Edit tour

Windows Analysis Report
https://urlshortener.teams.cloud.microsoft/8DC6524B7BA4BE6-3-2

Overview

General Information

Sample URL:	https://urlshortener.teams.cloud.microsoft/8DC6524B7BA4BE6-3-2
Analysis ID:	1431670
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

HTML body contains low number of good links

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6460 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://urlshortener.teams.cloud.microsoft/8DC6524B7BA4BE6-3-2 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6956 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1972,i,12641275858175302215,10052665692327869527,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=4b3e8f46-56d3-427f-b1e2-d239b2ea6bca&redirect_uri=https%3A%2F%2Fteams.live.com%2Fgo&state=eyJpZCI6ImEyMDY2NDE4LTcyNjQtNGNmNC1iYTRjLTc4ZThiY2VlMjZiMyIsInRzIjoxNzE0MDUzNDUxLCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0%3D&nonce=539c480e-d8b2-40c4-9d3c-3d892a76377c&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&nopa=2&client-request-id=786f855e-c771-495a-ac7f-188dfe5e225c&response_mode=fragment	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=4b3e8f46-56d3-427f-b1e2-d239b2ea6bca&redirect_uri=https%3A%2F%2Fteams.live.com%2Fgo&state=eyJpZCI6ImEyMDY2NDE4LTcyNjQtNGNmNC1iYTRjLTc4ZThiY2VlMjZiMyIsInRzIjoxNzE0MDUzNDUxLCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0%3D&nonce=539c480e-d8b2-40c4-9d3c-3d892a76377c&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&nopa=2&client-request-id=786f855e-c771-495a-ac7f-188dfe5e225c&response_mode=fragment&sso_reload=true	HTTP Parser: Number of links: 0

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=4b3e8f46-56d3-427f-b1e2-d239b2ea6bca&redirect_uri=https%3A%2F%2Fteams.live.com%2Fgo&state=eyJpZCI6ImEyMDY2NDE4LTcyNjQtNGNmNC1iYTRjLTc4ZThiY2VlMjZiMyIsInRzIjoxNzE0MDUzNDUxLCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0%3D&nonce=539c480e-d8b2-40c4-9d3c-3d892a76377c&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&nopa=2&client-request-id=786f855e-c771-495a-ac7f-188dfe5e225c&response_mode=fragment	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=4b3e8f46-56d3-427f-b1e2-d239b2ea6bca&redirect_uri=https%3A%2F%2Fteams.live.com%2Fgo&state=eyJpZCI6ImEyMDY2NDE4LTcyNjQtNGNmNC1iYTRjLTc4ZThiY2VlMjZiMyIsInRzIjoxNzE0MDUzNDUxLCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0%3D&nonce=539c480e-d8b2-40c4-9d3c-3d892a76377c&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&nopa=2&client-request-id=786f855e-c771-495a-ac7f-188dfe5e225c&response_mode=fragment&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=4b3e8f46-56d3-427f-b1e2-d239b2ea6bca&redirect_uri=https%3A%2F%2Fteams.live.com%2Fgo&state=eyJpZCI6ImEyMDY2NDE4LTcyNjQtNGNmNC1iYTRjLTc4ZThiY2VlMjZiMyIsInRzIjoxNzE0MDUzNDUxLCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0%3D&nonce=539c480e-d8b2-40c4-9d3c-3d892a76377c&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&nopa=2&client-request-id=786f855e-c771-495a-ac7f-188dfe5e225c&response_mode=fragment&sso_reload=true

HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=4b3e8f46-56d3-427f-b1e2-d239b2ea6bca&redirect_uri=https%3A%2F%2Fteams.live.com%2Fgo&state=eyJpZCI6ImEyMDY2NDE4LTcyNjQtNGNmNC1iYTRjLTc4ZThiY2VlMjZiMyIsInRzIjoxNzE0MDUzNDUxLCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0%3D&nonce=539c480e-d8b2-40c4-9d3c-3d892a76377c&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&nopa=2&client-request-id=786f855e-c771-495a-ac7f-188dfe5e225c&response_mode=fragment	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=4b3e8f46-56d3-427f-b1e2-d239b2ea6bca&redirect_uri=https%3A%2F%2Fteams.live.com%2Fgo&state=eyJpZCI6ImEyMDY2NDE4LTcyNjQtNGNmNC1iYTRjLTc4ZThiY2VlMjZiMyIsInRzIjoxNzE0MDUzNDUxLCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0%3D&nonce=539c480e-d8b2-40c4-9d3c-3d892a76377c&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&nopa=2&client-request-id=786f855e-c771-495a-ac7f-188dfe5e225c&response_mode=fragment&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=4b3e8f46-56d3-427f-b1e2-d239b2ea6bca&redirect_uri=https%3A%2F%2Fteams.live.com%2Fgo&state=eyJpZCI6ImEyMDY2NDE4LTcyNjQtNGNmNC1iYTRjLTc4ZThiY2VlMjZiMyIsInRzIjoxNzE0MDUzNDUxLCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0%3D&nonce=539c480e-d8b2-40c4-9d3c-3d892a76377c&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&nopa=2&client-request-id=786f855e-c771-495a-ac7f-188dfe5e225c&response_mode=fragment&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=4b3e8f46-56d3-427f-b1e2-d239b2ea6bca&redirect_uri=https%3A%2F%2Fteams.live.com%2Fgo&state=eyJpZCI6ImEyMDY2NDE4LTcyNjQtNGNmNC1iYTRjLTc4ZThiY2VlMjZiMyIsInRzIjoxNzE0MDUzNDUxLCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0%3D&nonce=539c480e-d8b2-40c4-9d3c-3d892a76377c&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&nopa=2&client-request-id=786f855e-c771-495a-ac7f-188dfe5e225c&response_mode=fragment	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=4b3e8f46-56d3-427f-b1e2-d239b2ea6bca&redirect_uri=https%3A%2F%2Fteams.live.com%2Fgo&state=eyJpZCI6ImEyMDY2NDE4LTcyNjQtNGNmNC1iYTRjLTc4ZThiY2VlMjZiMyIsInRzIjoxNzE0MDUzNDUxLCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0%3D&nonce=539c480e-d8b2-40c4-9d3c-3d892a76377c&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&nopa=2&client-request-id=786f855e-c771-495a-ac7f-188dfe5e225c&response_mode=fragment&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=4b3e8f46-56d3-427f-b1e2-d239b2ea6bca&redirect_uri=https%3A%2F%2Fteams.live.com%2Fgo&state=eyJpZCI6ImEyMDY2NDE4LTcyNjQtNGNmNC1iYTRjLTc4ZThiY2VlMjZiMyIsInRzIjoxNzE0MDUzNDUxLCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0%3D&nonce=539c480e-d8b2-40c4-9d3c-3d892a76377c&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&nopa=2&client-request-id=786f855e-c771-495a-ac7f-188dfe5e225c&response_mode=fragment&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.46.200.91:443 -> 192.168.2.18:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.46.200.91:443 -> 192.168.2.18:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.18:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.18:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.253.33.200:443 -> 192.168.2.18:49777 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.40.205.35
Source: unknown	TCP traffic detected without corresponding DNS query: 23.40.205.35
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183

Source: global traffic	HTTP traffic detected: GET /8DC6524B7BA4BE6-3-2 HTTP/1.1Host: urlshortener.teams.cloud.microsoftConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+3LuncmL5GvGc6o&MD=ofF4+heM HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_l2bvdjfwt697xziuhxpwsg2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_4d4b76a02ae121e3b20c.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+3LuncmL5GvGc6o&MD=ofF4+heM HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: 120X-DeviceID: 01000A410900B03DX-BM-WindowsFlights: FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12E85C75X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAWtQnwbmX7VUoIL0A/0tuvmSMZ%2BUrAnALtIsyGvaqn6qiETbPN0SqiXClK1ON7nmG5huWfeacitoN9verPGjadPlbqSuFx/IlcU8VZniYn%2BjduDxGw29/39CJ8ex/eMHqeEJ3Uvh/hOEXKeozkjY3zO%2BW0tg5mv070rrp%2B1oqJqrpi5/5rqctXDElUyF7BBNvmOBevoKEqS5WQaW7xF4%2Bw8YSl9O82jw%2B6HIalQw8Aoq6Viy7ymyYKRg4Kyd8jwSd14lpuWubgVPxp33TymrpIuqYqeZpwaI1TeeVG8mEWSvYABLtZTJSjs0MzrrKorNjYM3UUjrPKWXEm3IU8kNsi8DZgAACM1847Xs3kD3qAHaU97LFBxO6d9AtzDDDxCglyNcSvu/TsIJFiWE02vohY9Tf5UHNE/vaa45XWFlcPqPJnRMgNVE7Z27Qfo4NzmZzvrZQmEpedh/CMCF9q5fQ2jQBZW3xUpHtwAwEv1PGLr4av8XqL7E1rGsiXSz2nEXC2ej8x7Btb1TYqEdgv0R7Kyz1iGJB8bnKSVEei9XsCLkZszBqgyw5VM7w00ciM0bdV3lWRSHzMMev2p6rbOX7AcfE54xFJf2HidiYcC3%2BvQCh6VwHG3lr2OgdMpQlErZ34YwFhzkLA/pgWsKmIbXXBEJdrDd1/V%2B2Imu6qaVtG2ISAPpDfWH%2BVPh9sJ6w8r7HwMqiKHLhBiHH6qgBNvxuQUx0iWZVNp9GTY2tMSds1V2%2BkAZUMphZmn1CjFjxgeE3vhHI/0ycKk6UEJIL8bkLRthkXgiGg8wXSbJ9CpY4XRF1RTkdE3CmGN9zPY3IcB7mpP0cSyxJgeO1tobr1MsA%2BpWgBLEYY4inl4W/SyR3KNSXMMfKYoVPWPqENW3uskui0DIXCaCN9HVaVNyoCK/%2BsUnlmbHSTDz2gE%3D%26p%3DX-Agent-DeviceId: 01000A410900B03DX-BM-CBT: 1714053490User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: B3ADC63356A4439E878B0AB53C27ABEAX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=B4BB39E5F80E411D94C438C0FA7ACF94&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&LUT=1707317051026&IPMH=6b344233&IPMID=1707317270835&HV=1707317277; ANON=A=680C1B1A649CBD64DD40EBFCFFFFFFFF; MUID=BC76BB0020D345C1A049A4820CB4C03C; MUIDB=BC76BB0020D345C1A049A4820CB4C03C

