin-left:auto;..}...ms-error-returnLink..{..line-height:19px;..vertical-align:middle;..}...ms-error-detailsFold..{..padding-top:42px;..}...ms-error-techMsg..{..padding-top:28px;..}...ms-error-groupJoinPanel..{..margin-top:15px;..}...ms-error-groupProfileText..{..margin-top:17px;..}...ms-error-separator..{..margin:34px 0px;..}..

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (35238), with no line terminators
Category:	downloaded
Size (bytes):	35238
Entropy (8bit):	5.390650418562352
Encrypted:	false
SSDEEP:	768:PrxzCC2akwbs7lSZTprPaTrPyrfKwKTZiNOzpCk47S:hsp7ly9rP0S4pCkx
MD5:	C637DE6889D81964119BA1FD124E2454
SHA1:	5DB2B1681BE6FF9A7B26E269CD80D817D41A01BE
SHA-256:	18E8366C8C5590C3D056BA6CA9691B7471D6970EE00D0E22A4B68E517B54F087
SHA-512:	78288767F08DB38F6DC8C366546CECC05DF35C25BCD898B94DCCC5ECCB3ACD7807817BAF813BCA11F4CCAC169A980E4F10EBF4334000C4D2D0F74DCC30BB36EE
Malicious:	false
Reputation:	low
URL:	https://res-1.cdn.office.net/bld/_layouts/15/16.0.24803.12007/theming.js
Preview:	var Theming={__namespace:true};Theming_module_def();function Theming_module_def(){Theming.ApplyThemeToCss=tb;Theming.ReplaceCssTextForElement=J;Theming.ThemeInfo=E;Theming.ImageProcessor=R;Theming.Colors={Color:a,ColorApplication:x,HslColor:h};function cb(d,c,e){for(var b=true,a=0;a<c.length;a++)if(d.charCodeAt(e+a)!==c.charCodeAt(a)){b=false;break}return b}var c={text:0,comment:1,string:2,url:3,right_par:4,font_family:5,rgb:6,rgba:7,colon:8,semicolon:9,right_curly:10,color:11};function d(a,b){this.kind=a;this.text=b}function Db(b){var e,a,g,f,l="*/",u="url(",i=")",j="font-family",t="rgb(",s="rgba(",o="#",w=":",y=";",x="}",k=new d(c.text,"");if(!Boolean(b))b="";a=0;f=b.length;m.prototype={kind:0,text:"",getToken:function(){return null}};function m(){}var r={"/":{},"'":{},'"':{},"#":{},")":new d(c.right_par,")"),";":new d(c.semicolon,";"),":":new d(c.colon,":"),"}":new d(c.right_curly,"}"),u:{getToken:q},f:{getToken:n},r:{getToken:p}};function h(c){var a=b.indexOf(")",c);if(a<0)a=f;retu

Chrome Cache Entry: 61

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (23437), with CRLF line terminators
Category:	downloaded
Size (bytes):	23594
Entropy (8bit):	5.107347306409284
Encrypted:	false
SSDEEP:	384:zyWvVsT5pTtxJOyNm7lMqasjI8LWv3n8wyM:zJsT5pTt7kK+M
MD5:	964FCB2BAF87049DC68975291AE89431
SHA1:	D0CD8C989D44BC531472B632868D3FB2DE4B3184
SHA-256:	B8F7BD568E379502CF0C00027581D2761C7DC14B166F5D25FC048A0B56B7BFBB
SHA-512:	03CB58D197A776F9C315C2A14B9C034D88C7B7E9F4247C5698396F4FE7363A22FC2042A24C02A245C7E035DD2862F88E8EF46A7E5A269EDC2B69E39752A52987
Malicious:	false
Reputation:	low
URL:	https://res-1.cdn.office.net/bld/_layouts/15/16.0.24803.12007/1033/initstrings.js
Preview:	var Strings; if (Strings === undefined) { Strings=new Object(); }Strings.STS=function(){};Strings.STS.L_NewTab="New tab";Strings.STS.L_CalloutLastEditedNameAndDate="Changed by ^1 on ^2";Strings.STS.L_CalloutSourceUrlHeader="Location";Strings.STS.L_SPDiscBestUndo="Remove best reply";Strings.STS.L_SPClientManage="manage";Strings.STS.L_SPAddNewWiki="new Wiki page";Strings.STS.L_SPCategorySortRecent="Recent";Strings.STS.L_ViewSelectorTitle="Change View";Strings.STS.L_SPDiscNumberOfLikes="{0} likes\|\|{0} like\|\|{0} likes";Strings.STS.L_Timeline_DfltViewName="Timeline";Strings.STS.L_TimelineToday="Today";Strings.STS.L_SPDiscNoPreviewAvailable="No preview available for this reply";Strings.STS.L_NODOCView="There are no documents in this view.";Strings.STS.L_SPBlogPostAuthorCategories="by {0} in {1}";Strings.STS.L_SPBlogsNoItemsInCategory="There are no posts in this category.";Strings.STS.L_QRCodeDescription="Scan this QR code with your phone or tablet to open {0}";Strings.STS.L_RelativeDateTime

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	341640
Entropy (8bit):	5.323828565757342
Encrypted:	false
SSDEEP:	1536:k6Bi397Ra/9FjWr5JwiaPyJmbu52JmKI1DS9sw83nm5ZMUuj24S+o0WmuGUmh4jA:Lvf42B9Hee3s
MD5:	DF800F7FF95F2D11EED62BA67F630677
SHA1:	7E6C6696874F1657E5D5B942562B61CDA6F925B7
SHA-256:	0A8090020B2D42FC859B054EF147B09844046A67B65DBDD175828F1B4244028B
SHA-512:	8CE2E13E55A77FB465F2126C36C7F80EDF1643EFDFDC4A66008A0CDED09CDC97DF77B98AEF05064F530442CBB34D66A6063E22A4CE1AB6D5BC8D5222FC853520
Malicious:	false
Reputation:	low
URL:	https://raveisnet-my.sharepoint.com/_layouts/15/1033/styles/corev15.css?rev=34APf%2FlfLRHu1iumf2MGdw%3D%3DTAG84
Preview:	/* _lcid="1033".._LocalBinding /..body,...ms-core-defaultFont,..#pageStatusBar,..#hybridTooltipStatusBar,...ms-status-msg,...js-callout-body..{../ [ReplaceFont(themeFont:"body")] / font-family:"Segoe UI","Segoe",Tahoma,Helvetica,Arial,sans-serif;..font-size:13px;..}..body,...ms-core-defaultFont,...js-callout-body..{../ [ReplaceColor(themeColor:"BodyText")] / color:#444;..}...ms-core-defaultFont..{..font-weight:normal;..text-decoration:none;..white-space:normal;..word-break:normal;..line-height:normal;..}..body..{..margin:0px;..overflow:hidden;../ [ReplaceColor(themeColor:"PageBackground")] / background-color:#fff;..background-size:cover;..background-repeat:no-repeat;..}..html > .ms-core-needIEFilter..{../ [ReplaceBGImage] / -ms-filter:"progid:DXImageTransform.Microsoft.AlphaImageLoader(src='about:blank',sizingMethod='scale');";..}...ms-backgroundImage..{../ [ReplaceBGImage] */ background-image:url();..}..#s4-ribbonrow..{..position:relative;..}..#s4-workspace..{..overflow:auto

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	23063
Entropy (8bit):	4.7535440881548165
Encrypted:	false
SSDEEP:	384:GvUzYI+Vi4g1V5it1ONhA6w+Kv8i/4CYzLKL4DrLU0iTxZTAzIzrwDlTWMClQip9:bkON69kClQq8hDRJHp2tWU25Zt/gREVG
MD5:	90EA7274F19755002360945D54C2A0D7
SHA1:	647B5D8BF7D119A2C97895363A07A0C6EB8CD284
SHA-256:	40732E9DCFA704CF615E4691BB07AECFD1CC5E063220A46E4A7FF6560C77F5DB
SHA-512:	7474667800FF52A0031029CC338F81E1586F237EB07A49183008C8EC44A8F67B37E5E896573F089A50283DF96A1C8F185E53D667741331B647894532669E2C07
Malicious:	false
Reputation:	low
URL:	https://raveisnet-my.sharepoint.com/WebResource.axd?d=48l9qh1Q6oqBGuYhK1eo1iGwX-BmcL3p-RVpszMUh3BYQaWavbmuJCl-Yf5sX-Vkgl-HjMy9FgTqHdsdQEPh_CDRj6SGwrgAOK-1iDYxP1Y1&t=638459572569584809
Preview:	function WebForm_PostBackOptions(eventTarget, eventArgument, validation, validationGroup, actionUrl, trackFocus, clientSubmit) {.. this.eventTarget = eventTarget;.. this.eventArgument = eventArgument;.. this.validation = validation;.. this.validationGroup = validationGroup;.. this.actionUrl = actionUrl;.. this.trackFocus = trackFocus;.. this.clientSubmit = clientSubmit;..}..function WebForm_DoPostBackWithOptions(options) {.. var validationResult = true;.. if (options.validation) {.. if (typeof(Page_ClientValidate) == 'function') {.. validationResult = Page_ClientValidate(options.validationGroup);.. }.. }.. if (validationResult) {.. if ((typeof(options.actionUrl) != "undefined") && (options.actionUrl != null) && (options.actionUrl.length > 0)) {.. theForm.action = options.actionUrl;.. }.. if (options.trackFocus) {.. var lastFocus = theForm.elements["__LASTFOCUS"];.. if ((typeo

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 40329
Category:	downloaded
Size (bytes):	9984
Entropy (8bit):	7.979200972475404
Encrypted:	false
SSDEEP:	192:/Z/x+yzJpYhEFmtHByePw0JwScHXWumyaxkomNwWs8pQegUOX+B/rHiG:/JP8hEFshyePw8cHXx58k3OWVpQegUO0
MD5:	027A7D52E1CEED8AEF7DC13505B81D36
SHA1:	33CF0BCE6A4C8B44B4A80B3116C978C12EE93FD0
SHA-256:	29061464FB6FCE2326B952EACAA95C3C6183BFEA74C3851390E9838720D372A6
SHA-512:	FCDDEBF6DE759B5079E7DF2432771A866DE1824B119AD8CB3BAE11F9FAA060B943D52F121E4C63E7E20D43F31B2220C1D4E9C24A20004C4B061CD1A0A5EE5AC9
Malicious:	false
Reputation:	low
URL:	https://raveisnet-my.sharepoint.com/ScriptResource.axd?d=DlDfgwQ2DzbnMNaMjJ_0MDdFzPzlWxf1bNrwdohlz2hAXm6ihePXqlvxPKpUJZUyY5I4qv_uR_9JK8uj2Q3JDwgf9zkWbP5Lt0328gLJDp_xcqVxlNnh_b9glFy_QP3mUYvd5gqh6B9UWQf6zWHpaazOuEwSlV_D4a2Vk-uoIzyFi8dwTLOrpmhINshBwRSx0&t=74258c30
Preview:	...........}ks.H......@a{ebU......h.^.._a..3!k...HB....m.%....?i..e..U@.........wefefefU........O.....?8).we:...?x..eQ.....EQ.:-.`p.e.^....b.W..X.........UQ.......,...4.jV~..tQ........`......Y..,.]........sR..E...M....\.c>H5.t......xW.jt.?6?.c(..`_....B.G..'.<.1.c....o...yZ..cZ.a=K+....l.l...EQ..4.=......L_..Z..4gYuQ\|._!]m1.`Q.uQ....)..=..\|.....2.8G."XY.......]c..\|xT....3@..?..Zm..E.'........2..E gy..<(.Z...8XY..4O2....U...4.0..5.W!}x._i.`.T,.V.G...b/.t..j>...<.((....,."Uo5X}.@QE.b.khU.h...>...Q~=.k.?.....o.0k........GM..X......P^G....=..<fY.U..S....K....H..9:......'...J=).O....#G[m...30k...j.2+.im.(Km3.uxv._.pT.4.>..f.-..UZ.=e...C....._5..xR.:..\U..jR. .....9A..1:1.......a..2...U......YTP..`...l0.9.t.}.'.p.c3q.. {m.,...G1..".L.Aj@.D.h.p......fZ{...eYB......1.Ep.b&..% .c.._i9.).,.eD.'...`.E.i..M3#+6...9+....B..NYB..%..8..?....zv.r..XP..W.../+..e.N........Z..i..... ....4I..iR...8+.>....k...N?....MA.....uU...&...Xyb..u..H....%.

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	dropped
Size (bytes):	7886
Entropy (8bit):	3.9482833105763633
Encrypted:	false
SSDEEP:	48:gubb4a2MNTgopLqyhFTv07EVc91JbV5FIXH0wp53O:Bbb4a5NTX1c9L6E
MD5:	0B60F3C9E4DA6E807E808DA7360F24F2
SHA1:	9AFC7ABB910DE855EFB426206E547574A1E074B7
SHA-256:	ADDEEDEEEF393B6B1BE5BBB099B656DCD797334FF972C495CCB09CFCB1A78341
SHA-512:	1328363987ABBAD1B927FC95F0A3D5646184EF69D66B42F32D1185EE06603AE1A574FAC64472FB6E349C2CE99F9B54407BA72B2908CA7AB01D023EC2F47E7E80
Malicious:	false
Reputation:	low
Preview:	...... .... .....6......... ............... .h...f...(... ...@..... ...........................................................................70..7...7...7...7...7...7...70..............................................................................................7`..7...7...7...7...7...7...7...7...7`......................................................................................7P..7...7...7...7...7...7...7...7...7...7...7P..............................................................................7...7...7...7...7...7...7...7...7...7...7...7...7...7...........................................................................7`..7...7...7...7...7...7...7...7...7...7...7...7...7`..........................................................................,...,...,...,...,...,...,.......7...7...7...7...7...7...........................................................................'...'...'...'...'...'...'...'...2...7...7...7...7...,....................`..........................

