Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
http://www.corp-internal.co/ae90cbd9826866b7?l=8

Overview

General Information

Sample URL:http://www.corp-internal.co/ae90cbd9826866b7?l=8
Analysis ID:1431610
Infos:

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Stores files to the Windows start menu directory
Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

  • System is w10x64
  • chrome.exe (PID: 5624 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 2000 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=2016,i,1715222104164893096,13145483760006011228,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 2700 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.corp-internal.co/ae90cbd9826866b7?l=8" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: http://www.corp-internal.co/load_training?guid=e390cbdd12686627&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0HTTP Parser: No favicon
Source: unknownHTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49740 version: TLS 1.0
Source: unknownHTTPS traffic detected: 23.54.200.130:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.54.200.130:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49740 version: TLS 1.0
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknownTCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 25 Apr 2024 12:24:45 GMTContent-Type: application/javascriptContent-Length: 7191Connection: keep-aliveLast-Modified: Thu, 11 Apr 2024 12:55:27 GMTVary: Accept-EncodingContent-Encoding: gzipServer: ThreatSim-Web-ServerExpires: Thu, 31 Dec 2037 23:55:55 GMTCache-Control: max-age=315360000Cache-Control: publicAccess-Control-Allow-Origin: *Data Raw: 1f 8b 08 00 c1 89 3e 60 02 03 cd 3d 6d 7b e3 36 8e df fd 2b 14 ed 5c 2b cd 38 8e 33 ed 76 af ce e5 72 99 4c a6 cd ee a4 99 9d 4c db bd 8b 53 3f b2 45 db 4c 64 c9 95 e4 bc ec 24 ff fd 00 f0 45 a4 4c 39 76 da ed 5d 9f 3e 49 44 82 00 08 80 20 48 82 9c 60 bc 48 47 25 cf d2 20 f4 3e b7 6e 79 1a 67 b7 9d 61 54 b0 c1 3c 2b ca c1 22 4f bc 87 07 2f 70 56 ec 7b be 1f b6 3d 59 97 64 93 01 cb f3 2c 87 72 8d 94 b5 3d 6e 20 46 98 32 1b 8c b2 b4 c8 12 16 70 68 9d b2 5b ef 64 16 4d 58 10 76 8a 7c 04 8d 9d b4 5e 79 fe 0e b4 3e e0 f1 be 0f 1f 2c 1d 65 31 fb f1 e3 c9 51 36 9b 67 29 4b 4b c5 62 99 47 a3 6b 9e 4e 06 3c 0e b1 d5 17 05 bb 69 6a c2 04 c4 ac 98 34 41 70 01 31 ca f2 9c 25 11 76 69 20 39 90 e4 ec 9a bd d6 a3 25 8f aa af a6 50 50 20 37 19 8f bd ae b7 b5 bf 5f 61 22 c0 41 cc 86 8b 89 f7 c5 17 9e 2c 40 44 75 bc 33 56 14 20 32 4b d2 cd 62 66 9b 89 19 25 c8 9e 21 e8 15 62 64 1b 8b 11 fe 0f 3b a3 28 49 82 72 ca 8b d0 d9 7b c3 30 57 09 e5 ff ba eb d8 95 bd 56 eb 26 ca bd 37 79 76 5b b0 fc 2d 2b d9 a8 04 46 3e b7 78 ca cb 9e 6d 1a d8 e1 ce 50 40 02 0c 7d 16 2c ca 47 d3 f3 32 07 aa 24 91 4e 1c 95 91 44 17 a2 24 fc 45 7a 9d 66 b7 a9 df f6 4c 04 a2 89 42 23 0b 3b 65 26 51 85 9d 9c cd 13 e8 74 b0 b3 b7 33 69 7b fe bf 7d f5 06 c7 b4 60 e2 86 e5 05 70 65 33 f1 93 28 54 b2 48 a3 1b 3e 89 ca 2c ef 2c 00 f3 e1 04 fa 4c fc 38 5a 54 a0 d1 7c 2e 0b eb bc 5b 84 6d e6 65 e1 d3 cc 13 f4 d9 f9 6a d9 9d 9d bb 49 9f 9d db 54 cf ce 57 51 c9 8a 9f 5c ac ea 62 e0 b1 62 57 91 e0 c5 61 1a e7 e0 00 40 dd 30 ce 83 8a 5f 5f 56 68 fc bc 78 03 a4 af 87 e0 58 ef 97 a1 a9 ee 0d d6 f9 68 65 ed d6 60 1a 15 ef 33 18 36 e7 20 65 b0 f8 9e 97 2e 92 a4 dd 5a 2a b6 0c 8e 8f bd 00 e1 c8 1b 11 fa 3a 9e d0 cb 59 b9 c8 53 c7 28 0c 7c db a8 b7 bd a3 c3 a3 ef 8f 7b 5e 62 b4 47 66 61 78 b8 71 2b b1 d4 2b f6 5a 65 7e 8f ae 12 06 0e 62 c0 71 fc 36 2a 61 18 ef 55 8e ae 02 07 3d 97 27 25 9b e1 9c c3 4c 87 61 80 4c 14 48 43 7d ce 66 d9 0d d3 20 6e be 80 95 ad 2e 88 db 1b 45 e5 68 ea 05 5c 0f 5a 17 e4 2e 40 b6 36 90 de ef 20 36 69 08 e7 40 82 2c b3 6e 0a f5 8a 35 8c c1 6e f2 1c 73 28 2c 0c f5 9e d5 f0 9b 7d b3 ab 94 51 d8 e8 b4 ee fd 68 34 90 4e 0e 26 52 e4 00 06 b6 5f b2 a2 d4 43 6a 19 27 29 14 48 d6 70 1a c6 b0 0a ad 61 09 cc b2 84 65 22 9b da c2 ef 26 33 69 11 47 59 76 cd 59 61 98 82 2e 59 c3 06 24 ec 73 94 5f b5 ae 77 42 21 35 b9 97 65 4a d5 f5 72 94 64 00 7e 3b 66 63 9e b2 d8 f7 90 c9 fb 39 cb c6 5e 9c 8d 16 33 98 81 20 9e 40 50 74 f0 5b d5 ac 23 0a 8f d3 68 98 b0 b8 59 6f 06 99 4d 15 b6 4e 3f 97 bb 09 da 01 c7 44 53 67 4d 11 92 b4 63 8e 85 69 e5 7d 76 cb f2 23 88 61 02 e1 fc 79 f1 33 1b fe cd 0a 27 98 d2 a6 20 aa 20
Source: global trafficHTTP traffic detected: GET /detect/plugin_detect.js?guid=90cbd26866&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: tslp.s3.amazonaws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://www.corp-internal.co/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global trafficHTTP traffic detected: GET /ae90cbd9826866b7?l=8 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /assets/ajax/libs/jquery/1.9.1/jquery.min.js HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /assets/all.js?g=90cbd26866 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20localStorage%20%3D%20true&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20sessionStorage%20%3D%20true&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20hasCookies%20%3D%20true&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20browser%20%3D%20Chrome&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20browser_version%20%3D%20117&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20os%20%3D%20Windows&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20os_version%20%3D%2010&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20language%20%3D%20en-US&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20colorDepth%20%3D%2024&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20width%20%3D%201280&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20height%20%3D%201024&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20Chrome%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20Chromium%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /secure/browser_post HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20sessionStorage%20%3D%20true&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20localStorage%20%3D%20true&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20Microsoft%20Edge%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20hasCookies%20%3D%20true&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20browser_version%20%3D%20117&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20browser%20%3D%20Chrome&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20WebKit%20built-in%20PDF&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=Chrome%20browser%2C%20using%20more%20detailed%20version&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=Skipping%20java%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=Skipping%20flash%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=Skipping%20pdf%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20os%20%3D%20Windows&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20language%20%3D%20en-US&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20os_version%20%3D%2010&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=Skipping%20quicktime%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20colorDepth%20%3D%2024&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20width%20%3D%201280&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20height%20%3D%201024&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=Skipping%20RealPlayer%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=Skipping%20Silverlight%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=Skipping%20WindowsMediaPlayer%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=redirecting%20to%20%2Fload_training%3Fguid%3De390cbdd12686627%26correlation_id%3D3fac3af0-74a1-4072-a0f1-391c2d2ad2d0&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=browser_post_successful&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20Chrome%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20Chromium%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /load_training?guid=e390cbdd12686627&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20Microsoft%20Edge%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20WebKit%20built-in%20PDF&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=Chrome%20browser%2C%20using%20more%20detailed%20version&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=Skipping%20java%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=Skipping%20flash%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=Skipping%20pdf%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=Skipping%20quicktime%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=Skipping%20RealPlayer%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=Skipping%20Silverlight%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=redirecting%20to%20%2Fload_training%3Fguid%3De390cbdd12686627%26correlation_id%3D3fac3af0-74a1-4072-a0f1-391c2d2ad2d0&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=browser_post_successful&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /trace?id=90cbd26866&msg=Skipping%20WindowsMediaPlayer%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.corp-internal.co/load_training?guid=e390cbdd12686627&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.corp-internal.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
Source: global trafficDNS traffic detected: DNS query: www.corp-internal.co
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: _49153._https.www.corp-internal.co
Source: global trafficDNS traffic detected: DNS query: tslp.s3.amazonaws.com
Source: unknownHTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1714047866016&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 25 Apr 2024 12:24:47 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingX-Request-Id: af743820-06dc-48c3-9150-917e4762c7abX-Runtime: 0.000906X-Host-Info: lw-prod-eu-i-06164ae2ecae76ca0X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7Server: ThreatSim-Web-ServerContent-Encoding: gzipData Raw: 33 66 63 0d 0a 1f 8b 08 00 00 00 00 00 02 03 ad 56 51 4f e3 38 10 7e e7 57 cc e5 09 24 88 5b 60 25 c4 26 5d b1 85 3b 90 96 03 1d 3d ad f6 e9 e4 d8 a6 31 38 76 d6 9e 34 5b 9d ee bf df 38 69 69 59 c8 09 ed 6d 1f aa d8 99 19 7f 33 f3 7d e3 64 bf 9c df 4c 67 5f 6e 2f e0 72 76 fd 09 6e ff fc f8 e9 6a 0a c9 01 63 9f 8f a6 8c 9d cf ce fb 17 c7 e9 68 cc d8 c5 ef c9 4e 52 22 d6 a7 8c b5 6d 9b b6 47 a9 f3 73 36 fb 83 95 58 99 63 16 d0 6b 81 a9 44 99 4c 76 b2 b8 37 d9 01 fa 65 a5 e2 b2 7f ec 96 41 78 5d e3 a4 d5 56 ba 36 45 15 f0 af ca 49 05 39 a0 6f d4 fb 8c ad 0c 36 1e a8 d1 a8 cd 3a fe 66 a5 82 9a cf 15 08 6e ad 43 28 14 dc bb c6 ca 8d 13 fb ce 2b ab 14 72 88 f8 0f d4 d7 46 2f f2 64 ea 2c 2a 8b 07 b3 65 ad 12 10 fd 2a 4f 50 7d c3 2e a5 f7 20 4a ee 83 c2 bc 09 07 3c 08 ad 93 ed 34 70 69 14 20 f9 ae 5c 44 08 5b ef 3f de 9c 7f 81 bf 09 94 c5 53 38 a9 91 8d 0f 6b 84 85 f2 92 5b 0e ff 3c d9 5d 8e 9f ac c6 47 d1 ec dd eb 66 87 6f 09 76 76 6a b4 7d 24 4b e1 8c f3 a7 e0 95 7c f6 76 a1 83 46 da 7b 32 a8 b8 77 ce 6e d9 50 f5 63 5e ab ce b1 4d eb b2 c2 c9 e5 8b 2e 42 f0 22 4f 18 0f 54 a5 c0 f8 03 ff c6 8c 2e 02 7b f8 da 28 bf 64 e3 f4 24 1d ad 16 69 a5 6d fa 10 92 ed 92 3d f0 05 ef 03 45 ca ac 1b ff 7a 6c 63 c8 fb c3 3c 3f 1e 1d bf 21 c6 16 79 78 41 7d 6a b5 c4 32 4f de 8d 46 09 14 ce 4b e5 f3 84 1e 85 32 26 d4 5c 68 3b cf 93 f1 28 79 4e b2 0c fd f3 8d 7e 53 be dc ec 79 3e 7e fd c5 9b f8 fa 2c 12 a3 50 4f 1e 4b d7 00 f7 0a 8c 73 8f 84 93 fc 3c 54 7a 5e 22 94 7c a1 28 92 b2 d4 e8 ca 2d 94 dc a7 2d 09 1a 03 58 5e a9 48 5f 3b 8f bb e4 a1 03 a0 aa 6a e7 b9 d7 66 09 8d a5 b2 69 13 6b 93 0e 64 e3 07 d2 ac 87 b3 bc 35 8a 07 12 85 5f 02 96 31 43 63 1c e9 7c 7e 3a 90 e6 40 a8 ac 31 c3 67 64 46 4f ae f9 a3 82 d0 50 51 b0 e4 d8 9d f5 59 15 10 c9 0d 5c 4a af 42 00 a9 43 6d f8 92 d8 ae 6d 67 b1 7e 51 70 0f ee 3e 96 d5 43 e1 5d 1b 54 57 9d 50 13 17 c8 9a 5b 19 4b 5c 71 8c 4a 11 ce 7b 25 d0 2c d3 61 40 44 f9 ff 86 7b d5 9d 46 4d e2 a2 a4 98 58 d2 71 5d 6b 8b 25 08 a3 45 d7 56 0e 51 bb fb dd 1c e2 e2 45 52 a4 1e 4d 13 96 23 f5 12 1d 70 a3 7c 67 53 6d 4a d0 69 9f 42 6b fb 84 7a 93 c9 8f e0 cf d8 50 23 b2 f2 70 38 e5 cb d9 ec 16 2e bc 27 a4 24 56 38 80 5f 35 29 90 56 52 47 54 8e d8 11 25 d0 f1 3f cd 0a 3f 1c e9 8a 46 b2 b7 0a e9 a1 4f 44 d3 b0 ba 53 7e a1 85 0a b0 7b 75 75 b7 37 24 a0 c3 c9 cf a3 f5 4c 89 d2 6a c1 cd 33 1c bb 51 88 a1 a9 49 53 08 b5 f2 c1 59 ab cc de 4f a6 fa 6f 2e b6 3b a3 9b cb ab fb 7c 7d ff ce 1d 8d 53 e1 5d 70 f7 98 0a 57 b1 fb 36 76 9f 7d 88 ff 5a e6 27 e3 13 1a 66 d7 6b 13 b8 f5 4e 36 44 aa bb 15 dc 75 0d 33 c6 27 1d e3 09 7f cc 8c 58 d8 5d 9b 10 14 f7
Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49703 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownHTTPS traffic detected: 23.54.200.130:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.54.200.130:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: classification engineClassification label: clean1.win@16/95@10/6
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=2016,i,1715222104164893096,13145483760006011228,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.corp-internal.co/ae90cbd9826866b7?l=8"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=2016,i,1715222104164893096,13145483760006011228,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: Google Drive.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnkJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
Registry Run Keys / Startup Folder		1
Process Injection		1
Masquerading		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
Registry Run Keys / Startup Folder		1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media5
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive6
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture4
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
http://www.corp-internal.co/ae90cbd9826866b7?l=80%Avira URL Cloudsafe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20Chromium%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d00%Avira URL Cloudsafe
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20hasCookies%20%3D%20true&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d00%Avira URL Cloudsafe
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20Chrome%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d00%Avira URL Cloudsafe
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20os_version%20%3D%2010&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d00%Avira URL Cloudsafe
http://www.corp-internal.co/trace?id=90cbd26866&msg=browser_post_successful&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d00%Avira URL Cloudsafe
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20localStorage%20%3D%20true&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d00%Avira URL Cloudsafe
http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20WindowsMediaPlayer%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d00%Avira URL Cloudsafe
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20browser%20%3D%20Chrome&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d00%Avira URL Cloudsafe
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20browser_version%20%3D%20117&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d00%Avira URL Cloudsafe
http://www.corp-internal.co/secure/browser_post0%Avira URL Cloudsafe
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20sessionStorage%20%3D%20true&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d00%Avira URL Cloudsafe
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20WebKit%20built-in%20PDF&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d00%Avira URL Cloudsafe
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20Microsoft%20Edge%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d00%Avira URL Cloudsafe
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20os%20%3D%20Windows&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d00%Avira URL Cloudsafe
http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20flash%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d00%Avira URL Cloudsafe
http://www.corp-internal.co/trace?id=90cbd26866&msg=redirecting%20to%20%2Fload_training%3Fguid%3De390cbdd12686627%26correlation_id%3D3fac3af0-74a1-4072-a0f1-391c2d2ad2d0&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d00%Avira URL Cloudsafe
http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20pdf%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d00%Avira URL Cloudsafe
http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20java%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d00%Avira URL Cloudsafe
http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20quicktime%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d00%Avira URL Cloudsafe
http://www.corp-internal.co/trace?id=90cbd26866&msg=Chrome%20browser%2C%20using%20more%20detailed%20version&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d00%Avira URL Cloudsafe
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20width%20%3D%201280&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d00%Avira URL Cloudsafe
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20colorDepth%20%3D%2024&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d00%Avira URL Cloudsafe
http://www.corp-internal.co/favicon.ico0%Avira URL Cloudsafe
http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20Silverlight%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d00%Avira URL Cloudsafe
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d00%Avira URL Cloudsafe
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20height%20%3D%201024&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d00%Avira URL Cloudsafe
http://www.corp-internal.co/assets/all.js?g=90cbd268660%Avira URL Cloudsafe
http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20RealPlayer%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d00%Avira URL Cloudsafe
http://www.corp-internal.co/assets/ajax/libs/jquery/1.9.1/jquery.min.js0%Avira URL Cloudsafe
http://www.corp-internal.co/favicon.ico2%VirustotalBrowse
http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20language%20%3D%20en-US&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d00%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
s3-w.us-east-1.amazonaws.com
52.216.26.156
truefalse
    		high
    bg.microsoft.map.fastly.net
    		199.232.210.172
    		truefalse
      		unknown
      prod-lp-alb-323408969.eu-west-1.elb.amazonaws.com
      		52.213.98.16
      		truefalse
        		high
        www.google.com
        		142.250.9.104
        		truefalse
          		high
          fp2e7a.wpc.phicdn.net
          		192.229.211.108
          		truefalse
            		unknown
            tslp.s3.amazonaws.com
            		unknown
            		unknownfalse
              		high
              _49153._https.www.corp-internal.co
              		unknown
              		unknownfalse
                		unknown
                www.corp-internal.co
                		unknown
                		unknownfalse
                  		unknown

                  Contacted URLs

                  NameMaliciousAntivirus DetectionReputation
                  http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20Chromium%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20os_version%20%3D%2010&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.corp-internal.co/trace?id=90cbd26866&msg=browser_post_successful&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20Chrome%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20hasCookies%20%3D%20true&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20localStorage%20%3D%20true&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20WindowsMediaPlayer%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20browser%20%3D%20Chrome&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20browser_version%20%3D%20117&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.corp-internal.co/secure/browser_postfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20sessionStorage%20%3D%20true&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20WebKit%20built-in%20PDF&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20Microsoft%20Edge%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20os%20%3D%20Windows&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20flash%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.corp-internal.co/trace?id=90cbd26866&msg=redirecting%20to%20%2Fload_training%3Fguid%3De390cbdd12686627%26correlation_id%3D3fac3af0-74a1-4072-a0f1-391c2d2ad2d0&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20pdf%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20java%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20quicktime%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.corp-internal.co/load_training?guid=e390cbdd12686627&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                    		unknown
                    http://www.corp-internal.co/trace?id=90cbd26866&msg=Chrome%20browser%2C%20using%20more%20detailed%20version&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20width%20%3D%201280&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20colorDepth%20%3D%2024&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.corp-internal.co/favicon.icofalse
                    • 2%, Virustotal, Browse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.corp-internal.co/ae90cbd9826866b7?l=8false
                      		unknown
                      http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20Silverlight%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                      • Avira URL Cloud: safe
                      		unknown
                      https://tslp.s3.amazonaws.com/detect/plugin_detect.js?guid=90cbd26866&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                        		high
                        http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20height%20%3D%201024&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.corp-internal.co/assets/all.js?g=90cbd26866false
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20RealPlayer%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.corp-internal.co/assets/ajax/libs/jquery/1.9.1/jquery.min.jsfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20language%20%3D%20en-US&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0false
                        • Avira URL Cloud: safe
                        		unknown

                        World Map of Contacted IPs

                        • No. of IPs < 25%
                        • 25% < No. of IPs < 50%
                        • 50% < No. of IPs < 75%
                        • 75% < No. of IPs

                        Public IPs

                        IPDomainCountryFlagASNASN NameMalicious
                        239.255.255.250
                        		unknownReserved
                        		unknownunknownfalse
                        142.250.9.104
                        		www.google.comUnited States
                        		15169GOOGLEUSfalse
                        34.248.78.201
                        		unknownUnited States
                        		16509AMAZON-02USfalse
                        52.216.26.156
                        		s3-w.us-east-1.amazonaws.comUnited States
                        		16509AMAZON-02USfalse
                        52.213.98.16
                        		prod-lp-alb-323408969.eu-west-1.elb.amazonaws.comUnited States
                        		16509AMAZON-02USfalse

                        Private

                        IP
                        192.168.2.5

                        General Information

                        Joe Sandbox version:40.0.0 Tourmaline
                        Analysis ID:1431610
                        Start date and time:2024-04-25 14:23:51 +02:00
                        Joe Sandbox product:CloudBasic
                        Overall analysis duration:0h 3m 24s
                        Hypervisor based Inspection enabled:false
                        Report type:full
                        Cookbook file name:browseurl.jbs
                        Sample URL:http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                        Number of analysed new started processes analysed:7
                        Number of new started drivers analysed:0
                        Number of existing processes analysed:0
                        Number of existing drivers analysed:0
                        Number of injected processes analysed:0
                        Technologies:
                        • HCA enabled
                        • EGA enabled
                        • AMSI enabled
                        Analysis Mode:default
                        Analysis stop reason:Timeout
                        Detection:CLEAN
                        Classification:clean1.win@16/95@10/6
                        EGA Information:Failed
                        HCA Information:
                        • Successful, ratio: 100%
                        • Number of executed functions: 0
                        • Number of non-executed functions: 0

                        Warnings

                        • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                        • Excluded IPs from analysis (whitelisted): 74.125.138.94, 74.125.136.138, 74.125.136.100, 74.125.136.139, 74.125.136.102, 74.125.136.113, 74.125.136.101, 172.217.215.84, 34.104.35.123, 20.12.23.50, 23.47.204.79, 199.232.210.172, 192.229.211.108, 13.95.31.18, 20.3.187.198, 173.194.219.94, 172.253.124.100, 172.253.124.138, 172.253.124.102, 172.253.124.139, 172.253.124.113, 172.253.124.101
                        • Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, clients.l.google.com, glb.sls.prod.dcat.dsp.trafficmanager.net
                        • HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                        • Not all processes where analyzed, report is missing behavior information
                        • Report size getting too big, too many NtSetInformationFile calls found.