Source: global traffic	DNS traffic detected: DNS query: urlshortener.teams.cloud.microsoft
Source: global traffic	DNS traffic detected: DNS query: teams.live.com
Source: global traffic	DNS traffic detected: DNS query: statics.teams.cdn.live.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net

Source: chromecache_92.2.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_83.2.dr	String found in binary or memory: http://rock.mit-license.org
Source: chromecache_83.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_92.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_102.2.dr	String found in binary or memory: https://api.spaces.skype.com/.default
Source: chromecache_92.2.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_83.2.dr	String found in binary or memory: https://github.com/zloirock/core-js
Source: chromecache_102.2.dr	String found in binary or memory: https://local.teams.office.com/#/calendar?meetingId=AA
Source: chromecache_84.2.dr, chromecache_91.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_115.2.dr, chromecache_100.2.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: chromecache_115.2.dr, chromecache_100.2.dr	String found in binary or memory: https://login.microsoftonline.com/common/discovery/v2.0/keys
Source: chromecache_115.2.dr, chromecache_100.2.dr	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/token
Source: chromecache_95.2.dr, chromecache_87.2.dr	String found in binary or memory: https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration
Source: chromecache_84.2.dr, chromecache_91.2.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_113.2.dr	String found in binary or memory: https://statics.teams.cdn.live.net
Source: chromecache_113.2.dr	String found in binary or memory: https://statics.teams.cdn.live.net/hashedcss-launcher/launcher.d6cd10b8b26b2130799c.css
Source: chromecache_113.2.dr	String found in binary or memory: https://statics.teams.cdn.live.net/hashedjs-launcher/launcher.3c5b23498b3a051ad013.js
Source: chromecache_113.2.dr	String found in binary or memory: https://statics.teams.cdn.live.net/hashedjs-launcher/polyfills.1f5a03d113c6ac7b91f5.js
Source: chromecache_102.2.dr	String found in binary or memory: https://teams.live.com/api/mt

Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 23.46.200.91:443 -> 192.168.2.18:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.46.200.91:443 -> 192.168.2.18:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.18:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.18:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.253.33.200:443 -> 192.168.2.18:49777 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@18/75@22/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://urlshortener.teams.cloud.microsoft/8DC6524B7BA4BE6-3-2
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1972,i,12641275858175302215,10052665692327869527,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1972,i,12641275858175302215,10052665692327869527,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://urlshortener.teams.cloud.microsoft/8DC6524B7BA4BE6-3-2	0%	Virustotal		Browse
https://urlshortener.teams.cloud.microsoft/8DC6524B7BA4BE6-3-2	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label	Link
https://statics.teams.cdn.live.net	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js	0%	Avira URL Cloud	safe
https://statics.teams.cdn.live.net/hashedcss-launcher/launcher.d6cd10b8b26b2130799c.css	0%	Avira URL Cloud	safe
https://statics.teams.cdn.live.net/hashedjs-launcher/polyfills.1f5a03d113c6ac7b91f5.js	0%	Avira URL Cloud	safe
https://statics.teams.cdn.live.net/hashedjs-launcher/launcher.3c5b23498b3a051ad013.js	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js	0%	Virustotal		Browse
https://statics.teams.cdn.live.net	0%	Virustotal		Browse
https://statics.teams.cdn.live.net/hashedjs-launcher/polyfills.1f5a03d113c6ac7b91f5.js	0%	Virustotal		Browse
https://statics.teams.cdn.live.net/hashedcss-launcher/launcher.d6cd10b8b26b2130799c.css	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
part-0013.t-0009.t-msedge.net	13.107.246.41	true	false	unknown
cs1100.wpc.omegacdn.net	152.199.4.44	true	false	unknown
www.google.com	64.233.177.147	true	false	high
s-0005.dual-s-msedge.net	52.123.129.14	true	false	unknown
urlshortener.teams.cloud.microsoft	unknown	unknown	false	unknown
identity.nel.measure.office.net	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	unknown
statics.teams.cdn.live.net	unknown	unknown	false	unknown
login.microsoftonline.com	unknown	unknown	false	high
teams.live.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=4b3e8f46-56d3-427f-b1e2-d239b2ea6bca&redirect_uri=https%3A%2F%2Fteams.live.com%2Fgo&state=eyJpZCI6ImEyMDY2NDE4LTcyNjQtNGNmNC1iYTRjLTc4ZThiY2VlMjZiMyIsInRzIjoxNzE0MDUzNDUxLCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0%3D&nonce=539c480e-d8b2-40c4-9d3c-3d892a76377c&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&nopa=2&client-request-id=786f855e-c771-495a-ac7f-188dfe5e225c&response_mode=fragment&sso_reload=true	false		high
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=4b3e8f46-56d3-427f-b1e2-d239b2ea6bca&redirect_uri=https%3A%2F%2Fteams.live.com%2Fgo&state=eyJpZCI6ImEyMDY2NDE4LTcyNjQtNGNmNC1iYTRjLTc4ZThiY2VlMjZiMyIsInRzIjoxNzE0MDUzNDUxLCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0%3D&nonce=539c480e-d8b2-40c4-9d3c-3d892a76377c&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&nopa=2&client-request-id=786f855e-c771-495a-ac7f-188dfe5e225c&response_mode=fragment	false		high
https://teams.live.com/dl/launcher/launcher.html?url=%2F_%23%2Fl%2Fchat%2F19%3Auni01_2hqxtwyf57dbz2miswffeciw5d4epfpr7i4h5u5gvnh7pqd4slpq%40thread.v2%2Fconversations%3FtenantId%3D9188040d-6c67-4c5b-b112-36a304b66dad%26launchAgent%3DES%26laEntry%3DMAE%26v%3DMAE5%26lm%3Ddeeplink%26lmsrc%3Demail%26emltid%3D10459c8b-4325-4997-8dae-4b4abe8055d7%26linkpos%3D1%26emltype%3DNew_Activities_TFL%26linktype%3DNew_ChatActivity_TFL&type=chat&deeplinkId=bda27838-9a4c-4bf2-b95e-469b509bf49f&directDl=true&msLaunch=true&enableMobilePage=true&suppressPrompt=true	false		high
https://urlshortener.teams.cloud.microsoft/8DC6524B7BA4BE6-3-2	false		unknown
https://teams.live.com/?tenantId=9188040d-6c67-4c5b-b112-36a304b66dad#/l/chat/19:uni01_2hqxtwyf57dbz2miswffeciw5d4epfpr7i4h5u5gvnh7pqd4slpq@thread.v2/conversations?tenantId=9188040d-6c67-4c5b-b112-36a304b66dad&launchAgent=ES&laEntry=MAE&v=MAE5&lm=deeplink&lmsrc=email&emltid=10459c8b-4325-4997-8dae-4b4abe8055d7&linkpos=1&emltype=New_Activities_TFL&linktype=New_ChatActivity_TFL&deeplinkId=46105036-5060-4449-b6d3-8dc1b42e2e8b	false		high
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	chromecache_83.2.dr	false		high
https://login.microsoftonline.com/	chromecache_115.2.dr, chromecache_100.2.dr	false		high
https://github.com/zloirock/core-js	chromecache_83.2.dr	false		high
http://knockoutjs.com/	chromecache_92.2.dr	false		high
https://github.com/douglascrockford/JSON-js	chromecache_92.2.dr	false		high
https://login.windows-ppe.net	chromecache_84.2.dr, chromecache_91.2.dr	false		high
https://statics.teams.cdn.live.net/hashedjs-launcher/launcher.3c5b23498b3a051ad013.js	chromecache_113.2.dr	false	Avira URL Cloud: safe	unknown
https://teams.live.com/api/mt	chromecache_102.2.dr	false		high
https://api.spaces.skype.com/.default	chromecache_102.2.dr	false		high
https://statics.teams.cdn.live.net/hashedcss-launcher/launcher.d6cd10b8b26b2130799c.css	chromecache_113.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://login.microsoftonline.com	chromecache_84.2.dr, chromecache_91.2.dr	false		high
http://www.opensource.org/licenses/mit-license.php)	chromecache_92.2.dr	false		high
https://statics.teams.cdn.live.net/hashedjs-launcher/polyfills.1f5a03d113c6ac7b91f5.js	chromecache_113.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://rock.mit-license.org	chromecache_83.2.dr	false		high
https://statics.teams.cdn.live.net	chromecache_113.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration	chromecache_95.2.dr, chromecache_87.2.dr	false		high
https://login.microsoftonline.com/common/discovery/v2.0/keys	chromecache_115.2.dr, chromecache_100.2.dr	false		high
https://local.teams.office.com/#/calendar?meetingId=AA	chromecache_102.2.dr	false		high
https://login.microsoftonline.com/common/oauth2/v2.0/token	chromecache_115.2.dr, chromecache_100.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.41	part-0013.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.199.4.44	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
52.123.129.14	s-0005.dual-s-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
64.233.177.147	www.google.com	United States	15169	GOOGLEUS	false
13.107.213.41	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.18