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	186722
Entropy (8bit):	5.127936869447186
Encrypted:	false
SSDEEP:	1536:qofu83Pw6jz1+8YZwf7BN6pJsnNxezT8+zacaS8Ob4C//aT5L4DK:883z5+nMDEuvezT8++6kZCe
MD5:	2DE2482829622DE740DB42E04CBCD047
SHA1:	2A88D65A01BDA232B97B24163F66BA7F90A63386
SHA-256:	947D9E7117E8528021EC98FBBD6FE75A4D393A699DFFFFB3A2803EAE42845CEB
SHA-512:	35A2B88CF1FD1505BAD30CF68FB235ED5E5029D4824EC8586452A53E820563229AEA06156B46702C5046DC4BCE0046DFC74E934E215BFDD040B2715D298E8886
Malicious:	false
Reputation:	low
URL:	https://res-1.cdn.office.net/bld/_layouts/15/16.0.24803.12007/1033/strings.js
Preview:	var Strings; if (Strings === undefined) { Strings=new Object(); }Strings.CMS=function(){};Strings.CMS.L_SelectAllAltKey_TEXT="false";Strings.CMS.L_SpellCheckKey_VALUE="0x76";Strings.CMS.L_Callout_Usage_Count="<p>{0}</p>view\|\|<p>{0}</p>views";Strings.CMS.L_NoElementStylesWereRemoved_TEXT="The selection did not contain any instances of element styles to remove.";Strings.CMS.L_DecWidthAltKey_TEXT="false";Strings.CMS.L_ExpandedTagNameH4="Heading 4";Strings.CMS.L_DecWidthShiftKey_TEXT="true";Strings.CMS.L_EditImageRenditionsAction="Edit Renditions";Strings.CMS.L_TabBackKey_TEXT="N";Strings.CMS.L_SvrBusySpellchecker_TEXT="The spell checking server was busy";Strings.CMS.L_RemoveLinkShiftKey_TEXT="false";Strings.CMS.L_Show_TEXT="Show";Strings.CMS.L_Title_TEXT="Title:";Strings.CMS.L_ShowSpecific_TEXT="Show the selected item in navigation";Strings.CMS.L_DecHeightShiftKey_TEXT="true";Strings.CMS.L_ChangeColumnWidthAndRowHeightKey_TEXT="W";Strings.CMS.L_UnlinkToolTip_TEXT="Remove Hyperlink";Strin

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (64257), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	203717
Entropy (8bit):	4.981459725992953
Encrypted:	false
SSDEEP:	6144:apkzi/OnGxq71RAEz68vAOyFWCQfh5aArPIcA2DU5+Z3sg/f+1DDU:4fGnGxq71RAEz68sxPa2U
MD5:	9C3F3D11E8BF7353675C7E14DC84F70F
SHA1:	A94C8F3C34209130B6786A98C8D0A80B094B0B8C
SHA-256:	5F9E00292979778C155E02E85A1ECCAC1A4335609F144A40A67FA5CC68E855BD
SHA-512:	E58DF0C375EF4A034E573B5035A37F8349627709E711AA3FD1A8A40D44B77BE79FAD799875875726E3C89529D5A40022084210EC905A21F257123622346761DF
Malicious:	false
Reputation:	low
URL:	https://raveisnet-my.sharepoint.com/:b:/g/personal/charles_magyar_raveis_com/EXcQ7jfjoRRElVGCYOzbRHgB-DdV8LhSQTAdk06dppgodw?email=Charles.Magyar%40Raveis.com&e=4%3alGbSIk&fromShare=true&at=9
Preview:	..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN".."http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns:o="urn:schemas-microsoft-com:office:office" lang="en-us" dir="ltr">..<head><meta name="GENERATOR" content="Microsoft SharePoint" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta http-equiv="Expires" content="0" /><meta http-equiv="X-UA-Compatible" content="IE=8"/><meta name="ROBOTS" content="NOHTMLINDEX" /><title>......Error....</title><link id="CssLink-6d2b07df21f147849d2a4ba9dc14748a" rel="stylesheet" type="text/css" href="/_layouts/15/1033/styles/corev15.css?rev=34APf%2FlfLRHu1iumf2MGdw%3D%3DTAG84"/>.<link id="CssLink-2f479efdce164260a2dc6a77824a172c" rel="stylesheet" type="text/css" href="/_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG84"/>.<style id="SPThemeHideForms" type="text/css">body {opacity:0 !important}</style><script type="text/javascript">// <![CDATA[ ...var _initGlobalSnapShot = {};try { if (O