                        Simulations

                        Behavior and APIs

                        ⊘No simulations

                        Joe Sandbox View / Context

                        IPs

                        ⊘No context

                        Domains

                        ⊘No context

                        ASNs

                        ⊘No context

                        JA3 Fingerprints

                        ⊘No context

                        Dropped Files

                        ⊘No context

                        Created / dropped Files

                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 11:24:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                        Category:dropped
                        Size (bytes):2677
                        Entropy (8bit):3.9800393104114047
                        Encrypted:false
                        SSDEEP:48:8sdRTZRMHqcidAKZdA19ehwiZUklqehiy+3:8arQpy
                        MD5:ED2BC44687BF127C41F6972DF09CFC2E
                        SHA1:CE6D59286264DAB0A12BC4B7E34386B50B85E397
                        SHA-256:71D7DA88D4CB5AA25972B40BCAB848FAE3658033C0D5EAF2353A645BAE2F235C
                        SHA-512:83CDB6A6E7426B7C5558702903FD8950671E1F3671184995BC55235A931C3DA275A73427044F92A9CCE63A231FBF5E1CA8530132AF764935210A4AE212AA21B1
                        Malicious:false
                        Reputation:low
                        Preview:L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.c....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.c....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.c....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.c..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.c...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 11:24:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                        Category:dropped
                        Size (bytes):2679
                        Entropy (8bit):3.990968348189458
                        Encrypted:false
                        SSDEEP:48:81dRTZRMHqcidAKZdA1weh/iZUkAQkqehZy+2:8prq9Qsy
                        MD5:90334940C7003AF044B02FE0E01167D5
                        SHA1:D56280972557B3F45BA34F16EEA35939C2853593
                        SHA-256:796E57433AF90617E08F346419F9C2DE6A1BE0836C89031D2428C7923A2B0496
                        SHA-512:BCFAE93575A6020F218408A0BBC7387D4FFD8831C18414ADF6DE97097DC48039A836AD7FEFBCC3853023F76C8D23D9CC758B15FB0BBDA9BEBD7C3EB22505450F
                        Malicious:false
                        Reputation:low
                        Preview:L..................F.@.. ...$+.,....lx.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.c....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.c....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.c....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.c..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.c...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                        Category:dropped
                        Size (bytes):2693
                        Entropy (8bit):4.004021965775463
                        Encrypted:false
                        SSDEEP:48:8xadRTZRsHqcidAKZdA14tseh7sFiZUkmgqeh7sLy+BX:8xArSndy
                        MD5:AEF57E426125A20801CDE4E52BABCFC8
                        SHA1:F9E9DF40A555EFCBF3509E6691C251AE975166BF
                        SHA-256:F7B623AA979D71FFDB4C79EF3806C0E05C3672B2B930A184ACA71A66803EE0F8
                        SHA-512:028A26E618DAE11C4EC73CD5DD5A7E8BB5842CCA32F2EDF38A9F6FBA6968FD13D8CC656D1E0F210EEF707B9E94DD3F4F8C248255808D515C64B4C218BD20A26C
                        Malicious:false
                        Reputation:low
                        Preview:L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.c....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.c....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.c....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.c..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 11:24:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                        Category:dropped
                        Size (bytes):2681
                        Entropy (8bit):3.9930505331872803
                        Encrypted:false
                        SSDEEP:48:8HdRTZRMHqcidAKZdA1vehDiZUkwqehFy+R:8DrxTy
                        MD5:FBFD8BFD9DB0D094BE54EB5E4A9520CF
                        SHA1:A26FCC6308A392CB31DF9911CFB1C0810B6652F5
                        SHA-256:218241A26B1F31FD51B85C69C0618FEB326DA52A72D81141C2C0774E7AFB1967
                        SHA-512:5475D88C5D565183CBF77A17E1D6CACC14D62746B22E6391293ADE9F42DAEC390BBF00C61F36413886C6BE1BDCD0DDD10F42E74A82D2FBC44C1EE0D1DB0BA635
                        Malicious:false
                        Reputation:low
                        Preview:L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.c....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.c....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.c....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.c..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.c...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 11:24:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                        Category:dropped
                        Size (bytes):2681
                        Entropy (8bit):3.9802327511991544
                        Encrypted:false
                        SSDEEP:48:81dRTZRMHqcidAKZdA1hehBiZUk1W1qehPy+C:8prR9vy
                        MD5:1C1E6F61444F0CFD498DF12292C75E8B
                        SHA1:B89FA7C892B8A8C4766BB2475098959757E73230
                        SHA-256:E97BD0500DC76DC8BB5336AE3266CF6AEBCF66736BE732E60852AEA8D05B7ABB
                        SHA-512:069E3CA9B608F7D98E6E40920A5BC62E97C5392614C6FDDADC5B5D1204011DA323836808DDC27BA5409684B8102A58979CDE0FFC4A19DED221435B385B439A79
                        Malicious:false
                        Reputation:low
                        Preview:L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.c....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.c....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.c....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.c..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.c...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 11:24:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                        Category:dropped
                        Size (bytes):2683
                        Entropy (8bit):3.9933036229689653
                        Encrypted:false
                        SSDEEP:48:8zdRTZRMHqcidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbdy+yT+:8/rNT/TbxWOvTbdy7T
                        MD5:39C35A7F536AF348134D2C777E23F5C2
                        SHA1:56E0F949BA45883607328F6F990A404915A213E0
                        SHA-256:7DD68CA1455F597C919820F9DA42C9F2C149D99BF0025CC4B375E9979A768C8B
                        SHA-512:9086E2B1D45D72EDF11746E1AA2E228978BB5DBE3D459BB43BDB93A2822E5C211EB58C097B890615BE498E920B90F633AA41490FD5FFD5419EAC486DCEBA4D59
                        Malicious:false
                        Reputation:low
                        Preview:L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.c....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.c....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.c....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.c..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.c...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                        Chrome Cache Entry: 100

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:downloaded
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20os%20%3D%20Windows&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:....................

                        Chrome Cache Entry: 101

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:dropped
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        Preview:....................

                        Chrome Cache Entry: 102

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:dropped
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        Preview:....................

                        Chrome Cache Entry: 103

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:downloaded
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20language%20%3D%20en-US&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:....................

                        Chrome Cache Entry: 104

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, original size modulo 2^32 2511
                        Category:dropped
                        Size (bytes):1020
                        Entropy (8bit):7.793626597157796
                        Encrypted:false
                        SSDEEP:24:XlcGF4aItTrPsVPClcGEyAE9vKwdcYHR1ARu4/wdBg:XlcGF4dtTrPsV4cGEa9yeHrA1/6g
                        MD5:66B876C99826874A4932C0EB6BB6BF2C
                        SHA1:B82CA3009A31860782F327A1368BEA016BCDFF0A
                        SHA-256:918B5688C88B703B9E6A418BD08481AEA342532FFAC7B7B8930CA5295346566B
                        SHA-512:3687A6D3F96C11975693BB8F14EE3CE7D444CCB509FD12437AC8D708538B117201BAED23B3A33A3EC21EB2526154B188417686022FE8F59E4CE12B125B8E5813
                        Malicious:false
                        Reputation:low
                        Preview:...........VQO.8.~.W...$.[`%.&]..;....=.....18v.4[...8iiY...m.....3.}.d...Lg_n/.rv..n....j...c...........h.....NR"...m..G..s6...X.c..k..D.Lv..7...e....Ax]..V.6E...I.9.o.....6....:.f......n.C(.......+..r.....F/.d.,*...e....*OP}.... J....<....4pi. ..\D.[.?.......S8....k...[..<.]....G....f.o.vvj.}$K....|.v..F.{2..w.n.P.c^..M.....B."O..T........{..(.d..$...i.m....=....E...zlc...<?...!..yxA}j..2O.F...K....2&.\h;..(yN....~S...y>~....,..PO.K.....s....<Tz^".|.(.....-..-...X^.H_;......j..f....i.k..d......5...._..1Cc..|~:..@..1.gdFO.....PQ....Y....\J.B..Cm...mg.~Qp..>..C.].TW.P...[.K\q.J..{%.,.a@D...{.FM..X.q]k.%..E.V.Q......ER..M..#...p.|gSmJ.i.Bk..z.....P#..p8.......'.$V8._5).VRGT...%..?..?..F....OD..S~....{uu.7$.....L..j..3..Q...IS....Y...O..o..;....|}....S.]p...W..6v.}..Z.'...f.k...N6D....u.3.'.....X.]......fM.VK#3..0...X.;.....G.75.0.E.Ke..o..R...f..g.q.....5]zs..&jTs.....j-B.J.3.....Na.:.......g.ui..3..Co...p...........?.......n...b,..

                        Chrome Cache Entry: 105

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:dropped
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        Preview:....................

                        Chrome Cache Entry: 106

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:downloaded
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20os_version%20%3D%2010&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:....................

                        Chrome Cache Entry: 107

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, original size modulo 2^32 3184
                        Category:downloaded
                        Size (bytes):809
                        Entropy (8bit):7.724693522249389
                        Encrypted:false
                        SSDEEP:12:Xae83BEMIM0l3tw8qDeTZaA1gAODW/yhZCMhuka4hJl5qT1qlgqJNVotLX:XrwvRKTzzzShq41eUTjVo1X
                        MD5:15159FC71871B925CF5C89B92A6BD022
                        SHA1:C007A96A2A80CEAC933A8A7876DE5A62DD3F64FC
                        SHA-256:5F0AFBED8278E37FDA5840D31E264E4125801B19C21E05ECFCAF41981C320983
                        SHA-512:B83B54FF031C7884C89D07B910F9B9973ADE0E3CFB40DF40388D32EE62C62AEC45A4F75D2DF486079210F34A80C4E311A88692A5680C17E88CE650FFC2C886D6
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Preview:...........W.v.0...+tX.$.5.;....&.....Y.@.@D.!nO.....6.4q..F3.;.;.1B.g..?\..g...M..j.9<,...x5..H..e...H.t./.{.,....Y..DC.=.]d.{....Zb..$|.3F=..dE.;...LF.k"...5..o...&c....;........w0..dDG....2 wp..9..-W.n.D.`X."%.g9.'.;5@...d..:V.......)..@?........"`a..W.7.<.2.r...D$.8...r..5w.<.m.'.0s.2..|..f....\.){.........Y.x. ..D..z......M;..Z....6..o..\..b......g!K...^..Y.). ...}..C..*r..?..F....CZf.....c.].UJ..82uN.5..2.$`^p..e.)._A..q...#..,.U4.!.9..j^.w..=u..z..)fa...0..'..`..@..~,(...s..z.(.E._../...L+F..r0G%.v."euv.gU....bG.....T......|............".+..V...i........I..n[.........o.g+._2...g.[..1K..q..{Tn........_..,...../....B.U..P/..!.....jW.{.s....)i..W.M.T..z....v.kJW_.m.G.PnN.o...`...^......Z.a.=...P.[.X.[h^...7du.c''.nz.&..a.-wC.......W.-(...`.:....{...l.}p...

                        Chrome Cache Entry: 108

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:dropped
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        Preview:....................

                        Chrome Cache Entry: 109

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:downloaded
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20pdf%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:....................

                        Chrome Cache Entry: 110

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:downloaded
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20Silverlight%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:....................

                        Chrome Cache Entry: 111

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:downloaded
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20Chromium%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:....................

                        Chrome Cache Entry: 112

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:dropped
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        Preview:....................

                        Chrome Cache Entry: 113

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:downloaded
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/trace?id=90cbd26866&msg=redirecting%20to%20%2Fload_training%3Fguid%3De390cbdd12686627%26correlation_id%3D3fac3af0-74a1-4072-a0f1-391c2d2ad2d0&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:....................

                        Chrome Cache Entry: 114

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:dropped
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        Preview:....................

                        Chrome Cache Entry: 115

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:dropped
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        Preview:....................

                        Chrome Cache Entry: 116

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:downloaded
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20WebKit%20built-in%20PDF&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:....................

                        Chrome Cache Entry: 117

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:dropped
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        Preview:....................

                        Chrome Cache Entry: 118

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:dropped
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        Preview:....................

                        Chrome Cache Entry: 119

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:dropped
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        Preview:....................

                        Chrome Cache Entry: 120

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:dropped
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        Preview:....................

                        Chrome Cache Entry: 63

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:ASCII text, with very long lines (306)
                        Category:downloaded
                        Size (bytes):50085
                        Entropy (8bit):3.5610506396954245
                        Encrypted:false
                        SSDEEP:768:so4D6PW10HQN3WQ9tD9BsiAmvwyWSdovbEuXg/:shDCW10HQN3WQ9tD9BsRyWSCvgUg/
                        MD5:00A513F07603DF01E3B99BE00F370754
                        SHA1:F0C03B1C50F39C95075DF687CD55F18861631526
                        SHA-256:4BAB432979D731F8264BCD9D40422CA7DFCFCB0E0E703288DB78BBFA555F853A
                        SHA-512:9824C521D8B214847E6193CB8046488CFF1F113D6C9637241D5EE1042ADC6C8C7724452611DD0994E7A478768860E69A29B4F4E6B51FD726761DE520D5C05765
                        Malicious:false
                        Reputation:low
                        URL:https://tslp.s3.amazonaws.com/detect/plugin_detect.js?guid=90cbd26866&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:/*.PluginDetect v0.9.1.www.pinlady.net/PluginDetect/license/.[ ].[ isMinVersion getVersion hasMimeType getInfo ].[ AllowActiveX BetterIE ].*/.(function() {. var j = {. version: "0.9.1",. name: "PluginDetect",. addPlugin: function(p, q) {. if (p && j.isString(p) && q && j.isFunc(q.getVersion)) {. p = p.replace(/\s/g, "").toLowerCase();. j.Plugins[p] = q;. if (!j.isDefined(q.getVersionDone)) {. q.installed = null;. q.version = null;. q.version0 = null;. q.getVersionDone = null;. q.pluginName = p;. }. }. },. uniqueName: function() {. return j.name + "998". },. openTag: "<",. hasOwnPROP: ({}).constructor.prototype.hasOwnProperty,. hasOwn: function(s, t) {. var p;. try {. p = j.hasOwnPROP.call(s, t).

                        Chrome Cache Entry: 64

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:downloaded
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20browser_version%20%3D%20117&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:....................

                        Chrome Cache Entry: 65

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:downloaded
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20quicktime%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:....................

                        Chrome Cache Entry: 66

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:dropped
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        Preview:....................

                        Chrome Cache Entry: 67

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:dropped
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        Preview:....................

                        Chrome Cache Entry: 68

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:downloaded
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20colorDepth%20%3D%2024&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:....................

                        Chrome Cache Entry: 69

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:dropped
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        Preview:....................

                        Chrome Cache Entry: 70

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:downloaded
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20hasCookies%20%3D%20true&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:....................

                        Chrome Cache Entry: 71

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, original size modulo 2^32 141
                        Category:downloaded
                        Size (bytes):142
                        Entropy (8bit):6.58263919687806
                        Encrypted:false
                        SSDEEP:3:Fttb0MDUgRVzny/hpgbsv7U8kaNw1HQsRnvmq6uyiVttn:Xtb0MDPQ/hpVqagd6uyiVv
                        MD5:F32E66A98BE7E1BE135E02BBF190F4B8
                        SHA1:275085128049F3B3FE98BF77C573E1011CEEF7FA
                        SHA-256:0B6D3B08F22CCD67B2AD49BF173AFF52DFE0DB49BB75D0204FA2345F1A17CF82
                        SHA-512:0F789D33C1D1BC93CDABB68DDF79E7768ACA6782A68FA4F3EF5E8A7217B0F1ECEDA6617AF578B47D3A3294E339664A510AFBB7404E2BCE401B764417FEB21E2B
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/load_training?guid=e390cbdd12686627&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:..........-....!...{O!B....z...z..t....".-:...W.^.r.q..o..|...X.R+.^.b...s..b3.......%U8..R./.h.....$G.o..h<.......O_......`......E....

                        Chrome Cache Entry: 72

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:downloaded
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20localStorage%20%3D%20true&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:....................

                        Chrome Cache Entry: 73

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:downloaded
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20height%20%3D%201024&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:....................

                        Chrome Cache Entry: 74

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:downloaded
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/trace?id=90cbd26866&msg=Chrome%20browser%2C%20using%20more%20detailed%20version&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:....................

                        Chrome Cache Entry: 75

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:downloaded
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/trace?id=90cbd26866&msg=browser_post_successful&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:....................

                        Chrome Cache Entry: 76

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:dropped
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        Preview:....................

                        Chrome Cache Entry: 77

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, original size modulo 2^32 92629
                        Category:downloaded
                        Size (bytes):32772
                        Entropy (8bit):7.99023218436654
                        Encrypted:true
                        SSDEEP:768:TOKp/xhnMIfgb5MXo091QnNS002aTFZGuuWnkV:TOKNMIfgbmXx91uZaZZPu9
                        MD5:1DCA01C6231917AABE380A98F67DAE36
                        SHA1:C6C800587EADD27A45CD29EF6D05742182E1454C
                        SHA-256:47126BAB74AC1FD0C429292DFDE3FACE2F931752C30E527888763166088B451C
                        SHA-512:5DFCB686F1E47E28CD13FFCF4BAB9962E733A7136F5B74FAB9985555C2FB9E4CFF42F0311F68822226E6C5C450852F37353E717B921D20076BE26DA583095F09
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/assets/ajax/libs/jquery/1.9.1/jquery.min.js
                        Preview:...........{{..7....".....o...v.q.[cg'-E.HPBL....RD....[kf0.Pq.~.sNZ....f....._..M...wg.?..vG.<8z2.........E...q..:z..GT._.f....t.de.....uT..b.|.o6iv..._E..:.F.x...O..6..*?QUp....2U.4..6I.<.T.%.E>...R1..4^.tIm..ZE.{5..3..<.....|4.3.D-.r.-o..]....4[$....:Z...UUP_........|...z.mF.r...f......Q..?..-3.0..F..^.F....l.O........\..f.|1..t..NG2U.}tz.jxz.^G.o......./^\.>.....#*........./.../......|zp2{...N.3*....~.\../O'...g...g.;.~.M.Tx..,g.....).y..w*@..i.^...]........2+..n;.\.'.'/f....*.4:..oP...f..]Ul..2^....V........V.P.N...z......o3z.........aC..,.....K.\p..x......WiY%YR.v.*..^.......<_oVI..a>*.xq....$8>....u%......n ..V?.Q.:..4....o.~.g..Q...S_..Y.....G)..T."......<......&..*..Z.t%..s@it5..y.c....p.h...X.*/.+.H.....){4U.y...I`..&-..+y.....L.O....Lf..X<..1M.w.xD;;....3zgn...'S.....g.~3Jn.9-..... ....3.A..e#....".-i.S..].9..3..=GE..,.R*.gs..j.M.0.._'.u.....E.|....K.Q'FY.H^.'.(.OK.\.-.T...8..Q....v||5J..Vq.}{.K2..K..z.R....o_..G..t.L..NF.W.}.