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431670
Start date and time:	2024-04-25 15:56:45 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://urlshortener.teams.cloud.microsoft/8DC6524B7BA4BE6-3-2
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@18/75@22/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 108.177.122.94, 74.125.136.101, 74.125.136.100, 74.125.136.138, 74.125.136.102, 74.125.136.139, 74.125.136.113, 142.250.105.84, 34.104.35.123, 52.113.194.132, 23.40.207.80, 23.40.207.35, 23.6.117.32, 23.6.117.25, 20.189.173.27, 20.44.10.123, 40.126.29.9, 20.190.157.11, 40.126.29.10, 40.126.29.15, 40.126.29.5, 40.126.29.8, 40.126.29.13, 40.126.29.14, 40.126.28.11, 40.126.28.22, 40.126.28.12, 40.126.28.14, 40.126.7.35, 40.126.28.23, 40.126.28.20, 40.126.28.18, 40.126.29.7, 40.126.29.6, 40.126.29.12, 23.0.175.18, 23.0.175.57, 40.126.7.32, 40.126.28.13, 40.126.28.19, 40.126.28.21, 172.253.124.95, 172.217.215.95, 74.125.136.95, 142.250.105.95, 64.233.185.95, 142.251.15.95, 64.233.176.95, 74.125.138.95, 142.250.9.95, 64.233.177.95, 173.194.219.95, 108.177.122.95, 142.250.105.94, 108.177.122.113, 108.177.122.102, 108.177.122.138, 108.177.122.139, 108.177.122.100, 108.177.122.101
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, browser.events.data.trafficmanager.net, ak.privatelink.msidentity.com, a1894.dscb.akamai.net, onedscolprdcus05.centralus.cloudapp.azure.com, clients2.google.com, login.live.com, onedscolprdwus21.westus.cloudapp.azure.com, update.googleapis.com, login.mso.msidentity.com, www.bing.com, clients1.google.com, www.tm.ak.prd.aadg.trafficmanager.net, prdv4a.aadg.msidentity.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, aadcdnoriginwus2.azureedge.net, www.tm.ak.prd.aadg.akadns.net, www.tm.v4.a.prd.aadg.akadns.net, www.tm.v4.a.prd.aadg.trafficmanager.net, aadcdn.msauth.net, a1996.dscd.akamai.net, firstparty-azurefd-prod.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, nel.measure.office.net.edgesuite.net, s-0005.s-msedge.net, statics.teams.cdn.live.net.edgesuite.net, tfl-staticscdn.trafficmanager.net, aadcdnoriginwus2.afd.azureedge.net,
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 12:57:18 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9760696054064257
Encrypted:	false
SSDEEP:	48:8tXCdrT5FqHJHBidAKZdA1rehwiZUklqehgy+3:8d2VFqHD/y
MD5:	24A350E9023CE06D3416BB22586E0168
SHA1:	303FDB8E3979933F7ABDC959AE6F3C8116F6DE50
SHA-256:	1DFBEB21430233E59ADC7BF20B2E35C982D92D99DFB266A181D775744F362BC6
SHA-512:	47EF19B96278452BA2B0C3816E76BC3129C4E3E94BDCEA6099B8AE7A9389094D51FAE09F48253309533F94C6EEB4628292DE96884CCD311061309EC6A07DA108
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....M$.\|........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.X o....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X(o....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.X(o....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.X(o...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Xo.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............=.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 12:57:18 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9927178525334384
Encrypted:	false
SSDEEP:	48:8yCdrT5FqHJHBidAKZdA1ceh/iZUkAQkqehvy+2:8y2VFqH39QWy
MD5:	76552F7F13D2608602D3E29682602992
SHA1:	6F9F9478597D8B71BAADB3D3429D86EFAEED18A0
SHA-256:	C1D47FA5A5B75A45E825CB96596FD596E31CE4BF1BB06D9E1832BDB4A2391B8C
SHA-512:	D7E015B128FB70A3488B246296B0E9C1E6F0A32AB69003DA6D77B6DBDF2B3DDB8090A4D246B48D39B5FA809EE149A3E977AF5930E1DE2DF009968F8ACDA579F8
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......\|........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.X o....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X(o....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.X(o....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.X(o...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Xo.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............=.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 09:23:19 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2691
Entropy (8bit):	3.9998192460007815
Encrypted:	false
SSDEEP:	48:8XRCdrT5FqHSHBidAKZdA14Aeh7sFiZUkmgqeh7sly+BX:8h2VFqHgnLy
MD5:	E1C802EE6D54A2A0295805F5B62ABDD7
SHA1:	8EE3CC0CCDD809BB5E253FCA5060EECE34E89F30
SHA-256:	8B6B1919287737FF05A44E7597B6ED0172BE339B2E46A79213E9513F1C8C9DEC
SHA-512:	E6662EFC24CFDA8E52251B359BD145BAC4F6C000EEBD00F0799AAF42AD659C911742F00151D3268D6E73D31C18F4E6268E94063732F1CD15E2641D4C6A3A6F00
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....?.4 ?.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.X o....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X(o....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.X(o....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.X(o...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.R.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............=.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 12:57:18 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.988652961312566
Encrypted:	false
SSDEEP:	48:86CdrT5FqHJHBidAKZdA1JehDiZUkwqehTy+R:862VFqHCNy
MD5:	AFB3BF3712D12027D675DA2B751289A0
SHA1:	8FB6551893838DABE9193E6B674322B7814275A8
SHA-256:	A2BF7471A27E5CE7355F7F92D754DC9B5D9E2299CABBFE8F76856E6D88F08FC9
SHA-512:	B771B2BEA1275A208A87B48E439881937415DEF29CA0726359BE9EC7D420DCAEC1046F75C1709F9609D56AE8E907BE59407B7E58D5BC221B93855C48C0A4CCBC
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......\|........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.X o....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X(o....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.X(o....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.X(o...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Xo.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............=.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 12:57:18 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9795297411301043
Encrypted:	false
SSDEEP:	48:8kCdrT5FqHJHBidAKZdA1XehBiZUk1W1qehBy+C:8k2VFqHC9hy
MD5:	8A4D683B4CD5DC84C56EEAC9F3FCCBBA
SHA1:	D199071DDED8CFC2C36F83CAC2AA61C6C197A6C3
SHA-256:	CFF0E3A6C0EA9DCD253B766D9DFECE09548534FB7A1218F7B616045CD55A2012
SHA-512:	7DE082B18C71902526C43FB64CDFD2B02CEC8ED618D385095DEBFA3664A4D3AEAFC379FD61214B21D31D609A68CAD4836D6BE2B21D8124DAE4D3CF555DC62500
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......\|........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.X o....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X(o....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.X(o....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.X(o...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Xo.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............=.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 12:57:18 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9910672365693625
Encrypted:	false
SSDEEP:	48:8lCdrT5FqHJHBidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbLy+yT+:8l2VFqHWT/TbxWOvTbLy7T
MD5:	38169EB2EA636E684EAC43F9B3F1817F
SHA1:	A3E0AADC9E6C611879FA67A7D281216A18D7A5C8
SHA-256:	60B51A900EC50BFAD5E5ACD10BCBDD37FCB92DABF69BA261D5110AEBCE19371F
SHA-512:	B2D64570470B37EF8BB52634A620E59ACA6D0A910AD63FA617F9C977089A5B9D7C0D4537A576370E0AA87AD9D63C21F019931EB61DE5E5FF23826BA19587A033
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....3.\|........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.X o....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X(o....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.X(o....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.X(o...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Xo.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............=.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1547
Entropy (8bit):	4.63779068711367
Encrypted:	false
SSDEEP:	48:Ye2+seQykaO+sMzcijLiDT4+sOJhKdZKA2+sL32+s92+sPmoy04jl2+sv4szmZY7:ppseXXxsMzjSsOKHLpsTps9psPA06pst
MD5:	3E2129EC7EE0D22D5874D661893921C0
SHA1:	E6B20A5603F8B9292D46E2A74E32D1DDC6229196
SHA-256:	C45868384DFD77121A6D62BA32304628C211FDC6D471CB985348D731890B6E96
SHA-512:	77A8919A97B102AA90D47C0C34A40FC82ABC491CBF4D7C4BC5649E5D8ED504BAA088003521AF68DD8B23DE7DD61257A7E9A72FE6AB841C827639DD13CF8D30EA
Malicious:	false
Reputation:	low
Preview:	{"token_endpoint":"https://login.microsoftonline.com/common/oauth2/v2.0/token","token_endpoint_auth_methods_supported":["client_secret_post","private_key_jwt","client_secret_basic"],"jwks_uri":"https://login.microsoftonline.com/common/discovery/v2.0/keys","response_modes_supported":["query","fragment","form_post"],"subject_types_supported":["pairwise"],"id_token_signing_alg_values_supported":["RS256"],"response_types_supported":["code","id_token","code id_token","id_token token"],"scopes_supported":["openid","profile","email","offline_access"],"issuer":"https://login.microsoftonline.com/{tenantid}/v2.0","request_uri_parameter_supported":false,"userinfo_endpoint":"https://graph.microsoft.com/oidc/userinfo","authorization_endpoint":"https://login.microsoftonline.com/common/oauth2/v2.0/authorize","device_authorization_endpoint":"https://login.microsoftonline.com/common/oauth2/v2.0/devicecode","http_logout_supported":true,"frontchannel_logout_supported":true,"end_session_endpoint":"https:/

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 8 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Category:	downloaded
Size (bytes):	91302
Entropy (8bit):	5.083847889045784
Encrypted:	false
SSDEEP:	1536:59iJX9Lgm9iJX9Lgm9iJX9Lg/jHXZwuumF:54p4p4qXZwuumF
MD5:	2B4509D8A869917BBC5CE10982956619
SHA1:	DC21BD40ED9B873779F855026F253BDD3322723D
SHA-256:	397EDDF44E1BF7E557B0B4F5173DA95D8FD832B6F2F10D6E41C17DC539D5A822
SHA-512:	2D0A54E85C7BBDD653B1557A3741D44B621876503D6E8B8CFD5FC6BD3047E28B9702DFB132474DD3981174D96F994B46083008A327646C8D16467E80DA164BAB
Malicious:	false
Reputation:	low
URL:	https://statics.teams.cdn.live.net/hashedassets-launcher/favicon/favicon.ico
Preview:	............ ............... ............... ......7..``.... ......S..@@.... .(B......00.... ..%...).. .... ......O........ .h...>`...PNG........IHDR.............\r.f....pHYs..........o.d...:IDATx...{........Uu...f.......#ry.='^....1...A].q!...$^.2...`.h...&...0Q@7.=.{6.%z..-.]#....0.L.tW}.....KOOW.......Q...w..@)..RJ)..RJ)..RJ)..RJ)..R.....H...L[..7.j.....#.0..L.....y.U..@D%.i...g..3....x..Cd...R....-.^...nY...{..\..@.4..~.zz/..\|.....g..@6S......~....W.N...%.J....r.9G ./.2......_.`..L.b.7Z.%......["...1VB.;H.].o....~+....J....E..+>..h..............y...JH..mR..,..4.Y.Bp.k.+..#^..E...P.."&.{>.$D..y.Dz$ou..5'I.v....(r..GtKj...c;.P.\[.K...>..%....M..{...'.2.v.\...s..Fn..%....*77-.{.../....2..x..h....D..@..y......".....H.x._.p....D........=C../.(..%...._Z0...D..@....{O.3..%./d.q.3..@.h......#..........M.$=;P.z...$EL........80.-..I...,....@f..b;.?."rNf.F.9.@w.B...6)-.....o...;U...K..BLD..3.#.......3.%_.,P}...V...W....l.h.s.....3w..v.R...Rw.%