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 13:35:07.704408884 CEST	49678	443	192.168.2.4	104.46.162.224
Apr 25, 2024 13:35:09.251296997 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 25, 2024 13:35:18.736845016 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:18.736892939 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:18.736979008 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:18.737497091 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:18.737545967 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:18.737601042 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:18.737811089 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:18.737824917 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:18.737993956 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:18.738010883 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:18.859657049 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 25, 2024 13:35:19.084856033 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.085376024 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.085400105 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.086386919 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.086462975 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.087246895 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.087424040 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.087486982 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.087574005 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.087608099 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.087724924 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.087733030 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.091336012 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.091413975 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.092274904 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.092453003 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.137584925 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.137598991 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.137639046 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.191759109 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.620301962 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.620332956 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.620424032 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.620425940 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.620434046 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.620472908 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.620486975 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.620524883 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.620568037 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.620574951 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.620615005 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.620742083 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.620805025 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.620810986 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.662797928 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.663685083 CEST	49739	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.663774014 CEST	443	49739	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.663846970 CEST	49739	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.664172888 CEST	49739	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.664210081 CEST	443	49739	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.665832043 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.678525925 CEST	49740	443	192.168.2.4	108.177.122.147
Apr 25, 2024 13:35:19.678556919 CEST	443	49740	108.177.122.147	192.168.2.4
Apr 25, 2024 13:35:19.678615093 CEST	49740	443	192.168.2.4	108.177.122.147
Apr 25, 2024 13:35:19.678777933 CEST	49740	443	192.168.2.4	108.177.122.147
Apr 25, 2024 13:35:19.678796053 CEST	443	49740	108.177.122.147	192.168.2.4
Apr 25, 2024 13:35:19.708116055 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.729918003 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.729933977 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.729985952 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.730000973 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.730128050 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.730154991 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.730175972 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.730180979 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.730206013 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.730348110 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.730397940 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.730402946 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.730535030 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.730581999 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.730587006 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.730669022 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.730721951 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.730727911 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.730813026 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.730868101 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.730873108 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.772564888 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.801713943 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.801759958 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.801815033 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.801851988 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.801903963 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.801928043 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.801949978 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.801959038 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.801980972 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.801983118 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.802050114 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.802146912 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.802191973 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.802202940 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.802212000 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.802233934 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.802248001 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.802263021 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.802283049 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.802293062 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.802328110 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.802335978 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.839692116 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.839704037 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.839756966 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.839767933 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.839808941 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.839818001 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.839858055 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.839864969 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.839879990 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.840038061 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.840089083 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.840095043 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.840255976 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.840298891 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.840305090 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.840459108 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.840503931 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.840511084 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.840624094 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.840668917 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.840675116 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.840966940 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.841017008 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.841022015 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.841099024 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.841145992 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.841152906 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.843421936 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.866468906 CEST	49741	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.866503954 CEST	443	49741	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.866554022 CEST	49741	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.868604898 CEST	49742	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.868633986 CEST	443	49742	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.868683100 CEST	49742	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.870022058 CEST	49741	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.870034933 CEST	443	49741	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.870929003 CEST	49743	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.870979071 CEST	443	49743	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.871057987 CEST	49743	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.871746063 CEST	49742	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.871764898 CEST	443	49742	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.871926069 CEST	49743	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.871958017 CEST	443	49743	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.881867886 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.881943941 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.881989956 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.910381079 CEST	443	49740	108.177.122.147	192.168.2.4
Apr 25, 2024 13:35:19.911314011 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.911333084 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.911345959 CEST	49740	443	192.168.2.4	108.177.122.147
Apr 25, 2024 13:35:19.911358118 CEST	443	49740	108.177.122.147	192.168.2.4
Apr 25, 2024 13:35:19.911376953 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.911391020 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.911437035 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.911453009 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.911473036 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.911499977 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.911534071 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.911541939 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.911659002 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.911685944 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.911714077 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.911720991 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.911732912 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.911915064 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.911969900 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.911977053 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.912056923 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.912111044 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.912117958 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.912255049 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.912306070 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.912313938 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.913420916 CEST	443	49740	108.177.122.147	192.168.2.4
Apr 25, 2024 13:35:19.913475037 CEST	49740	443	192.168.2.4	108.177.122.147
Apr 25, 2024 13:35:19.915466070 CEST	49740	443	192.168.2.4	108.177.122.147
Apr 25, 2024 13:35:19.915549994 CEST	443	49740	108.177.122.147	192.168.2.4
Apr 25, 2024 13:35:19.923796892 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.950664043 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.950676918 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.950707912 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.950728893 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.950737953 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.950766087 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.950772047 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.950788021 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.950812101 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.951093912 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.951102972 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.951128960 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.951143980 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.951152086 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.951170921 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.951195002 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.951572895 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.951591969 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.951628923 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.951634884 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.951653957 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.951669931 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.951900005 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.951956034 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.951961040 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.951991081 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.952033043 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.952265978 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.958219051 CEST	49740	443	192.168.2.4	108.177.122.147
Apr 25, 2024 13:35:19.958231926 CEST	443	49740	108.177.122.147	192.168.2.4
Apr 25, 2024 13:35:19.960990906 CEST	49736	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:19.961009026 CEST	443	49736	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:19.999634981 CEST	49740	443	192.168.2.4	108.177.122.147
Apr 25, 2024 13:35:20.003812075 CEST	443	49739	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.006345034 CEST	49739	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.006361961 CEST	443	49739	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.007515907 CEST	443	49739	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.008148909 CEST	49739	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.008311033 CEST	443	49739	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.008394957 CEST	49739	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.021162987 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.021177053 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.021239996 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.021281958 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.021292925 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.021317005 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.021352053 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.021368980 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.021377087 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.021393061 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.021444082 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.021493912 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.021502018 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.021687031 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.021734953 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.021743059 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.021997929 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.022058010 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.022066116 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.022124052 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.022181988 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.022190094 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.022324085 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.022367954 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.022376060 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.022695065 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.022749901 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.022757053 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.022852898 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.022907972 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.022916079 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.056113005 CEST	443	49739	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.063828945 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.132286072 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.132299900 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.132348061 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.132369995 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.132375002 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.132396936 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.132420063 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.132443905 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.132757902 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.132783890 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.132817030 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.132824898 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.132848024 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.132880926 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.133125067 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.133146048 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.133178949 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.133186102 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.133213043 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.133225918 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.133498907 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.133527040 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.133560896 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.133568048 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.133591890 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.133610964 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.133893967 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.133915901 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.133951902 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.133958101 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.133976936 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.133992910 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.134289980 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.134311914 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.134344101 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.134350061 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.134378910 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.134387016 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.134717941 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.134741068 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.134768963 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.134776115 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.134803057 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.134820938 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.135029078 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.135050058 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.135082006 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.135087013 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.135117054 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.135134935 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.135493040 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.135521889 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.135569096 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.135576963 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.135603905 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.135622025 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.163139105 CEST	443	49739	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.163378954 CEST	443	49739	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.163477898 CEST	49739	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.168148041 CEST	49739	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.168183088 CEST	443	49739	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.205220938 CEST	443	49741	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.205595016 CEST	49741	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.205626965 CEST	443	49741	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.205987930 CEST	443	49741	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.206398964 CEST	49741	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.206463099 CEST	443	49741	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.206614971 CEST	49741	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.206916094 CEST	443	49743	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.207016945 CEST	443	49742	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.207154989 CEST	49743	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.207216978 CEST	443	49743	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.207305908 CEST	49742	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.207323074 CEST	443	49742	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.208265066 CEST	443	49743	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.208321095 CEST	443	49742	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.208336115 CEST	49743	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.208379030 CEST	49742	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.208713055 CEST	49743	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.208781004 CEST	443	49743	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.209116936 CEST	49742	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.209172964 CEST	443	49742	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.209245920 CEST	49743	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.209261894 CEST	443	49743	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.209404945 CEST	49742	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.209414005 CEST	443	49742	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.244678974 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.244720936 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.244755983 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.244771957 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.244813919 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.244827986 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.244899988 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.244925976 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.244959116 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.244966030 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.244992018 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.245008945 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.245238066 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.245289087 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.245287895 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.245313883 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.245358944 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.245389938 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.245803118 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.247459888 CEST	49735	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.247474909 CEST	443	49735	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.248120070 CEST	443	49741	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.249929905 CEST	49742	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.249964952 CEST	49743	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.351938009 CEST	443	49743	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.351963043 CEST	443	49743	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.352041960 CEST	443	49743	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.352051020 CEST	49743	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.352085114 