                        Chrome Cache Entry: 78

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:dropped
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        Preview:....................

                        Chrome Cache Entry: 79

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:dropped
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        Preview:....................

                        Chrome Cache Entry: 80

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:dropped
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        Preview:....................

                        Chrome Cache Entry: 81

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:downloaded
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20flash%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:....................

                        Chrome Cache Entry: 82

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:downloaded
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20sessionStorage%20%3D%20true&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:....................

                        Chrome Cache Entry: 83

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:dropped
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        Preview:....................

                        Chrome Cache Entry: 84

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:downloaded
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20browser%20%3D%20Chrome&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:....................

                        Chrome Cache Entry: 85

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:dropped
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        Preview:....................

                        Chrome Cache Entry: 86

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:dropped
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        Preview:....................

                        Chrome Cache Entry: 87

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:downloaded
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20java%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:....................

                        Chrome Cache Entry: 88

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:downloaded
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20Chrome%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:....................

                        Chrome Cache Entry: 89

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:dropped
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        Preview:....................

                        Chrome Cache Entry: 90

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:dropped
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        Preview:....................

                        Chrome Cache Entry: 91

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:downloaded
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:....................

                        Chrome Cache Entry: 92

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:dropped
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        Preview:....................

                        Chrome Cache Entry: 93

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:downloaded
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20WindowsMediaPlayer%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:....................

                        Chrome Cache Entry: 94

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:downloaded
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20width%20%3D%201280&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:....................

                        Chrome Cache Entry: 95

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:dropped
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        Preview:....................

                        Chrome Cache Entry: 96

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:downloaded
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/trace?id=90cbd26866&msg=Skipping%20RealPlayer%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:....................

                        Chrome Cache Entry: 97

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, last modified: Tue Mar 2 18:53:53 2021, max compression, from Unix, original size modulo 2^32 28406
                        Category:downloaded
                        Size (bytes):7191
                        Entropy (8bit):7.971342533314586
                        Encrypted:false
                        SSDEEP:192:yPCSrrg5jUzEozsrwygZ4kYT0An0u7umdXjirJ4:yPT85jUwoUWlZS0u7umdXji+
                        MD5:DB7C58FC21F4BBB0900FED3889F61DF2
                        SHA1:24047C64E0DBDBCC8EEF175A42DC1911F7F8A6AA
                        SHA-256:5A1DCEA95A97B018B93CC58089502FD2069D508C02088C0C6A49533FEF91AFB7
                        SHA-512:7E499080895443B5974B0BEA28353CEBB39EFB5BF94A38A801AFB835C7547B2CDC733CBF05278739EF93347FA35A86DE45995E5C45AF1D252EE66D4F37551641
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/assets/all.js?g=90cbd26866
                        Preview:......>`...=m{.6...+..\+.8.3.v...r.L....L..S?.E.Ld...$....E.L9v..].>ID.... H..`.HG%.. .>.ny.g..aT..<+.."O.../pV.{...=Y.d....,.r...=n F.2.......ph..[.d.MX.v.|....^y...>....,.e1....Q6.g)KK.b.G.k.N.<......ij....4Ap.1..%.vi 9....%....PP 7......._a".A.......,@Du.3V. 2K..bf...%.!..bd.....;.(I.r...{.0W.......V.&.7yv[..-+..F>.x..m....P@..}.,.G..2..$.N...D..$.Ez.f....L...B#.;e&Q......t...3i{..}...`...pe3.(T.H..>..,.,.....L.8ZT..|...[.m.e.......j...I...T..WQ..\..b.bW...a....@.0..__Vh..x.....X......he..`...3.6. e........Z*...........:...Y..S.(.|......{^b.Gfax.q+..+.Ze~.....b.q.6*a..U....=.'%...L.a.L.HC}.f... n........E.h..\.Z...@.6... 6i..@.,.n...5..n..s(,.....}...Q....h4.N.&R...._...Cj.').H.p....a...e"....&3i.GYv.Ya...Y..$.s._..wB!5..eJ..r.d.~;fc.......9..^...3.. .@Pt.[.#...h...Yo..M..N?......DSgM...c..i.}v..#.a...y.3....'.. . @b...`(},......G...........9...&*vx5miPW.l|".k....Q\..j.%..`.b..5..f....V....V$....NQ...\4C.r..<.|.h....4..m..X).T....]`..U

                        Chrome Cache Entry: 98

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:dropped
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        Preview:....................

                        Chrome Cache Entry: 99

                        Download File
                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                        File Type:gzip compressed data, max compression, from Unix, truncated
                        Category:downloaded
                        Size (bytes):20
                        Entropy (8bit):1.5567796494470394
                        Encrypted:false
                        SSDEEP:3:FttZl:Xtb
                        MD5:4A4DD3598707603B3F76A2378A4504AA
                        SHA1:A0FDDD5458378C1BF3C10DD2F5C060D1347741ED
                        SHA-256:F61F27BD17DE546264AA58F40F3AAFAAC7021E0EF69C17F6B1B4CD7664A037EC
                        SHA-512:1B46B9B08D5B338BE9D732A1724795B2EAB63DAFFDE377218727C90857B79FE6A47BCEED495117FCDE60F7339812EF75EF4C69F82DD79FB69B6CBF8006B521F2
                        Malicious:false
                        Reputation:low
                        URL:http://www.corp-internal.co/trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20Microsoft%20Edge%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Preview:....................