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (412)
Category:	downloaded
Size (bytes):	77254
Entropy (8bit):	4.026171311495582
Encrypted:	false
SSDEEP:	768:Vl3rSHX5qbXpci/bLS8wegFYoznIcNjx8RwEc1zGJVknmPyWd7BQyxvM2E:K6ai/bLS8wjYoznIcNWRwEc1zeXKsQXZ
MD5:	949453D1480A64378AD4536FB876114F
SHA1:	0D1858ADA65AAF0B993D253220DC5B5F6AFB04FE
SHA-256:	F76C464631DA0535CD4669C03BE3A08F9D4BA74520F1C4C0D4FC91C1CEFDA027
SHA-512:	8514E1597CC00EA9AAE4FB8ECD61D92EFB1D5F7B6F667DBDA14B1638CBC36BBC4E7300C24152BCD12F5C72E0D236D765EA1DE20307525182A1202CDF2126F3D7
Malicious:	false
Reputation:	low
URL:	https://statics.teams.cdn.live.net/authstrapjs/auth-js/authstrap_m1_v3.js
Preview:	"use strict";.var __assign = (this && this.__assign) \|\| function () {. __assign = Object.assign \|\| function(t) {. for (var s, i = 1, n = arguments.length; i < n; i++) {. s = arguments[i];. for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p)). t[p] = s[p];. }. return t;. };. return __assign.apply(this, arguments);.};.var teamspace;.(function (teamspace) {. var auth;. (function (auth) {. /*. WARNING: If you update this file you need to keep in mind that this file is compiled and inserting into Authstrap.html.. * Currently this file is served from local disc which is different from all other resources. Therefore be sure your change. * is backwards compat with the FE bits.. */. var CommonFrontDoorType;. (function (CommonFrontDoorType) {. // Not enabled. CommonFrontDoorType["None"] = "none";. // The primary site.

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 444227
Category:	downloaded
Size (bytes):	121212
Entropy (8bit):	7.9972852524966695
Encrypted:	true
SSDEEP:	1536:iD6XUiMe8qYwKDImT4zkhRc8JbmxMwGysvrO/Q0wjsFUUXbBHfy18nZIH9JxhmTK:wHHDZT33eAvrn0wjsm8Z0otE
MD5:	0868DA2DD5EFFED92904047439E49D48
SHA1:	D760173E5E6B25461B0D2A0B32D384FE659B2338
SHA-256:	8C41E973CB5EE0194EBF3BAA0716EEEB57EED53552F042E200190E3C37F08CFD
SHA-512:	9F430A42D5380D12C553255A324E347A37337E659D623F50314CF47FE52889FD4120F8DD2895DE3327ED97B65DE4E78C982DA966A3F5253286AB0DE0260817CB
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js
Preview:	...........m{.8....~.......%..J....Te;.3q..wS.<.D;..W..2.......e......X$H. .. .~.i....T........MexZ..\|v}\.....\.o.N...l.....O.?`..;v..U.....?t.x..N.....}'.L.hVI.Xe.G.27M...Ph..R..b.r...k..V.....O..J....~?..0J}.U.......VY...+....P...8J.IZ....'h$Y@z........2....Q...R.P3.....'..'.Q..:.G..\|...2Q....$...."..4..F..}..?.V.n......:@.[.i....O.b.T"..+D..q...9.$.ke.;!.\6...Lc.f,Lu .....?..".3..4..Y.cK.?...K6.T.L..Q.3.T....7...Y.Y.i:O....~.....h......I.u..:.}....r...8.W.1`P9.f....T....%.?..K....4?N.........."t...-..JX..+..O.._....o.;=.?....w...Q=`.4}8H..j...&w.p......F.....d...I.......W....:....[./..~@+5....."...V..wU..)TYe....?5......;........Vk..Jt.^.t.^6Z..:...!..I...j1K.qX..u.S......1.^.V.....Lk.Z..B.....,..z.;..G`..y..T`.tz...[5..q.*...E}K.[.b.&........Z...t..s..RO....m....s.IQ...+...Re....T...ag.0.F...T.}<].<Nt........ ..k..5..X....El_..w..\|..VC=...H$F..~r%..'U..!.k1=.e.)y!`)....Y.c%.....{.Kx.........s...dZ....^:3V..H..\|Sz.1%C..G..a2:v

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	46672
Entropy (8bit):	4.699890563164541
Encrypted:	false
SSDEEP:	768:fnUjUVjWqCODE7ZDP38TsXYfAMoM6wgjnlsuOK8TTI:fnUjkrE7ZDP38T8JZigbGKP
MD5:	570F11D9E530B70ED3FCC44B355C1D64
SHA1:	824EF8F872B2E7F86CF5AD2F6FFC6D2EE4018FDE
SHA-256:	DCDA18533910157B38C266C465CE4E099C77DAC8F2DB94C21BEDE074A5A7583C
SHA-512:	E0F36108A7D18109BB9A98D3D69D817F18F6AB13144669881179DFDB42BC46BD6DFF6F062F904AF3DD3FE06D4985398AE44E9CBC41E2FE0983C77BF60F3BB427
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 588 263">. <g clip-path="url(#a)">. <path fill="#56A84F" d="M480.181 94.4848c.244-7.9042 8.288-9.7641 8.497-16.5133.208-6.749-6.389-8.3956-5.95-16.2692.688-12.3156 13.271-11.9275 13.271-11.9275s12.583.3881 12.509 12.7227c-.047 7.8858-6.732 9.1226-6.941 15.8716-.208 6.7492 7.707 9.1015 7.463 17.0057-.244 7.9042-6.478 10.8312-6.696 17.9082-.219 7.077 4.918 9.855 4.611 19.803-.307 9.947-12.708 23.562-12.708 23.562l-3.069-.095s-11.537-14.353-11.23-24.301c.307-9.947 5.605-12.403 5.823-19.48.218-7.077-5.824-10.383-5.58-18.2872Z"/>. <path fill="#77D672" d="M510.893 147.675c2.762-8.968-.522-13.684-1.243-16.159-.72-2.475-1.271-3.241-.841-5.206.382-1.737.855-2.644 3.174-3.976 2.617-1.505 5.876-3.377 7.218-7.855 1.256-4.195.517-7.633-.134-10.665-.508-2.363-.947-4.4019-.329-6.4639.426-1.424 1.181-1.7644 3.296-2.5402 2.384-.8738 5.647-2.0697 7.656-6.298 4.659-9.8042-2.252-16.5148-6.557-18.6934-.282-.1424-2.851-1.3992-6.241-1.59

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65449)
Category:	downloaded
Size (bytes):	727637
Entropy (8bit):	5.392624931706444
Encrypted:	false
SSDEEP:	6144:BzoNDcDzTDZqLLWkYx2H2quAi07Fkmoml9JlsObw1Zk220HBz1JCY8U4UYUKuIaC:BzoNE07FkmTp3CBgpWC
MD5:	1C620C053F64B1CC6580EB0976B03CF1
SHA1:	CE0F97846637599FDBA6C151FE37CF5B932DFCE0
SHA-256:	DE1C3258200DE22E0EB2850183FBC4EA15A1E39C4C5D979B88015D4EEA549F3B
SHA-512:	9C05543F692058A4913AE50186BDC44E1227EE40F7DB25A3F07DB6356392E66DADFAD7D106AB3EDA055944D82801170F4636A46E04E25AF9C5929C3BF97AAED3
Malicious:	false
Reputation:	low
URL:	https://statics.teams.cdn.live.net/hashedjs-launcher/launcher.3c5b23498b3a051ad013.js
Preview:	/! For license information please see launcher.3c5b23498b3a051ad013.js.LICENSE.txt /.!function(){var e={1247:function(e,t){"use strict";var n;Object.defineProperty(t,"__esModule",{value:!0}),(n=t._BondDataType\|\|(t._BondDataType={}))[n._BT_STOP=0]="_BT_STOP",n[n._BT_STOP_BASE=1]="_BT_STOP_BASE",n[n._BT_BOOL=2]="_BT_BOOL",n[n._BT_DOUBLE=8]="_BT_DOUBLE",n[n._BT_STRING=9]="_BT_STRING",n[n._BT_STRUCT=10]="_BT_STRUCT",n[n._BT_LIST=11]="_BT_LIST",n[n._BT_MAP=13]="_BT_MAP",n[n._BT_INT32=16]="_BT_INT32",n[n._BT_INT64=17]="_BT_INT64"},6601:function(e,t,n){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var r=n(1953),i=n(8833),o=n(1486);t._Utf8_GetBytes=function(e){for(var t=[],n=0;n<e.length;++n){var r=e.charCodeAt(n);r<128?t.push(r):r<2048?t.push(192\|r>>6,128\|63&r):r<55296\|\|r>=57344?t.push(224\|r>>12,128\|r>>6&63,128\|63&r):(r=65536+((1023&r)<<10\|1023&e.charCodeAt(++n)),t.push(240\|r>>18,128\|r>>12&63,128\|r>>6&63,128\|63&r))}return t},t._Base64_GetString=function(e){for(var t,n="ABCDE