CEST	443	49743	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.352121115 CEST	443	49743	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.352134943 CEST	49743	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.352163076 CEST	49743	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.352176905 CEST	443	49743	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.352232933 CEST	49743	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.357275963 CEST	49743	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.357316017 CEST	443	49743	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.360265017 CEST	443	49742	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.360296011 CEST	443	49742	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.360340118 CEST	49742	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.360352039 CEST	443	49742	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.360392094 CEST	49742	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.360454082 CEST	443	49742	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.360471964 CEST	443	49742	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.360498905 CEST	49742	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.360527039 CEST	49742	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.360532045 CEST	443	49742	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.360573053 CEST	443	49742	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.360615969 CEST	49742	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.360625982 CEST	443	49742	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.360665083 CEST	49742	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.360862017 CEST	443	49742	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.360920906 CEST	49742	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.360925913 CEST	443	49742	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.360935926 CEST	443	49742	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.360964060 CEST	49742	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.360989094 CEST	49742	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.365322113 CEST	443	49741	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.365334034 CEST	443	49741	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.365381956 CEST	49741	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.365407944 CEST	443	49741	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.365602016 CEST	443	49741	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.365655899 CEST	49741	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.365662098 CEST	443	49741	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.365685940 CEST	443	49741	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.365725040 CEST	49741	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.365731001 CEST	443	49741	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.365968943 CEST	443	49741	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.366020918 CEST	49741	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.366027117 CEST	443	49741	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.372287989 CEST	49742	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.372317076 CEST	443	49742	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.406141043 CEST	49741	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.475028992 CEST	443	49741	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.475133896 CEST	49741	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.475158930 CEST	443	49741	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.475172043 CEST	443	49741	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:20.475228071 CEST	49741	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.475876093 CEST	49741	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:20.475889921 CEST	443	49741	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:21.283221006 CEST	49748	443	192.168.2.4	23.46.200.91
Apr 25, 2024 13:35:21.283291101 CEST	443	49748	23.46.200.91	192.168.2.4
Apr 25, 2024 13:35:21.283503056 CEST	49748	443	192.168.2.4	23.46.200.91
Apr 25, 2024 13:35:21.384275913 CEST	49748	443	192.168.2.4	23.46.200.91
Apr 25, 2024 13:35:21.384315968 CEST	443	49748	23.46.200.91	192.168.2.4
Apr 25, 2024 13:35:21.420696974 CEST	49749	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:21.420737028 CEST	443	49749	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:21.421384096 CEST	49749	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:21.422122955 CEST	49749	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:21.422138929 CEST	443	49749	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:21.615621090 CEST	443	49748	23.46.200.91	192.168.2.4
Apr 25, 2024 13:35:21.615721941 CEST	49748	443	192.168.2.4	23.46.200.91
Apr 25, 2024 13:35:21.619271994 CEST	49748	443	192.168.2.4	23.46.200.91
Apr 25, 2024 13:35:21.619292021 CEST	443	49748	23.46.200.91	192.168.2.4
Apr 25, 2024 13:35:21.619715929 CEST	443	49748	23.46.200.91	192.168.2.4
Apr 25, 2024 13:35:21.672338963 CEST	49748	443	192.168.2.4	23.46.200.91
Apr 25, 2024 13:35:21.695960999 CEST	49748	443	192.168.2.4	23.46.200.91
Apr 25, 2024 13:35:21.736146927 CEST	443	49748	23.46.200.91	192.168.2.4
Apr 25, 2024 13:35:21.758400917 CEST	443	49749	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:21.758882046 CEST	49749	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:21.758900881 CEST	443	49749	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:21.759260893 CEST	443	49749	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:21.759710073 CEST	49749	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:21.759772062 CEST	443	49749	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:21.760085106 CEST	49749	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:21.800139904 CEST	443	49749	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:21.840856075 CEST	443	49748	23.46.200.91	192.168.2.4
Apr 25, 2024 13:35:21.841017962 CEST	443	49748	23.46.200.91	192.168.2.4
Apr 25, 2024 13:35:21.841208935 CEST	49748	443	192.168.2.4	23.46.200.91
Apr 25, 2024 13:35:21.853410006 CEST	49748	443	192.168.2.4	23.46.200.91
Apr 25, 2024 13:35:21.853430033 CEST	443	49748	23.46.200.91	192.168.2.4
Apr 25, 2024 13:35:21.853441954 CEST	49748	443	192.168.2.4	23.46.200.91
Apr 25, 2024 13:35:21.853447914 CEST	443	49748	23.46.200.91	192.168.2.4
Apr 25, 2024 13:35:21.900943995 CEST	443	49749	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:21.900970936 CEST	443	49749	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:21.901030064 CEST	443	49749	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:21.901031017 CEST	49749	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:21.901041985 CEST	443	49749	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:21.901093960 CEST	49749	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:21.901102066 CEST	443	49749	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:21.901145935 CEST	49749	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:21.901165009 CEST	443	49749	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:21.901206017 CEST	49749	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:21.902946949 CEST	49749	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:21.902954102 CEST	443	49749	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:21.917318106 CEST	49751	443	192.168.2.4	23.46.200.91
Apr 25, 2024 13:35:21.917351007 CEST	443	49751	23.46.200.91	192.168.2.4
Apr 25, 2024 13:35:21.917432070 CEST	49751	443	192.168.2.4	23.46.200.91
Apr 25, 2024 13:35:21.918035984 CEST	49751	443	192.168.2.4	23.46.200.91
Apr 25, 2024 13:35:21.918047905 CEST	443	49751	23.46.200.91	192.168.2.4
Apr 25, 2024 13:35:22.144910097 CEST	443	49751	23.46.200.91	192.168.2.4
Apr 25, 2024 13:35:22.145009041 CEST	49751	443	192.168.2.4	23.46.200.91
Apr 25, 2024 13:35:22.232585907 CEST	49751	443	192.168.2.4	23.46.200.91
Apr 25, 2024 13:35:22.232608080 CEST	443	49751	23.46.200.91	192.168.2.4
Apr 25, 2024 13:35:22.233606100 CEST	443	49751	23.46.200.91	192.168.2.4
Apr 25, 2024 13:35:22.233673096 CEST	49752	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:22.233716965 CEST	443	49752	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:22.233778000 CEST	49752	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:22.234221935 CEST	49752	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:22.234234095 CEST	443	49752	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:22.236047983 CEST	49751	443	192.168.2.4	23.46.200.91
Apr 25, 2024 13:35:22.276140928 CEST	443	49751	23.46.200.91	192.168.2.4
Apr 25, 2024 13:35:22.364192009 CEST	443	49751	23.46.200.91	192.168.2.4
Apr 25, 2024 13:35:22.364387035 CEST	443	49751	23.46.200.91	192.168.2.4
Apr 25, 2024 13:35:22.364454985 CEST	49751	443	192.168.2.4	23.46.200.91
Apr 25, 2024 13:35:22.365540981 CEST	49751	443	192.168.2.4	23.46.200.91
Apr 25, 2024 13:35:22.365556002 CEST	443	49751	23.46.200.91	192.168.2.4
Apr 25, 2024 13:35:22.365566969 CEST	49751	443	192.168.2.4	23.46.200.91
Apr 25, 2024 13:35:22.365571976 CEST	443	49751	23.46.200.91	192.168.2.4
Apr 25, 2024 13:35:22.571523905 CEST	443	49752	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:22.575315952 CEST	49752	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:22.575351954 CEST	443	49752	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:22.576853991 CEST	443	49752	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:22.576911926 CEST	49752	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:22.577526093 CEST	49752	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:22.577608109 CEST	443	49752	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:22.577780008 CEST	49752	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:22.577788115 CEST	443	49752	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:22.630285025 CEST	49752	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:22.728926897 CEST	443	49752	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:22.728960037 CEST	443	49752	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:22.729032040 CEST	443	49752	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:22.729032040 CEST	49752	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:22.729043007 CEST	443	49752	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:22.729058027 CEST	443	49752	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:22.729080915 CEST	49752	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:22.729173899 CEST	443	49752	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:22.729228020 CEST	49752	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:22.730221987 CEST	49752	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:22.730238914 CEST	443	49752	13.107.136.10	192.168.2.4
Apr 25, 2024 13:35:22.730248928 CEST	49752	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:22.730326891 CEST	49752	443	192.168.2.4	13.107.136.10
Apr 25, 2024 13:35:29.901001930 CEST	443	49740	108.177.122.147	192.168.2.4
Apr 25, 2024 13:35:29.901077032 CEST	443	49740	108.177.122.147	192.168.2.4
Apr 25, 2024 13:35:29.901315928 CEST	49740	443	192.168.2.4	108.177.122.147
Apr 25, 2024 13:35:30.814176083 CEST	49740	443	192.168.2.4	108.177.122.147
Apr 25, 2024 13:35:30.814208031 CEST	443	49740	108.177.122.147	192.168.2.4
Apr 25, 2024 13:35:31.106053114 CEST	49755	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:35:31.106080055 CEST	443	49755	40.127.169.103	192.168.2.4
Apr 25, 2024 13:35:31.106169939 CEST	49755	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:35:31.107125044 CEST	49755	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:35:31.107137918 CEST	443	49755	40.127.169.103	192.168.2.4
Apr 25, 2024 13:35:31.724596977 CEST	443	49755	40.127.169.103	192.168.2.4
Apr 25, 2024 13:35:31.724740028 CEST	49755	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:35:31.727444887 CEST	49755	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:35:31.727459908 CEST	443	49755	40.127.169.103	192.168.2.4
Apr 25, 2024 13:35:31.727691889 CEST	443	49755	40.127.169.103	192.168.2.4
Apr 25, 2024 13:35:31.781203032 CEST	49755	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:35:32.133666992 CEST	49755	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:35:32.180123091 CEST	443	49755	40.127.169.103	192.168.2.4
Apr 25, 2024 13:35:32.536556959 CEST	443	49755	40.127.169.103	192.168.2.4
Apr 25, 2024 13:35:32.536581039 CEST	443	49755	40.127.169.103	192.168.2.4
Apr 25, 2024 13:35:32.536588907 CEST	443	49755	40.127.169.103	192.168.2.4
Apr 25, 2024 13:35:32.536613941 CEST	443	49755	40.127.169.103	192.168.2.4
Apr 25, 2024 13:35:32.536627054 CEST	443	49755	40.127.169.103	192.168.2.4
Apr 25, 2024 13:35:32.536640882 CEST	443	49755	40.127.169.103	192.168.2.4
Apr 25, 2024 13:35:32.536649942 CEST	49755	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:35:32.536662102 CEST	443	49755	40.127.169.103	192.168.2.4
Apr 25, 2024 13:35:32.536670923 CEST	443	49755	40.127.169.103	192.168.2.4
Apr 25, 2024 13:35:32.536705971 CEST	49755	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:35:32.536705971 CEST	49755	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:35:32.536742926 CEST	49755	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:35:32.536752939 CEST	443	49755	40.127.169.103	192.168.2.4
Apr 25, 2024 13:35:32.536765099 CEST	443	49755	40.127.169.103	192.168.2.4
Apr 25, 2024 13:35:32.536811113 CEST	49755	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:35:32.803004026 CEST	49755	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:35:32.803026915 CEST	443	49755	40.127.169.103	192.168.2.4
Apr 25, 2024 13:35:32.803080082 CEST	49755	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:35:32.803086996 CEST	443	49755	40.127.169.103	192.168.2.4
Apr 25, 2024 13:36:09.227401972 CEST	49761	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:36:09.227453947 CEST	443	49761	40.127.169.103	192.168.2.4
Apr 25, 2024 13:36:09.227768898 CEST	49761	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:36:09.227942944 CEST	49761	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:36:09.227956057 CEST	443	49761	40.127.169.103	192.168.2.4
Apr 25, 2024 13:36:09.841474056 CEST	443	49761	40.127.169.103	192.168.2.4
Apr 25, 2024 13:36:09.841547966 CEST	49761	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:36:09.845423937 CEST	49761	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:36:09.845436096 CEST	443	49761	40.127.169.103	192.168.2.4
Apr 25, 2024 13:36:09.845757008 CEST	443	49761	40.127.169.103	192.168.2.4
Apr 25, 2024 13:36:09.854585886 CEST	49761	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:36:09.900110006 CEST	443	49761	40.127.169.103	192.168.2.4
Apr 25, 2024 13:36:10.443020105 CEST	443	49761	40.127.169.103	192.168.2.4
Apr 25, 2024 13:36:10.443083048 CEST	443	49761	40.127.169.103	192.168.2.4
Apr 25, 2024 13:36:10.443142891 CEST	443	49761	40.127.169.103	192.168.2.4
Apr 25, 2024 13:36:10.443167925 CEST	49761	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:36:10.443196058 CEST	443	49761	40.127.169.103	192.168.2.4
Apr 25, 2024 13:36:10.443209887 CEST	49761	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:36:10.443243980 CEST	49761	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:36:10.443303108 CEST	443	49761	40.127.169.103	192.168.2.4
Apr 25, 2024 13:36:10.443345070 CEST	443	49761	40.127.169.103	192.168.2.4
Apr 25, 2024 13:36:10.443362951 CEST	49761	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:36:10.443373919 CEST	443	49761	40.127.169.103	192.168.2.4
Apr 25, 2024 13:36:10.443501949 CEST	443	49761	40.127.169.103	192.168.2.4
Apr 25, 2024 13:36:10.443546057 CEST	49761	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:36:10.448240995 CEST	49761	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:36:10.448259115 CEST	443	49761	40.127.169.103	192.168.2.4
Apr 25, 2024 13:36:10.448271036 CEST	49761	443	192.168.2.4	40.127.169.103
Apr 25, 2024 13:36:10.448276043 CEST	443	49761	40.127.169.103	192.168.2.4
Apr 25, 2024 13:36:19.627033949 CEST	49763	443	192.168.2.4	108.177.122.147
Apr 25, 2024 13:36:19.627074003 CEST	443	49763	108.177.122.147	192.168.2.4
Apr 25, 2024 13:36:19.627389908 CEST	49763	443	192.168.2.4	108.177.122.147
Apr 25, 2024 13:36:19.627779961 CEST	49763	443	192.168.2.4	108.177.122.147
Apr 25, 2024 13:36:19.627793074 CEST	443	49763	108.177.122.147	192.168.2.4
Apr 25, 2024 13:36:19.858228922 CEST	443	49763	108.177.122.147	192.168.2.4
Apr 25, 2024 13:36:19.858587027 CEST	49763	443	192.168.2.4	108.177.122.147
Apr 25, 2024 13:36:19.858613968 CEST	443	49763	108.177.122.147	192.168.2.4
Apr 25, 2024 13:36:19.859708071 CEST	443	49763	108.177.122.147	192.168.2.4
Apr 25, 2024 13:36:19.860244036 CEST	49763	443	192.168.2.4	108.177.122.147
Apr 25, 2024 13:36:19.860415936 CEST	443	49763	108.177.122.147	192.168.2.4
Apr 25, 2024 13:36:19.906867027 CEST	49763	443	192.168.2.4	108.177.122.147
Apr 25, 2024 13:36:26.657244921 CEST	49723	80	192.168.2.4	199.232.210.172
Apr 25, 2024 13:36:26.657406092 CEST	49724	80	192.168.2.4	199.232.214.172
Apr 25, 2024 13:36:26.766597986 CEST	80	49724	199.232.214.172	192.168.2.4
Apr 25, 2024 13:36:26.766719103 CEST	80	49724	199.232.214.172	192.168.2.4
Apr 25, 2024 13:36:26.766781092 CEST	80	49723	199.232.210.172	192.168.2.4
Apr 25, 2024 13:36:26.766797066 CEST	80	49723	199.232.210.172	192.168.2.4
Apr 25, 2024 13:36:26.766818047 CEST	49724	80	192.168.2.4	199.232.214.172
Apr 25, 2024 13:36:26.766928911 CEST	49723	80	192.168.2.4	199.232.210.172
Apr 25, 2024 13:36:29.882261038 CEST	443	49763	108.177.122.147	192.168.2.4
Apr 25, 2024 13:36:29.882426023 CEST	443	49763	108.177.122.147	192.168.2.4
Apr 25, 2024 13:36:29.882571936 CEST	49763	443	192.168.2.4	108.177.122.147
Apr 25, 2024 13:36:30.809993982 CEST	49763	443	192.168.2.4	108.177.122.147
Apr 25, 2024 13:36:30.810046911 CEST	443	49763	108.177.122.147	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 13:35:16.549526930 CEST	53	54599	1.1.1.1	192.168.2.4
Apr 25, 2024 13:35:16.558288097 CEST	53	58075	1.1.1.1	192.168.2.4
Apr 25, 2024 13:35:17.238217115 CEST	53	59504	1.1.1.1	192.168.2.4
Apr 25, 2024 13:35:18.483402967 CEST	65018	53	192.168.2.4	1.1.1.1
Apr 25, 2024 13:35:18.483544111 CEST	61855	53	192.168.2.4	1.1.1.1
Apr 25, 2024 13:35:19.567049026 CEST	64902	53	192.168.2.4	1.1.1.1
Apr 25, 2024 13:35:19.567224979 CEST	60818	53	192.168.2.4	1.1.1.1
Apr 25, 2024 13:35:19.677078009 CEST	53	64902	1.1.1.1	192.168.2.4
Apr 25, 2024 13:35:19.677100897 CEST	53	60818	1.1.1.1	192.168.2.4
Apr 25, 2024 13:35:21.952811003 CEST	60618	53	192.168.2.4	1.1.1.1
Apr 25, 2024 13:35:21.953845978 CEST	60923	53	192.168.2.4	1.1.1.1
Apr 25, 2024 13:35:34.676333904 CEST	53	61528	1.1.1.1	192.168.2.4
Apr 25, 2024 13:35:38.239854097 CEST	138	138	192.168.2.4	192.168.2.255
Apr 25, 2024 13:35:53.393584967 CEST	53	55232	1.1.1.1	192.168.2.4
Apr 25, 2024 13:36:15.756607056 CEST	53	60717	1.1.1.1	192.168.2.4
Apr 25, 2024 13:36:16.207357883 CEST	53	54901	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 25, 2024 13:35:18.483402967 CEST	192.168.2.4	1.1.1.1	0x57c1	Standard query (0)	raveisnet-my.sharepoint.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:35:18.483544111 CEST	192.168.2.4	1.1.1.1	0x10c9	Standard query (0)	raveisnet-my.sharepoint.com	65	IN (0x0001)	false
Apr 25, 2024 13:35:19.567049026 CEST	192.168.2.4	1.1.1.1	0xd5b7	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:35:19.567224979 CEST	192.168.2.4	1.1.1.1	0xfcbc	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 25, 2024 13:35:21.952811003 CEST	192.168.2.4	1.1.1.1	0xddb9	Standard query (0)	raveisnet-my.sharepoint.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:35:21.953845978 CEST	192.168.2.4	1.1.1.1	0xe28c	Standard query (0)	raveisnet-my.sharepoint.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 25, 2024 13:35:18.724340916 CEST	1.1.1.1	192.168.2.4	0x10c9	No error (0)	raveisnet-my.sharepoint.com	raveisnet.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 13:35:18.724340916 CEST	1.1.1.1	192.168.2.4	0x10c9	No error (0)	raveisnet.sharepoint.com	9959-ipv4v6e.clump.dprodmgd105.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 13:35:18.724340916 CEST	1.1.1.1	192.168.2.4	0x10c9	No error (0)	9959-ipv4v6e.clump.dprodmgd105.aa-rt.sharepoint.com	194019-ipv4v6e.farm.dprodmgd105.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 13:35:18.724340916 CEST	1.1.1.1	192.168.2.4	0x10c9	No error (0)	194019-ipv4v6e.farm.dprodmgd105.aa-rt.sharepoint.com	194019-ipv4v6e.farm.dprodmgd105.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 13:35:18.736001015 CEST	1.1.1.1	192.168.2.4	0x57c1	No error (0)	raveisnet-my.sharepoint.com	raveisnet.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 13:35:18.736001015 CEST	1.1.1.1	192.168.2.4	0x57c1	No error (0)	raveisnet.sharepoint.com	9959-ipv4v6e.clump.dprodmgd105.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 13:35:18.736001015 CEST	1.1.1.1	192.168.2.4	0x57c1	No error (0)	9959-ipv4v6e.clump.dprodmgd105.aa-rt.sharepoint.com	194019-ipv4v6e.farm.dprodmgd105.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 13:35:18.736001015 CEST	1.1.1.1	192.168.2.4	0x57c1	No error (0)	194019-ipv4v6e.farm.dprodmgd105.aa-rt.sharepoint.com	194019-ipv4v6e.farm.dprodmgd105.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 13:35:18.736001015 CEST	1.1.1.1	192.168.2.4	0x57c1	No error (0)	194019-ipv4v6.farm.dprodmgd105.aa-rt.sharepoint.com.dual-spo-0005.spo-msedge.net	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 13:35:18.736001015 CEST	1.1.1.1	192.168.2.4	0x57c1	No error (0)	dual-spo-0005.spo-msedge.net		13.107.136.10	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:35:18.736001015 CEST	1.1.1.1	192.168.2.4	0x57c1	No error (0)	dual-spo-0005.spo-msedge.net		13.107.138.10	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:35:19.677078009 CEST	1.1.1.1	192.168.2.4	0xd5b7	No error (0)	www.google.com		108.177.122.147	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:35:19.677078009 CEST	1.1.1.1	192.168.2.4	0xd5b7	No error (0)	www.google.com		108.177.122.103	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:35:19.677078009 CEST	1.1.1.1	192.168.2.4	0xd5b7	No error (0)	www.google.com		108.177.122.99	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:35:19.677078009 CEST	1.1.1.1	192.168.2.4	0xd5b7	No error (0)	www.google.com		108.177.122.106	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:35:19.677078009 CEST	1.1.1.1	192.168.2.4	0xd5b7	No error (0)	www.google.com		108.177.122.104	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:35:19.677078009 CEST	1.1.1.1	192.168.2.4	0xd5b7	No error (0)	www.google.com		108.177.122.105	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:35:19.677100897 CEST	1.1.1.1	192.168.2.4	0xfcbc	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 25, 2024 13:35:22.176733017 CEST	1.1.1.1	192.168.2.4	0xddb9	No error (0)	raveisnet-my.sharepoint.com	raveisnet.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 13:35:22.176733017 CEST	1.1.1.1	192.168.2.4	0xddb9	No error (0)	raveisnet.sharepoint.com	9959-ipv4v6e.clump.dprodmgd105.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 13:35:22.176733017 CEST	1.1.1.1	192.168.2.4	0xddb9	No error (0)	9959-ipv4v6e.clump.dprodmgd105.aa-rt.sharepoint.com	194019-ipv4v6e.farm.dprodmgd105.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 13:35:22.176733017 CEST	1.1.1.1	192.168.2.4	0xddb9	No error (0)	194019-ipv4v6e.farm.dprodmgd105.aa-rt.sharepoint.com	194019-ipv4v6e.farm.dprodmgd105.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 13:35:22.176733017 CEST	1.1.1.1	192.168.2.4	0xddb9	No error (0)	194019-ipv4v6.farm.dprodmgd105.aa-rt.sharepoint.com.dual-spo-0005.spo-msedge.net	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 13:35:22.176733017 CEST	1.1.1.1	192.168.2.4	0xddb9	No error (0)	dual-spo-0005.spo-msedge.net		13.107.136.10	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:35:22.176733017 CEST	1.1.1.1	192.168.2.4	0xddb9	No error (0)	dual-spo-0005.spo-msedge.net		13.107.138.10	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:35:22.193519115 CEST	1.1.1.1	192.168.2.4	0xe28c	No error (0)	raveisnet-my.sharepoint.com	raveisnet.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 13:35:22.193519115 CEST	1.1.1.1	192.168.2.4	0xe28c	No error (0)	raveisnet.sharepoint.com	9959-ipv4v6e.clump.dprodmgd105.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 13:35:22.193519115 CEST	1.1.1.1	192.168.2.4	0xe28c	No error (0)	9959-ipv4v6e.clump.dprodmgd105.aa-rt.sharepoint.com	194019-ipv4v6e.farm.dprodmgd105.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 13:35:22.193519115 CEST	1.1.1.1	192.168.2.4	0xe28c	No error (0)	194019-ipv4v6e.farm.dprodmgd105.aa-rt.sharepoint.com	194019-ipv4v6e.farm.dprodmgd105.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