                        Static File Info

                        ⊘No static file info

                        Network Behavior

                        Network Port Distribution

                        TCP Packets

                        TimestampSource PortDest PortSource IPDest IP
                        Apr 25, 2024 14:24:36.716279984 CEST49675443192.168.2.523.1.237.91
                        Apr 25, 2024 14:24:36.716300964 CEST49674443192.168.2.523.1.237.91
                        Apr 25, 2024 14:24:36.810035944 CEST49673443192.168.2.523.1.237.91
                        Apr 25, 2024 14:24:45.189408064 CEST4971080192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:45.189794064 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:45.288605928 CEST4971280192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:45.339076996 CEST49713443192.168.2.5142.250.9.104
                        Apr 25, 2024 14:24:45.339118958 CEST44349713142.250.9.104192.168.2.5
                        Apr 25, 2024 14:24:45.339238882 CEST49713443192.168.2.5142.250.9.104
                        Apr 25, 2024 14:24:45.339443922 CEST49713443192.168.2.5142.250.9.104
                        Apr 25, 2024 14:24:45.339462042 CEST44349713142.250.9.104192.168.2.5
                        Apr 25, 2024 14:24:45.398730040 CEST804971052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:45.399116993 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:45.399255037 CEST4971080192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:45.399781942 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:45.400207043 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:45.498495102 CEST804971252.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:45.499881029 CEST4971280192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:45.605776072 CEST44349713142.250.9.104192.168.2.5
                        Apr 25, 2024 14:24:45.606105089 CEST49713443192.168.2.5142.250.9.104
                        Apr 25, 2024 14:24:45.606115103 CEST44349713142.250.9.104192.168.2.5
                        Apr 25, 2024 14:24:45.607438087 CEST44349713142.250.9.104192.168.2.5
                        Apr 25, 2024 14:24:45.607495070 CEST49713443192.168.2.5142.250.9.104
                        Apr 25, 2024 14:24:45.609359980 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:45.611783981 CEST49713443192.168.2.5142.250.9.104
                        Apr 25, 2024 14:24:45.611854076 CEST44349713142.250.9.104192.168.2.5
                        Apr 25, 2024 14:24:45.628371954 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:45.628424883 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:45.628460884 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:45.628490925 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:45.657344103 CEST49713443192.168.2.5142.250.9.104
                        Apr 25, 2024 14:24:45.657358885 CEST44349713142.250.9.104192.168.2.5
                        Apr 25, 2024 14:24:45.672688007 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:45.698576927 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:45.698705912 CEST4971080192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:45.706265926 CEST49713443192.168.2.5142.250.9.104
                        Apr 25, 2024 14:24:45.812186003 CEST49716443192.168.2.552.216.26.156
                        Apr 25, 2024 14:24:45.812217951 CEST4434971652.216.26.156192.168.2.5
                        Apr 25, 2024 14:24:45.812288046 CEST49716443192.168.2.552.216.26.156
                        Apr 25, 2024 14:24:45.812489033 CEST49716443192.168.2.552.216.26.156
                        Apr 25, 2024 14:24:45.812500000 CEST4434971652.216.26.156192.168.2.5
                        Apr 25, 2024 14:24:45.873296022 CEST4971749153192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:45.907809019 CEST804971052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:45.909229994 CEST804971052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:45.909287930 CEST804971052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:45.909328938 CEST804971052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:45.909367085 CEST804971052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:45.909400940 CEST4971080192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:45.909404039 CEST804971052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:45.909441948 CEST804971052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:45.909447908 CEST4971080192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:45.910846949 CEST4971080192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:45.913650990 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:45.913728952 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:45.913764954 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:45.913819075 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:45.913821936 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:45.913858891 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:45.913861036 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:45.913913012 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:45.913964033 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:45.914000988 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:45.914037943 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:45.914088964 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:45.914124966 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:45.914134979 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:45.916352034 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:45.963340998 CEST4971849153192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.069686890 CEST4434971652.216.26.156192.168.2.5
                        Apr 25, 2024 14:24:46.069979906 CEST49716443192.168.2.552.216.26.156
                        Apr 25, 2024 14:24:46.069993973 CEST4434971652.216.26.156192.168.2.5
                        Apr 25, 2024 14:24:46.071079969 CEST4434971652.216.26.156192.168.2.5
                        Apr 25, 2024 14:24:46.071149111 CEST49716443192.168.2.552.216.26.156
                        Apr 25, 2024 14:24:46.072269917 CEST49716443192.168.2.552.216.26.156
                        Apr 25, 2024 14:24:46.072371960 CEST4434971652.216.26.156192.168.2.5
                        Apr 25, 2024 14:24:46.072442055 CEST49716443192.168.2.552.216.26.156
                        Apr 25, 2024 14:24:46.072453022 CEST4434971652.216.26.156192.168.2.5
                        Apr 25, 2024 14:24:46.115102053 CEST49716443192.168.2.552.216.26.156
                        Apr 25, 2024 14:24:46.123301029 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.123406887 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.123445034 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.123456001 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.123508930 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.123548031 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.123554945 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.123584986 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.123627901 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.123640060 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.123680115 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.123716116 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.123718977 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.123754025 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.123790026 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.123806000 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.123853922 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.123891115 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.123919964 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.123945951 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.123989105 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.124022961 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.124061108 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.124105930 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.319042921 CEST49675443192.168.2.523.1.237.91
                        Apr 25, 2024 14:24:46.319051027 CEST49674443192.168.2.523.1.237.91
                        Apr 25, 2024 14:24:46.335680962 CEST4434971652.216.26.156192.168.2.5
                        Apr 25, 2024 14:24:46.335726023 CEST4434971652.216.26.156192.168.2.5
                        Apr 25, 2024 14:24:46.335791111 CEST49716443192.168.2.552.216.26.156
                        Apr 25, 2024 14:24:46.335803986 CEST4434971652.216.26.156192.168.2.5
                        Apr 25, 2024 14:24:46.336210966 CEST4434971652.216.26.156192.168.2.5
                        Apr 25, 2024 14:24:46.336242914 CEST4434971652.216.26.156192.168.2.5
                        Apr 25, 2024 14:24:46.336257935 CEST49716443192.168.2.552.216.26.156
                        Apr 25, 2024 14:24:46.336261034 CEST4434971652.216.26.156192.168.2.5
                        Apr 25, 2024 14:24:46.336283922 CEST4434971652.216.26.156192.168.2.5
                        Apr 25, 2024 14:24:46.336286068 CEST49716443192.168.2.552.216.26.156
                        Apr 25, 2024 14:24:46.336307049 CEST49716443192.168.2.552.216.26.156
                        Apr 25, 2024 14:24:46.336329937 CEST49716443192.168.2.552.216.26.156
                        Apr 25, 2024 14:24:46.415839911 CEST49673443192.168.2.523.1.237.91
                        Apr 25, 2024 14:24:46.458511114 CEST4434971652.216.26.156192.168.2.5
                        Apr 25, 2024 14:24:46.458539009 CEST4434971652.216.26.156192.168.2.5
                        Apr 25, 2024 14:24:46.458587885 CEST4434971652.216.26.156192.168.2.5
                        Apr 25, 2024 14:24:46.458686113 CEST49716443192.168.2.552.216.26.156
                        Apr 25, 2024 14:24:46.458700895 CEST4434971652.216.26.156192.168.2.5
                        Apr 25, 2024 14:24:46.458734989 CEST49716443192.168.2.552.216.26.156
                        Apr 25, 2024 14:24:46.458882093 CEST4434971652.216.26.156192.168.2.5
                        Apr 25, 2024 14:24:46.458935976 CEST49716443192.168.2.552.216.26.156
                        Apr 25, 2024 14:24:46.458945036 CEST4434971652.216.26.156192.168.2.5
                        Apr 25, 2024 14:24:46.459072113 CEST4434971652.216.26.156192.168.2.5
                        Apr 25, 2024 14:24:46.459115982 CEST49716443192.168.2.552.216.26.156
                        Apr 25, 2024 14:24:46.459121943 CEST4434971652.216.26.156192.168.2.5
                        Apr 25, 2024 14:24:46.459146023 CEST4434971652.216.26.156192.168.2.5
                        Apr 25, 2024 14:24:46.459184885 CEST49716443192.168.2.552.216.26.156
                        Apr 25, 2024 14:24:46.461529016 CEST49716443192.168.2.552.216.26.156
                        Apr 25, 2024 14:24:46.461540937 CEST4434971652.216.26.156192.168.2.5
                        Apr 25, 2024 14:24:46.524106979 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.524106979 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.538759947 CEST4971080192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.538943052 CEST4971980192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.539169073 CEST4972080192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.539177895 CEST4971280192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.541771889 CEST4972180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.733345985 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.742281914 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.742295027 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.742350101 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.749234915 CEST804971252.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.752763987 CEST804971052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.752774000 CEST804971052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.752834082 CEST4971080192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.755043030 CEST804971252.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.755090952 CEST804972052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.755135059 CEST804971252.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.755179882 CEST4972080192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.755192995 CEST4971280192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.756398916 CEST804972152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.756459951 CEST804971952.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:46.757136106 CEST4972180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.758259058 CEST4971980192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.849149942 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.851640940 CEST4972080192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.851893902 CEST4972180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.875869989 CEST4971980192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.883944988 CEST4971749153192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.901844978 CEST4971080192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.901997089 CEST4971280192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:46.975068092 CEST4971849153192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.040334940 CEST4972280192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.040779114 CEST4972380192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.040994883 CEST4972480192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.062563896 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.062576056 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.062654018 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.066104889 CEST804972152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.067188978 CEST804972052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.067914009 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.070277929 CEST804972152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.070286989 CEST804972152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.070425987 CEST4972180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.071800947 CEST804972052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.071809053 CEST804972052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.071863890 CEST4972080192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.081671000 CEST4972080192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.083512068 CEST4972180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.087032080 CEST4972580192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.089210987 CEST4972680192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.090802908 CEST4972780192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.093234062 CEST804971952.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.102375984 CEST804971952.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.102385998 CEST804971952.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.102474928 CEST4971980192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.106590986 CEST4971980192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.115422010 CEST804971252.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.115439892 CEST804971252.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.115472078 CEST804971052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.115482092 CEST804971052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.115509987 CEST4971280192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.115545988 CEST4971080192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.125526905 CEST4971080192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.126446009 CEST4971280192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.249984026 CEST804972334.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.250540972 CEST804972434.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.250715971 CEST4972480192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.250802040 CEST4972380192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.251100063 CEST4972480192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.251754999 CEST4972380192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.256618977 CEST804972234.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.259840965 CEST4972280192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.260488987 CEST4972280192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.280980110 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.280994892 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.281764984 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.285876036 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.302387953 CEST804972734.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.302476883 CEST4972780192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.303020954 CEST804972152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.303030014 CEST804972152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.303086996 CEST4972180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.303118944 CEST804972052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.303145885 CEST804972052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.303208113 CEST4972080192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.303374052 CEST4972780192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.304137945 CEST804972534.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.304199934 CEST4972580192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.305639982 CEST804972634.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.305866957 CEST4972580192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.306035042 CEST4972680192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.306035042 CEST4972680192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.317075968 CEST4972180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.319161892 CEST4972080192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.337270021 CEST804971952.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.337281942 CEST804971952.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.337358952 CEST4971980192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.339802980 CEST804971252.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.339814901 CEST804971252.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.339867115 CEST804971052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.339874983 CEST804971052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.339881897 CEST4971280192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.339907885 CEST4971080192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.343219995 CEST4971980192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.350822926 CEST4971280192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.352628946 CEST4971080192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.460788965 CEST804972434.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.460922003 CEST804972334.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.463344097 CEST804972434.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.463355064 CEST804972434.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.463370085 CEST804972434.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.463430882 CEST4972480192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.464545012 CEST4972480192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.464659929 CEST804972334.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.464689016 CEST804972334.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.464948893 CEST4972380192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.465764999 CEST4972380192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.476783991 CEST804972234.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.480773926 CEST804972234.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.480890989 CEST804972234.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.480956078 CEST4972280192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.482038975 CEST4972280192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.499386072 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.499404907 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.499592066 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.501718998 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.514905930 CEST804972734.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.518672943 CEST804972734.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.518697977 CEST804972734.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.518804073 CEST4972780192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.519793987 CEST4972780192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.522512913 CEST804972634.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.522967100 CEST804972534.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.525895119 CEST804972634.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.525913000 CEST804972634.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.525955915 CEST4972680192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.526947021 CEST4972680192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.527081966 CEST804972534.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.527116060 CEST804972534.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.527163029 CEST4972580192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.528114080 CEST4972580192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.535770893 CEST804972152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.535809994 CEST804972152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.536010027 CEST4972180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.537410975 CEST4972180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.538877010 CEST804972052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.538911104 CEST804972052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.538959026 CEST4972080192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.539963961 CEST4972080192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.564753056 CEST804971952.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.564851999 CEST804971952.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.564898014 CEST4971980192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.565304041 CEST804971252.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.565340042 CEST804971252.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.565378904 CEST4971280192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.565474987 CEST804971052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.565512896 CEST804971052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.565573931 CEST4971080192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.568753004 CEST4971980192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.569796085 CEST4971080192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.570460081 CEST4971280192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.678195000 CEST804972434.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.678271055 CEST804972434.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.678328991 CEST4972480192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.678999901 CEST804972334.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.679034948 CEST804972334.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.679105043 CEST4972380192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.680143118 CEST4972480192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.681327105 CEST4972380192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.702471972 CEST804972234.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.702505112 CEST804972234.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.702564955 CEST4972280192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.703727961 CEST4972280192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.716945887 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.716973066 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.717014074 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.737785101 CEST804972734.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.737827063 CEST804972734.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.737874985 CEST4972780192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.746882915 CEST804972634.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.746947050 CEST804972634.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.746994972 CEST4972680192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.748594046 CEST804972534.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.748629093 CEST804972534.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.748680115 CEST4972580192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.755650997 CEST804972152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.755686045 CEST804972152.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.755738020 CEST4972180192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.759367943 CEST804972052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.759402990 CEST804972052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.759466887 CEST4972080192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.783153057 CEST804971052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.783204079 CEST804971052.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.783256054 CEST4971080192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.783720016 CEST804971252.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.783755064 CEST804971252.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.783813953 CEST4971280192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.786421061 CEST4434970323.1.237.91192.168.2.5
                        Apr 25, 2024 14:24:47.786511898 CEST49703443192.168.2.523.1.237.91
                        Apr 25, 2024 14:24:47.790050030 CEST804971952.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.790086031 CEST804971952.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:47.790160894 CEST4971980192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.893719912 CEST804972434.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.893805981 CEST804972434.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.893873930 CEST4972480192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.894252062 CEST804972334.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.894332886 CEST804972334.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.894373894 CEST4972380192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:47.900392056 CEST4971980192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:47.923515081 CEST804972234.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.923542976 CEST804972234.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:47.923608065 CEST4972280192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:48.137176991 CEST804971952.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:48.137228012 CEST804971952.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:48.137310982 CEST4971980192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:48.204241037 CEST4972280192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:48.205945969 CEST4972380192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:48.207701921 CEST4972480192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:48.210166931 CEST4972580192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:48.211364031 CEST4972680192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:48.213187933 CEST4972780192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:48.301035881 CEST49730443192.168.2.523.54.200.130
                        Apr 25, 2024 14:24:48.301086903 CEST4434973023.54.200.130192.168.2.5
                        Apr 25, 2024 14:24:48.301198959 CEST49730443192.168.2.523.54.200.130
                        Apr 25, 2024 14:24:48.339956045 CEST49730443192.168.2.523.54.200.130
                        Apr 25, 2024 14:24:48.339971066 CEST4434973023.54.200.130192.168.2.5
                        Apr 25, 2024 14:24:48.418524027 CEST804972334.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:48.418577909 CEST804972334.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:48.419027090 CEST4972380192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:48.420972109 CEST804972434.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:48.421009064 CEST804972434.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:48.421082973 CEST4972480192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:48.423912048 CEST804972234.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:48.423949003 CEST804972234.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:48.424043894 CEST4972280192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:48.427778006 CEST804972734.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:48.427814007 CEST804972734.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:48.427874088 CEST4972780192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:48.430217981 CEST804972634.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:48.430258989 CEST804972634.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:48.430319071 CEST4972680192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:48.431155920 CEST804972534.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:48.431196928 CEST804972534.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:48.431272030 CEST4972580192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:48.447988033 CEST4972480192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:48.448813915 CEST4972380192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:48.449495077 CEST4972680192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:48.450519085 CEST4972780192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:48.451258898 CEST4972280192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:48.452094078 CEST4972580192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:48.568202019 CEST4434973023.54.200.130192.168.2.5
                        Apr 25, 2024 14:24:48.568301916 CEST49730443192.168.2.523.54.200.130
                        Apr 25, 2024 14:24:48.572299957 CEST49730443192.168.2.523.54.200.130
                        Apr 25, 2024 14:24:48.572309017 CEST4434973023.54.200.130192.168.2.5
                        Apr 25, 2024 14:24:48.572613001 CEST4434973023.54.200.130192.168.2.5
                        Apr 25, 2024 14:24:48.614644051 CEST49730443192.168.2.523.54.200.130
                        Apr 25, 2024 14:24:48.655575037 CEST49730443192.168.2.523.54.200.130
                        Apr 25, 2024 14:24:48.661706924 CEST804972434.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:48.661756039 CEST804972434.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:48.661781073 CEST804972334.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:48.661798000 CEST804972334.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:48.661837101 CEST4972480192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:48.661870003 CEST4972380192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:48.665610075 CEST804972734.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:48.665628910 CEST804972734.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:48.665692091 CEST4972780192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:48.668786049 CEST804972634.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:48.668884993 CEST804972634.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:48.669416904 CEST4972680192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:48.670427084 CEST804972234.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:48.670463085 CEST804972234.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:48.670561075 CEST4972280192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:48.672125101 CEST804972534.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:48.672146082 CEST804972534.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:48.672233105 CEST4972580192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:48.696142912 CEST4434973023.54.200.130192.168.2.5
                        Apr 25, 2024 14:24:48.796830893 CEST4434973023.54.200.130192.168.2.5
                        Apr 25, 2024 14:24:48.796994925 CEST4434973023.54.200.130192.168.2.5
                        Apr 25, 2024 14:24:48.797158003 CEST49730443192.168.2.523.54.200.130
                        Apr 25, 2024 14:24:48.841500044 CEST49730443192.168.2.523.54.200.130
                        Apr 25, 2024 14:24:48.841520071 CEST4434973023.54.200.130192.168.2.5
                        Apr 25, 2024 14:24:48.885409117 CEST4971749153192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:48.974982023 CEST4971849153192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:48.982300043 CEST49734443192.168.2.523.54.200.130
                        Apr 25, 2024 14:24:48.982398987 CEST4434973423.54.200.130192.168.2.5
                        Apr 25, 2024 14:24:48.982599974 CEST49734443192.168.2.523.54.200.130
                        Apr 25, 2024 14:24:48.982964993 CEST49734443192.168.2.523.54.200.130
                        Apr 25, 2024 14:24:48.982996941 CEST4434973423.54.200.130192.168.2.5
                        Apr 25, 2024 14:24:49.206327915 CEST4434973423.54.200.130192.168.2.5
                        Apr 25, 2024 14:24:49.206424952 CEST49734443192.168.2.523.54.200.130
                        Apr 25, 2024 14:24:49.207863092 CEST49734443192.168.2.523.54.200.130
                        Apr 25, 2024 14:24:49.207891941 CEST4434973423.54.200.130192.168.2.5
                        Apr 25, 2024 14:24:49.208168983 CEST4434973423.54.200.130192.168.2.5
                        Apr 25, 2024 14:24:49.209412098 CEST49734443192.168.2.523.54.200.130
                        Apr 25, 2024 14:24:49.256109953 CEST4434973423.54.200.130192.168.2.5
                        Apr 25, 2024 14:24:49.426378012 CEST4434973423.54.200.130192.168.2.5
                        Apr 25, 2024 14:24:49.426487923 CEST4434973423.54.200.130192.168.2.5
                        Apr 25, 2024 14:24:49.426589966 CEST49734443192.168.2.523.54.200.130
                        Apr 25, 2024 14:24:49.427299976 CEST49734443192.168.2.523.54.200.130
                        Apr 25, 2024 14:24:49.427345037 CEST4434973423.54.200.130192.168.2.5
                        Apr 25, 2024 14:24:49.427373886 CEST49734443192.168.2.523.54.200.130
                        Apr 25, 2024 14:24:49.427390099 CEST4434973423.54.200.130192.168.2.5
                        Apr 25, 2024 14:24:50.472667933 CEST4971980192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:50.691225052 CEST804971952.213.98.16192.168.2.5
                        Apr 25, 2024 14:24:50.743390083 CEST4971980192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:51.119404078 CEST4972580192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:51.337960958 CEST804972534.248.78.201192.168.2.5
                        Apr 25, 2024 14:24:51.383122921 CEST4972580192.168.2.534.248.78.201
                        Apr 25, 2024 14:24:52.898749113 CEST4971749153192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:52.976907015 CEST4971849153192.168.2.552.213.98.16
                        Apr 25, 2024 14:24:55.615271091 CEST44349713142.250.9.104192.168.2.5
                        Apr 25, 2024 14:24:55.615444899 CEST44349713142.250.9.104192.168.2.5
                        Apr 25, 2024 14:24:55.615504026 CEST49713443192.168.2.5142.250.9.104
                        Apr 25, 2024 14:24:55.632000923 CEST49713443192.168.2.5142.250.9.104
                        Apr 25, 2024 14:24:55.632013083 CEST44349713142.250.9.104192.168.2.5
                        Apr 25, 2024 14:24:58.256201982 CEST49703443192.168.2.523.1.237.91
                        Apr 25, 2024 14:24:58.256609917 CEST49703443192.168.2.523.1.237.91
                        Apr 25, 2024 14:24:58.256926060 CEST49740443192.168.2.523.1.237.91
                        Apr 25, 2024 14:24:58.256973982 CEST4434974023.1.237.91192.168.2.5
                        Apr 25, 2024 14:24:58.257076025 CEST49740443192.168.2.523.1.237.91
                        Apr 25, 2024 14:24:58.257281065 CEST49740443192.168.2.523.1.237.91
                        Apr 25, 2024 14:24:58.257292032 CEST4434974023.1.237.91192.168.2.5
                        Apr 25, 2024 14:24:58.413889885 CEST4434970323.1.237.91192.168.2.5
                        Apr 25, 2024 14:24:58.414252996 CEST4434970323.1.237.91192.168.2.5
                        Apr 25, 2024 14:24:58.588830948 CEST4434974023.1.237.91192.168.2.5
                        Apr 25, 2024 14:24:58.588941097 CEST49740443192.168.2.523.1.237.91
                        Apr 25, 2024 14:24:58.698095083 CEST49740443192.168.2.523.1.237.91
                        Apr 25, 2024 14:24:58.698117018 CEST4434974023.1.237.91192.168.2.5
                        Apr 25, 2024 14:24:58.698641062 CEST4434974023.1.237.91192.168.2.5
                        Apr 25, 2024 14:24:58.698765039 CEST49740443192.168.2.523.1.237.91
                        Apr 25, 2024 14:24:58.701579094 CEST49740443192.168.2.523.1.237.91
                        Apr 25, 2024 14:24:58.701616049 CEST4434974023.1.237.91192.168.2.5
                        Apr 25, 2024 14:24:58.703083038 CEST49740443192.168.2.523.1.237.91
                        Apr 25, 2024 14:24:58.703092098 CEST4434974023.1.237.91192.168.2.5
                        Apr 25, 2024 14:24:58.968664885 CEST4434974023.1.237.91192.168.2.5
                        Apr 25, 2024 14:24:58.968817949 CEST49740443192.168.2.523.1.237.91
                        Apr 25, 2024 14:24:58.969223976 CEST4434974023.1.237.91192.168.2.5
                        Apr 25, 2024 14:24:58.969278097 CEST49740443192.168.2.523.1.237.91
                        Apr 25, 2024 14:24:58.969341040 CEST4434974023.1.237.91192.168.2.5
                        Apr 25, 2024 14:24:58.969491959 CEST49740443192.168.2.523.1.237.91
                        Apr 25, 2024 14:24:58.970014095 CEST49740443192.168.2.523.1.237.91
                        Apr 25, 2024 14:24:58.970027924 CEST4434974023.1.237.91192.168.2.5
                        Apr 25, 2024 14:24:58.970057964 CEST49740443192.168.2.523.1.237.91
                        Apr 25, 2024 14:24:58.970093012 CEST49740443192.168.2.523.1.237.91
                        Apr 25, 2024 14:25:00.912633896 CEST4971749153192.168.2.552.213.98.16
                        Apr 25, 2024 14:25:00.990637064 CEST4971849153192.168.2.552.213.98.16
                        Apr 25, 2024 14:25:06.927599907 CEST4974249153192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:07.008531094 CEST4974349153192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:07.926806927 CEST4974249153192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:08.004940033 CEST4974349153192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:09.926800966 CEST4974249153192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:10.020550013 CEST4974349153192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:13.942468882 CEST4974249153192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:14.020963907 CEST4974349153192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:21.942739010 CEST4974249153192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:22.036494970 CEST4974349153192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:32.724119902 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:25:32.755362034 CEST4972180192.168.2.552.213.98.16
                        Apr 25, 2024 14:25:32.770955086 CEST4972080192.168.2.552.213.98.16
                        Apr 25, 2024 14:25:32.786693096 CEST4971080192.168.2.552.213.98.16
                        Apr 25, 2024 14:25:32.786710978 CEST4971280192.168.2.552.213.98.16
                        Apr 25, 2024 14:25:32.933466911 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:25:32.970161915 CEST804972152.213.98.16192.168.2.5
                        Apr 25, 2024 14:25:32.986545086 CEST804972052.213.98.16192.168.2.5
                        Apr 25, 2024 14:25:32.995639086 CEST804971052.213.98.16192.168.2.5
                        Apr 25, 2024 14:25:32.996459961 CEST804971252.213.98.16192.168.2.5
                        Apr 25, 2024 14:25:33.677232027 CEST4972380192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:33.677233934 CEST4972480192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:33.677243948 CEST4972780192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:33.677258968 CEST4972680192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:33.677303076 CEST4972280192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:33.886754036 CEST804972334.248.78.201192.168.2.5
                        Apr 25, 2024 14:25:33.887092113 CEST804972434.248.78.201192.168.2.5
                        Apr 25, 2024 14:25:33.889002085 CEST804972734.248.78.201192.168.2.5
                        Apr 25, 2024 14:25:33.893812895 CEST804972234.248.78.201192.168.2.5
                        Apr 25, 2024 14:25:33.893846989 CEST804972634.248.78.201192.168.2.5
                        Apr 25, 2024 14:25:35.692861080 CEST4971980192.168.2.552.213.98.16
                        Apr 25, 2024 14:25:35.911789894 CEST804971952.213.98.16192.168.2.5
                        Apr 25, 2024 14:25:36.349184036 CEST4972580192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:36.569365025 CEST804972534.248.78.201192.168.2.5
                        Apr 25, 2024 14:25:45.289609909 CEST49746443192.168.2.5142.250.9.104
                        Apr 25, 2024 14:25:45.289702892 CEST44349746142.250.9.104192.168.2.5
                        Apr 25, 2024 14:25:45.289814949 CEST49746443192.168.2.5142.250.9.104
                        Apr 25, 2024 14:25:45.290021896 CEST49746443192.168.2.5142.250.9.104
                        Apr 25, 2024 14:25:45.290045977 CEST44349746142.250.9.104192.168.2.5
                        Apr 25, 2024 14:25:45.544780016 CEST44349746142.250.9.104192.168.2.5
                        Apr 25, 2024 14:25:45.545110941 CEST49746443192.168.2.5142.250.9.104
                        Apr 25, 2024 14:25:45.545135021 CEST44349746142.250.9.104192.168.2.5
                        Apr 25, 2024 14:25:45.545404911 CEST44349746142.250.9.104192.168.2.5
                        Apr 25, 2024 14:25:45.545892000 CEST49746443192.168.2.5142.250.9.104
                        Apr 25, 2024 14:25:45.545933962 CEST44349746142.250.9.104192.168.2.5
                        Apr 25, 2024 14:25:45.599097013 CEST49746443192.168.2.5142.250.9.104
                        Apr 25, 2024 14:25:47.722198963 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:25:47.722274065 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:25:47.754224062 CEST804972052.213.98.16192.168.2.5
                        Apr 25, 2024 14:25:47.754276037 CEST804972152.213.98.16192.168.2.5
                        Apr 25, 2024 14:25:47.754307032 CEST4972080192.168.2.552.213.98.16
                        Apr 25, 2024 14:25:47.754336119 CEST4972180192.168.2.552.213.98.16
                        Apr 25, 2024 14:25:47.778289080 CEST804971052.213.98.16192.168.2.5
                        Apr 25, 2024 14:25:47.778362989 CEST4971080192.168.2.552.213.98.16
                        Apr 25, 2024 14:25:47.782172918 CEST804971252.213.98.16192.168.2.5
                        Apr 25, 2024 14:25:47.782228947 CEST4971280192.168.2.552.213.98.16
                        Apr 25, 2024 14:25:47.933284044 CEST4971180192.168.2.552.213.98.16
                        Apr 25, 2024 14:25:47.933347940 CEST4972180192.168.2.552.213.98.16
                        Apr 25, 2024 14:25:47.933384895 CEST4972080192.168.2.552.213.98.16
                        Apr 25, 2024 14:25:47.933425903 CEST4971080192.168.2.552.213.98.16
                        Apr 25, 2024 14:25:47.933430910 CEST4971280192.168.2.552.213.98.16
                        Apr 25, 2024 14:25:48.142404079 CEST804971052.213.98.16192.168.2.5
                        Apr 25, 2024 14:25:48.142497063 CEST804971152.213.98.16192.168.2.5
                        Apr 25, 2024 14:25:48.143126965 CEST804971252.213.98.16192.168.2.5
                        Apr 25, 2024 14:25:48.147578001 CEST804972152.213.98.16192.168.2.5
                        Apr 25, 2024 14:25:48.148838997 CEST804972052.213.98.16192.168.2.5
                        Apr 25, 2024 14:25:48.661514997 CEST804972434.248.78.201192.168.2.5
                        Apr 25, 2024 14:25:48.661537886 CEST804972334.248.78.201192.168.2.5
                        Apr 25, 2024 14:25:48.661631107 CEST4972480192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:48.661664963 CEST4972380192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:48.663307905 CEST804972734.248.78.201192.168.2.5
                        Apr 25, 2024 14:25:48.663413048 CEST4972780192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:48.669161081 CEST804972634.248.78.201192.168.2.5
                        Apr 25, 2024 14:25:48.669243097 CEST4972680192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:48.669321060 CEST804972234.248.78.201192.168.2.5
                        Apr 25, 2024 14:25:48.669426918 CEST4972280192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:49.643438101 CEST4972380192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:49.643583059 CEST4972480192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:49.643642902 CEST4972780192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:49.643683910 CEST4972680192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:49.643759966 CEST4972280192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:49.852773905 CEST804972334.248.78.201192.168.2.5
                        Apr 25, 2024 14:25:49.853132963 CEST804972434.248.78.201192.168.2.5
                        Apr 25, 2024 14:25:49.855191946 CEST804972734.248.78.201192.168.2.5
                        Apr 25, 2024 14:25:49.859913111 CEST804972234.248.78.201192.168.2.5
                        Apr 25, 2024 14:25:49.860109091 CEST804972634.248.78.201192.168.2.5
                        Apr 25, 2024 14:25:50.690207005 CEST804971952.213.98.16192.168.2.5
                        Apr 25, 2024 14:25:50.690316916 CEST4971980192.168.2.552.213.98.16
                        Apr 25, 2024 14:25:51.339592934 CEST804972534.248.78.201192.168.2.5
                        Apr 25, 2024 14:25:51.339695930 CEST4972580192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:51.632447004 CEST4972580192.168.2.534.248.78.201
                        Apr 25, 2024 14:25:51.632488012 CEST4971980192.168.2.552.213.98.16
                        Apr 25, 2024 14:25:51.849762917 CEST804972534.248.78.201192.168.2.5
                        Apr 25, 2024 14:25:51.849812984 CEST804971952.213.98.16192.168.2.5
                        Apr 25, 2024 14:25:55.558399916 CEST44349746142.250.9.104192.168.2.5
                        Apr 25, 2024 14:25:55.558479071 CEST44349746142.250.9.104192.168.2.5
                        Apr 25, 2024 14:25:55.558603048 CEST49746443192.168.2.5142.250.9.104
                        Apr 25, 2024 14:25:55.634306908 CEST49746443192.168.2.5142.250.9.104
                        Apr 25, 2024 14:25:55.634350061 CEST44349746142.250.9.104192.168.2.5

                        UDP Packets

                        TimestampSource PortDest PortSource IPDest IP
                        Apr 25, 2024 14:24:43.556452036 CEST53565451.1.1.1192.168.2.5
                        Apr 25, 2024 14:24:43.560893059 CEST53610321.1.1.1192.168.2.5
                        Apr 25, 2024 14:24:44.188577890 CEST53600371.1.1.1192.168.2.5
                        Apr 25, 2024 14:24:45.018234968 CEST6245253192.168.2.51.1.1.1
                        Apr 25, 2024 14:24:45.018377066 CEST6362953192.168.2.51.1.1.1
                        Apr 25, 2024 14:24:45.188535929 CEST53624521.1.1.1192.168.2.5
                        Apr 25, 2024 14:24:45.188545942 CEST53636291.1.1.1192.168.2.5
                        Apr 25, 2024 14:24:45.226833105 CEST6268253192.168.2.51.1.1.1
                        Apr 25, 2024 14:24:45.226964951 CEST5478153192.168.2.51.1.1.1
                        Apr 25, 2024 14:24:45.336803913 CEST53626821.1.1.1192.168.2.5
                        Apr 25, 2024 14:24:45.337100983 CEST53547811.1.1.1192.168.2.5
                        Apr 25, 2024 14:24:45.697359085 CEST4982853192.168.2.51.1.1.1
                        Apr 25, 2024 14:24:45.697525978 CEST5442053192.168.2.51.1.1.1
                        Apr 25, 2024 14:24:45.698029041 CEST6485953192.168.2.51.1.1.1
                        Apr 25, 2024 14:24:45.698167086 CEST5379853192.168.2.51.1.1.1
                        Apr 25, 2024 14:24:45.810050011 CEST53648591.1.1.1192.168.2.5
                        Apr 25, 2024 14:24:45.811722994 CEST53537981.1.1.1192.168.2.5
                        Apr 25, 2024 14:24:45.862651110 CEST53498281.1.1.1192.168.2.5
                        Apr 25, 2024 14:24:45.870951891 CEST53544201.1.1.1192.168.2.5
                        Apr 25, 2024 14:24:46.906758070 CEST5589853192.168.2.51.1.1.1
                        Apr 25, 2024 14:24:46.907041073 CEST5489953192.168.2.51.1.1.1
                        Apr 25, 2024 14:24:47.034991026 CEST53548991.1.1.1192.168.2.5
                        Apr 25, 2024 14:24:47.038774014 CEST53558981.1.1.1192.168.2.5
                        Apr 25, 2024 14:24:48.169972897 CEST137137192.168.2.5192.168.2.255
                        Apr 25, 2024 14:24:48.930157900 CEST137137192.168.2.5192.168.2.255
                        Apr 25, 2024 14:24:49.694075108 CEST137137192.168.2.5192.168.2.255
                        Apr 25, 2024 14:25:01.404175997 CEST53653811.1.1.1192.168.2.5
                        Apr 25, 2024 14:25:20.711313963 CEST53627271.1.1.1192.168.2.5
                        Apr 25, 2024 14:25:41.078290939 CEST53624641.1.1.1192.168.2.5
                        Apr 25, 2024 14:25:43.712677002 CEST53527951.1.1.1192.168.2.5
                        Apr 25, 2024 14:26:08.899230957 CEST53651131.1.1.1192.168.2.5