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 8 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Category:	dropped
Size (bytes):	91302
Entropy (8bit):	5.083847889045784
Encrypted:	false
SSDEEP:	1536:59iJX9Lgm9iJX9Lgm9iJX9Lg/jHXZwuumF:54p4p4qXZwuumF
MD5:	2B4509D8A869917BBC5CE10982956619
SHA1:	DC21BD40ED9B873779F855026F253BDD3322723D
SHA-256:	397EDDF44E1BF7E557B0B4F5173DA95D8FD832B6F2F10D6E41C17DC539D5A822
SHA-512:	2D0A54E85C7BBDD653B1557A3741D44B621876503D6E8B8CFD5FC6BD3047E28B9702DFB132474DD3981174D96F994B46083008A327646C8D16467E80DA164BAB
Malicious:	false
Reputation:	low
Preview:	............ ............... ............... ......7..``.... ......S..@@.... .(B......00.... ..%...).. .... ......O........ .h...>`...PNG........IHDR.............\r.f....pHYs..........o.d...:IDATx...{........Uu...f.......#ry.='^....1...A].q!...$^.2...`.h...&...0Q@7.=.{6.%z..-.]#....0.L.tW}.....KOOW.......Q...w..@)..RJ)..RJ)..RJ)..RJ)..R.....H...L[..7.j.....#.0..L.....y.U..@D%.i...g..3....x..Cd...R....-.^...nY...{..\..@.4..~.zz/..\|.....g..@6S......~....W.N...%.J....r.9G ./.2......_.`..L.b.7Z.%......["...1VB.;H.].o....~+....J....E..+>..h..............y...JH..mR..,..4.Y.Bp.k.+..#^..E...P.."&.{>.$D..y.Dz$ou..5'I.v....(r..GtKj...c;.P.\[.K...>..%....M..{...'.2.v.\...s..Fn..%....*77-.{.../....2..x..h....D..@..y......".....H.x._.p....D........=C../.(..%...._Z0...D..@....{O.3..%./d.q.3..@.h......#..........M.$=;P.z...$EL........80.-..I...,....@f..b;.?."rNf.F.9.@w.B...6)-.....o...;U...K..BLD..3.#.......3.%_.,P}...V...W....l.h.s.....3w..v.R...Rw.%

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	low
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 223759
Category:	downloaded
Size (bytes):	54325
Entropy (8bit):	7.996017457525811
Encrypted:	true
SSDEEP:	768:MBOXdNQNgHZp9Ga0EqoitKVFF9dMVtakANyFeDpz3ZSgaDpk4JGUISrX+pk7RU/P:bDQNg5pFneONYu9ZpfUv7+m7aITS2Du
MD5:	799F880143F17E47C4EFDBB3FF35A54C
SHA1:	8CECC74EB422322F78EDE1111F175A28725CCA9F
SHA-256:	EA70CC2977F4DEB5236041A7A0628FA671FB8AD20A5E9E3FD6885A11359EF2FE
SHA-512:	46E811AA3D03023596B47DB39B6FABCC1A4B7388C7F0A187A4C23B024695593702A70227F5B770174A258A265A48D4F87EF01281210229E51022E9BC6948214B
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js
Preview:	...........k{.F.0.}...gF.L."..eR..v.y.O....g...............~...@....f<...F./...u...;............x.y.C...y...sx.....^=}.....N.W.I.Y$.....".w....$..\|..a...+.7O.eg.gW..2...8..2)J..<^f.:.4..;....<}.....ZK.......5..,;iV&Q...9......;U:....$....DyVd....Q...N......N..".;.,//.8...X..ZP7......&shpA...a.I.C\U0i.&K..}m..1..9.N.u....^.'I/:......r...a^Ee.f..oq..e'..y..U..;...T(...<L..;X.."..8-}.^L.._w.....f.w..V.x.kK..K../.A..[....oE....G..ao0...\........Qv.7..eX..70.....\|.s.}.#...:..t...$.}=....s..g.}Q..........SO.....p.%..v..\|.Fo.. ..,e.......=;;..7....J#......{7o....;.........<..?.....G._..}..(..k?....2.......J.E.z.^.O.....}...XWe.....O...,C...+......O.r..he.............$Y.;..?).y....&.$..u..m.~.Z...2./..\|9..(.m....W.8.?QO}.....]....Y..z..=..2........>..8...87.&..ajn.m.E.,.<...n.t..`......\|..s7..v.w.z....d{...m.^..Y..AA...,C^...:0.~A.]....,...........6xR..8.p,./?..~v.+../c..Z...$.....Ysg....U....H....._q....o..acC...fpv.fb.....\|.?.-V

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (16913), with no line terminators
Category:	downloaded
Size (bytes):	16929
Entropy (8bit):	4.96322254058682
Encrypted:	false
SSDEEP:	384:P7L7e7e7e7n70ZZkybCgKX6v169F7sV4Jz3ECGR7sjFtUQkwcuj3egT1gF7OU6Oi:P7L7e7e7e7n70Y+CgKqv16LsV4JzUCjx
MD5:	5125FEC98454804FDF6FFBF4F41DADF0
SHA1:	0DC560C437FA2D16530E59BD90328E41CAD7AF33
SHA-256:	BA1F5F0A795411C9E3EBBA6F38F44E93EAEE918F23E52315858FBAC841B8D0B3
SHA-512:	400F57023C0E252BA92B6A40396E32B77D39109C50A59ADAB426EBB72EB26BF186FC4255B84CB2D9524D7EB033C778E33C709507270C9256D9FF55FA5A4F2E36
Malicious:	false
Reputation:	low
URL:	https://teams.live.com/dl/launcher/launcher.html?url=%2F_%23%2Fl%2Fchat%2F19%3Auni01_2hqxtwyf57dbz2miswffeciw5d4epfpr7i4h5u5gvnh7pqd4slpq%40thread.v2%2Fconversations%3FtenantId%3D9188040d-6c67-4c5b-b112-36a304b66dad%26launchAgent%3DES%26laEntry%3DMAE%26v%3DMAE5%26lm%3Ddeeplink%26lmsrc%3Demail%26emltid%3D10459c8b-4325-4997-8dae-4b4abe8055d7%26linkpos%3D1%26emltype%3DNew_Activities_TFL%26linktype%3DNew_ChatActivity_TFL&type=chat&deeplinkId=bda27838-9a4c-4bf2-b95e-469b509bf49f&directDl=true&msLaunch=true&enableMobilePage=true
Preview:	<!doctype html><html lang="en-US" dir="ltr" class="ltr"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="googlebot" content="noindex, nofollow"><meta name="robots" content="noindex, nofollow"><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="shortcut icon" href="https://statics.teams.cdn.live.net/hashedassets-launcher/favicon/favicon.ico" type="image/x-icon"><link rel="apple-touch-icon" href="https://statics.teams.cdn.live.net/hashedassets-launcher/favicon/favicon-96x96.png"><link rel="apple-touch-icon" sizes="16x16" href="https://statics.teams.cdn.live.net/hashedassets-launcher/favicon/favicon-16x16.png"><link rel="apple-touch-icon" sizes="32x32" href="https://statics.teams.cdn.live.net/hashedassets-launcher/favicon/favicon-32x32.png"><link rel="apple-touch-icon" sizes="96x96" href="https://statics.teams.cdn.live.net/hashedassets-launcher/favicon/favicon-96x96.png"><met

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	low
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	1547
Entropy (8bit):	4.63779068711367
Encrypted:	false
SSDEEP:	48:Ye2+seQykaO+sMzcijLiDT4+sOJhKdZKA2+sL32+s92+sPmoy04jl2+sv4szmZY7:ppseXXxsMzjSsOKHLpsTps9psPA06pst
MD5:	3E2129EC7EE0D22D5874D661893921C0
SHA1:	E6B20A5603F8B9292D46E2A74E32D1DDC6229196
SHA-256:	C45868384DFD77121A6D62BA32304628C211FDC6D471CB985348D731890B6E96
SHA-512:	77A8919A97B102AA90D47C0C34A40FC82ABC491CBF4D7C4BC5649E5D8ED504BAA088003521AF68DD8B23DE7DD61257A7E9A72FE6AB841C827639DD13CF8D30EA
Malicious:	false
Reputation:	low
URL:	https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration
Preview:	{"token_endpoint":"https://login.microsoftonline.com/common/oauth2/v2.0/token","token_endpoint_auth_methods_supported":["client_secret_post","private_key_jwt","client_secret_basic"],"jwks_uri":"https://login.microsoftonline.com/common/discovery/v2.0/keys","response_modes_supported":["query","fragment","form_post"],"subject_types_supported":["pairwise"],"id_token_signing_alg_values_supported":["RS256"],"response_types_supported":["code","id_token","code id_token","id_token token"],"scopes_supported":["openid","profile","email","offline_access"],"issuer":"https://login.microsoftonline.com/{tenantid}/v2.0","request_uri_parameter_supported":false,"userinfo_endpoint":"https://graph.microsoft.com/oidc/userinfo","authorization_endpoint":"https://login.microsoftonline.com/common/oauth2/v2.0/authorize","device_authorization_endpoint":"https://login.microsoftonline.com/common/oauth2/v2.0/devicecode","http_logout_supported":true,"frontchannel_logout_supported":true,"end_session_endpoint":"https:/

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 8 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Category:	dropped
Size (bytes):	91302
Entropy (8bit):	5.083847889045784
Encrypted:	false
SSDEEP:	1536:59iJX9Lgm9iJX9Lgm9iJX9Lg/jHXZwuumF:54p4p4qXZwuumF
MD5:	2B4509D8A869917BBC5CE10982956619
SHA1:	DC21BD40ED9B873779F855026F253BDD3322723D
SHA-256:	397EDDF44E1BF7E557B0B4F5173DA95D8FD832B6F2F10D6E41C17DC539D5A822
SHA-512:	2D0A54E85C7BBDD653B1557A3741D44B621876503D6E8B8CFD5FC6BD3047E28B9702DFB132474DD3981174D96F994B46083008A327646C8D16467E80DA164BAB
Malicious:	false
Reputation:	low
Preview:	............ ............... ............... ......7..``.... ......S..@@.... .(B......00.... ..%...).. .... ......O........ .h...>`...PNG........IHDR.............\r.f....pHYs..........o.d...:IDATx...{........Uu...f.......#ry.='^....1...A].q!...$^.2...`.h...&...0Q@7.=.{6.%z..-.]#....0.L.tW}.....KOOW.......Q...w..@)..RJ)..RJ)..RJ)..RJ)..R.....H...L[..7.j.....#.0..L.....y.U..@D%.i...g..3....x..Cd...R....-.^...nY...{..\..@.4..~.zz/..\|.....g..@6S......~....W.N...%.J....r.9G ./.2......_.`..L.b.7Z.%......["...1VB.;H.].o....~+....J....E..+>..h..............y...JH..mR..,..4.Y.Bp.k.+..#^..E...P.."&.{>.$D..y.Dz$ou..5'I.v....(r..GtKj...c;.P.\[.K...>..%....M..{...'.2.v.\...s..Fn..%....*77-.{.../....2..x..h....D..@..y......".....H.x._.p....D........=C../.(..%...._Z0...D..@....{O.3..%./d.q.3..@.h......#..........M.$=;P.z...$EL........80.-..I...,....@f..b;.?."rNf.F.9.@w.B...6)-.....o...;U...K..BLD..3.#.......3.%_.,P}...V...W....l.h.s.....3w..v.R...Rw.%