raveisnet-my.sharepoint.com

https:

fs.microsoft.com

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	13.107.136.10	443	5436	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 11:35:19 UTC	824	OUT	GET /:b:/g/personal/charles_magyar_raveis_com/EXcQ7jfjoRRElVGCYOzbRHgB-DdV8LhSQTAdk06dppgodw?email=Charles.Magyar%40Raveis.com&e=4%3alGbSIk&fromShare=true&at=9 HTTP/1.1 Host: raveisnet-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 11:35:19 UTC	1483	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 203717 Content-Type: text/html; charset=utf-8 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-NetworkStatistics: 0,525568,0,0,100213,0,55759 X-SharePointHealthScore: 1 Referrer-Policy: no-referrer, strict-origin-when-cross-origin SharePointError: 0 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: 6b7322a1-f057-5000-3d22-fda9afe2faac request-id: 6b7322a1-f057-5000-3d22-fda9afe2faac MS-CV: oSJza1fwAFA9Iv2pr+L6rA.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=1b6c0a12-f7be-44e5-b404-d3d3b6f93175&destinationEndpoint=Edge-Prod-ATL33r5d&frontEnd=AFD&RemoteIP=185.152.66.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 SPRequestDuration: 376 SPIisLatency: 4 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24727 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 47B83AAFEE284C05A41A406B1789CF43 Ref B: ATL331000107053 Ref C: 2024-04-25T11:35:19Z Date: Thu, 25 Apr 2024 11:35:19 GMT Connection: close
2024-04-25 11:35:19 UTC	2664	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0d 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3a 6f 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 6f 66 66 69 63 65 3a 6f 66 66 69 63 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 64 69 72 3d 22 6c 74 72 22 3e 0d 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 47 45 4e 45 52 41 54 4f 52 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 69 63 72 6f 73 6f 66 74 20 53 68 61 72 65 50 6f 69 6e 74 22 20 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns:o="urn:schemas-microsoft-com:office:office" lang="en-us" dir="ltr"><head><meta name="GENERATOR" content="Microsoft SharePoint"
2024-04-25 11:35:19 UTC	8192	IN	Data Raw: 41 35 30 2d 34 35 32 46 2d 39 43 45 41 2d 37 44 45 37 37 45 44 36 39 32 32 31 22 3a 31 2c 22 45 38 36 32 45 43 36 31 2d 35 30 35 45 2d 34 39 30 46 2d 41 46 44 46 2d 42 42 42 33 35 32 46 39 42 42 37 33 22 3a 31 2c 22 38 34 42 33 34 30 38 32 2d 46 34 32 43 2d 34 42 31 35 2d 39 43 42 37 2d 35 33 30 36 30 36 42 36 46 33 36 33 22 3a 31 2c 22 38 32 34 34 44 44 44 35 2d 44 45 38 34 2d 34 31 43 42 2d 39 46 35 36 2d 43 38 33 32 30 38 42 37 33 38 46 32 22 3a 31 2c 22 43 41 43 39 43 38 43 35 2d 39 46 41 44 2d 37 41 44 46 2d 42 33 43 31 2d 35 35 31 37 31 44 43 31 43 43 31 42 22 3a 31 2c 22 33 39 33 32 46 36 42 43 2d 37 41 31 46 2d 34 33 34 35 2d 38 32 41 43 2d 38 41 39 37 30 34 38 35 30 32 44 42 22 3a 31 2c 22 36 37 30 38 36 45 38 39 2d 30 30 43 38 2d 45 45 41 45 2d Data Ascii: A50-452F-9CEA-7DE77ED69221":1,"E862EC61-505E-490F-AFDF-BBB352F9BB73":1,"84B34082-F42C-4B15-9CB7-530606B6F363":1,"8244DDD5-DE84-41CB-9F56-C83208B738F2":1,"CAC9C8C5-9FAD-7ADF-B3C1-55171DC1CC1B":1,"3932F6BC-7A1F-4345-82AC-8A97048502DB":1,"67086E89-00C8-EEAE-
2024-04-25 11:35:19 UTC	4167	IN	Data Raw: 45 33 33 36 38 38 2d 37 30 45 44 2d 34 39 34 41 2d 41 39 32 31 2d 37 30 35 46 33 30 38 43 31 30 41 36 22 3a 31 2c 22 30 35 34 36 46 30 36 35 2d 43 33 34 37 2d 34 41 44 30 2d 38 38 36 44 2d 38 44 38 34 36 39 37 33 44 43 36 38 22 3a 31 2c 22 32 36 36 46 33 42 42 36 2d 44 42 37 46 2d 34 32 37 30 2d 42 38 38 33 2d 44 32 35 43 42 44 32 36 37 38 33 31 22 3a 31 2c 22 46 36 39 42 41 44 39 38 2d 33 34 38 42 2d 34 34 43 41 2d 38 33 37 33 2d 32 30 32 35 46 46 45 33 44 45 45 45 22 3a 31 2c 22 31 30 38 37 41 39 35 39 2d 41 39 32 30 2d 34 38 36 42 2d 39 39 42 37 2d 30 41 41 34 46 38 32 31 36 39 36 42 22 3a 31 2c 22 34 44 46 38 42 45 36 34 2d 45 38 36 34 2d 34 38 45 30 2d 41 42 31 42 2d 44 32 36 32 34 34 31 30 35 33 46 41 22 3a 31 2c 22 42 42 37 35 43 38 45 42 2d 35 36 Data Ascii: E33688-70ED-494A-A921-705F308C10A6":1,"0546F065-C347-4AD0-886D-8D846973DC68":1,"266F3BB6-DB7F-4270-B883-D25CBD267831":1,"F69BAD98-348B-44CA-8373-2025FFE3DEEE":1,"1087A959-A920-486B-99B7-0AA4F821696B":1,"4DF8BE64-E864-48E0-AB1B-D262441053FA":1,"BB75C8EB-56
2024-04-25 11:35:19 UTC	8192	IN	Data Raw: 46 38 44 31 37 38 45 31 22 3a 31 2c 22 31 35 41 43 37 38 43 43 2d 34 38 37 38 2d 34 42 38 31 2d 42 34 42 31 2d 44 46 37 35 38 43 44 35 31 37 39 30 22 3a 31 2c 22 34 35 42 34 42 33 34 32 2d 46 39 38 36 2d 34 33 42 45 2d 42 42 45 33 2d 37 33 39 44 43 46 39 32 44 32 36 46 22 3a 31 2c 22 33 45 38 33 37 34 32 43 2d 37 42 30 36 2d 34 38 38 44 2d 42 43 45 44 2d 37 34 38 32 35 45 37 30 44 45 34 42 22 3a 31 2c 22 41 39 43 35 31 37 43 36 2d 41 42 45 36 2d 34 32 31 42 2d 38 35 35 38 2d 39 37 42 46 35 45 36 31 43 44 30 42 22 3a 31 2c 22 30 46 45 31 41 44 43 31 2d 30 36 34 43 2d 34 41 37 42 2d 41 45 38 37 2d 37 39 42 46 37 34 33 34 35 42 37 30 22 3a 31 2c 22 30 30 35 41 33 44 44 43 2d 36 37 45 33 2d 34 44 42 35 2d 39 46 41 34 2d 46 35 38 41 33 34 42 41 42 32 33 45 22 Data Ascii: F8D178E1":1,"15AC78CC-4878-4B81-B4B1-DF758CD51790":1,"45B4B342-F986-43BE-BBE3-739DCF92D26F":1,"3E83742C-7B06-488D-BCED-74825E70DE4B":1,"A9C517C6-ABE6-421B-8558-97BF5E61CD0B":1,"0FE1ADC1-064C-4A7B-AE87-79BF74345B70":1,"005A3DDC-67E3-4DB5-9FA4-F58A34BAB23E"
2024-04-25 11:35:19 UTC	8192	IN	Data Raw: 43 43 31 2d 46 33 36 38 45 33 45 45 37 44 32 45 22 3a 31 2c 22 35 34 30 32 35 32 34 30 2d 32 38 41 42 2d 34 39 38 38 2d 39 31 32 41 2d 35 36 41 30 37 37 38 35 32 38 38 41 22 3a 31 2c 22 33 42 31 42 38 44 43 34 2d 30 46 31 44 2d 34 45 34 33 2d 38 46 35 33 2d 46 38 33 30 34 36 37 46 35 38 37 39 22 3a 31 2c 22 34 44 37 39 45 35 36 36 2d 35 39 32 34 2d 34 32 33 46 2d 41 34 45 43 2d 34 43 41 45 31 31 35 38 44 31 43 35 22 3a 31 2c 22 39 44 36 37 41 31 41 41 2d 33 39 35 44 2d 34 32 41 33 2d 39 44 38 35 2d 43 39 46 43 35 46 46 42 37 33 44 34 22 3a 31 2c 22 35 36 34 35 33 44 39 32 2d 44 45 33 31 2d 34 32 33 46 2d 41 35 43 32 2d 44 38 30 45 35 42 31 30 39 37 32 42 22 3a 31 2c 22 41 37 43 33 32 45 43 44 2d 43 39 39 46 2d 34 42 42 33 2d 41 32 41 33 2d 31 34 36 37 36 Data Ascii: CC1-F368E3EE7D2E":1,"54025240-28AB-4988-912A-56A07785288A":1,"3B1B8DC4-0F1D-4E43-8F53-F830467F5879":1,"4D79E566-5924-423F-A4EC-4CAE1158D1C5":1,"9D67A1AA-395D-42A3-9D85-C9FC5FFB73D4":1,"56453D92-DE31-423F-A5C2-D80E5B10972B":1,"A7C32ECD-C99F-4BB3-A2A3-14676
2024-04-25 11:35:19 UTC	8192	IN	Data Raw: 31 2d 34 42 34 32 2d 39 46 31 36 2d 34 44 33 30 34 38 34 35 30 32 35 42 22 3a 31 2c 22 43 46 41 36 32 36 31 42 2d 36 34 45 33 2d 34 31 37 44 2d 39 37 35 37 2d 38 32 32 39 41 30 35 31 46 42 46 43 22 3a 31 2c 22 44 32 44 39 36 43 37 38 2d 35 41 33 46 2d 34 35 37 37 2d 39 44 43 42 2d 46 43 38 42 35 36 35 39 41 36 36 41 22 3a 31 2c 22 45 38 41 43 31 31 33 30 2d 31 45 35 34 2d 34 32 38 44 2d 39 35 34 46 2d 30 46 34 31 42 44 33 33 32 45 38 42 22 3a 31 2c 22 30 42 45 30 38 32 43 36 2d 34 33 41 36 2d 34 32 45 39 2d 41 39 45 42 2d 43 33 38 31 30 43 44 36 42 36 37 36 22 3a 31 2c 22 42 39 35 30 35 43 35 32 2d 46 45 41 36 2d 34 30 32 30 2d 41 46 31 36 2d 33 44 35 46 41 44 35 34 41 32 34 30 22 3a 31 2c 22 33 41 42 32 45 35 42 31 2d 41 38 45 43 2d 34 42 39 36 2d 39 32 Data Ascii: 1-4B42-9F16-4D304845025B":1,"CFA6261B-64E3-417D-9757-8229A051FBFC":1,"D2D96C78-5A3F-4577-9DCB-FC8B5659A66A":1,"E8AC1130-1E54-428D-954F-0F41BD332E8B":1,"0BE082C6-43A6-42E9-A9EB-C3810CD6B676":1,"B9505C52-FEA6-4020-AF16-3D5FAD54A240":1,"3AB2E5B1-A8EC-4B96-92
2024-04-25 11:35:19 UTC	8192	IN	Data Raw: 44 41 31 33 2d 30 39 44 31 2d 34 39 46 39 2d 38 38 41 35 2d 44 32 41 42 41 39 42 41 35 37 37 37 22 3a 31 2c 22 42 39 39 30 39 44 36 37 2d 37 32 34 37 2d 34 32 42 30 2d 41 42 39 46 2d 31 44 36 37 34 36 38 32 35 30 43 37 22 3a 31 2c 22 41 45 30 37 44 39 46 33 2d 31 46 31 39 2d 34 41 43 41 2d 38 41 38 32 2d 43 39 42 38 43 44 41 45 45 45 38 37 22 3a 31 2c 22 38 39 35 41 38 33 30 38 2d 38 36 46 42 2d 34 41 43 37 2d 38 46 31 43 2d 37 34 44 46 31 46 30 31 34 45 33 32 22 3a 31 2c 22 30 35 43 42 39 37 34 46 2d 30 33 39 35 2d 34 33 38 37 2d 41 30 39 38 2d 44 45 43 43 34 39 43 39 42 36 34 39 22 3a 31 2c 22 46 39 30 30 33 33 35 39 2d 31 42 42 46 2d 34 33 38 41 2d 41 41 41 43 2d 36 45 44 46 39 31 31 41 45 43 41 43 22 3a 31 2c 22 30 44 45 35 45 45 39 41 2d 35 31 37 32 Data Ascii: DA13-09D1-49F9-88A5-D2ABA9BA5777":1,"B9909D67-7247-42B0-AB9F-1D67468250C7":1,"AE07D9F3-1F19-4ACA-8A82-C9B8CDAEEE87":1,"895A8308-86FB-4AC7-8F1C-74DF1F014E32":1,"05CB974F-0395-4387-A098-DECC49C9B649":1,"F9003359-1BBF-438A-AAAC-6EDF911AECAC":1,"0DE5EE9A-5172
2024-04-25 11:35:19 UTC	8192	IN	Data Raw: 3a 31 2c 22 37 36 30 39 34 32 38 45 2d 33 43 38 45 2d 34 30 34 38 2d 41 35 43 32 2d 41 43 33 33 35 43 42 33 45 33 42 34 22 3a 31 2c 22 43 30 34 45 46 37 30 32 2d 42 33 37 44 2d 34 39 33 42 2d 38 31 43 32 2d 46 36 38 41 32 34 34 30 39 36 33 38 22 3a 31 2c 22 41 42 33 30 37 33 32 31 2d 37 39 38 42 2d 34 42 34 43 2d 41 44 42 37 2d 35 43 38 45 43 31 35 41 30 35 45 35 22 3a 31 2c 22 45 34 42 44 39 44 45 30 2d 46 35 43 32 2d 34 44 45 46 2d 39 31 33 33 2d 42 31 43 38 46 43 30 44 45 33 34 44 22 3a 31 2c 22 34 38 43 42 42 38 41 35 2d 35 36 42 33 2d 34 45 46 39 2d 38 38 41 46 2d 39 37 44 41 45 37 30 41 34 46 41 32 22 3a 31 2c 22 43 45 34 46 31 44 41 35 2d 31 45 30 42 2d 34 44 39 42 2d 41 44 44 38 2d 31 38 38 33 41 41 36 41 35 46 45 31 22 3a 31 2c 22 46 35 33 34 30 Data Ascii: :1,"7609428E-3C8E-4048-A5C2-AC335CB3E3B4":1,"C04EF702-B37D-493B-81C2-F68A24409638":1,"AB307321-798B-4B4C-ADB7-5C8EC15A05E5":1,"E4BD9DE0-F5C2-4DEF-9133-B1C8FC0DE34D":1,"48CBB8A5-56B3-4EF9-88AF-97DAE70A4FA2":1,"CE4F1DA5-1E0B-4D9B-ADD8-1883AA6A5FE1":1,"F5340
2024-04-25 11:35:19 UTC	8192	IN	Data Raw: 38 38 34 44 34 39 38 22 3a 31 2c 22 44 39 38 38 46 46 35 32 2d 32 43 44 45 2d 34 46 30 44 2d 41 39 32 34 2d 33 33 43 30 37 42 36 42 35 43 37 45 22 3a 31 2c 22 42 37 35 34 44 38 38 46 2d 43 33 37 37 2d 34 42 31 41 2d 41 46 37 42 2d 38 35 45 31 43 30 45 37 34 38 39 42 22 3a 31 2c 22 39 44 38 30 36 38 32 45 2d 41 41 41 39 2d 34 38 30 32 2d 38 31 34 34 2d 34 32 46 41 39 42 32 42 38 38 44 39 22 3a 31 2c 22 44 43 36 33 33 31 31 42 2d 36 44 41 42 2d 34 33 37 37 2d 38 41 44 44 2d 36 43 46 43 44 30 34 34 42 38 46 35 22 3a 31 2c 22 32 37 41 35 36 38 34 42 2d 35 39 34 42 2d 34 41 43 37 2d 41 39 36 37 2d 36 39 33 46 34 39 38 39 32 33 42 45 22 3a 31 2c 22 35 32 31 36 34 41 31 44 2d 30 30 36 41 2d 34 39 39 35 2d 42 44 37 35 2d 32 30 39 41 45 31 41 39 34 35 38 39 22 3a Data Ascii: 884D498":1,"D988FF52-2CDE-4F0D-A924-33C07B6B5C7E":1,"B754D88F-C377-4B1A-AF7B-85E1C0E7489B":1,"9D80682E-AAA9-4802-8144-42FA9B2B88D9":1,"DC63311B-6DAB-4377-8ADD-6CFCD044B8F5":1,"27A5684B-594B-4AC7-A967-693F498923BE":1,"52164A1D-006A-4995-BD75-209AE1A94589":
2024-04-25 11:35:19 UTC	8192	IN	Data Raw: 45 35 2d 35 46 33 39 37 33 41 39 45 32 44 41 22 3a 31 2c 22 42 44 36 33 43 44 45 35 2d 44 36 38 39 2d 34 42 32 32 2d 42 46 43 30 2d 31 31 34 37 38 30 30 37 44 35 45 32 22 3a 31 2c 22 30 43 44 32 32 35 34 36 2d 34 39 46 41 2d 34 46 42 46 2d 39 31 31 34 2d 36 33 46 42 36 32 38 43 39 46 32 39 22 3a 31 2c 22 45 31 37 37 43 35 44 31 2d 46 43 45 42 2d 34 35 43 35 2d 39 35 43 30 2d 34 33 38 44 46 46 39 42 35 38 33 42 22 3a 31 2c 22 31 37 46 44 37 46 43 39 2d 44 37 35 39 2d 34 32 35 32 2d 39 31 35 31 2d 42 43 33 30 33 31 45 32 31 44 46 34 22 3a 31 2c 22 35 36 42 41 35 36 37 42 2d 32 35 32 31 2d 34 45 37 44 2d 41 32 36 46 2d 31 37 44 30 37 35 44 35 44 41 46 45 22 3a 31 2c 22 34 38 45 31 32 37 37 34 2d 41 44 37 44 2d 34 33 31 36 2d 38 41 30 38 2d 39 32 39 43 35 43 Data Ascii: E5-5F3973A9E2DA":1,"BD63CDE5-D689-4B22-BFC0-11478007D5E2":1,"0CD22546-49FA-4FBF-9114-63FB628C9F29":1,"E177C5D1-FCEB-45C5-95C0-438DFF9B583B":1,"17FD7FC9-D759-4252-9151-BC3031E21DF4":1,"56BA567B-2521-4E7D-A26F-17D075D5DAFE":1,"48E12774-AD7D-4316-8A08-929C5C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	13.107.136.10	443	5436	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 11:35:19 UTC	782	OUT	GET /_layouts/15/1033/styles/corev15.css?rev=34APf%2FlfLRHu1iumf2MGdw%3D%3DTAG84 HTTP/1.1 Host: raveisnet-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://raveisnet-my.sharepoint.com/:b:/g/personal/charles_magyar_raveis_com/EXcQ7jfjoRRElVGCYOzbRHgB-DdV8LhSQTAdk06dppgodw?email=Charles.Magyar%40Raveis.com&e=4%3alGbSIk&fromShare=true&at=9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 11:35:19 UTC	676	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 341640 Content-Type: text/css Last-Modified: Thu, 18 Apr 2024 04:09:42 GMT Accept-Ranges: bytes ETag: "0871e3d4691da1:0" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" SPRequestDuration: 4 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24727 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 347025DA87D74E438A2DF9443B3CE040 Ref B: ATL331000104025 Ref C: 2024-04-25T11:35:19Z Date: Thu, 25 Apr 2024 11:35:18 GMT Connection: close