                        DNS Queries

                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                        Apr 25, 2024 14:24:45.018234968 CEST192.168.2.51.1.1.10xc31Standard query (0)www.corp-internal.coA (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:45.018377066 CEST192.168.2.51.1.1.10x4df3Standard query (0)www.corp-internal.co65IN (0x0001)false
                        Apr 25, 2024 14:24:45.226833105 CEST192.168.2.51.1.1.10xc632Standard query (0)www.google.comA (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:45.226964951 CEST192.168.2.51.1.1.10x48f2Standard query (0)www.google.com65IN (0x0001)false
                        Apr 25, 2024 14:24:45.697359085 CEST192.168.2.51.1.1.10xfc7eStandard query (0)www.corp-internal.coA (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:45.697525978 CEST192.168.2.51.1.1.10x593dStandard query (0)_49153._https.www.corp-internal.co65IN (0x0001)false
                        Apr 25, 2024 14:24:45.698029041 CEST192.168.2.51.1.1.10x15eaStandard query (0)tslp.s3.amazonaws.comA (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:45.698167086 CEST192.168.2.51.1.1.10x2465Standard query (0)tslp.s3.amazonaws.com65IN (0x0001)false
                        Apr 25, 2024 14:24:46.906758070 CEST192.168.2.51.1.1.10xfe46Standard query (0)www.corp-internal.coA (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:46.907041073 CEST192.168.2.51.1.1.10x81deStandard query (0)www.corp-internal.co65IN (0x0001)false

                        DNS Answers

                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                        Apr 25, 2024 14:24:45.188535929 CEST1.1.1.1192.168.2.50xc31No error (0)www.corp-internal.coprod-lp-alb-323408969.eu-west-1.elb.amazonaws.comCNAME (Canonical name)IN (0x0001)false
                        Apr 25, 2024 14:24:45.188535929 CEST1.1.1.1192.168.2.50xc31No error (0)prod-lp-alb-323408969.eu-west-1.elb.amazonaws.com52.213.98.16A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:45.188535929 CEST1.1.1.1192.168.2.50xc31No error (0)prod-lp-alb-323408969.eu-west-1.elb.amazonaws.com34.248.78.201A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:45.188545942 CEST1.1.1.1192.168.2.50x4df3No error (0)www.corp-internal.coprod-lp-alb-323408969.eu-west-1.elb.amazonaws.comCNAME (Canonical name)IN (0x0001)false
                        Apr 25, 2024 14:24:45.336803913 CEST1.1.1.1192.168.2.50xc632No error (0)www.google.com142.250.9.104A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:45.336803913 CEST1.1.1.1192.168.2.50xc632No error (0)www.google.com142.250.9.103A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:45.336803913 CEST1.1.1.1192.168.2.50xc632No error (0)www.google.com142.250.9.99A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:45.336803913 CEST1.1.1.1192.168.2.50xc632No error (0)www.google.com142.250.9.147A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:45.336803913 CEST1.1.1.1192.168.2.50xc632No error (0)www.google.com142.250.9.106A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:45.336803913 CEST1.1.1.1192.168.2.50xc632No error (0)www.google.com142.250.9.105A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:45.337100983 CEST1.1.1.1192.168.2.50x48f2No error (0)www.google.com65IN (0x0001)false
                        Apr 25, 2024 14:24:45.810050011 CEST1.1.1.1192.168.2.50x15eaNo error (0)tslp.s3.amazonaws.coms3-1-w.amazonaws.comCNAME (Canonical name)IN (0x0001)false
                        Apr 25, 2024 14:24:45.810050011 CEST1.1.1.1192.168.2.50x15eaNo error (0)s3-1-w.amazonaws.coms3-w.us-east-1.amazonaws.comCNAME (Canonical name)IN (0x0001)false
                        Apr 25, 2024 14:24:45.810050011 CEST1.1.1.1192.168.2.50x15eaNo error (0)s3-w.us-east-1.amazonaws.com52.216.26.156A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:45.810050011 CEST1.1.1.1192.168.2.50x15eaNo error (0)s3-w.us-east-1.amazonaws.com3.5.28.205A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:45.810050011 CEST1.1.1.1192.168.2.50x15eaNo error (0)s3-w.us-east-1.amazonaws.com52.216.105.91A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:45.810050011 CEST1.1.1.1192.168.2.50x15eaNo error (0)s3-w.us-east-1.amazonaws.com52.217.121.177A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:45.810050011 CEST1.1.1.1192.168.2.50x15eaNo error (0)s3-w.us-east-1.amazonaws.com3.5.25.223A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:45.810050011 CEST1.1.1.1192.168.2.50x15eaNo error (0)s3-w.us-east-1.amazonaws.com52.217.116.81A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:45.810050011 CEST1.1.1.1192.168.2.50x15eaNo error (0)s3-w.us-east-1.amazonaws.com52.217.170.185A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:45.810050011 CEST1.1.1.1192.168.2.50x15eaNo error (0)s3-w.us-east-1.amazonaws.com3.5.8.146A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:45.811722994 CEST1.1.1.1192.168.2.50x2465No error (0)tslp.s3.amazonaws.coms3-1-w.amazonaws.comCNAME (Canonical name)IN (0x0001)false
                        Apr 25, 2024 14:24:45.811722994 CEST1.1.1.1192.168.2.50x2465No error (0)s3-1-w.amazonaws.coms3-w.us-east-1.amazonaws.comCNAME (Canonical name)IN (0x0001)false
                        Apr 25, 2024 14:24:45.862651110 CEST1.1.1.1192.168.2.50xfc7eNo error (0)www.corp-internal.coprod-lp-alb-323408969.eu-west-1.elb.amazonaws.comCNAME (Canonical name)IN (0x0001)false
                        Apr 25, 2024 14:24:45.862651110 CEST1.1.1.1192.168.2.50xfc7eNo error (0)prod-lp-alb-323408969.eu-west-1.elb.amazonaws.com52.213.98.16A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:45.862651110 CEST1.1.1.1192.168.2.50xfc7eNo error (0)prod-lp-alb-323408969.eu-west-1.elb.amazonaws.com34.248.78.201A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:45.870951891 CEST1.1.1.1192.168.2.50x593dNo error (0)_49153._https.www.corp-internal.coprod-lp-alb-323408969.eu-west-1.elb.amazonaws.comCNAME (Canonical name)IN (0x0001)false
                        Apr 25, 2024 14:24:47.034991026 CEST1.1.1.1192.168.2.50x81deNo error (0)www.corp-internal.coprod-lp-alb-323408969.eu-west-1.elb.amazonaws.comCNAME (Canonical name)IN (0x0001)false
                        Apr 25, 2024 14:24:47.038774014 CEST1.1.1.1192.168.2.50xfe46No error (0)www.corp-internal.coprod-lp-alb-323408969.eu-west-1.elb.amazonaws.comCNAME (Canonical name)IN (0x0001)false
                        Apr 25, 2024 14:24:47.038774014 CEST1.1.1.1192.168.2.50xfe46No error (0)prod-lp-alb-323408969.eu-west-1.elb.amazonaws.com34.248.78.201A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:47.038774014 CEST1.1.1.1192.168.2.50xfe46No error (0)prod-lp-alb-323408969.eu-west-1.elb.amazonaws.com52.213.98.16A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:57.376024008 CEST1.1.1.1192.168.2.50xfc90No error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:57.376024008 CEST1.1.1.1192.168.2.50xfc90No error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:24:57.786274910 CEST1.1.1.1192.168.2.50x79d6No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                        Apr 25, 2024 14:24:57.786274910 CEST1.1.1.1192.168.2.50x79d6No error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:25:10.667182922 CEST1.1.1.1192.168.2.50x591dNo error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                        Apr 25, 2024 14:25:10.667182922 CEST1.1.1.1192.168.2.50x591dNo error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:25:35.757544041 CEST1.1.1.1192.168.2.50xc2d3No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                        Apr 25, 2024 14:25:35.757544041 CEST1.1.1.1192.168.2.50xc2d3No error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:25:54.100960970 CEST1.1.1.1192.168.2.50x5084No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                        Apr 25, 2024 14:25:54.100960970 CEST1.1.1.1192.168.2.50x5084No error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:25:58.831185102 CEST1.1.1.1192.168.2.50xd0abNo error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
                        Apr 25, 2024 14:25:58.831185102 CEST1.1.1.1192.168.2.50xd0abNo error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false

                        HTTP Request Dependency Graph

                        • www.corp-internal.co
                          • tslp.s3.amazonaws.com
                        • fs.microsoft.com
                        • https:
                          • www.bing.com

                        HTTP Packets

                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                        0192.168.2.54971152.213.98.16802000C:\Program Files\Google\Chrome\Application\chrome.exe
                        TimestampBytes transferredDirectionData
                        Apr 25, 2024 14:24:45.400207043 CEST455OUTGET /ae90cbd9826866b7?l=8 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        Upgrade-Insecure-Requests: 1
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Apr 25, 2024 14:24:45.628371954 CEST1289INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:45 GMT
                        Content-Type: text/html; charset=utf-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        ETag: W/"5986c89c73680ecac5f4f5a37905020f"
                        Cache-Control: max-age=0, private, must-revalidate
                        Set-Cookie: EXFILGUID=90cbd26866; path=/
                        Set-Cookie: link_clicked_90cbd26866=1; path=/
                        X-Request-Id: 9ab29dd2-90b3-4f29-b3ab-1286623c2f5e
                        X-Runtime: 0.016716
                        X-Host-Info: lw-prod-eu-i-0630ecaca960f15d1
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 33 32 39 0d 0a 1f 8b 08 00 00 00 00 00 02 03 b5 57 cb 76 9b 30 10 dd e7 2b 74 58 e4 24 a7 35 18 3b b1 eb 07 c9 26 ab ae fa 07 1c 59 1a 40 8e 40 44 12 21 6e 4f fe bd e2 e1 07 36 b8 34 71 d8 18 46 33 a3 3b 9a 3b a3 31 42 db 67 19 e9 98 3f 5c a1 83 67 19 01 a6 4d 91 11 6a a6 39 3c 2c 9d ea f7 78 35 11 8a 48 96 ea 87 65 0c 1a a3 48 eb 74 00 2f 19 7b f5 2c 09 81 04 15 59 88 88 44 43 a2 3d cb 5d 64 92 7b 0e 17 98 fa 5a 62 96 b0 24 7c 0c 33 46 3d 18 cf 86 64 45 a9 3b 9a fc 98 4c 46 d3 6b 22 a4 04 8e 35 13 89 6f d6 c7 01 26 63 1c 0c 07 d3 3b ec 0e ee 86 d3 d1 00 0f 03 77 30 9e b9 64 44 47 98 8e e8 d0 32 20 77 70 9a 81 39 a7 91 2d 57 82 6e 8e 44 fb 60 58 1c 22 25 89 67 39 06 27 01 3b 35 40 0d 8c 12 64 09 f1 3a 56 a1 f7 13 bf e2 ca e2 89 29 bc e2 40 3f 84 1b e5 8c ea c8 1c 8f 85 22 60 61 a4 cb 57 a5 37 1c 3c 8b 32 95 72 bc 99 a3 44 24 b0 38 13 e3 0e 72 91 03 35 77 9c 3c cf 6d 03 27 1d 30 73 fc 32 c1 dc 7c cd ef 66 ee fd d8 c1 5c fb 29 7b 03 ee 13 ce c8 b3 bf 8f cb 0e 59 f0 78 b9 20 9c e3 44 b4 9c 7a 15 0d d2 9b d4 84 ab e1 4d 3b eb dd b9 5a cd 90 b4 e2 a9 ad c6 36 8e f1 6f 91 e0 5c 99 90 62 87 82 06 a2 9d 94 67 21 4b fc ea cb 5e ab 8a 59 07 29 fb 20 a7 b6 a7 7d 1e e8 43 ce 12 2a 72 9b 0a 3f 11 ba 46 e1 17 0a c8 43 5a 66 b0 f8 9c a7 80 63 15 5d c6 55 4a 83 cb 38 32 75 4e 9e 35 8b e1 32 ee 24 60 5e 70 1d e4 65 fc 29 c6 5f 41 f2 82 8c 97 71 98 c7 e9 a9 23 d4 f9 2c
                        Data Ascii: 329Wv0+tX$5;&Y@@D!nO64qF3;;1Bg?\gMj9<,x5HeHt/{,YDC=]d{Zb$|3F=dE;LFk"5o&c;w0dDG2 wp9-WnD`X"%g9';5@d:V)@?"`aW7<2rD$8r5w<m'0s2|f\){Yx DzM;Z6o\bg!K^Y) }C*r?FCZfc]UJ82uN52$`^pe)_Aq#,
                        Apr 25, 2024 14:24:45.628424883 CEST358INData Raw: bb 55 34 96 21 e8 39 fa d3 6a 5e 10 77 8e ac 3d 75 ad ef ad 7a 04 c7 29 66 61 e2 d7 06 30 9e 8e 27 f7 10 60 b7 c3 40 83 d2 7e 2c 28 18 e5 00 73 05 1d 7a 12 28 93 45 c4 a6 5f 1b d5 2f eb d8 ed bb 8b 4c 2b 46 c1 af 72 30 47 25 d2 76 d5 22 65 75 76
                        Data Ascii: U4!9j^w=uz)fa0'`@~,(sz(E_/L+Fr0G%v"euvgUbGT|"+ViIn[og+_2g[1Kq{Tn_,/BUP/!jW{s)iWMT
                        Apr 25, 2024 14:24:45.628460884 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:45.698576927 CEST432OUTGET /assets/ajax/libs/jquery/1.9.1/jquery.min.js HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:45.913650990 CEST1289INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:45 GMT
                        Content-Type: application/javascript
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Last-Modified: Thu, 11 Apr 2024 12:55:27 GMT
                        Vary: Accept-Encoding
                        Server: ThreatSim-Web-Server
                        Expires: Thu, 31 Dec 2037 23:55:55 GMT
                        Cache-Control: max-age=315360000
                        Cache-Control: public
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 37 65 36 63 0d 0a 1f 8b 08 00 00 00 00 00 02 03 cc bd 7b 7b db c6 b5 37 fa ff fe 14 22 ea ad 00 e6 88 a2 9c a4 6f 0b 05 e2 76 ec b8 71 9b 5b 63 67 27 2d 45 e7 81 48 50 42 4c 02 0c 00 da 52 44 f6 b3 9f f5 5b 6b 66 30 b8 50 71 f7 7e cf 73 4e 5a 8b b8 0c e6 ba 66 cd ba af d3 c7 83 a3 5f fe be 4d 8a bb a3 77 67 a3 3f 8f ce 8e 76 47 fe 3c 38 7a 32 1e 7f aa e8 ef d9 13 f3 fa 45 be cd 16 71 95 e6 99 3a 7a 99 cd 47 54 f0 97 5f f1 66 94 17 d7 a7 ab 74 9e 64 65 f2 1f a7 a7 ff 75 54 e6 db 62 9e 7c 1d 6f 36 69 76 fd c3 f7 5f 45 ba dc 3a cd 46 eb 78 f3 1f 8f 4f fd e5 36 9b a3 2a 3f 51 55 70 ff 2e 2e 8e 32 55 a8 34 aa ee 36 49 be 3c aa 54 1e 25 a3 45 3e df ae 93 ac 52 31 dd ac f2 b9 34 5e d2 8d 74 49 6d e9 f2 91 5a 45 f7 7b 35 8f a6 33 b5 89 3c 1e 83 a7 96 d1 7c 34 cf 33 fa 44 2d e8 72 b3 2d 6f d4 0d 5d 94 e8 a7 ba a6 ab 34 5b 24 b7 df 2e d5 3a 5a 8d aa fc 55 55 50 5f d5 1d dd dc c4 e5 b7 ef b3 ef 8a 7c 93 14 d5 9d 7a 17 6d 46 f4 72 ad ae a2 66 a7 8b a4 da 16 d9 51 96 bc 3f ba 1a 2d 33 aa 30 ad f0 46 15 c1 5e dd 46 a7 d3 e1 c9 6c e2 4f c2 cb c5 e3 cb d1 2e b8 5c 0c e9 66 9a 7c 31 e3 17 74 bb 0b 4e 47 32 55 ea 7d 74 7a f9 6a 78 7a ad 5e 47 a7 6f a6 97 e5 e5 f6 c5 17 2f 5e 5c de 3e 1d cf 86 bb d6 fd 23 2a f6 0d 15 a3 da fc cf a6 97 ef 2f 7f 9c 0d 2f 82 e9 9b 8b d9 e3 dd 1f 7c 7a 70 32 7b 1c 04 8f 4e d5 33 2a f4 99 7f f9 7e 18 5c 96 8f 2f 4f 27 17 f4 c5 67 97 a7 97 67 17 3b bc 7e cb 4d cd 54 78 bf bf 2c 67 8f e9 c9 17 d1 29 15 79 b3 0b 77 2a 40 c7 e9 ab 69 80 5e bd a2 ee 5d a2 f7 de e5 e5 e5 e9 d5 32 2b aa d9 6e 3b bd 5c c4 27 cb a7 27 2f 66 f7 9f ec 03 2a f6 34 3a f5 a6 6f 50 a6 b8 cc 66 8f bd 5d 55 6c 93 dd 32 5e 95 c9 2e db ae 56 bb 13 99 8f e1 c1 f9 b8 56 bf 50 af 4e d6 e5 c9 a9 7a 1e 9d 9e f8 dc c6 6f 33 7a 93 aa af fa 17 a0 a2 e5 fb 61 43 8b f5 2c 2e 13 9f e6 fe 4b a7 5c 70 ef e7 a3 78 b1 f8 e2 1d c1 d1 57 69 59 25 59 52 ec 76 de 2a 8f 17 5e 14 11 fc 00 e2 e8 c1 3c 5f 6f 56 49 95 e0 61 3e 2a 92 78 71 f7 aa 8a ab 24 38 3e f6 7f f5 03 75 25 cf fc 80 1a f8 b5 6e 20 b8 ef 56 3f f1 51 c1 3a 7f 97 34 1e fb de f3 6f bf 7e 96 67 15 9e 51 f3 c9 c2 53 5f aa c1 59 a0 92 fe e2 dc 47 29 12 84 54 e7 22 a9 e2 f9 0d 17 f2 bd 3c e3 fe 94 e8 e3 fc 26 ce ae 13 2a 8a aa 5a a5 74 25 d4 ed 73 40 69 74 35 da 14 79 95 63 d4 d1 bd ec cb 70 a3 68 ab 94 b4 58 f3 2a 2f c2 2b 05 48 0e 9d b9 a6 ad 29 7b 34 55 f1 79 ba f4 07 49 60 e6 fe 26 2d f1 c4 2b 79 ff d0 e4 e9 0d 4c 13 4f 8f d3 c8 fb 4c 66 99 ba 58 3c ad fc 31 4d a7 77 d1 78 44 3b 3b c9 ae ab 9b 93 33 7a 67 6e 2e a2 8f 27 53 80 8c a2 d6 e9 67 16 7e 33 4a 6e 93 39 2d a8 1a a4 bb dd 20 9d 9e cd 8e 8f 33 dd 8f 41 b6 db 65 23 19 cd c4 a7 9b 22 18 2d 69 83 53 f1 10 5d 1c 39 e3 f3 33 fb 0e 3d 47 45 dc d7 2c ca 8e 52
                        Data Ascii: 7e6c{{7"ovq[cg'-EHPBLRD[kf0Pq~sNZf_Mwg?vG<8z2Eq:zGT_ftdeuTb|o6iv_E:FxO6*?QUp..2U46I<T%E>R14^tImZE{53<|43D-r-o]4[$.:ZUUP_|zmFrfQ?-30F^FlO.\f|1tNG2U}tzjxz^Go/^\>#*//|zp2{N3*~\/O'gg;~MTx,g)yw*@i^]2+n;\''/f*4:oPf]Ul2^.VVPNzo3zaC,.K\pxWiY%YRv*^<_oVIa>*xq$8>u%n V?Q:4o~gQS_YG)T"<&*Zt%s@it5ycphX*/+H){4UyI`&-+yLOLfX<1MwxD;;3zgn.'Sg~3Jn9- 3Ae#"-iS]93=GE,R
                        Apr 25, 2024 14:24:45.913728952 CEST1289INData Raw: 2a 15 67 73 0c e0 6a 92 4d c7 b3 30 a3 85 5f 27 c5 75 e2 a3 1e ba d9 c4 45 99 7c f9 fa eb af f8 4b 95 51 27 46 59 be 48 5e d3 b8 27 d9 28 7f 4f 4b f7 5c e3 2d ea 54 98 ab c1 38 08 d4 b3 51 95 94 95 b4 76 7c 7c 35 4a cb ef 56 71 9a 7d 7b f5 4b 32
                        Data Ascii: *gsjM0_'uE|KQ'FYH^'(OK\-T8Qv||5JVq}{K2KzRo_GtLNFW}"{NLP|T_j,PqQo<x.Qt=$nJ%:S,N*d`M)T7|$[Eh`b
                        Apr 25, 2024 14:24:45.913764954 CEST1289INData Raw: 00 82 d9 ac e2 79 e2 bf 52 de 7f 79 81 bd 7d aa bc 99 73 fb 85 f2 3c 9c 13 f6 fc f2 74 df bc 61 16 10 d5 48 98 8d 57 d3 f7 5e 66 ef e2 55 ba 38 e2 c1 f0 6b 26 ce b8 9f 3f b9 0b 99 09 90 d0 b1 cc 8c 5e d6 b3 98 59 63 31 b1 2b 92 11 71 b6 df a1 2e
                        Data Ascii: yRy}s<taHW^fU8k&?^Yc1+q.}Tz"f3<]<.Ic|YT]6<)xt^&*r-Im^OP@i,{_W*8>+Ug$ H7
                        Apr 25, 2024 14:24:45.913821936 CEST1289INData Raw: af b8 a3 41 83 8d c4 99 5a ee 76 63 3a e1 70 ee 6d eb 85 20 94 b9 25 c8 be 88 cf 63 21 2e b6 d3 78 66 24 cc 40 2d 15 38 4c 26 f7 40 27 97 55 be f9 36 7b 01 66 04 5c 07 6d 18 a1 1c 59 68 07 e9 e1 6a b2 d2 95 1f 1f cf fd d5 a8 bc 49 97 95 0f 31 dc
                        Data Ascii: AZvc:pm %c!.xf$@-8L&@'U6{f\mYhjI1]7EZWD50vz`Vt*R[ajTYl7B7Zt%:MY9!WK>tkq.nq*\[-u_*>9F@
                        Apr 25, 2024 14:24:45.913861036 CEST1289INData Raw: 67 af 5e 9d 3d cb d7 9b b8 12 a1 c5 9c af f1 52 d1 fb 84 6a bc dd c4 c4 77 86 c4 24 65 39 37 cf e2 01 dc a7 19 2d 46 f2 39 8e 90 6f 92 64 51 7e 15 df 51 13 50 ea 97 37 c4 20 bc fd b1 88 37 fc b6 14 45 ff 2a c5 56 fc 9a 50 64 9a 7d 9f 5e df 70 25
                        Data Ascii: g^=Rjw$e97-F9odQ~QP7 7E*VPd}^p%WoSxIowy.|pF4Y[F+5R]V"<V%5dG^m-n!?j1r;zQ7ZB[p'=_f:uv`\ZK=_f5*E0]=
                        Apr 25, 2024 14:24:45.913913012 CEST1289INData Raw: 8f 64 bc b0 ae f5 79 8e a0 cc e4 e9 84 65 23 11 8c a1 95 bf 34 19 98 dd ae 1c 44 a5 b6 e6 9d 38 f5 f2 54 e9 1d bd df d7 62 75 99 7d a8 db 34 27 e8 89 29 b7 37 f4 37 43 36 c5 29 f0 78 4d a4 b5 b5 39 3a bd 7c 7e 7a cd 5c 4f 96 a3 53 e1 7d b2 be 22
                        Data Ascii: dye#4D8Tbu}4')77C6)xM9:|~z\OS}"lt>=_<O??|'~?"F6P&+8cfz}:pu!NuvY[{S?@u*le:"T{}mktj36Khk
                        Apr 25, 2024 14:24:45.914000988 CEST1289INData Raw: 1d 62 78 57 83 2c cc 1c 5e 00 76 e9 a6 de 09 18 f4 a1 f3 60 08 86 dd 52 8a 3f 29 dc 86 cc c4 df c3 e7 43 f0 02 b1 f1 ec b1 11 8c 2f 8a 9a 1d a0 8a 52 fe 9c 9a 28 86 91 5c 9f 3b 75 1b 4f be a2 d7 e6 f1 7f b2 12 2c 5e 6f 41 52 ed 8f f7 7f 67 7d 9c
                        Data Ascii: bxW,^v`R?)C/R(\;uO,^oARg}yE4&^Y7QCUgL/vMz$i$YkI@7i2+Ce8MU,2mLj1xKL6N^Nm/0fTD,l5}^[
                        Apr 25, 2024 14:24:45.914037943 CEST1289INData Raw: 47 e7 19 18 30 27 d0 42 fa d0 2c b4 11 83 a3 ad ad 84 7d e8 e0 ce 10 7d 25 c8 72 7a d9 dc f8 c0 70 6d 10 a3 cf 7e 07 d5 b1 83 2c 0e 4c 25 f5 fb ce 81 a4 71 c7 c1 85 78 70 16 7a 51 d8 04 d1 61 b9 03 8c f5 42 21 7c 2d 04 15 9a 98 eb ce 10 6f cb 07
                        Data Ascii: G0'B,}}%rzpm~,L%qxpzQaB!|-okUGC<>~7k0<Ypta<Y_sB)CUq{CcO@)bV.s<#2dMmTtvace_^(7L=bFY$js>{-h-in
                        Apr 25, 2024 14:24:45.914088964 CEST1289INData Raw: 57 90 e7 a4 8e 6e e9 4f ad fb 41 a6 91 e1 f5 b0 73 26 61 f4 d7 b5 f2 77 c4 6a 5f 7a b6 8e ae 9d 36 a9 fb 6b 6b b9 b7 d6 db 27 60 8d 81 f3 71 08 cd be c6 5d 59 94 39 86 e3 c4 75 49 8e 1f 59 ce eb 6e 18 79 80 34 a4 e2 69 f9 5a ba c6 4c 7d 3d 01 91
                        Data Ascii: WnOAs&awj_z6kk'`q]Y9uIYny4iZL}=Ns;lnPltaEwD8mDT\.-#5B,NT,:x6fpH_C?%^:x,fPfGM,|xVny=K+,rK+HRW%#'/y5~3]@
                        Apr 25, 2024 14:24:46.524106979 CEST566OUTPOST /secure/browser_post HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        Content-Length: 1902
                        Accept: */*
                        X-Requested-With: XMLHttpRequest
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
                        Origin: http://www.corp-internal.co
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:46.742281914 CEST711INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:46 GMT
                        Content-Type: image/gif; charset=utf-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Vary: Accept
                        Cache-Control: no-cache
                        X-Request-Id: aad2d688-c68e-4613-9d19-1cd88bb5bf0f
                        X-Runtime: 0.006665
                        X-Host-Info: lw-prod-eu-i-06164ae2ecae76ca0
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:46.849149942 CEST569OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20hasCookies%20%3D%20true&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.062563896 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:46 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 41720bef-dfff-4a23-8cd8-5002e6975b01
                        X-Runtime: 0.001893
                        X-Host-Info: lw-prod-eu-i-034fcb0b4e2cb4302
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.067914009 CEST567OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20colorDepth%20%3D%2024&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.280980110 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: d53d8145-a423-44dc-9bf9-d71f9a21b51a
                        X-Runtime: 0.001769
                        X-Host-Info: lw-prod-eu-i-0630ecaca960f15d1
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.285876036 CEST586OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20Microsoft%20Edge%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.499386072 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 6d8b47a7-ae9c-44d8-82fe-3eb4898ee6f4
                        X-Runtime: 0.001976
                        X-Host-Info: lw-prod-eu-i-0acc5e90dd72f7192
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.501718998 CEST558OUTGET /trace?id=90cbd26866&msg=Skipping%20quicktime%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.716945887 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 87fe21e3-9e4b-42b4-89f4-1972f27c2e19
                        X-Runtime: 0.002421
                        X-Host-Info: lw-prod-eu-i-034fcb0b4e2cb4302
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14