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	low
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 55071
Category:	downloaded
Size (bytes):	15799
Entropy (8bit):	7.985179973188672
Encrypted:	false
SSDEEP:	384:UwXl87i4naaFtPESJ2DWOq1IcQS0SL7EOONPk:UwXW7i4naTSOAszOG8
MD5:	978A6C1AA934E5B1C5320D515FD25662
SHA1:	64636EF3E1AD607F095DBA6CB01447AC133B483D
SHA-256:	D1963B1837F4087E988FD18BB4CF25B38D61D675C4B6A6FC01158BD39945F10A
SHA-512:	411A51CC19890DC5B27E4800E5BB4BFB4D0E3DC076010C6AB8B10396524F4C996D86420888AF3A1632D5FB281CEB4373C18B0EEFC9F8A84AA59D295450393DA7
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_l2bvdjfwt697xziuhxpwsg2.js
Preview:	...........}Ms#G.....uh.O=.>...4..p.O$...P.IF4.".K....1..5.......7.\|.....S6..w8?......9...B.AwUeeeeeefee..f.Oc/._..G.............{..._..%.q..q........j<.w..O.7..."pgbV.C..k.T`..X....'v....<p....I.'..k<j@Ai..NP.6<..j..N.....0.......=..ox/+...9.sB..p.q.ai...?.....qw.D.X..b..?.bOD.x.B1..X..`.N..b..E...%JWg..x8.ys..:...I.....b1...q.......[..a..7q..N........._..4....&.. ........m&6.F.\.@.e.B..`.'.....0............]/.........`..iZ6......./f8..BCz_...i....MQ>..E,/x>v......{.........._.........Z.rP+......e..R.\.Z.u..3@./.oJ7.'.......%.;.WP.9.b..z._..b....0......X...Ro^k.lI..t..K7~.ep.`.)......'."".."....../..S....M..B5nEc2..g..m..\|f.{...pbi(.0.@[_Lc.Z.....U`./!..@.....p.-..kQ@T..8...-...0.....AX.D.?...".....5.NE..\...VQa.....,......?..M.0......_<......C..fOq..bz'..z/BF.;&.K......%.....g........f!..^.:Z...g...j...7.._........S.2/.2.n.....>.<P!!.Bv..J........e!d....B.Ra$.......N........> f.C.....^.D.-.e.c+...............!....$.9x...{.....p~._.0.

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	low
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113084
Category:	downloaded
Size (bytes):	20314
Entropy (8bit):	7.979540464295058
Encrypted:	false
SSDEEP:	384:ekqQ8rNFEhCgMyL2iww6oIR8mWG+Pu9Z5IM6mxqrghTvUty7T9Q:9CGEiL/w7R8DW9Z5B6AasTv37T9Q
MD5:	92A840DC3D177339DAE03FEDF22A22B5
SHA1:	C1C9A6E6442388D07A9D9D72C12DA25094D6920F
SHA-256:	4A986BA8875F22A0EABC356112A6790F90E114ADB72EAEC4632E03812EC1EDE4
SHA-512:	98C705395DD249501D8069A03E0068BC9CCF4F2D139BEC63A00564C69CD21C05CB25CF56BA7B40822963737989D5048AD310E20D6022E84346C982CFCEF79E11
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css
Preview:	...........}ks.6.....\.R;.J.H=-WR;..&>g^53.G.R[.DY<C..$e.WG..... )...{+'g...l............bw_f7.:x..<x.-.V5)/wE..Y...gy.0.(.-o.e.\|..._..I.....?<{.!x...W..._..^..p..E..'..Y...<.....]..6(. ..D.....Y.......:.ve.?..!..\|t...].+.......a.......\|.P...u.H.d.d.r.c[..~.L..n.-.}e.H3...r..^..iP.u..z.....)..Z.jx..C'......u..{.C...N.o.m~..F(b..f.....h..O.....6....kr.......n2m M$.R..R..i{.~.....n.dKY..#.Kn.4..G...O..l.#.a=..iU..].S.2.wY..O.\|...Z.A....].uU.._%U.<...pp..u=.....C.R..S.....0...A<......&...W..'o.T.."..jO..^+.....DiW.b..7i..7..........lKe.0.~B0.....zQu#...YB.,.{.&.6..G.6..._...J.i.?.LS$( .^.{..u.-.0....K....M&j..s.yB..+....^.)...7e.....]..eFI_.kRX.B......D[.4......+.u=>....R.`QEK...R..d...*S.. ,c5RKBK(......][..eF{T.....6...".....Uk:..S.0Ro.}B.dwJZ}U..S.F.....&.&.~\|......{..Ep.>x..._....}p..=.}...v...7?}...g..1&.......}...^...o.x.>x...../.^....._.........w.v./.........BA...{J..w..$?.}w....?zO.r..5...7.gl..z...g.?.{....R.......yGj

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113657
Category:	downloaded
Size (bytes):	35813
Entropy (8bit):	7.9933603091137355
Encrypted:	true
SSDEEP:	768:GuwXn8kBZAqgpsnCq63v9K6eodOamRz3YkdBSqwSsg84Yk5RFB6:Jc8kBBnChQodOamRz3YQFSLk3q
MD5:	57911010756C90D58754C91EF1EE2765
SHA1:	BAA48FEF4866D7DAFD9F59417745EE838F0E63CA
SHA-256:	87C5385BA17F84CC25FB7BBE1EDB4169BC702842BD74B758ACDC130986D55BC2
SHA-512:	FF5A7B638CD9117C89C277F6846506D41768D3A30F81B63768379294160AEE89F0D60E853F938D28A654226E18FE3389808ECCDA7D106F76EBE95A53A00DD560
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57.js
Preview:	...........{..8.(.........,.-.......gglu.. .m..I....~..oRv......i.(....P(......k............o.6>.\|..d..........O...V..}.G..4......9.l..F.mDI.f.4...o,..EA.1...F1g..,...E..Gy...,No6.@..l....n..;....P.fQ...ty...b#I.(d.A2!j1$..m....6n.Q8.x..Y...b#c!....\|.p..w#..F..i..s.Gc..b..9U.k......&@pJ..'40J......e.$.k.L(b...F.n.+..nO..6@n...A.&.,LVa......Y......V..o..% ....,......:..e.-XR. <FE.w..b..P......r.b.["~..!.....y.......V...4.;M..Y.X.{.......0].N..,.r`=...Mv....;...k....w.1p.q...(.u.3....;).. }...s....'....c...o.d....Ax.W..._...?.9...........3..MWI..3.p3..u.m$~Vo:n.'.8..!5h....y...6=7...hz.......f.-.).......Nc..:...g...~.8..4.....0P......$.=.a....#._..3.t..7Q...-....6..j.\|....5-...B...}.VQ.&/...e.XeI.C../.y...{...1...Y..g..`'..F..h.o.]SHW...,..Ac_%y...M..u.O..U..`.&...Y.}....Tu..z..iv.....5..M.q.. .Bz.,..oSS.%..y.....gS1s.(.........%,fE.m.@~.4.........7.x.$0mQ..o....J.J^....~......u!.~Z.iw.b...Q~).=..Tq.:.7HH.E.&6.D`.(..Cxmf.(o...^y_.v.{..K<Y.5.

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (32062)
Category:	downloaded
Size (bytes):	206103
Entropy (8bit):	5.389993237776146
Encrypted:	false
SSDEEP:	6144:BrsXEo/GApIN5smQi1adf71PxyPcAKd8Mh5rUlyGAsnn:cJuACiX38Mh5mn
MD5:	6F216E8CCC75B0546E4C6B08EF6B315D
SHA1:	9197148E5BF973F64E0FF23CABB413A014424A5D
SHA-256:	BADD4EEE14E40C55248444F234FED775A1A813EEDC98FFFE3A01C0420064562D
SHA-512:	DF60630C89B2BA15DBC9D58EFD77BF1DDBF4504D46638433F1C8D2D032833F7DB4CDB80888BEEA6BE1CC92627B00CB6A55EB568664C7DE61E243317F7332DBF1
Malicious:	false
Reputation:	low
URL:	https://statics.teams.cdn.live.net/authstrapjs/auth-js/teams_enterprise_m1.js
Preview:	/* eslint-disable /. /. core-js 2.4.1. * https://github.com/zloirock/core-js. * License: http://rock.mit-license.org. * .. 2016 Denis Pushkarev. */. !function(a,b,c){"use strict";!function(a){function __webpack_require__(c){if(b[c])return b[c].exports;var d=b[c]={exports:{},id:c,loaded:!1};return a[c].call(d.exports,d,d.exports,__webpack_require__),d.loaded=!0,d.exports}var b={};return __webpack_require__.m=a,__webpack_require__.c=b,__webpack_require__.p="",__webpack_require__(0)}([function(a,b,c){c(1),c(50),c(51),c(52),c(54),c(55),c(58),c(59),c(60),c(61),c(62),c(63),c(64),c(65),c(66),c(68),c(70),c(72),c(74),c(77),c(78),c(79),c(83),c(86),c(87),c(88),c(89),c(91),c(92),c(93),c(94),c(95),c(97),c(99),c(100),c(101),c(103),c(104),c(105),c(107),c(108),c(109),c(111),c(112),c(113),c(114),c(115),c(116),c(117),c(118),c(119),c(120),c(121),c(122),c(123),c(124),c(126),c(130),c(131),c(132),c(133),c(137),c(139),c(140),c(141),c(142),c(143),c(144),c(145),c(146),c(147),c(148),c(149),c(150),c(151),