2024-04-25 11:35:19 UTC	1668	IN	Data Raw: 2f 2a 20 5f 6c 63 69 64 3d 22 31 30 33 33 22 0d 0a 5f 4c 6f 63 61 6c 42 69 6e 64 69 6e 67 20 2a 2f 0d 0a 62 6f 64 79 2c 0d 0a 2e 6d 73 2d 63 6f 72 65 2d 64 65 66 61 75 6c 74 46 6f 6e 74 2c 0d 0a 23 70 61 67 65 53 74 61 74 75 73 42 61 72 2c 0d 0a 23 68 79 62 72 69 64 54 6f 6f 6c 74 69 70 53 74 61 74 75 73 42 61 72 2c 0d 0a 2e 6d 73 2d 73 74 61 74 75 73 2d 6d 73 67 2c 0d 0a 2e 6a 73 2d 63 61 6c 6c 6f 75 74 2d 62 6f 64 79 0d 0a 7b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 46 6f 6e 74 28 74 68 65 6d 65 46 6f 6e 74 3a 22 62 6f 64 79 22 29 5d 20 2a 2f 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 53 65 67 6f 65 20 55 49 22 2c 22 53 65 67 6f 65 22 2c 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 66 6f 6e 74 Data Ascii: /* _lcid="1033"_LocalBinding /body,.ms-core-defaultFont,#pageStatusBar,#hybridTooltipStatusBar,.ms-status-msg,.js-callout-body{/ [ReplaceFont(themeFont:"body")] */ font-family:"Segoe UI","Segoe",Tahoma,Helvetica,Arial,sans-serif;font
2024-04-25 11:35:19 UTC	8192	IN	Data Raw: 67 68 74 3a 33 30 30 3b 0d 0a 7d 0d 0a 68 32 2c 2e 6d 73 2d 68 32 0d 0a 7b 0d 0a 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 34 36 65 6d 3b 0d 0a 7d 0d 0a 68 33 2c 2e 6d 73 2d 68 33 0d 0a 7b 0d 0a 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 31 35 65 6d 3b 0d 0a 7d 0d 0a 68 34 2c 68 35 2c 68 36 2c 2e 6d 73 2d 68 34 2c 2e 6d 73 2d 68 35 2c 2e 6d 73 2d 68 36 0d 0a 7b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 46 6f 6e 74 28 74 68 65 6d 65 46 6f 6e 74 3a 22 73 6d 61 6c 6c 2d 68 65 61 64 69 6e 67 22 29 5d 20 2a 2f 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 53 65 67 6f 65 20 55 49 22 2c 22 53 65 67 6f 65 22 2c 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 7d 0d 0a 68 34 2c 2e 6d 73 2d 68 34 0d 0a 7b 0d 0a 66 6f 6e 74 2d Data Ascii: ght:300;}h2,.ms-h2{font-size:1.46em;}h3,.ms-h3{font-size:1.15em;}h4,h5,h6,.ms-h4,.ms-h5,.ms-h6{/* [ReplaceFont(themeFont:"small-heading")] */ font-family:"Segoe UI","Segoe",Tahoma,Helvetica,Arial,sans-serif;}h4,.ms-h4{font-
2024-04-25 11:35:19 UTC	5970	IN	Data Raw: 7d 0d 0a 2e 6d 73 2d 64 64 2d 62 75 74 74 6f 6e 0d 0a 7b 0d 0a 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0d 0a 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 3b 0d 0a 7d 0d 0a 64 69 76 2e 6d 73 2d 63 75 69 2d 54 61 62 52 6f 77 52 69 67 68 74 0d 0a 7b 0d 0a 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 35 70 78 3b 0d 0a 68 65 69 67 68 74 3a 33 35 70 78 3b 0d 0a 6c 69 6e 65 2d 68 65 69 67 68 74 3a 33 35 70 78 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 71 61 74 62 75 74 74 6f 6e 0d 0a 7b 0d 0a 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 0d 0a 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0d 0a 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 0d 0a 68 65 69 67 68 74 3a 33 30 70 78 Data Ascii: }.ms-dd-button{display:inline-block;margin-left:5px;}div.ms-cui-TabRowRight{padding-right:5px;height:35px;line-height:35px;}.ms-qatbutton{border:1px solid transparent;display:inline-block;vertical-align:middle;height:30px
2024-04-25 11:35:19 UTC	8192	IN	Data Raw: 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 48 65 61 64 65 72 42 61 63 6b 67 72 6f 75 6e 64 22 2c 6f 70 61 63 69 74 79 3a 22 31 22 29 5d 20 2a 2f 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 48 65 61 64 65 72 42 61 63 6b 67 72 6f 75 6e 64 22 29 5d 20 2a 2f 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 20 32 35 35 2c 32 35 35 2c 32 35 35 2c 30 2e 38 35 20 29 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 73 72 63 68 2d 73 62 2d 62 6f 72 64 65 72 0d 0a 7b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 4c 69 6e 65 73 22 29 5d 20 2a 2f 20 62 6f 72 64 65 Data Ascii: * [ReplaceColor(themeColor:"HeaderBackground",opacity:"1")] / background-color:#fff;/ [ReplaceColor(themeColor:"HeaderBackground")] / background-color:rgba( 255,255,255,0.85 );}.ms-srch-sb-border{/ [ReplaceColor(themeColor:"Lines")] */ borde
2024-04-25 11:35:19 UTC	8192	IN	Data Raw: 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 45 6d 70 68 61 73 69 73 42 61 63 6b 67 72 6f 75 6e 64 22 29 5d 20 2a 2f 20 2d 6d 73 2d 66 69 6c 74 65 72 3a 22 70 72 6f 67 69 64 3a 44 58 49 6d 61 67 65 54 72 61 6e 73 66 6f 72 6d 2e 4d 69 63 72 6f 73 6f 66 74 2e 67 72 61 64 69 65 6e 74 28 47 72 61 64 69 65 6e 74 54 79 70 65 3d 30 2c 73 74 61 72 74 43 6f 6c 6f 72 73 74 72 3d 23 66 66 30 30 37 32 63 36 2c 65 6e 64 43 6f 6c 6f 72 73 74 72 3d 23 66 66 30 30 37 32 63 36 29 22 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 73 74 6f 72 65 66 72 6f 6e 74 2d 6e 6f 62 61 63 6b 67 72 6f 75 6e 64 61 70 70 69 63 6f 6e 73 70 61 6e 2e 6d 73 2d 73 74 6f 72 65 66 72 6f 6e 74 2d 61 70 70 69 Data Ascii: -color:transparent;/* [ReplaceColor(themeColor:"EmphasisBackground")] */ -ms-filter:"progid:DXImageTransform.Microsoft.gradient(GradientType=0,startColorstr=#ff0072c6,endColorstr=#ff0072c6)";}.ms-storefront-nobackgroundappiconspan.ms-storefront-appi
2024-04-25 11:35:19 UTC	8192	IN	Data Raw: 72 6d 76 61 6c 69 64 61 74 69 6f 6e 2c 0d 0a 2e 6d 73 2d 64 69 66 66 64 65 6c 65 74 65 6e 6f 73 74 72 69 6b 65 2c 0d 0a 2e 6d 73 2d 64 69 66 66 64 65 6c 65 74 65 0d 0a 7b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 45 72 72 6f 72 54 65 78 74 22 29 5d 20 2a 2f 20 63 6f 6c 6f 72 3a 23 62 66 30 30 30 30 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 74 6f 6f 6c 74 69 70 0d 0a 7b 0d 0a 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 0d 0a 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 64 6f 74 74 65 64 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 65 6d 70 74 79 4d 6f 64 65 2c 0d 0a 2e 6d 73 2d 61 74 74 72 61 63 74 4d 6f 64 65 7b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 46 6f 6e 74 28 74 68 65 6d 65 46 6f 6e 74 3a 22 6c 61 Data Ascii: rmvalidation,.ms-diffdeletenostrike,.ms-diffdelete{/* [ReplaceColor(themeColor:"ErrorText")] / color:#bf0000;}.ms-tooltip{text-decoration:none;border-bottom:1px dotted;}.ms-emptyMode,.ms-attractMode{/ [ReplaceFont(themeFont:"la
2024-04-25 11:35:19 UTC	8192	IN	Data Raw: 70 78 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 68 69 67 68 43 6f 6e 74 72 61 73 74 42 6f 72 64 65 72 0d 0a 7b 0d 0a 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 63 75 72 73 6f 72 44 65 66 61 75 6c 74 0d 0a 7b 0d 0a 63 75 72 73 6f 72 3a 64 65 66 61 75 6c 74 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 63 75 72 73 6f 72 50 6f 69 6e 74 65 72 0d 0a 7b 0d 0a 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 73 68 61 64 6f 77 0d 0a 7b 0d 0a 62 6f 78 2d 73 68 61 64 6f 77 3a 30 70 78 20 30 70 78 20 37 70 78 20 30 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 34 37 29 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 6c 69 6e 65 73 7b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f Data Ascii: px;}.ms-highContrastBorder{border:1px solid transparent;}.ms-cursorDefault{cursor:default;}.ms-cursorPointer{cursor:pointer;}.ms-shadow{box-shadow:0px 0px 7px 0px rgba(0,0,0,0.47);}.ms-lines{/* [ReplaceColor(themeColo
2024-04-25 11:35:19 UTC	8192	IN	Data Raw: 38 38 30 35 34 3b 7d 0d 0a 2e 6d 73 2d 43 6f 6e 74 65 6e 74 41 63 63 65 6e 74 34 2d 62 6f 72 64 65 72 43 6f 6c 6f 72 7b 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 43 6f 6e 74 65 6e 74 41 63 63 65 6e 74 34 22 2c 6f 70 61 63 69 74 79 3a 22 31 22 29 5d 20 2a 2f 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 37 36 37 39 35 36 3b 7d 0d 0a 2e 6d 73 2d 43 6f 6e 74 65 6e 74 41 63 63 65 6e 74 35 2d 62 6f 72 64 65 72 43 6f 6c 6f 72 7b 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 43 6f 6e 74 65 6e 74 41 63 63 65 6e 74 35 22 2c 6f 70 61 63 69 74 79 3a 22 31 22 29 5d 20 2a 2f 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 45 44 30 30 33 33 3b 7d 0d 0a 2e 6d 73 2d 43 6f 6e 74 65 6e 74 41 Data Ascii: 88054;}.ms-ContentAccent4-borderColor{/* [ReplaceColor(themeColor:"ContentAccent4",opacity:"1")] / border-color:#767956;}.ms-ContentAccent5-borderColor{/ [ReplaceColor(themeColor:"ContentAccent5",opacity:"1")] */ border-color:#ED0033;}.ms-ContentA
2024-04-25 11:35:19 UTC	8192	IN	Data Raw: 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 72 74 65 54 68 65 6d 65 46 6f 72 65 43 6f 6c 6f 72 2d 36 2d 31 0d 0a 7b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 43 6f 6e 74 65 6e 74 41 63 63 65 6e 74 32 2d 4c 69 67 68 74 65 73 74 22 2c 6f 70 61 63 69 74 79 3a 22 31 22 29 5d 20 2a 2f 20 63 6f 6c 6f 72 3a 23 44 35 46 36 46 46 3b 0d 0a 2d 6d 73 2d 6e 61 6d 65 3a 22 41 63 63 65 6e 74 20 32 20 4c 69 67 68 74 65 73 74 22 3b 0d 0a 2f 2a 20 5b 43 6f 6c 6f 72 4e 61 6d 65 5d 20 2a 2f 20 2d 6d 73 2d 63 6f 6c 6f 72 3a 22 50 69 6e 6b 22 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 72 74 65 54 68 65 6d 65 46 6f 72 65 43 6f 6c 6f 72 2d 37 2d 31 0d 0a 7b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 43 6f Data Ascii: ;}.ms-rteThemeForeColor-6-1{/* [ReplaceColor(themeColor:"ContentAccent2-Lightest",opacity:"1")] / color:#D5F6FF;-ms-name:"Accent 2 Lightest";/ [ColorName] / -ms-color:"Pink";}.ms-rteThemeForeColor-7-1{/ [ReplaceColor(themeColor:"Co
2024-04-25 11:35:19 UTC	8192	IN	Data Raw: 0a 7d 0d 0a 2e 6d 73 2d 72 74 65 54 68 65 6d 65 46 6f 72 65 43 6f 6c 6f 72 2d 39 2d 35 0d 0a 7b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a 22 43 6f 6e 74 65 6e 74 41 63 63 65 6e 74 35 2d 44 61 72 6b 65 73 74 22 2c 6f 70 61 63 69 74 79 3a 22 31 22 29 5d 20 2a 2f 20 63 6f 6c 6f 72 3a 23 37 36 30 30 31 39 3b 0d 0a 2d 6d 73 2d 6e 61 6d 65 3a 22 41 63 63 65 6e 74 20 35 20 44 61 72 6b 65 73 74 22 3b 0d 0a 2f 2a 20 5b 43 6f 6c 6f 72 4e 61 6d 65 5d 20 2a 2f 20 2d 6d 73 2d 63 6f 6c 6f 72 3a 22 44 61 72 6b 20 47 72 65 65 6e 22 3b 0d 0a 7d 0d 0a 2e 6d 73 2d 72 74 65 54 68 65 6d 65 46 6f 72 65 43 6f 6c 6f 72 2d 31 30 2d 35 0d 0a 7b 0d 0a 2f 2a 20 5b 52 65 70 6c 61 63 65 43 6f 6c 6f 72 28 74 68 65 6d 65 43 6f 6c 6f 72 3a Data Ascii: }.ms-rteThemeForeColor-9-5{/* [ReplaceColor(themeColor:"ContentAccent5-Darkest",opacity:"1")] / color:#760019;-ms-name:"Accent 5 Darkest";/ [ColorName] / -ms-color:"Dark Green";}.ms-rteThemeForeColor-10-5{/ [ReplaceColor(themeColor:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	13.107.136.10	443	5436	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 11:35:20 UTC	778	OUT	GET /_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG84 HTTP/1.1 Host: raveisnet-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://raveisnet-my.sharepoint.com/:b:/g/personal/charles_magyar_raveis_com/EXcQ7jfjoRRElVGCYOzbRHgB-DdV8LhSQTAdk06dppgodw?email=Charles.Magyar%40Raveis.com&e=4%3alGbSIk&fromShare=true&at=9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 11:35:20 UTC	673	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 622 Content-Type: text/css Last-Modified: Thu, 18 Apr 2024 04:09:42 GMT Accept-Ranges: bytes ETag: "0871e3d4691da1:0" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" SPRequestDuration: 5 SPIisLatency: 4 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24727 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: ACB370A36AA44505B397C8937734F73C Ref B: ATL331000107023 Ref C: 2024-04-25T11:35:20Z Date: Thu, 25 Apr 2024 11:35:20 GMT Connection: close
2024-04-25 11:35:20 UTC	622	IN	Data Raw: 2f 2a 20 5f 6c 63 69 64 3d 22 31 30 33 33 22 0d 0a 5f 4c 6f 63 61 6c 42 69 6e 64 69 6e 67 20 2a 2f 0d 0a 23 6d 73 2d 65 72 72 6f 72 2d 68 65 61 64 65 72 0d 0a 7b 0d 0a 6d 61 72 67 69 6e 3a 31 31 38 70 78 20 30 70 78 20 31 36 70 78 3b 0d 0a 6d 69 6e 2d 68 65 69 67 68 74 3a 35 30 70 78 3b 0d 0a 7d 0d 0a 23 6d 73 2d 65 72 72 6f 72 2d 67 6f 62 61 63 6b 63 6f 6e 74 0d 0a 7b 0d 0a 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 38 70 78 3b 0d 0a 7d 0d 0a 23 6d 73 2d 61 63 63 65 73 73 44 65 6e 69 65 64 2d 72 65 71 44 69 61 6c 6f 67 0d 0a 7b 0d 0a 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 0d 0a 7d 0d 0a 23 6d 73 2d 65 72 72 6f 72 2d 62 6f 64 79 0d 0a 7b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 61 75 74 6f 3b 0d 0a 6f 76 65 72 66 6c 6f 77 3a 61 75 74 6f 3b 0d Data Ascii: /* _lcid="1033"_LocalBinding */#ms-error-header{margin:118px 0px 16px;min-height:50px;}#ms-error-gobackcont{margin-top:28px;}#ms-accessDenied-reqDialog{max-width:100%;}#ms-error-body{background-size:auto;overflow:auto;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49741	13.107.136.10	443	5436	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 11:35:20 UTC	918	OUT	GET /ScriptResource.axd?d=xEqMoQOETTWMkBfcAWgApwdEfMw5b8zV-FBRbSC_BI7OlAW61jtIaNtZGa1g2Qexvqy-SEbjBo7HnbR9mikPFn3qzFNVmNVCXVjf5pGtC929OBVnazUyYZc9euNQFAh-iED9b558EzZ0Ru52fT_uR5IapADF7SfSQReGp7zyiObGjp3pp-eo8wF8YVTD8_sc0&t=74258c30 HTTP/1.1 Host: raveisnet-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://raveisnet-my.sharepoint.com/:b:/g/personal/charles_magyar_raveis_com/EXcQ7jfjoRRElVGCYOzbRHgB-DdV8LhSQTAdk06dppgodw?email=Charles.Magyar%40Raveis.com&e=4%3alGbSIk&fromShare=true&at=9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 11:35:20 UTC	727	IN	HTTP/1.1 200 OK Cache-Control: public Content-Length: 25609 Content-Type: application/x-javascript Content-Encoding: gzip Expires: Fri, 25 Apr 2025 11:35:20 GMT Last-Modified: Thu, 25 Apr 2024 11:35:20 GMT P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-AspNet-Version: 4.0.30319 SPRequestDuration: 13 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24727 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 5D9CE9965A294459AA60B109C972C801 Ref B: ATL331000107049 Ref C: 2024-04-25T11:35:20Z Date: Thu, 25 Apr 2024 11:35:19 GMT Connection: close