                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                        1192.168.2.54971052.213.98.16802000C:\Program Files\Google\Chrome\Application\chrome.exe
                        TimestampBytes transferredDirectionData
                        Apr 25, 2024 14:24:45.698705912 CEST415OUTGET /assets/all.js?g=90cbd26866 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:45.909229994 CEST1289INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:45 GMT
                        Content-Type: application/javascript
                        Content-Length: 7191
                        Connection: keep-alive
                        Last-Modified: Thu, 11 Apr 2024 12:55:27 GMT
                        Vary: Accept-Encoding
                        Content-Encoding: gzip
                        Server: ThreatSim-Web-Server
                        Expires: Thu, 31 Dec 2037 23:55:55 GMT
                        Cache-Control: max-age=315360000
                        Cache-Control: public
                        Access-Control-Allow-Origin: *
                        Data Raw: 1f 8b 08 00 c1 89 3e 60 02 03 cd 3d 6d 7b e3 36 8e df fd 2b 14 ed 5c 2b cd 38 8e 33 ed 76 af ce e5 72 99 4c a6 cd ee a4 99 9d 4c db bd 8b 53 3f b2 45 db 4c 64 c9 95 e4 bc ec 24 ff fd 00 f0 45 a4 4c 39 76 da ed 5d 9f 3e 49 44 82 00 08 80 20 48 82 9c 60 bc 48 47 25 cf d2 20 f4 3e b7 6e 79 1a 67 b7 9d 61 54 b0 c1 3c 2b ca c1 22 4f bc 87 07 2f 70 56 ec 7b be 1f b6 3d 59 97 64 93 01 cb f3 2c 87 72 8d 94 b5 3d 6e 20 46 98 32 1b 8c b2 b4 c8 12 16 70 68 9d b2 5b ef 64 16 4d 58 10 76 8a 7c 04 8d 9d b4 5e 79 fe 0e b4 3e e0 f1 be 0f 1f 2c 1d 65 31 fb f1 e3 c9 51 36 9b 67 29 4b 4b c5 62 99 47 a3 6b 9e 4e 06 3c 0e b1 d5 17 05 bb 69 6a c2 04 c4 ac 98 34 41 70 01 31 ca f2 9c 25 11 76 69 20 39 90 e4 ec 9a bd d6 a3 25 8f aa af a6 50 50 20 37 19 8f bd ae b7 b5 bf 5f 61 22 c0 41 cc 86 8b 89 f7 c5 17 9e 2c 40 44 75 bc 33 56 14 20 32 4b d2 cd 62 66 9b 89 19 25 c8 9e 21 e8 15 62 64 1b 8b 11 fe 0f 3b a3 28 49 82 72 ca 8b d0 d9 7b c3 30 57 09 e5 ff ba eb d8 95 bd 56 eb 26 ca bd 37 79 76 5b b0 fc 2d 2b d9 a8 04 46 3e b7 78 ca cb 9e 6d 1a d8 e1 ce 50 40 02 0c 7d 16 2c ca 47 d3 f3 32 07 aa 24 91 4e 1c 95 91 44 17 a2 24 fc 45 7a 9d 66 b7 a9 df f6 4c 04 a2 89 42 23 0b 3b 65 26 51 85 9d 9c cd 13 e8 74 b0 b3 b7 33 69 7b fe bf 7d f5 06 c7 b4 60 e2 86 e5 05 70 65 33 f1 93 28 54 b2 48 a3 1b 3e 89 ca 2c ef 2c 00 f3 e1 04 fa 4c fc 38 5a 54 a0 d1 7c 2e 0b eb bc 5b 84 6d e6 65 e1 d3 cc 13 f4 d9 f9 6a d9 9d 9d bb 49 9f 9d db 54 cf ce 57 51 c9 8a 9f 5c ac ea 62 e0 b1 62 57 91 e0 c5 61 1a e7 e0 00 40 dd 30 ce 83 8a 5f 5f 56 68 fc bc 78 03 a4 af 87 e0 58 ef 97 a1 a9 ee 0d d6 f9 68 65 ed d6 60 1a 15 ef 33 18 36 e7 20 65 b0 f8 9e 97 2e 92 a4 dd 5a 2a b6 0c 8e 8f bd 00 e1 c8 1b 11 fa 3a 9e d0 cb 59 b9 c8 53 c7 28 0c 7c db a8 b7 bd a3 c3 a3 ef 8f 7b 5e 62 b4 47 66 61 78 b8 71 2b b1 d4 2b f6 5a 65 7e 8f ae 12 06 0e 62 c0 71 fc 36 2a 61 18 ef 55 8e ae 02 07 3d 97 27 25 9b e1 9c c3 4c 87 61 80 4c 14 48 43 7d ce 66 d9 0d d3 20 6e be 80 95 ad 2e 88 db 1b 45 e5 68 ea 05 5c 0f 5a 17 e4 2e 40 b6 36 90 de ef 20 36 69 08 e7 40 82 2c b3 6e 0a f5 8a 35 8c c1 6e f2 1c 73 28 2c 0c f5 9e d5 f0 9b 7d b3 ab 94 51 d8 e8 b4 ee fd 68 34 90 4e 0e 26 52 e4 00 06 b6 5f b2 a2 d4 43 6a 19 27 29 14 48 d6 70 1a c6 b0 0a ad 61 09 cc b2 84 65 22 9b da c2 ef 26 33 69 11 47 59 76 cd 59 61 98 82 2e 59 c3 06 24 ec 73 94 5f b5 ae 77 42 21 35 b9 97 65 4a d5 f5 72 94 64 00 7e 3b 66 63 9e b2 d8 f7 90 c9 fb 39 cb c6 5e 9c 8d 16 33 98 81 20 9e 40 50 74 f0 5b d5 ac 23 0a 8f d3 68 98 b0 b8 59 6f 06 99 4d 15 b6 4e 3f 97 bb 09 da 01 c7 44 53 67 4d 11 92 b4 63 8e 85 69 e5 7d 76 cb f2 23 88 61 02 e1 fc 79 f1 33 1b fe cd 0a 27 98 d2 a6 20 aa 20 40 62 fb 9e 16 60 28 7d 2c 07 9e 99 9e ba 15 47 88 bc de da db da e2 9d 19 ca 2e d8 39 9c
                        Data Ascii: >`=m{6+\+83vrLLS?ELd$EL9v]>ID H`HG% >nygaT<+"O/pV{=Yd,r=n F2ph[dMXv|^y>,e1Q6g)KKbGkN<ij4Ap1%vi 9%PP 7_a"A,@Du3V 2Kbf%!bd;(Ir{0WV&7yv[-+F>xmP@},G2$ND$EzfLB#;e&Qt3i{}`pe3(TH>,,L8ZT|.[mejITWQ\bbWa@0__VhxXhe`36 e.Z*:YS(|{^bGfaxq++Ze~bq6*aU='%LaLHC}f n.Eh\Z.@6 6i@,n5ns(,}Qh4N&R_Cj')Hpae"&3iGYvYa.Y$s_wB!5eJrd~;fc9^3 @Pt[#hYoMN?DSgMci}v#ay3' @b`(},G.9
                        Apr 25, 2024 14:24:45.909287930 CEST1289INData Raw: cf 13 26 2a 76 78 35 6d 69 50 57 7f 6c 7c 22 da 6b ac c3 8e f1 0f 51 5c ef d6 6a 96 25 b6 ad 60 cb 62 08 9d 35 1a 85 66 9f cf a3 18 f8 56 12 94 f3 ef bf 86 56 24 90 1b e4 aa c9 bd 4e 51 e1 dc 0a 5c 34 43 85 72 a8 11 3c e4 7c e6 95 68 da a8 07 89
                        Data Ascii: &*vx5miPWl|"kQ\j%`b5fVV$NQ\4Cr<|h4mX)T]`Ul'X%*T4T1Y4iSK(8;=\E8}WL[U55q@bx};;w ywY%__r_^Z^B<v
                        Apr 25, 2024 14:24:45.909328938 CEST1289INData Raw: d5 d6 b2 4b 7d 78 d7 d6 76 21 83 d8 64 b7 8b 0b f7 2e a5 3e c8 d5 7b 05 9e 59 e0 73 88 3a 8b f2 04 d7 97 18 db b4 a1 00 cf cf 10 e6 c0 fb d2 ff 12 51 e8 28 6b de 6e 58 a1 e6 17 ec 52 07 07 be 90 92 79 00 c4 01 19 c7 7d ae 7e 7f 81 5c 05 7e 17 fe
                        Data Ascii: K}xv!d.>{Ys:Q(knXRy}~\~#:ie1;,q,Mv)YbK|[}\)zncWmo"b[oqiG/lx\!jOR#BU{':]i+B=`[((*bOI5n1]ET-W|Y
                        Apr 25, 2024 14:24:45.909367085 CEST1289INData Raw: e6 ca 3f 17 e7 62 ae ad d7 65 68 08 2b bc 34 2b bd 82 c1 78 87 91 f6 65 e1 c1 5c ed f1 d2 b8 c7 61 82 ef 5b f9 d1 6e 9e a8 73 1d c1 89 8b 0b 20 b0 2d 28 57 cd d5 8e 3b 9b d0 a0 dd b9 38 dc 86 49 eb db cb cf df 3c a2 22 20 ee 99 15 d5 89 84 56 e6
                        Data Ascii: ?beh+4+xe\a[ns -(W;8I<" V<*?$lGm.]td/XjA'q0eC`({D\3); nW,6,Yu&\]Qz'idW_q)i6&W
                        Apr 25, 2024 14:24:45.909404039 CEST1289INData Raw: 82 95 19 94 cb 66 80 0e 28 5b f5 00 45 cd 06 0a 68 97 54 0f 52 90 83 41 13 35 dd 8a b9 d9 81 f5 d7 4f bc 65 d2 f8 1a 4a b9 d9 23 1d c2 03 37 ed 5a f0 d9 84 76 2d f0 66 f6 61 09 02 18 2e 4a f4 6f f9 08 6c 1a d7 18 f5 9a 28 a1 3b d5 29 a5 e5 d7 2b
                        Data Ascii: f([EhTRA5OeJ#7Zv-fa.Jol(;)+E,wiFS:^"'}/L @GS5h0^-y7\|lGA+?igdHv$,C%3Gp;b=}61#)fPR(XWX9OY,kM@
                        Apr 25, 2024 14:24:45.909441948 CEST1138INData Raw: d7 6e 64 5d 2a 78 34 46 ca 6d ce 4b f6 9e a7 d7 85 2b f9 c1 e7 e9 38 c3 a3 e1 ce b4 9c 25 96 69 ac ca 50 ee cc b3 39 26 7b e9 f4 7c 66 9e 81 82 03 93 07 a0 c5 9b fb 4f d1 e4 07 4c 6f f1 e9 44 53 3c af a6 53 f7 b7 b7 f7 bc 50 3c d4 26 85 8d ff bc
                        Data Ascii: nd]*x4FmK+8%iP9&{|fOLoDS<SP<&EAWB',%v9A2At<z!z(VETn/+<H:nhOEn8F}~rYgFcxl-2)>(4%_q55x
                        Apr 25, 2024 14:24:46.538759947 CEST571OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20localStorage%20%3D%20true&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:46.752763987 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:46 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: bc1b1e7f-8b9f-4117-a5e2-30a0f5b91ab8
                        X-Runtime: 0.001769
                        X-Host-Info: lw-prod-eu-i-0630ecaca960f15d1
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:46.752774000 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:46.901844978 CEST567OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20os_version%20%3D%2010&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.115472078 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 206667b3-50f5-4860-8dce-b3ae1add7701
                        X-Runtime: 0.001899
                        X-Host-Info: lw-prod-eu-i-034fcb0b4e2cb4302
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.115482092 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:47.125526905 CEST576OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20Chrome%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.339867115 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 5d7dc124-a1fb-4acb-bdc2-dff253d4e2c0
                        X-Runtime: 0.002066
                        X-Host-Info: lw-prod-eu-i-0630ecaca960f15d1
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.339874983 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:47.352628946 CEST552OUTGET /trace?id=90cbd26866&msg=Skipping%20pdf%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.565474987 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 67bd48ff-e3d0-45b6-9277-5541b8504673
                        X-Runtime: 0.002113
                        X-Host-Info: lw-prod-eu-i-0acc5e90dd72f7192
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.565512896 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:47.569796085 CEST643OUTGET /trace?id=90cbd26866&msg=redirecting%20to%20%2Fload_training%3Fguid%3De390cbdd12686627%26correlation_id%3D3fac3af0-74a1-4072-a0f1-391c2d2ad2d0&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.783153057 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 5e11561a-61e6-45b0-ae92-b84384aac515
                        X-Runtime: 0.001985
                        X-Host-Info: lw-prod-eu-i-0acc5e90dd72f7192
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.783204079 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0