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2345), with CRLF line terminators
Category:	downloaded
Size (bytes):	2347
Entropy (8bit):	5.290031538794594
Encrypted:	false
SSDEEP:	48:gCgF0+kNL5iQ6+GhB+SYWzGuesAFcsGJOzgO6FIEv+sj+M++sx+suse+swsosmC0:gC3Na5+GX+Ti2XsYE2sqAsosushswsoB
MD5:	E86EF8B6111E5FB1D1665BCDC90888C9
SHA1:	994BF7651CB967CD9053056AF2D69ACB74DB7F29
SHA-256:	3410242720DE50B090D07A23AEE2DAD879B31D36F2615732962EC4CFA8A9D458
SHA-512:	2486B491681EE91A9CD1ECC9AA011A3FB34B48358C5D7A4D503A5357BC5CE4CA22999F918D40AC60A3063940D5F326FC7E4E5713D89D5C102DE68824E371B3AB
Malicious:	false
Reputation:	low
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(n,t){for(var e in t)n[e]=t[e]}(this,function(n){function t(i){if(e[i])return e[i].exports;var s=e[i]={exports:{},id:i,loaded:!1};return n[i].call(s.exports,s,s.exports,t),s.loaded=!0,s.exports}var e={};return t.m=n,t.c=e,t.p="",t(0)}([function(n,t){function e(n){for(var t=g[c],e=0,i=t.length;e<i;++e)if(t[e]===n)return!0;return!1}function i(n){if(!n)return null;for(var t=n+"=",e=document.cookie.split(";"),i=0,s=e.length;i<s;i++){var o=e[i].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===o.indexOf(t))return o.substring(t.length)}return null}function s(n,t,e){if(n)for(var i=n.split(":"),s=null,o=0,a=i.length;o<a;++o){var l=null,c=i[o].split("$");if(0===o&&(s=parseInt(c.shift()),!s))return;var p=c.length;if(p>=1){var f=r(s,c[0]);if(!f\|\|e[f])continue;l={signInName:f,idp:"msa",isSignedIn:!0}}if(p>=3&&(l.firstName=r(s,c[1]),l.lastName=r(s,c[2])),p>=4){var g=c[3],m=g.split("\|");l.otherHashedAliases=m}if(p>=5){var h=parseInt(c[4],16);h&&(l.

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	5621
Entropy (8bit):	4.2543291215767
Encrypted:	false
SSDEEP:	96:Rf6psAY2NMgC2s2K2U72u+qz3L3K2AtLP5y2YTDzGKOMSH0H2u+qz3LZ:96pNNlC7yu+qYVP42YTDz9S1u+qx
MD5:	EE0F7622A71A597595C5A8FB2F89A097
SHA1:	0D9768FDBA8B1D89A6DBA27D5CECC27737BF5CDD
SHA-256:	433388EFC4567EF14D3FED6F2DA976D457D43D09F6753E289C7FE544E0175281
SHA-512:	55E1161AC6A533B67FA3D073691E936090019B10283BC40F248F47DA38788A7A00FAF307BD5001B6327DAF38F874DC578A0CD212ECCF94520801C37DF668D9FF
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.<svg class="msft-teams-logo" version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 141.5 16.2" style="enable-background:new 0 0 141.5 16.2;" xml:space="preserve">.<style type="text/css">...msft-teams-logo .st0{fill:#5b5fc7;}.</style>.<g>..<path class="st0" d="M15.2,16h-1.7V6c0-0.8,0-1.8,0.1-2.9h0c-0.1,0.5-0.3,1-0.4,1.4L8,16H7.2L2.1,4.6c-0.2-0.5-0.3-1-0.4-1.5h0...C1.7,3.7,1.7,4.6,1.7,6v10H0V1.1h2.3l4.6,10.4c0.3,0.6,0.5,1.2,0.7,1.8h0.1c0.3-0.8,0.5-1.4,0.7-1.8L13,1.1h2.2V16z"/>..<path class="st0" d="M19.1,2.6c-0.3,0-0.6-0.1-0.8-0.3C18.1,2.1,18,1.8,18,1.5c0-0.6,0.5-1.1,1.1-1.1c0,0,0,0,0,0...c0.3,0,0.6,0.1,0.8,0.3c0.4,0.4,0.4,1.1,0,1.6c0,0,0,0,0,0C19.7,2.5,19.4,2.6,19.1,2.6z M19.9,16h-1.7V5.3h1.7V16z"/>..<path class="st0" d="M29.9,15.5c-0.9,0.5-1.9,0.8-2.9,0.7c-1.4,0.1-2.7-0.5-3.7-1.5c-1-1-1.5-2.4-1.4-3.8c-0.1-1.5,0.5-3.1,1.5-4.2...c1-1.1,2.5-1.7,4-1.6c0.9,0,1.7,0.2,2.5,0

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	950
Entropy (8bit):	4.48198966493377
Encrypted:	false
SSDEEP:	24:YE/O+si8Gv8+sarUM+sd+8sAIse/sv+sOd+sIM+sX+sxd+sBM+s7sarzsA6sa:YE2+sRp+sWUM+sd+8sAIse/sv+sOd+sd
MD5:	9FCE93410EB828E0EDF41D3F021D93E2
SHA1:	1584BC813F34E9B7356C6BD05CB2A14EC52E1590
SHA-256:	F463580C98FD336D4E69E7DCA36CF345A81A5E402F61D9F870EAE9D8C4E59DE9
SHA-512:	4683EAB5A623912C9684C67E49896C4C0F26C95D335898FEE201D6CB2FF4E2A4134F81903A333BF3C0E6F32A0F822A45BDFCBC613277F2B64CB483DE3173A32F
Malicious:	false
Reputation:	low
URL:	https://login.microsoftonline.com/common//discovery/instance?api-version=1.1&authorization_endpoint=https://login.microsoftonline.com/common/oauth2/v2.0/authorize
Preview:	{"tenant_discovery_endpoint":"https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration","api-version":"1.1","metadata":[{"preferred_network":"login.microsoftonline.com","preferred_cache":"login.windows.net","aliases":["login.microsoftonline.com","login.windows.net","login.microsoft.com","sts.windows.net"]},{"preferred_network":"login.partner.microsoftonline.cn","preferred_cache":"login.partner.microsoftonline.cn","aliases":["login.partner.microsoftonline.cn","login.chinacloudapi.cn"]},{"preferred_network":"login.microsoftonline.de","preferred_cache":"login.microsoftonline.de","aliases":["login.microsoftonline.de"]},{"preferred_network":"login.microsoftonline.us","preferred_cache":"login.microsoftonline.us","aliases":["login.microsoftonline.us","login.usgovcloudapi.net"]},{"preferred_network":"login-us.microsoftonline.com","preferred_cache":"login-us.microsoftonline.com","aliases":["login-us.microsoftonline.com"]}]}

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 8 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Category:	downloaded
Size (bytes):	91302
Entropy (8bit):	5.083847889045784
Encrypted:	false
SSDEEP:	1536:59iJX9Lgm9iJX9Lgm9iJX9Lg/jHXZwuumF:54p4p4qXZwuumF
MD5:	2B4509D8A869917BBC5CE10982956619
SHA1:	DC21BD40ED9B873779F855026F253BDD3322723D
SHA-256:	397EDDF44E1BF7E557B0B4F5173DA95D8FD832B6F2F10D6E41C17DC539D5A822
SHA-512:	2D0A54E85C7BBDD653B1557A3741D44B621876503D6E8B8CFD5FC6BD3047E28B9702DFB132474DD3981174D96F994B46083008A327646C8D16467E80DA164BAB
Malicious:	false
Reputation:	low
URL:	https://statics.teams.cdn.live.net/hashed/favicon/prod/favicon-f1722d9.ico
Preview:	............ ............... ............... ......7..``.... ......S..@@.... .(B......00.... ..%...).. .... ......O........ .h...>`...PNG........IHDR.............\r.f....pHYs..........o.d...:IDATx...{........Uu...f.......#ry.='^....1...A].q!...$^.2...`.h...&...0Q@7.=.{6.%z..-.]#....0.L.tW}.....KOOW.......Q...w..@)..RJ)..RJ)..RJ)..RJ)..R.....H...L[..7.j.....#.0..L.....y.U..@D%.i...g..3....x..Cd...R....-.^...nY...{..\..@.4..~.zz/..\|.....g..@6S......~....W.N...%.J....r.9G ./.2......_.`..L.b.7Z.%......["...1VB.;H.].o....~+....J....E..+>..h..............y...JH..mR..,..4.Y.Bp.k.+..#^..E...P.."&.{>.$D..y.Dz$ou..5'I.v....(r..GtKj...c;.P.\[.K...>..%....M..{...'.2.v.\...s..Fn..%....*77-.{.../....2..x..h....D..@..y......".....H.x._.p....D........=C../.(..%...._Z0...D..@....{O.3..%./d.q.3..@.h......#..........M.$=;P.z...$EL........80.-..I...,....@f..b;.?."rNf.F.9.@w.B...6)-.....o...;U...K..BLD..3.#.......3.%_.,P}...V...W....l.h.s.....3w..v.R...Rw.%

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	low
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2345), with CRLF line terminators
Category:	downloaded
Size (bytes):	2347
Entropy (8bit):	5.290031538794594
Encrypted:	false
SSDEEP:	48:gCgF0+kNL5iQ6+GhB+SYWzGuesAFcsGJOzgO6FIEv+sj+M++sx+suse+swsosmC0:gC3Na5+GX+Ti2XsYE2sqAsosushswsoB
MD5:	E86EF8B6111E5FB1D1665BCDC90888C9
SHA1:	994BF7651CB967CD9053056AF2D69ACB74DB7F29
SHA-256:	3410242720DE50B090D07A23AEE2DAD879B31D36F2615732962EC4CFA8A9D458
SHA-512:	2486B491681EE91A9CD1ECC9AA011A3FB34B48358C5D7A4D503A5357BC5CE4CA22999F918D40AC60A3063940D5F326FC7E4E5713D89D5C102DE68824E371B3AB
Malicious:	false
Reputation:	low
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(n,t){for(var e in t)n[e]=t[e]}(this,function(n){function t(i){if(e[i])return e[i].exports;var s=e[i]={exports:{},id:i,loaded:!1};return n[i].call(s.exports,s,s.exports,t),s.loaded=!0,s.exports}var e={};return t.m=n,t.c=e,t.p="",t(0)}([function(n,t){function e(n){for(var t=g[c],e=0,i=t.length;e<i;++e)if(t[e]===n)return!0;return!1}function i(n){if(!n)return null;for(var t=n+"=",e=document.cookie.split(";"),i=0,s=e.length;i<s;i++){var o=e[i].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===o.indexOf(t))return o.substring(t.length)}return null}function s(n,t,e){if(n)for(var i=n.split(":"),s=null,o=0,a=i.length;o<a;++o){var l=null,c=i[o].split("$");if(0===o&&(s=parseInt(c.shift()),!s))return;var p=c.length;if(p>=1){var f=r(s,c[0]);if(!f\|\|e[f])continue;l={signInName:f,idp:"msa",isSignedIn:!0}}if(p>=3&&(l.firstName=r(s,c[1]),l.lastName=r(s,c[2])),p>=4){var g=c[3],m=g.split("\|");l.otherHashedAliases=m}if(p>=5){var h=parseInt(c[4],16);h&&(l.