2024-04-25 11:35:20 UTC	2467	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed bd d9 72 1b 49 92 28 fa 3e 66 f3 0f 64 8e 8a 42 36 92 20 29 55 2f 05 28 c5 d1 da a5 1e 6d 47 52 75 77 0d c9 96 e5 06 20 49 10 c9 42 02 92 58 04 be ec 3c dc 4f ba bf 70 7d 89 3d 23 01 50 aa 3e 73 8f 59 97 95 a4 44 2c 1e 11 1e 1e 1e 1e 1e ee 1e ff ef ff fe 7f 0e 0e f6 bf fa bf 7f ff b7 83 83 9d 27 d5 d5 f5 ac 1c 8d e7 3b 9d 27 e1 ce ab 32 9b 55 75 35 9c 43 fa ec aa 9a 25 f3 b2 9a f6 76 1e 4d 26 3b 54 a8 de 99 15 75 31 fb 54 e4 3d ac fd 8d 6d ab d6 1e 9d 27 5f 7a e7 f5 bf ff db f3 c5 34 a3 26 3f 7e 9c 5f 5f 15 af 93 cb 22 0e 64 62 30 30 b2 b3 49 52 d7 f1 7c b6 28 74 6a 36 2b 92 79 f1 24 99 4c d2 24 bb 88 87 22 bd 93 46 49 78 33 2b e6 8b d9 74 47 25 86 37 9f 92 d9 4e 11 27 b3 d1 e2 b2 98 ce eb de a4 98 8e e6 e3 41 39 ec 14 0f Data Ascii: rI(>fdB6 )U/(mGRuw IBX<Op}=#P>sYD,';'2Uu5C%vM&;Tu1T=m'_z4&?~__"db00IR\|(tj6+y$L$"FIx3+tG%7N'A9
2024-04-25 11:35:20 UTC	8192	IN	Data Raw: 53 80 30 10 05 ec c8 29 d0 68 a1 94 47 87 5a 61 cb d0 45 84 37 62 93 aa ab c9 27 60 82 e3 62 56 92 ba b5 c3 67 d6 0c 24 3c ad 3b 10 92 ab 81 bf 27 49 36 2e c4 7d a0 b8 e6 41 bd a2 e6 85 85 2d 9b 86 4a 47 c2 aa 07 3f c0 f8 66 25 e4 cb e6 04 0e 3d 13 38 44 c5 2d 4f 8a e4 ed 43 58 1b bb 24 f0 4a dc a3 d2 93 d6 6c cb dc 60 3e b1 9d 26 0a 19 2d f5 f3 59 75 69 31 b6 f5 b8 53 83 93 4d 89 81 24 74 76 49 cc 0b 04 ea 57 12 27 9e 7e b5 75 a9 9c 97 70 9c fd b5 c0 b5 e6 ac da f6 6e e1 bc d8 7d 0a 99 7f 38 a9 0e 1b 69 c9 85 b6 06 ad 94 5d d6 c6 a1 f5 f1 b5 25 f4 19 4a 3e 77 ab 4c ec d3 81 d8 08 98 18 1a 32 af 6c 7d 77 17 36 3b 0f a1 e3 7e e9 49 26 1c 84 4d ce e5 5e 36 f8 04 55 ff ad 84 34 a3 70 21 ce 8a 51 59 e3 11 98 76 0c cb 6e 41 2e 3d 63 2f d0 27 0c a6 7b 77 ed 67 Data Ascii: S0)hGZaE7b'`bVg$<;'I6.}A-JG?f%=8D-OCX$Jl`>&-Yui1SM$tvIW'~upn}8i]%J>wL2l}w6;~I&M^6U4p!QYvnA.=c/'{wg
2024-04-25 11:35:20 UTC	5120	IN	Data Raw: 38 a2 86 e7 47 e4 75 d8 80 d4 77 cf 9f 1c 1d dd bb 6f 40 f7 bb 61 40 ce 4f d3 12 c3 f7 01 c9 fb 8b 9c ad 2c 81 d7 19 f1 2a fa 48 0f 6d 23 35 1a 13 69 1c bc a4 9c 4c 46 48 40 cb 20 cb d8 9e d2 b9 f0 94 4e 78 9d bb d9 85 f5 8c 70 64 9b e7 b9 71 c7 c5 3c 52 08 41 2a 55 cb 58 62 46 92 dd 25 6a ad e3 99 62 e3 62 47 46 66 34 80 c8 db 98 5b 01 b3 ae 70 42 1b b1 12 8d 1d 11 83 db 6c ac 99 22 21 85 8c 11 db e0 70 1d 56 54 49 1b 33 3a 79 db 01 79 ef 9c 2c 44 69 98 b7 45 d6 da ab af ad f0 a6 db f6 a7 3a f8 93 66 5f eb 30 07 65 ea d0 f9 bd ed 80 e4 5d a7 a2 64 9b c6 1d a8 91 bd 66 d0 7f 31 72 0d d4 36 cd b1 db 5b 99 f6 15 53 b0 7d e7 65 23 de 01 98 4d 1a bc 42 f2 09 eb b5 68 10 69 4d a7 a4 9c 0c aa 53 fd 22 8e 62 27 f8 38 a6 76 dc 52 8d f8 9c 5a a5 7d 5e 80 ba b5 e4 Data Ascii: 8Guwo@a@O,Hm#5iLFH@ Nxpdq<RAUXbF%jbbGFf4[pBl"!pVTI3:yy,DiE:f_0e]df1r6[S}e#MBhiMS"b'8vRZ}^
2024-04-25 11:35:20 UTC	8192	IN	Data Raw: e5 23 e8 23 fe 27 15 af c4 67 83 64 70 1e 27 51 67 14 c3 9e a6 b4 26 6f 89 12 c3 b0 f5 6c 25 e2 c1 bc 9f 5f 4f c8 14 4c 2e f6 79 32 c2 9d ef 58 7d d9 61 0c fb 92 8e 3b b2 25 5e 85 f2 17 ae aa bd 3d 3a 0f 05 8f df 3c fd 19 68 9a e4 e1 51 ef 8a a2 85 b0 0e 30 49 eb 6a b2 98 17 68 be 78 93 77 63 13 d6 a0 d0 bf 71 0e f9 21 02 0f 9d 3f 8c ef 53 65 fd ec 0d 50 33 ae 1b 84 42 b4 19 22 ac 46 36 00 e5 dc d5 6a 2b e4 64 8c 9c 71 9c 1e a7 6a 14 0a 0f bb b0 2f 8f ed 31 89 89 31 38 31 cc 11 4e 8d 4e 80 63 d7 2d 70 ad b1 c9 26 ee c1 8f 1f 5e bd 84 ef 4e 62 71 c2 c4 e0 6c 80 99 fd d8 ce 3e 1c 14 3a 89 58 e1 e1 76 08 10 d4 51 fa 11 50 ee ed 95 b1 35 7e 96 75 db 28 1b a3 f8 ae d4 65 e4 36 0b 2a 67 03 61 b5 a0 72 bd a0 f2 e5 32 bf e5 82 c2 c5 34 a4 05 55 da 0b 8a 8f 31 3c Data Ascii: ##'gdp'Qg&ol%_OL.y2X}a;%^=:<hQ0Ijhxwcq!?SeP3B"F6j+dqj/1181NNc-p&^Nbql>:XvQP5~u(e6*gar24U1<
2024-04-25 11:35:20 UTC	1638	IN	Data Raw: 84 10 11 5c f8 fb 8c fd 10 16 a4 d1 38 be c0 19 40 f6 41 93 39 e6 77 21 a1 c9 cd eb 2d 93 eb 0d be f4 fa 81 1f d6 ca 89 b2 70 e5 1f a1 17 37 bb 99 92 1c b2 5e ee 88 d5 59 1f d2 b0 9b c3 07 c0 1b 96 cb e1 c3 f8 3e fe 3b 96 6c 82 ec f0 61 bf 19 6f 35 80 db 71 09 7a ce d0 58 fa 43 58 fa 99 67 e9 8b 34 75 49 55 0e 14 05 4a c3 5a 20 bc 32 be 05 b7 16 24 b2 b1 8a dd 61 c9 c8 d7 21 c2 ed 57 54 46 41 00 ff 87 62 60 f2 7a a5 5d 28 fa 38 42 25 09 46 8e 80 59 cb 61 3d d4 40 4c 99 e5 61 a8 5f 39 74 5c f3 d3 d0 79 58 10 c5 33 7a 06 0d 37 09 96 6b 3f ce d9 48 4f 9c b8 59 7c 3f 6c ef 8e 90 8a e2 83 7f 9c d6 bf eb 9c 24 fb bf 3e da ff ef c3 fd 1f 4e bb a7 fb a7 bd b3 ee 69 3f 3c 3d 38 3d e8 9c fc e3 f8 3f 4e 0f ce ba e1 81 07 16 21 c7 7a 7d 00 04 2b 23 c2 a3 f2 18 93 66 Data Ascii: \8@A9w!-p7^Y>;lao5qzXCXg4uIUJZ 2$a!WTFAb`z](8B%FYa=@La_9t\yX3z7k?HOY\|?l$>Ni?<=8=?N!z}+#f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49743	13.107.136.10	443	5436	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 11:35:20 UTC	918	OUT	GET /ScriptResource.axd?d=DlDfgwQ2DzbnMNaMjJ_0MDdFzPzlWxf1bNrwdohlz2hAXm6ihePXqlvxPKpUJZUyY5I4qv_uR_9JK8uj2Q3JDwgf9zkWbP5Lt0328gLJDp_xcqVxlNnh_b9glFy_QP3mUYvd5gqh6B9UWQf6zWHpaazOuEwSlV_D4a2Vk-uoIzyFi8dwTLOrpmhINshBwRSx0&t=74258c30 HTTP/1.1 Host: raveisnet-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://raveisnet-my.sharepoint.com/:b:/g/personal/charles_magyar_raveis_com/EXcQ7jfjoRRElVGCYOzbRHgB-DdV8LhSQTAdk06dppgodw?email=Charles.Magyar%40Raveis.com&e=4%3alGbSIk&fromShare=true&at=9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 11:35:20 UTC	725	IN	HTTP/1.1 200 OK Cache-Control: public Content-Length: 9984 Content-Type: application/x-javascript Content-Encoding: gzip Expires: Fri, 25 Apr 2025 11:35:20 GMT Last-Modified: Thu, 25 Apr 2024 11:35:20 GMT P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-AspNet-Version: 4.0.30319 SPRequestDuration: 9 SPIisLatency: 0 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24727 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 4917DD8FE76B4E3A8934A0D755561D8F Ref B: ATL331000107025 Ref C: 2024-04-25T11:35:20Z Date: Thu, 25 Apr 2024 11:35:19 GMT Connection: close
2024-04-25 11:35:20 UTC	3445	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e5 7d 6b 73 db 48 92 e0 f7 89 98 ff 40 61 7b 65 62 55 86 e4 de bd b8 08 d2 68 85 5e 9e d6 9e 5f 61 cb d3 33 21 6b 15 05 a0 48 42 02 01 1a 00 6d ab 25 fe b2 fb b0 3f 69 ff c2 65 d6 0b 55 40 81 a4 e4 9e bd 8b b8 89 1e 99 a8 77 65 66 65 66 65 66 55 fd d7 ff fe cf fd fd e7 4f fe df 9f ff b4 bf 3f 38 29 16 77 65 3a 9d d5 83 e1 89 3f 78 93 c6 65 51 15 93 1a d2 cb 45 51 d2 3a 2d f2 60 70 94 65 03 5e a8 1a 94 ac 62 e5 57 96 04 58 fb 07 fb d6 bd 1d dd d0 ef bf b1 e8 55 51 ce ab e0 a6 fa f3 9f 2e ee 16 2c b8 2e d9 34 ad 6a 56 7e 8c cb 74 51 0f bd be f2 1e b9 b4 f3 60 f0 8c a7 db c9 1f 59 99 d2 2c fd 5d cc aa 9b ff 96 d5 df 8a f2 d6 91 73 52 cc 17 45 ce f2 fa 4d 91 b0 0c 0b 5c f9 63 3e 48 35 c6 b7 74 ce aa 05 8d d9 d0 fb 78 57 05 6a 74 Data Ascii: }ksH@a{ebUh^_a3!kHBm%?ieU@wefefefUO?8)we:?xeQEQ:-`pe^bWXUQ.,.4jV~tQ`Y,]sREM\c>H5txWjt
2024-04-25 11:35:20 UTC	6539	IN	Data Raw: 2b da 06 44 cd 9b f0 5f 0f c6 df 40 7f 65 c3 24 e8 a9 b3 bb fb fc f9 8d 9f 84 bd 05 c6 93 f0 66 77 d7 cc 16 62 e1 d0 48 02 cd 78 24 0c 18 6b f6 e8 38 a2 99 69 21 40 99 13 8a ad 0a 88 0e b1 99 c1 04 63 33 a3 44 8a 61 0c 50 1b d0 c7 19 2a b8 05 c1 ef 33 2d 88 48 0d 33 ce 6d 4e d1 7f 8e 2a 8e d4 30 4e 49 16 f6 8a 37 ea 83 2c ec db 21 65 7c 87 b4 33 dd dd 8d 7d ee 42 4d 71 ab ff 0e f4 8b 3d ef 27 cf e7 31 40 6b 6a 07 20 cc aa ba 1c c6 12 ee 7b 2f 7c d9 20 b6 d6 f2 c1 ae 5d af a8 f7 3e d9 c8 c3 03 06 d4 c6 ad af e3 ee e2 7e 6a 9f 12 5f 1a 2f 4c 11 0e 00 ef 2d 83 3d 63 a5 e3 73 a8 2f 42 b3 d6 76 03 50 ed f4 c1 d4 7c ee 85 a9 26 06 6d ef 27 6f 6c e3 48 e0 67 5d f7 6d 04 f9 5c f4 fe d0 78 b8 12 36 ae cb 3b d8 0c 4f 0e 27 41 cd f5 bd 87 87 09 fa e1 95 72 c7 17 5c Data Ascii: +D_@e$fwbHx$k8i!@c3DaP3-H3mN0NI7,!e\|3}BMq='1@kj {/\| ]>~j_/L-=cs/BvP\|&m'olHg]m\x6;O'Ar\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49742	13.107.136.10	443	5436	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 11:35:20 UTC	840	OUT	GET /WebResource.axd?d=48l9qh1Q6oqBGuYhK1eo1iGwX-BmcL3p-RVpszMUh3BYQaWavbmuJCl-Yf5sX-Vkgl-HjMy9FgTqHdsdQEPh_CDRj6SGwrgAOK-1iDYxP1Y1&t=638459572569584809 HTTP/1.1 Host: raveisnet-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://raveisnet-my.sharepoint.com/:b:/g/personal/charles_magyar_raveis_com/EXcQ7jfjoRRElVGCYOzbRHgB-DdV8LhSQTAdk06dppgodw?email=Charles.Magyar%40Raveis.com&e=4%3alGbSIk&fromShare=true&at=9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 11:35:20 UTC	702	IN	HTTP/1.1 200 OK Cache-Control: public Content-Length: 23063 Content-Type: application/x-javascript Expires: Fri, 25 Apr 2025 03:44:25 GMT Last-Modified: Thu, 14 Mar 2024 03:07:36 GMT P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-AspNet-Version: 4.0.30319 SPRequestDuration: 4 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24727 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 9CF5C89ED8AD445EB1134BF2316F2432 Ref B: ATL331000104039 Ref C: 2024-04-25T11:35:20Z Date: Thu, 25 Apr 2024 11:35:19 GMT Connection: close
2024-04-25 11:35:20 UTC	3468	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 57 65 62 46 6f 72 6d 5f 50 6f 73 74 42 61 63 6b 4f 70 74 69 6f 6e 73 28 65 76 65 6e 74 54 61 72 67 65 74 2c 20 65 76 65 6e 74 41 72 67 75 6d 65 6e 74 2c 20 76 61 6c 69 64 61 74 69 6f 6e 2c 20 76 61 6c 69 64 61 74 69 6f 6e 47 72 6f 75 70 2c 20 61 63 74 69 6f 6e 55 72 6c 2c 20 74 72 61 63 6b 46 6f 63 75 73 2c 20 63 6c 69 65 6e 74 53 75 62 6d 69 74 29 20 7b 0d 0a 20 20 20 20 74 68 69 73 2e 65 76 65 6e 74 54 61 72 67 65 74 20 3d 20 65 76 65 6e 74 54 61 72 67 65 74 3b 0d 0a 20 20 20 20 74 68 69 73 2e 65 76 65 6e 74 41 72 67 75 6d 65 6e 74 20 3d 20 65 76 65 6e 74 41 72 67 75 6d 65 6e 74 3b 0d 0a 20 20 20 20 74 68 69 73 2e 76 61 6c 69 64 61 74 69 6f 6e 20 3d 20 76 61 6c 69 64 61 74 69 6f 6e 3b 0d 0a 20 20 20 20 74 68 69 73 2e 76 61 6c Data Ascii: function WebForm_PostBackOptions(eventTarget, eventArgument, validation, validationGroup, actionUrl, trackFocus, clientSubmit) { this.eventTarget = eventTarget; this.eventArgument = eventArgument; this.validation = validation; this.val
2024-04-25 11:35:20 UTC	8192	IN	Data Raw: 75 65 73 74 3b 0d 0a 20 20 20 20 20 20 20 20 2f 2f 20 65 2e 67 2e 20 68 74 74 70 3a 0d 0a 20 20 20 20 20 20 20 20 76 61 72 20 61 63 74 69 6f 6e 20 3d 20 74 68 65 46 6f 72 6d 2e 61 63 74 69 6f 6e 20 7c 7c 20 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 2c 20 66 72 61 67 6d 65 6e 74 49 6e 64 65 78 20 3d 20 61 63 74 69 6f 6e 2e 69 6e 64 65 78 4f 66 28 27 23 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 69 66 20 28 66 72 61 67 6d 65 6e 74 49 6e 64 65 78 20 21 3d 3d 20 2d 31 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 63 74 69 6f 6e 20 3d 20 61 63 74 69 6f 6e 2e 73 75 62 73 74 72 28 30 2c 20 66 72 61 67 6d 65 6e 74 49 6e 64 65 78 29 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 69 66 20 28 21 5f 5f 6e 6f Data Ascii: uest; // e.g. http: var action = theForm.action \|\| document.location.pathname, fragmentIndex = action.indexOf('#'); if (fragmentIndex !== -1) { action = action.substr(0, fragmentIndex); } if (!__no
2024-04-25 11:35:20 UTC	4144	IN	Data Raw: 73 65 28 29 2e 69 6e 64 65 78 4f 66 28 27 65 78 70 6c 6f 72 65 72 27 29 20 3d 3d 20 2d 31 29 3b 0d 0a 76 61 72 20 5f 5f 74 68 65 46 6f 72 6d 50 6f 73 74 44 61 74 61 20 3d 20 22 22 3b 0d 0a 76 61 72 20 5f 5f 74 68 65 46 6f 72 6d 50 6f 73 74 43 6f 6c 6c 65 63 74 69 6f 6e 20 3d 20 6e 65 77 20 41 72 72 61 79 28 29 3b 0d 0a 76 61 72 20 5f 5f 63 61 6c 6c 62 61 63 6b 54 65 78 74 54 79 70 65 73 20 3d 20 2f 5e 28 74 65 78 74 7c 70 61 73 73 77 6f 72 64 7c 68 69 64 64 65 6e 7c 73 65 61 72 63 68 7c 74 65 6c 7c 75 72 6c 7c 65 6d 61 69 6c 7c 6e 75 6d 62 65 72 7c 72 61 6e 67 65 7c 63 6f 6c 6f 72 7c 64 61 74 65 74 69 6d 65 7c 64 61 74 65 7c 6d 6f 6e 74 68 7c 77 65 65 6b 7c 74 69 6d 65 7c 64 61 74 65 74 69 6d 65 2d 6c 6f 63 61 6c 29 24 2f 69 3b 0d 0a 66 75 6e 63 74 69 6f Data Ascii: se().indexOf('explorer') == -1);var __theFormPostData = "";var __theFormPostCollection = new Array();var __callbackTextTypes = /^(text\|password\|hidden\|search\|tel\|url\|email\|number\|range\|color\|datetime\|date\|month\|week\|time\|datetime-local)$/i;functio
2024-04-25 11:35:20 UTC	7259	IN	Data Raw: 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 69 66 20 28 64 65 66 61 75 6c 74 42 75 74 74 6f 6e 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 57 65 62 46 6f 72 6d 5f 53 69 6d 75 6c 61 74 65 43 6c 69 63 6b 28 64 65 66 61 75 6c 74 42 75 74 74 6f 6e 2c 20 65 76 65 6e 74 29 3b 0d 0a 20 20 20 20 20 20 20 20 7d 20 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 72 65 74 75 72 6e 20 74 72 75 65 3b 0d 0a 7d 0d 0a 66 75 6e 63 74 69 6f 6e 20 57 65 62 46 6f 72 6d 5f 47 65 74 53 63 72 6f 6c 6c 58 28 29 20 7b 0d 0a 20 20 20 20 69 66 20 28 5f 5f 6e 6f 6e 4d 53 44 4f 4d 42 72 6f 77 73 65 72 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 70 61 67 65 58 4f 66 66 73 65 74 3b 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 65 6c 73 Data Ascii: } if (defaultButton) { return WebForm_SimulateClick(defaultButton, event); } } return true;}function WebForm_GetScrollX() { if (__nonMSDOMBrowser) { return window.pageXOffset; } els