                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                        2192.168.2.54971252.213.98.16802000C:\Program Files\Google\Chrome\Application\chrome.exe
                        TimestampBytes transferredDirectionData
                        Apr 25, 2024 14:24:46.539177895 CEST573OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20sessionStorage%20%3D%20true&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:46.755043030 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:46 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: a0818578-6e89-4b53-a099-d1a7778ac616
                        X-Runtime: 0.001707
                        X-Host-Info: lw-prod-eu-i-06164ae2ecae76ca0
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:46.755135059 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:46.901997089 CEST568OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20language%20%3D%20en-US&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.115422010 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: a8891be4-9898-4590-94b5-6f0aa32da0d1
                        X-Runtime: 0.001627
                        X-Host-Info: lw-prod-eu-i-0630ecaca960f15d1
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.115439892 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:47.126446009 CEST578OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20Chromium%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.339802980 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 4bf1382a-cdb3-4d4a-a4ea-4ff1a7894fcb
                        X-Runtime: 0.001275
                        X-Host-Info: lw-prod-eu-i-06164ae2ecae76ca0
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.339814901 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:47.350822926 CEST554OUTGET /trace?id=90cbd26866&msg=Skipping%20flash%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.565304041 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 740ef758-ccfc-4518-905a-21d8e6a2dce3
                        X-Runtime: 0.002381
                        X-Host-Info: lw-prod-eu-i-0acc5e90dd72f7192
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.565340042 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:47.570460081 CEST549OUTGET /trace?id=90cbd26866&msg=browser_post_successful&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.783720016 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: b1d56f7f-57bb-432d-9e8c-3794d5bcb5ab
                        X-Runtime: 0.001448
                        X-Host-Info: lw-prod-eu-i-06164ae2ecae76ca0
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.783755064 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:25:32.786710978 CEST6OUTData Raw: 00
                        Data Ascii:


                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                        3192.168.2.54972052.213.98.16802000C:\Program Files\Google\Chrome\Application\chrome.exe
                        TimestampBytes transferredDirectionData
                        Apr 25, 2024 14:24:46.851640940 CEST568OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20browser%20%3D%20Chrome&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.071800947 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:46 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 8173e9c1-1bc0-4a5f-93ac-91856796f78c
                        X-Runtime: 0.001933
                        X-Host-Info: lw-prod-eu-i-0630ecaca960f15d1
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.071809053 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:47.081671000 CEST564OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20width%20%3D%201280&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.303118944 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: a903f90d-6898-4059-8e36-e4538be17c41
                        X-Runtime: 0.001896
                        X-Host-Info: lw-prod-eu-i-034fcb0b4e2cb4302
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.303145885 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:47.319161892 CEST581OUTGET /trace?id=90cbd26866&msg=Chrome%20browser%2C%20using%20more%20detailed%20version&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.538877010 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 88d2ce99-b5d2-4ce0-a377-9dae14937465
                        X-Runtime: 0.001939
                        X-Host-Info: lw-prod-eu-i-06164ae2ecae76ca0
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.538911104 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:47.539963961 CEST560OUTGET /trace?id=90cbd26866&msg=Skipping%20Silverlight%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.759367943 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 8380f810-81e4-4147-8ab5-1b79248c28bf
                        X-Runtime: 0.001732
                        X-Host-Info: lw-prod-eu-i-0630ecaca960f15d1
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.759402990 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:25:32.770955086 CEST6OUTData Raw: 00
                        Data Ascii:


                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                        4192.168.2.54972152.213.98.16802000C:\Program Files\Google\Chrome\Application\chrome.exe
                        TimestampBytes transferredDirectionData
                        Apr 25, 2024 14:24:46.851893902 CEST573OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20browser_version%20%3D%20117&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.070277929 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:46 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: a1dc3d36-1cfe-447d-a2b6-eed9e1ae75a1
                        X-Runtime: 0.001845
                        X-Host-Info: lw-prod-eu-i-06164ae2ecae76ca0
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.070286989 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:47.083512068 CEST565OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20height%20%3D%201024&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.303020954 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 31f7cb1a-7f54-4373-a8cb-3c83b8cb941b
                        X-Runtime: 0.001783
                        X-Host-Info: lw-prod-eu-i-0acc5e90dd72f7192
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.303030014 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:47.317075968 CEST578OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20WebKit%20built-in%20PDF&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.535770893 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 6b38747b-b69f-419a-8039-f2584cdc162c
                        X-Runtime: 0.001654
                        X-Host-Info: lw-prod-eu-i-034fcb0b4e2cb4302
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.535809994 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:47.537410975 CEST559OUTGET /trace?id=90cbd26866&msg=Skipping%20RealPlayer%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.755650997 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 34f667d3-dff3-469d-bdcb-7ad0fb9b60bd
                        X-Runtime: 0.001329
                        X-Host-Info: lw-prod-eu-i-06164ae2ecae76ca0
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.755686045 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:25:32.755362034 CEST6OUTData Raw: 00
                        Data Ascii:


                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                        5192.168.2.54971952.213.98.16802000C:\Program Files\Google\Chrome\Application\chrome.exe
                        TimestampBytes transferredDirectionData
                        Apr 25, 2024 14:24:46.875869989 CEST564OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20os%20%3D%20Windows&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.102375984 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:46 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 2939bc25-2714-47f5-b3fa-9819f11e46e1
                        X-Runtime: 0.001926
                        X-Host-Info: lw-prod-eu-i-0acc5e90dd72f7192
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.102385998 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:47.106590986 CEST567OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.337270021 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: de07aba3-72d4-48d3-845e-c3887377a343
                        X-Runtime: 0.001431
                        X-Host-Info: lw-prod-eu-i-06164ae2ecae76ca0
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.337281942 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:47.343219995 CEST553OUTGET /trace?id=90cbd26866&msg=Skipping%20java%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.564753056 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 34fe677c-ed33-4c6c-ab49-ce663e695ad5
                        X-Runtime: 0.001952
                        X-Host-Info: lw-prod-eu-i-0630ecaca960f15d1
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.564851999 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:47.568753004 CEST567OUTGET /trace?id=90cbd26866&msg=Skipping%20WindowsMediaPlayer%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.790050030 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: e5d4bda4-4086-4deb-b70d-0173fc6ea971
                        X-Runtime: 0.001682
                        X-Host-Info: lw-prod-eu-i-034fcb0b4e2cb4302
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.790086031 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:47.900392056 CEST638OUTGET /load_training?guid=e390cbdd12686627&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        Upgrade-Insecure-Requests: 1
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                        Referer: http://www.corp-internal.co/ae90cbd9826866b7?l=8
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:48.137176991 CEST890INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:48 GMT
                        Content-Type: text/html; charset=utf-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        ETag: W/"de3727e93de9d8b26b113299c56122ea"
                        Cache-Control: max-age=0, private, must-revalidate
                        X-Request-Id: 5e8f4901-b58e-4f35-aa8f-1ae94679b341
                        X-Runtime: 0.017370
                        X-Host-Info: lw-prod-eu-i-0acc5e90dd72f7192
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 38 65 0d 0a 1f 8b 08 00 00 00 00 00 02 03 2d ce c1 0a 02 21 10 80 e1 7b 4f 21 42 c7 9a d8 e3 e6 7a 0f 82 16 7a 80 c5 74 d2 89 d5 15 9d 22 df be 2d 3a fe df e9 57 8e 5e a2 72 9b 71 90 8c 6f de 99 99 7c ea 85 c5 c4 58 8e 52 2b 8a 5e d4 62 07 19 98 73 ed 01 62 33 ce de e0 92 b1 18 a6 25 55 38 a5 fb 52 e2 2f ae 68 9f 85 b8 c1 d9 24 47 c9 6f bb c3 68 3c c2 18 a8 86 b5 a7 bf 4f 5f ed f6 8f ec a5 00 ad 60 dd d0 9b 0f 10 8f cb 45 8d 00 00 00 0d 0a
                        Data Ascii: 8e-!{O!Bzzt"-:W^rqo|XR+^bsb3%U8R/h$Goh<O_`E
                        Apr 25, 2024 14:24:48.137228012 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:50.472667933 CEST528OUTGET /favicon.ico HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                        Referer: http://www.corp-internal.co/load_training?guid=e390cbdd12686627&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:50.691225052 CEST277INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:50 GMT
                        Content-Type: image/x-icon
                        Content-Length: 0
                        Connection: keep-alive
                        Last-Modified: Thu, 11 Apr 2024 12:55:27 GMT
                        ETag: "6617ddbf-0"
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Accept-Ranges: bytes
                        Apr 25, 2024 14:25:35.692861080 CEST6OUTData Raw: 00
                        Data Ascii:


                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                        6192.168.2.54972434.248.78.201802000C:\Program Files\Google\Chrome\Application\chrome.exe
                        TimestampBytes transferredDirectionData
                        Apr 25, 2024 14:24:47.251100063 CEST349OUTGET /secure/browser_post HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.463344097 CEST1289INHTTP/1.1 404 Not Found
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Request-Id: af743820-06dc-48c3-9150-917e4762c7ab
                        X-Runtime: 0.000906
                        X-Host-Info: lw-prod-eu-i-06164ae2ecae76ca0
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Content-Encoding: gzip
                        Data Raw: 33 66 63 0d 0a 1f 8b 08 00 00 00 00 00 02 03 ad 56 51 4f e3 38 10 7e e7 57 cc e5 09 24 88 5b 60 25 c4 26 5d b1 85 3b 90 96 03 1d 3d ad f6 e9 e4 d8 a6 31 38 76 d6 9e 34 5b 9d ee bf df 38 69 69 59 c8 09 ed 6d 1f aa d8 99 19 7f 33 f3 7d e3 64 bf 9c df 4c 67 5f 6e 2f e0 72 76 fd 09 6e ff fc f8 e9 6a 0a c9 01 63 9f 8f a6 8c 9d cf ce fb 17 c7 e9 68 cc d8 c5 ef c9 4e 52 22 d6 a7 8c b5 6d 9b b6 47 a9 f3 73 36 fb 83 95 58 99 63 16 d0 6b 81 a9 44 99 4c 76 b2 b8 37 d9 01 fa 65 a5 e2 b2 7f ec 96 41 78 5d e3 a4 d5 56 ba 36 45 15 f0 af ca 49 05 39 a0 6f d4 fb 8c ad 0c 36 1e a8 d1 a8 cd 3a fe 66 a5 82 9a cf 15 08 6e ad 43 28 14 dc bb c6 ca 8d 13 fb ce 2b ab 14 72 88 f8 0f d4 d7 46 2f f2 64 ea 2c 2a 8b 07 b3 65 ad 12 10 fd 2a 4f 50 7d c3 2e a5 f7 20 4a ee 83 c2 bc 09 07 3c 08 ad 93 ed 34 70 69 14 20 f9 ae 5c 44 08 5b ef 3f de 9c 7f 81 bf 09 94 c5 53 38 a9 91 8d 0f 6b 84 85 f2 92 5b 0e ff 3c d9 5d 8e 9f ac c6 47 d1 ec dd eb 66 87 6f 09 76 76 6a b4 7d 24 4b e1 8c f3 a7 e0 95 7c f6 76 a1 83 46 da 7b 32 a8 b8 77 ce 6e d9 50 f5 63 5e ab ce b1 4d eb b2 c2 c9 e5 8b 2e 42 f0 22 4f 18 0f 54 a5 c0 f8 03 ff c6 8c 2e 02 7b f8 da 28 bf 64 e3 f4 24 1d ad 16 69 a5 6d fa 10 92 ed 92 3d f0 05 ef 03 45 ca ac 1b ff 7a 6c 63 c8 fb c3 3c 3f 1e 1d bf 21 c6 16 79 78 41 7d 6a b5 c4 32 4f de 8d 46 09 14 ce 4b e5 f3 84 1e 85 32 26 d4 5c 68 3b cf 93 f1 28 79 4e b2 0c fd f3 8d 7e 53 be dc ec 79 3e 7e fd c5 9b f8 fa 2c 12 a3 50 4f 1e 4b d7 00 f7 0a 8c 73 8f 84 93 fc 3c 54 7a 5e 22 94 7c a1 28 92 b2 d4 e8 ca 2d 94 dc a7 2d 09 1a 03 58 5e a9 48 5f 3b 8f bb e4 a1 03 a0 aa 6a e7 b9 d7 66 09 8d a5 b2 69 13 6b 93 0e 64 e3 07 d2 ac 87 b3 bc 35 8a 07 12 85 5f 02 96 31 43 63 1c e9 7c 7e 3a 90 e6 40 a8 ac 31 c3 67 64 46 4f ae f9 a3 82 d0 50 51 b0 e4 d8 9d f5 59 15 10 c9 0d 5c 4a af 42 00 a9 43 6d f8 92 d8 ae 6d 67 b1 7e 51 70 0f ee 3e 96 d5 43 e1 5d 1b 54 57 9d 50 13 17 c8 9a 5b 19 4b 5c 71 8c 4a 11 ce 7b 25 d0 2c d3 61 40 44 f9 ff 86 7b d5 9d 46 4d e2 a2 a4 98 58 d2 71 5d 6b 8b 25 08 a3 45 d7 56 0e 51 bb fb dd 1c e2 e2 45 52 a4 1e 4d 13 96 23 f5 12 1d 70 a3 7c 67 53 6d 4a d0 69 9f 42 6b fb 84 7a 93 c9 8f e0 cf d8 50 23 b2 f2 70 38 e5 cb d9 ec 16 2e bc 27 a4 24 56 38 80 5f 35 29 90 56 52 47 54 8e d8 11 25 d0 f1 3f cd 0a 3f 1c e9 8a 46 b2 b7 0a e9 a1 4f 44 d3 b0 ba 53 7e a1 85 0a b0 7b 75 75 b7 37 24 a0 c3 c9 cf a3 f5 4c 89 d2 6a c1 cd 33 1c bb 51 88 a1 a9 49 53 08 b5 f2 c1 59 ab cc de 4f a6 fa 6f 2e b6 3b a3 9b cb ab fb 7c 7d ff ce 1d 8d 53 e1 5d 70 f7 98 0a 57 b1 fb 36 76 9f 7d 88 ff 5a e6 27 e3 13 1a 66 d7 6b 13 b8 f5 4e 36 44 aa bb 15 dc 75 0d 33 c6 27 1d e3 09 7f cc 8c 58 d8 5d 9b 10 14 f7 a2 ec 66 4d a4 56 4b 23 33 d0 1d 30 89 bd cd 58 d1 3b d1 9a
                        Data Ascii: 3fcVQO8~W$[`%&];=18v4[8iiYm3}dLg_n/rvnjchNR"mGs6XckDLv7eAx]V6EI9o6:fnC(+rF/d,*e*OP}. J<4pi \D[?S8k[<]Gfovvj}$K|vF{2wnPc^M.B"OT.{(d$im=Ezlc<?!yxA}j2OFK2&\h;(yN~Sy>~,POKs<Tz^"|(--X^H_;jfikd5_1Cc|~:@1gdFOPQY\JBCmmg~Qp>C]TWP[K\qJ{%,a@D{FMXq]k%EVQERM#p|gSmJiBkzP#p8.'$V8_5)VRGT%??FODS~{uu7$Lj3QISYOo.;|}S]pW6v}Z'fkN6Du3'X]fMVK#30X;
                        Apr 25, 2024 14:24:47.463355064 CEST145INData Raw: 1a 1c 97 ff 47 1d 37 35 0d 30 0a 45 dd 84 4b 65 ea 18 6f 1f da 52 d3 f9 c4 66 2e 08 67 d0 71 88 93 90 a3 d1 35 5d 7a 73 12 ed ae 26 6a 54 73 bf b7 df a1 d9 86 ec 6a 2d 42 9f 4a 07 33 0a e9 2e 0a e9 4e 61 b3 3a 81 b6 a7 ae aa a8 93 67 1b 75 69 9a
                        Data Ascii: G750EKeoRf.gq5]zs&jTsj-BJ3.Na:gui3Cop?nb,^_c_r,Z
                        Apr 25, 2024 14:24:47.463370085 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:47.464545012 CEST444OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20os%20%3D%20Windows&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.678195000 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: d3ff119e-c773-45cb-ad1c-8c258a6cd1a5
                        X-Runtime: 0.001988
                        X-Host-Info: lw-prod-eu-i-0630ecaca960f15d1
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.678271055 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:47.680143118 CEST447OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.893719912 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 13a91647-742d-4e9f-8492-7be91629e9c2
                        X-Runtime: 0.001793
                        X-Host-Info: lw-prod-eu-i-0630ecaca960f15d1
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.893805981 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:48.207701921 CEST461OUTGET /trace?id=90cbd26866&msg=Chrome%20browser%2C%20using%20more%20detailed%20version&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:48.420972109 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:48 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 8f63e3a9-72ee-4ac8-bb40-67196a813a76
                        X-Runtime: 0.001786
                        X-Host-Info: lw-prod-eu-i-0acc5e90dd72f7192
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:48.421009064 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:48.447988033 CEST438OUTGET /trace?id=90cbd26866&msg=Skipping%20quicktime%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:48.661706924 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:48 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 54960db4-76e3-44ce-9ae5-b550ee0ec340
                        X-Runtime: 0.001765
                        X-Host-Info: lw-prod-eu-i-0630ecaca960f15d1
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:48.661756039 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:25:33.677233934 CEST6OUTData Raw: 00
                        Data Ascii:


                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                        7192.168.2.54972334.248.78.201802000C:\Program Files\Google\Chrome\Application\chrome.exe
                        TimestampBytes transferredDirectionData
                        Apr 25, 2024 14:24:47.251754999 CEST453OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20sessionStorage%20%3D%20true&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.464659929 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 8bddaff3-260a-444b-b9fd-839e4d582d9f
                        X-Runtime: 0.001793
                        X-Host-Info: lw-prod-eu-i-0630ecaca960f15d1
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.464689016 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:47.465764999 CEST448OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20language%20%3D%20en-US&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.678999901 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: b71aa55d-1beb-4f78-84f0-2964e27aff4c
                        X-Runtime: 0.002033
                        X-Host-Info: lw-prod-eu-i-0acc5e90dd72f7192
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.679034948 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:47.681327105 CEST456OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20Chrome%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.894252062 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 5961668a-ad3c-45fe-97ce-05caeedb4b17
                        X-Runtime: 0.001873
                        X-Host-Info: lw-prod-eu-i-0acc5e90dd72f7192
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.894332886 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:48.205945969 CEST458OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20WebKit%20built-in%20PDF&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:48.418524027 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:48 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: b3a62b18-f3bd-4184-95ad-fa737b4e2a5a
                        X-Runtime: 0.001371
                        X-Host-Info: lw-prod-eu-i-0630ecaca960f15d1
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:48.418577909 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:48.448813915 CEST439OUTGET /trace?id=90cbd26866&msg=Skipping%20RealPlayer%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:48.661781073 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:48 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: ab096b09-1d83-4cc1-9b4e-30c51e0bcf02
                        X-Runtime: 0.001747
                        X-Host-Info: lw-prod-eu-i-0acc5e90dd72f7192
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:48.661798000 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:25:33.677232027 CEST6OUTData Raw: 00
                        Data Ascii:


                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                        8192.168.2.54972234.248.78.201802000C:\Program Files\Google\Chrome\Application\chrome.exe
                        TimestampBytes transferredDirectionData
                        Apr 25, 2024 14:24:47.260488987 CEST451OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20localStorage%20%3D%20true&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.480773926 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 2b4471bb-c9bc-448a-8a3b-14489ac35ecf
                        X-Runtime: 0.002138
                        X-Host-Info: lw-prod-eu-i-06164ae2ecae76ca0
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.480890989 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:47.482038975 CEST447OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20os_version%20%3D%2010&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.702471972 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 7fe82f0a-0697-4fdd-85be-36f0bb329698
                        X-Runtime: 0.001737
                        X-Host-Info: lw-prod-eu-i-0acc5e90dd72f7192
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.702505112 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:47.703727961 CEST458OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20Chromium%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.923515081 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 6856d9c1-f1ce-44cb-bf7c-735f57f8405a
                        X-Runtime: 0.001736
                        X-Host-Info: lw-prod-eu-i-06164ae2ecae76ca0
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.923542976 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:48.204241037 CEST466OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20plugin%20Microsoft%20Edge%20PDF%20Viewer&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:48.423912048 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:48 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: c997fff3-5bfc-49bc-9018-224701e0d598
                        X-Runtime: 0.001624
                        X-Host-Info: lw-prod-eu-i-0630ecaca960f15d1
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:48.423949003 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:48.451258898 CEST429OUTGET /trace?id=90cbd26866&msg=browser_post_successful&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:48.670427084 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:48 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: a043c663-299a-487a-b638-054ec6ea920e
                        X-Runtime: 0.001492
                        X-Host-Info: lw-prod-eu-i-034fcb0b4e2cb4302
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:48.670463085 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:25:33.677303076 CEST6OUTData Raw: 00
                        Data Ascii:


                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                        9192.168.2.54972734.248.78.201802000C:\Program Files\Google\Chrome\Application\chrome.exe
                        TimestampBytes transferredDirectionData
                        Apr 25, 2024 14:24:47.303374052 CEST449OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20hasCookies%20%3D%20true&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.518672943 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: b277a6db-e05b-4448-a812-35f648ee8a2c
                        X-Runtime: 0.001755
                        X-Host-Info: lw-prod-eu-i-0acc5e90dd72f7192
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.518697977 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:47.519793987 CEST447OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20colorDepth%20%3D%2024&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.737785101 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: d9b04208-942d-4b43-8c86-0f57dac14b11
                        X-Runtime: 0.001583
                        X-Host-Info: lw-prod-eu-i-034fcb0b4e2cb4302
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.737827063 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:48.213187933 CEST432OUTGET /trace?id=90cbd26866&msg=Skipping%20pdf%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:48.427778006 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:48 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 741bee4a-301f-4d5b-9246-f6682d4d9adf
                        X-Runtime: 0.001607
                        X-Host-Info: lw-prod-eu-i-034fcb0b4e2cb4302
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:48.427814007 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:48.450519085 CEST523OUTGET /trace?id=90cbd26866&msg=redirecting%20to%20%2Fload_training%3Fguid%3De390cbdd12686627%26correlation_id%3D3fac3af0-74a1-4072-a0f1-391c2d2ad2d0&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:48.665610075 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:48 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 3c0f65a8-3146-4f9f-8218-5f175357dc87
                        X-Runtime: 0.001759
                        X-Host-Info: lw-prod-eu-i-034fcb0b4e2cb4302
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:48.665628910 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:25:33.677243948 CEST6OUTData Raw: 00
                        Data Ascii:


                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                        10192.168.2.54972534.248.78.201802000C:\Program Files\Google\Chrome\Application\chrome.exe
                        TimestampBytes transferredDirectionData
                        Apr 25, 2024 14:24:47.305866957 CEST453OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20browser_version%20%3D%20117&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.527081966 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 1ed26044-b7eb-4906-bdce-6cfe1e9f76a5
                        X-Runtime: 0.002091
                        X-Host-Info: lw-prod-eu-i-0630ecaca960f15d1
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.527116060 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:47.528114080 CEST445OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20height%20%3D%201024&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.748594046 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: fd60aaa8-8197-4ee0-a0cf-db6742c04691
                        X-Runtime: 0.001796
                        X-Host-Info: lw-prod-eu-i-034fcb0b4e2cb4302
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.748629093 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:48.210166931 CEST433OUTGET /trace?id=90cbd26866&msg=Skipping%20java%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:48.431155920 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:48 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 73e9a46b-6ef6-4aef-990a-8741cb6fde1d
                        X-Runtime: 0.001883
                        X-Host-Info: lw-prod-eu-i-0acc5e90dd72f7192
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:48.431196928 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:48.452094078 CEST447OUTGET /trace?id=90cbd26866&msg=Skipping%20WindowsMediaPlayer%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:48.672125101 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:48 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: d1820ee1-90af-4200-b0d8-85bca53c2ac2
                        X-Runtime: 0.001373
                        X-Host-Info: lw-prod-eu-i-06164ae2ecae76ca0
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:48.672146082 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:51.119404078 CEST341OUTGET /favicon.ico HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:51.337960958 CEST277INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:51 GMT
                        Content-Type: image/x-icon
                        Content-Length: 0
                        Connection: keep-alive
                        Last-Modified: Thu, 11 Apr 2024 12:55:27 GMT
                        ETag: "6617ddbf-0"
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Accept-Ranges: bytes
                        Apr 25, 2024 14:25:36.349184036 CEST6OUTData Raw: 00
                        Data Ascii:


                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                        11192.168.2.54972634.248.78.201802000C:\Program Files\Google\Chrome\Application\chrome.exe
                        TimestampBytes transferredDirectionData
                        Apr 25, 2024 14:24:47.306035042 CEST448OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20browser%20%3D%20Chrome&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.525895119 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 8a400180-023c-4f98-84ed-2f5c535f7249
                        X-Runtime: 0.001767
                        X-Host-Info: lw-prod-eu-i-034fcb0b4e2cb4302
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.525913000 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:47.526947021 CEST444OUTGET /trace?id=90cbd26866&msg=BrowserDetect%20-%20width%20%3D%201280&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:47.746882915 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 9e5190b8-a7ea-40a0-92f8-55a2b2bc9814
                        X-Runtime: 0.001741
                        X-Host-Info: lw-prod-eu-i-06164ae2ecae76ca0
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:47.746947050 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:48.211364031 CEST434OUTGET /trace?id=90cbd26866&msg=Skipping%20flash%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:48.430217981 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:48 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: 410a945d-d73b-4c3c-a289-14d97b0f4c97
                        X-Runtime: 0.001172
                        X-Host-Info: lw-prod-eu-i-06164ae2ecae76ca0
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:48.430258989 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:24:48.449495077 CEST440OUTGET /trace?id=90cbd26866&msg=Skipping%20Silverlight%20detection&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: www.corp-internal.co
                        Connection: keep-alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        Accept: */*
                        Accept-Encoding: gzip, deflate
                        Accept-Language: en-US,en;q=0.9
                        Cookie: EXFILGUID=90cbd26866; link_clicked_90cbd26866=1
                        Apr 25, 2024 14:24:48.668786049 CEST682INHTTP/1.1 200 OK
                        Date: Thu, 25 Apr 2024 12:24:48 GMT
                        Content-Type: text/html
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Vary: Accept-Encoding
                        X-Frame-Options: SAMEORIGIN
                        X-XSS-Protection: 1; mode=block
                        X-Content-Type-Options: nosniff
                        X-Download-Options: noopen
                        X-Permitted-Cross-Domain-Policies: none
                        Referrer-Policy: strict-origin-when-cross-origin
                        Cache-Control: no-cache
                        X-Request-Id: ffca204f-3182-47bb-837c-b7001bc4a270
                        X-Runtime: 0.001522
                        X-Host-Info: lw-prod-eu-i-06164ae2ecae76ca0
                        X-Host-Info: ; 7ab042967e623923e817fbc8931e097004f737c7
                        Server: ThreatSim-Web-Server
                        Access-Control-Allow-Origin: *
                        Content-Encoding: gzip
                        Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 0d 0a
                        Data Ascii: 14
                        Apr 25, 2024 14:24:48.668884993 CEST5INData Raw: 30 0d 0a 0d 0a
                        Data Ascii: 0
                        Apr 25, 2024 14:25:33.677258968 CEST6OUTData Raw: 00
                        Data Ascii:


                        HTTPS Proxied Packets

                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                        0192.168.2.54971652.216.26.1564432000C:\Program Files\Google\Chrome\Application\chrome.exe
                        TimestampBytes transferredDirectionData
                        2024-04-25 12:24:46 UTC615OUTGET /detect/plugin_detect.js?guid=90cbd26866&correlation_id=3fac3af0-74a1-4072-a0f1-391c2d2ad2d0 HTTP/1.1
                        Host: tslp.s3.amazonaws.com
                        Connection: keep-alive
                        sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                        sec-ch-ua-mobile: ?0
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                        sec-ch-ua-platform: "Windows"
                        Accept: */*
                        Sec-Fetch-Site: cross-site
                        Sec-Fetch-Mode: no-cors
                        Sec-Fetch-Dest: script
                        Referer: http://www.corp-internal.co/
                        Accept-Encoding: gzip, deflate, br
                        Accept-Language: en-US,en;q=0.9
                        2024-04-25 12:24:46 UTC407INHTTP/1.1 200 OK
                        x-amz-id-2: MQi9EcEjjMNi6uZdxHA6hvx0M4ScDUJTABA8p6sbIaSZkE+1hsW4nFfZxDIlBRwJAtRxucfRD7c=
                        x-amz-request-id: JQ1VHFFWG3RN42AM
                        Date: Thu, 25 Apr 2024 12:24:47 GMT
                        Last-Modified: Wed, 15 Feb 2017 17:56:07 GMT
                        ETag: "00a513f07603df01e3b99be00f370754"
                        x-amz-version-id: null
                        Accept-Ranges: bytes
                        Content-Type: text/javascript
                        Server: AmazonS3
                        Content-Length: 50085
                        Connection: close
                        2024-04-25 12:24:46 UTC1550INData Raw: 2f 2a 0a 50 6c 75 67 69 6e 44 65 74 65 63 74 20 76 30 2e 39 2e 31 0a 77 77 77 2e 70 69 6e 6c 61 64 79 2e 6e 65 74 2f 50 6c 75 67 69 6e 44 65 74 65 63 74 2f 6c 69 63 65 6e 73 65 2f 0a 5b 20 5d 0a 5b 20 69 73 4d 69 6e 56 65 72 73 69 6f 6e 20 67 65 74 56 65 72 73 69 6f 6e 20 68 61 73 4d 69 6d 65 54 79 70 65 20 67 65 74 49 6e 66 6f 20 5d 0a 5b 20 41 6c 6c 6f 77 41 63 74 69 76 65 58 20 42 65 74 74 65 72 49 45 20 5d 0a 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 76 61 72 20 6a 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 76 65 72 73 69 6f 6e 3a 20 22 30 2e 39 2e 31 22 2c 0a 20 20 20 20 20 20 20 20 6e 61 6d 65 3a 20 22 50 6c 75 67 69 6e 44 65 74 65 63 74 22 2c 0a 20 20 20 20 20 20 20 20 61 64 64 50 6c 75 67 69 6e 3a 20 66 75 6e 63 74 69 6f 6e 28 70
                        Data Ascii: /*PluginDetect v0.9.1www.pinlady.net/PluginDetect/license/[ ][ isMinVersion getVersion hasMimeType getInfo ][ AllowActiveX BetterIE ]*/(function() { var j = { version: "0.9.1", name: "PluginDetect", addPlugin: function(p
                        2024-04-25 12:24:46 UTC16384INData Raw: 6f 6e 28 70 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 6a 2e 72 67 78 2e 6e 75 6d 2e 74 65 73 74 28 6a 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 70 29 29 0a 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 69 73 53 74 72 4e 75 6d 3a 20 66 75 6e 63 74 69 6f 6e 28 70 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 6a 2e 69 73 53 74 72 69 6e 67 28 70 29 20 26 26 20 28 2f 5c 64 2f 29 2e 74 65 73 74 28 70 29 0a 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 69 73 46 75 6e 63 3a 20 66 75 6e 63 74 69 6f 6e 28 70 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 6a 2e 72 67 78 2e 66 75 6e 2e 74 65 73 74 28 6a 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 70 29 29 0a 20 20 20 20
                        Data Ascii: on(p) { return j.rgx.num.test(j.toString.call(p)) }, isStrNum: function(p) { return j.isString(p) && (/\d/).test(p) }, isFunc: function(p) { return j.rgx.fun.test(j.toString.call(p))
                        2024-04-25 12:24:46 UTC1024INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 6a 2e 69 73 46 75 6e 63 28 71 29 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 71 28 6a 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 61 6c 6c 41 72 72 61 79 30 3a 20 66 75 6e 63 74 69 6f 6e 28 70 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 71 20 3d 20 74 68 69 73 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 6a 2e 69 73 41 72 72 61 79 28 70 29 29 20 7b 0a 20 20 20 20 20
                        Data Ascii: if (j.isFunc(q)) { q(j) } } }, callArray0: function(p) { var q = this, r; if (j.isArray(p)) {
                        2024-04-25 12:24:46 UTC16384INData Raw: 20 20 20 20 20 20 69 66 20 28 21 72 2e 61 6c 6c 44 6f 6e 65 48 6e 64 6c 72 73 2e 6c 65 6e 67 74 68 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 6a 2e 77 69 6e 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 21 6a 2e 77 69 6e 2e 6c 6f 61 64 65 64 20 7c 7c 20 6a 2e 77 69 6e 2e 6c 6f 61 64 50 72 76 74 48 6e 64 6c 72 73 2e 6c 65 6e 67 74 68 20 7c 7c 20 6a 2e 77 69 6e 2e 6c 6f 61 64 50 62 6c 63 48 6e 64 6c 72 73 2e 6c 65 6e 67 74 68 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 0a 20 20 20 20 20 20 20 20 20 20
                        Data Ascii: if (!r.allDoneHndlrs.length) { return } if (j.win) { if (!j.win.loaded || j.win.loadPrvtHndlrs.length || j.win.loadPblcHndlrs.length) { return
                        2024-04-25 12:24:46 UTC1024INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 2e 64 6f 63 20 3d 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 2e 6f 62 6a 65 63 74 50 72 6f 70 65 72 74 79 20 3d 20 30 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 20 3d 20 74 2e 67 65 74 44 69 76 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 2e 65 6d 70 74 79 4e 6f 64 65 28 72 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 2e 72 65 6d 6f 76 65 4e 6f 64 65 28 72 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20
                        Data Ascii: v.doc = 0; v.objectProperty = 0 } } } r = t.getDiv(); t.emptyNode(r); t.removeNode(r);
                        2024-04-25 12:24:46 UTC8136INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 70 20 3f 20 70 2e 66 69 72 73 74 43 68 69 6c 64 20 7c 7c 20 6e 75 6c 6c 20 3a 20 6e 75 6c 6c 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 61 64 79 53 74 61 74 65 3a 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 70 20 3d 20 74 68 69 73 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 6a 2e 62 72 6f 77 73 65 72 2e 69 73 49 45 20 26 26 20 6a 2e 69 73 44 65 66 69 6e 65 64 28 6a 2e 70 64 2e 67 65 74 50 52 4f 50 28 70 2e 73 70 61 6e 28 29 2c 20 22 72 65 61 64 79 53 74 61 74 65 22 29 29 20 3f 20 6a 2e 70 64 2e 67 65 74 50 52 4f 50 28 70 2e 6f 62 6a 28 29 2c 20 22 72 65 61 64 79
                        Data Ascii: return p ? p.firstChild || null : null }, readyState: function() { var p = this; return j.browser.isIE && j.isDefined(j.pd.getPROP(p.span(), "readyState")) ? j.pd.getPROP(p.obj(), "ready
                        2024-04-25 12:24:46 UTC5583INData Raw: 6c 73 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 43 20 3d 20 64 6f 63 75 6d 65 6e 74 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 21 6a 2e 69 73 44 65 66 69 6e 65 64 28 70 29 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 20 3d 20 22 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 6a 2e 69 73 53 74 72 69 6e 67 28 74 29 20 26 26 20 28 2f 5b 5e 5c 73 5d 2f 29 2e 74 65 73 74 28 74 29 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 20 3d 20 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2e 72 65 70 6c 61 63 65 28 2f 5c 73 2f 67 2c 20 22
                        Data Ascii: lse { C = document } if (!j.isDefined(p)) { p = "" } if (j.isString(t) && (/[^\s]/).test(t)) { t = t.toLowerCase().replace(/\s/g, "


                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                        1192.168.2.54973023.54.200.130443
                        TimestampBytes transferredDirectionData
                        2024-04-25 12:24:48 UTC161OUTHEAD /fs/windows/config.json HTTP/1.1
                        Connection: Keep-Alive
                        Accept: */*
                        Accept-Encoding: identity
                        User-Agent: Microsoft BITS/7.8
                        Host: fs.microsoft.com
                        2024-04-25 12:24:48 UTC467INHTTP/1.1 200 OK
                        Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                        Content-Type: application/octet-stream
                        ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                        Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                        Server: ECAcc (chd/0712)
                        X-CID: 11
                        X-Ms-ApiVersion: Distribute 1.2
                        X-Ms-Region: prod-eus-z1
                        Cache-Control: public, max-age=153507
                        Date: Thu, 25 Apr 2024 12:24:48 GMT
                        Connection: close
                        X-CID: 2


                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                        2192.168.2.54973423.54.200.130443
                        TimestampBytes transferredDirectionData
                        2024-04-25 12:24:49 UTC239OUTGET /fs/windows/config.json HTTP/1.1
                        Connection: Keep-Alive
                        Accept: */*
                        Accept-Encoding: identity
                        If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT
                        Range: bytes=0-2147483646
                        User-Agent: Microsoft BITS/7.8
                        Host: fs.microsoft.com
                        2024-04-25 12:24:49 UTC531INHTTP/1.1 200 OK
                        Content-Type: application/octet-stream
                        Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                        ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                        ApiVersion: Distribute 1.1
                        Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                        X-Azure-Ref: 0rcGnYgAAAAANOnx9vccHTr21ROgX9ESTU0pDRURHRTAzMDkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm
                        Cache-Control: public, max-age=153494
                        Date: Thu, 25 Apr 2024 12:24:49 GMT
                        Content-Length: 55
                        Connection: close
                        X-CID: 2
                        2024-04-25 12:24:49 UTC55INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
                        Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


                        Session IDSource IPSource PortDestination IPDestination Port
                        3192.168.2.54974023.1.237.91443
                        TimestampBytes transferredDirectionData
                        2024-04-25 12:24:58 UTC2148OUTPOST /threshold/xls.aspx HTTP/1.1
                        Origin: https://www.bing.com
                        Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init
                        Accept: */*
                        Accept-Language: en-CH
                        Content-type: text/xml
                        X-Agent-DeviceId: 01000A410900D492
                        X-BM-CBT: 1696428841
                        X-BM-DateFormat: dd/MM/yyyy
                        X-BM-DeviceDimensions: 784x984
                        X-BM-DeviceDimensionsLogical: 784x984
                        X-BM-DeviceScale: 100
                        X-BM-DTZ: 120
                        X-BM-Market: CH
                        X-BM-Theme: 000000;0078d7
                        X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E
                        X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22
                        X-Device-isOptin: false
                        X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}
                        X-Device-OSSKU: 48
                        X-Device-Touch: false
                        X-DeviceID: 01000A410900D492
                        X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh
                        X-MSEdge-ExternalExpType: JointCoord
                        X-PositionerType: Desktop
                        X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI
                        X-Search-CortanaAvailableCapabilities: None
                        X-Search-SafeSearch: Moderate
                        X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time
                        X-UserAgeClass: Unknown
                        Accept-Encoding: gzip, deflate, br
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045
                        Host: www.bing.com
                        Content-Length: 2484
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1714047866016&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
                        2024-04-25 12:24:58 UTC1OUTData Raw: 3c
                        Data Ascii: <
                        2024-04-25 12:24:58 UTC2483OUTData Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49
                        Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
                        2024-04-25 12:24:58 UTC479INHTTP/1.1 204 No Content
                        Access-Control-Allow-Origin: *
                        Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                        X-MSEdge-Ref: Ref A: 3FBF1C7D9FF449F3904E8A464D339584 Ref B: LAX311000110049 Ref C: 2024-04-25T12:24:58Z
                        Date: Thu, 25 Apr 2024 12:24:58 GMT
                        Connection: close
                        Alt-Svc: h3=":443"; ma=93600
                        X-CDN-TraceID: 0.57ed0117.1714047898.aa75e3d


                        Statistics

                        CPU Usage

                        Click to jump to process

                        Memory Usage

                        Click to jump to process

                        Behavior

                        Click to jump to process

                        System Behavior

                        General

                        Target ID:0
                        Start time:14:24:35
                        Start date:25/04/2024
                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
                        Imagebase:0x7ff715980000
                        File size:3'242'272 bytes
                        MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:low
                        Has exited:false

                        General

                        Target ID:2
                        Start time:14:24:38
                        Start date:25/04/2024
                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=2016,i,1715222104164893096,13145483760006011228,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                        Imagebase:0x7ff715980000
                        File size:3'242'272 bytes
                        MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:low
                        Has exited:false

                        General

                        Target ID:3
                        Start time:14:24:43
                        Start date:25/04/2024
                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.corp-internal.co/ae90cbd9826866b7?l=8"
                        Imagebase:0x7ff715980000
                        File size:3'242'272 bytes
                        MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:low
                        Has exited:true

                        Disassembly

                        ⊘No disassembly