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49748	23.46.200.91	443

Timestamp	Bytes transferred	Direction	Data
2024-04-25 11:35:21 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-25 11:35:21 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/073D) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=156513 Date: Thu, 25 Apr 2024 11:35:21 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49749	13.107.136.10	443	5436	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 11:35:21 UTC	790	OUT	GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1 Host: raveisnet-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://raveisnet-my.sharepoint.com/:b:/g/personal/charles_magyar_raveis_com/EXcQ7jfjoRRElVGCYOzbRHgB-DdV8LhSQTAdk06dppgodw?email=Charles.Magyar%40Raveis.com&e=4%3alGbSIk&fromShare=true&at=9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 11:35:21 UTC	679	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 7886 Content-Type: image/x-icon Last-Modified: Sat, 13 Apr 2024 02:47:19 GMT Accept-Ranges: bytes ETag: "80d5cbe64c8dda1:0" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" SPRequestDuration: 6 SPIisLatency: 2 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24727 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 2A52CF743B8C407E9D53D32D03123277 Ref B: ATL331000105011 Ref C: 2024-04-25T11:35:21Z Date: Thu, 25 Apr 2024 11:35:21 GMT Connection: close
2024-04-25 11:35:21 UTC	3468	IN	Data Raw: 00 00 01 00 03 00 20 20 00 00 01 00 20 00 a8 10 00 00 36 00 00 00 18 18 00 00 01 00 20 00 88 09 00 00 de 10 00 00 10 10 00 00 01 00 20 00 68 04 00 00 66 1a 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 c6 37 30 d0 c6 37 af d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 af d0 c6 37 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6 hf( @ 7077777770
2024-04-25 11:35:21 UTC	4418	IN	Data Raw: 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 bf 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 6c 03 40 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 6c 03 8f 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 Data Ascii: plplplplplplplplplplplplpl@plplplplplplplplplplplplplplplplpl@plplplplp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49751	23.46.200.91	443

Timestamp	Bytes transferred	Direction	Data
2024-04-25 11:35:22 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-25 11:35:22 UTC	531	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0rcGnYgAAAAANOnx9vccHTr21ROgX9ESTU0pDRURHRTAzMDkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=156525 Date: Thu, 25 Apr 2024 11:35:22 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-25 11:35:22 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49752	13.107.136.10	443	5436	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 11:35:22 UTC	388	OUT	GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1 Host: raveisnet-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 11:35:22 UTC	679	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 7886 Content-Type: image/x-icon Last-Modified: Sat, 13 Apr 2024 02:47:19 GMT Accept-Ranges: bytes ETag: "80d5cbe64c8dda1:0" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" SPRequestDuration: 5 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24727 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: F42BE57B9C0D461F9D25F71FC1648F40 Ref B: ATL331000105025 Ref C: 2024-04-25T11:35:22Z Date: Thu, 25 Apr 2024 11:35:22 GMT Connection: close
2024-04-25 11:35:22 UTC	3484	IN	Data Raw: 00 00 01 00 03 00 20 20 00 00 01 00 20 00 a8 10 00 00 36 00 00 00 18 18 00 00 01 00 20 00 88 09 00 00 de 10 00 00 10 10 00 00 01 00 20 00 68 04 00 00 66 1a 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 c6 37 30 d0 c6 37 af d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 af d0 c6 37 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6 hf( @ 7077777770
2024-04-25 11:35:22 UTC	4402	IN	Data Raw: 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 bf 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 6c 03 40 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 6c 03 8f 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 6c 03 ff 70 Data Ascii: plplplplplplplplpl@plplplplplplplplplplplplplplplplpl@plplplplplplplplp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49755	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-04-25 11:35:32 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pszvDRwZX+ZhWSL&MD=KKdG9bt7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-25 11:35:32 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: f35bcda0-02c8-4743-bea2-375448ea7ad7 MS-RequestId: ade6f9cd-9b64-4145-a455-c738772533f8 MS-CV: 8am5sriiDkyZfSQW.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 25 Apr 2024 11:35:31 GMT Connection: close Content-Length: 24490
2024-04-25 11:35:32 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-25 11:35:32 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49761	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-04-25 11:36:09 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pszvDRwZX+ZhWSL&MD=KKdG9bt7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-25 11:36:10 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 27621c32-1eb0-40e3-9443-07bd901fd4de MS-RequestId: f8921e51-5a0f-4819-a48b-3c8c64d2ba9a MS-CV: xlfeuQ0rzkKYsgtg.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 25 Apr 2024 11:36:09 GMT Connection: close Content-Length: 25457
2024-04-25 11:36:10 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-25 11:36:10 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 5472, Parent PID: 4904

General

Target ID:	0
Start time:	13:35:11
Start date:	25/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 5436, Parent PID: 5472

General

Target ID:	2
Start time:	13:35:14
Start date:	25/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 --field-trial-handle=2304,i,13728218226947553562,16425673572567539754,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6452, Parent PID: 4904

General

Target ID:	3
Start time:	13:35:17
Start date:	25/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://raveisnet-my.sharepoint.com/:b:/g/personal/charles_magyar_raveis_com/EXcQ7jfjoRRElVGCYOzbRHgB-DdV8LhSQTAdk06dppgodw?email=Charles.Magyar%40Raveis.com&e=4%3alGbSIk&fromShare=true&at=9"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://raveisnet-my.sharepoint.com/:b:/g/personal/charles_magyar_raveis_com/EXcQ7jfjoRRElVGCYOzbRHgB-DdV8LhSQTAdk06dppgodw?email=Charles.Magyar%40Raveis.com&e=4%3alGbSIk&fromShare=true&at=9

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 5472, Parent PID: 4904

General

Chronological Activities

Windows Analysis Report
https://raveisnet-my.sharepoint.com/:b:/g/personal/charles_magyar_raveis_com/EXcQ7jfjoRRElVGCYOzbRHgB-DdV8LhSQTAdk06dppgodw?email=Charles.Magyar%40Raveis.com&e=4%3alGbSIk&fromShare=true&at=9