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (45563)
Category:	downloaded
Size (bytes):	141339
Entropy (8bit):	5.431048966728945
Encrypted:	false
SSDEEP:	1536:5FZ5ELQbTPRUbx3jog/MhTJvRkmYWp0BSYmvIxdL/Bpns0Vgt2CTJm0wTxFojd9q:jEArg/M1Nn3vIPzDk80ZjT0qcePg3
MD5:	0A1A5BA009FB1F25E3F3D036D8CF26CE
SHA1:	8E9E6A11CED0807252C34DCA1D8C7C2390D1A5CA
SHA-256:	94153F2A6DAAE35DFCB61DC987E2D4310B7CA021E36375E87D8B8C641C0C6121
SHA-512:	018FA3AD6DCC5DD17258334C2AD5BD0CE4E6AC278A340EE9F0147EC3084B56D0BC5F7224DAF950E89B53828FF57737E1DB1539DCE2B3E7967FE40971677CDFB4
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */!function(e){function n(n){for(var t,r,i=n[0],a=n[1],s=0,u=[];s<i.length;s++)

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	46672
Entropy (8bit):	4.699890563164541
Encrypted:	false
SSDEEP:	768:fnUjUVjWqCODE7ZDP38TsXYfAMoM6wgjnlsuOK8TTI:fnUjkrE7ZDP38T8JZigbGKP
MD5:	570F11D9E530B70ED3FCC44B355C1D64
SHA1:	824EF8F872B2E7F86CF5AD2F6FFC6D2EE4018FDE
SHA-256:	DCDA18533910157B38C266C465CE4E099C77DAC8F2DB94C21BEDE074A5A7583C
SHA-512:	E0F36108A7D18109BB9A98D3D69D817F18F6AB13144669881179DFDB42BC46BD6DFF6F062F904AF3DD3FE06D4985398AE44E9CBC41E2FE0983C77BF60F3BB427
Malicious:	false
Reputation:	low
URL:	https://statics.teams.cdn.live.net/hashedassets-launcher/download_teams_desktop.56ea711b4689afe2bd227c93e4ab38ed.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 588 263">. <g clip-path="url(#a)">. <path fill="#56A84F" d="M480.181 94.4848c.244-7.9042 8.288-9.7641 8.497-16.5133.208-6.749-6.389-8.3956-5.95-16.2692.688-12.3156 13.271-11.9275 13.271-11.9275s12.583.3881 12.509 12.7227c-.047 7.8858-6.732 9.1226-6.941 15.8716-.208 6.7492 7.707 9.1015 7.463 17.0057-.244 7.9042-6.478 10.8312-6.696 17.9082-.219 7.077 4.918 9.855 4.611 19.803-.307 9.947-12.708 23.562-12.708 23.562l-3.069-.095s-11.537-14.353-11.23-24.301c.307-9.947 5.605-12.403 5.823-19.48.218-7.077-5.824-10.383-5.58-18.2872Z"/>. <path fill="#77D672" d="M510.893 147.675c2.762-8.968-.522-13.684-1.243-16.159-.72-2.475-1.271-3.241-.841-5.206.382-1.737.855-2.644 3.174-3.976 2.617-1.505 5.876-3.377 7.218-7.855 1.256-4.195.517-7.633-.134-10.665-.508-2.363-.947-4.4019-.329-6.4639.426-1.424 1.181-1.7644 3.296-2.5402 2.384-.8738 5.647-2.0697 7.656-6.298 4.659-9.8042-2.252-16.5148-6.557-18.6934-.282-.1424-2.851-1.3992-6.241-1.59

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15708
Category:	downloaded
Size (bytes):	5512
Entropy (8bit):	7.968035355108244
Encrypted:	false
SSDEEP:	96:G7tBbRd2YmPbYfuJeBaCkiw4vCM5257nrGunGwVHG0DW80tMBZX/m5nyZf:GDz2Rxiwd7nrGuGeG0DvBdyyZf
MD5:	98421BE6893CF3AA929C5F6C4A0C5C67
SHA1:	2BB411BB6B6C31AE02B81F199C90219717F718AF
SHA-256:	019D26044CCF18F979DFBB8677828FA36BF5CBFC529CECD942644CFE86D90D04
SHA-512:	3142C929754027BA755A6633B51C87C52F1C27B14686C70A22CAB66BD859840F6E7847E0ECA61F4E1B399EEABECA6D28B8A9487CED42D976A9F9397F7C0F6230
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_4d4b76a02ae121e3b20c.js
Preview:	...........[}w.F....Bh..i3.M....>./.......&9...P,$U#......HH..N..I...s...~...h.............{.ij.x.....u....M.........#.........8.c'.B..o.9.6...L.....>L..{".....f.].j.N.,..i.?.6o..X=....O.-..o.5'p%6.....,py..'.p.]z.8..(.b>..=6.3.on.4'...6..d...A.X..F.($8...\ .../..Db4.iM....@....I...."........M...st ....k...D..k!.cM2K...... ..6...X.m..s.1.S.$...r.`.y....1..$."...J.sOp+..M."....Eh....G'....L55I.H...^2...a8=v...w.H...p.....G_.Zp.xU.g.P.5....^.E.w6...q.....B7.~..7...A.q..1....4.......Ev..r..iE311>~...=~W{]..!...,`.\|.wpY.0^.,.G.d1>NL.....5..........g3;.~..x.MbH...r.RA....2. ...E..Z..Lq...O..C]....~.w..4.P..\...$NL..;....[R0.8..[A.t ......\|.Ln..3H......g.q"n...\|g..4..g....w....l..[........q...llW..]....L.'....$..m....-...svg'......]..cl..N.`7.......7f=..F....2.....f.<.oyB..f)w.0<.N.y..T......Y.p].\......7.....Vo./e...K..3....:d.......g..H...}=..l.<.{..".s .g.Q..\|v..O#HM.r.b...7..`a.c..i..j..Zm.=..@w.%..q..-yBV91.4.z..Y.....

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	950
Entropy (8bit):	4.48198966493377
Encrypted:	false
SSDEEP:	24:YE/O+si8Gv8+sarUM+sd+8sAIse/sv+sOd+sIM+sX+sxd+sBM+s7sarzsA6sa:YE2+sRp+sWUM+sd+8sAIse/sv+sOd+sd
MD5:	9FCE93410EB828E0EDF41D3F021D93E2
SHA1:	1584BC813F34E9B7356C6BD05CB2A14EC52E1590
SHA-256:	F463580C98FD336D4E69E7DCA36CF345A81A5E402F61D9F870EAE9D8C4E59DE9
SHA-512:	4683EAB5A623912C9684C67E49896C4C0F26C95D335898FEE201D6CB2FF4E2A4134F81903A333BF3C0E6F32A0F822A45BDFCBC613277F2B64CB483DE3173A32F
Malicious:	false
Reputation:	low
Preview:	{"tenant_discovery_endpoint":"https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration","api-version":"1.1","metadata":[{"preferred_network":"login.microsoftonline.com","preferred_cache":"login.windows.net","aliases":["login.microsoftonline.com","login.windows.net","login.microsoft.com","sts.windows.net"]},{"preferred_network":"login.partner.microsoftonline.cn","preferred_cache":"login.partner.microsoftonline.cn","aliases":["login.partner.microsoftonline.cn","login.chinacloudapi.cn"]},{"preferred_network":"login.microsoftonline.de","preferred_cache":"login.microsoftonline.de","aliases":["login.microsoftonline.de"]},{"preferred_network":"login.microsoftonline.us","preferred_cache":"login.microsoftonline.us","aliases":["login.microsoftonline.us","login.usgovcloudapi.net"]},{"preferred_network":"login-us.microsoftonline.com","preferred_cache":"login-us.microsoftonline.com","aliases":["login-us.microsoftonline.com"]}]}

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4212)
Category:	downloaded
Size (bytes):	31054
Entropy (8bit):	5.115262666558672
Encrypted:	false
SSDEEP:	384:dZJPRAKEMuYgmJT0cISW6Z6qDD6b9nQFFQUR2IVf69AWhLX47SHTlk4nO8FIYTJ8:DE2tUsIW8FhdVG
MD5:	62624B374594C5B37AC2840166D36869
SHA1:	4F1ED0D897D0A729DB319A914DDC0607875C39C6
SHA-256:	80270CC751ED1DE7959C538CD7032E811207AF63B73477A446865AA3870ED3F8
SHA-512:	CD01101EFAE2A9AF2194AE020B00E68C8F453BA53293CC17618968065001D79E76F729A084E8214F29E82DD11BA8424CD50BCA694EBB476AB65E8246228B40C7
Malicious:	false
Reputation:	low
URL:	https://statics.teams.cdn.live.net/hashedcss-launcher/launcher.d6cd10b8b26b2130799c.css
Preview:	@font-face{font-family:"Segoe UI";src:local("Segoe UI Light");font-style:normal;font-weight:200}@font-face{font-family:"Segoe UI";src:local("Segoe UI Semilight");font-style:normal;font-weight:300}@font-face{font-family:"Segoe UI";src:local("Segoe UI");font-style:normal;font-weight:400}@font-face{font-family:"Segoe UI";src:local("Segoe UI Semibold");font-style:normal;font-weight:600}@font-face{font-family:"Segoe UI";src:local("Segoe UI Bold");font-style:normal;font-weight:700}@font-face{font-family:"Segoe UI";src:local("Segoe UI Light Italic");font-style:italic;font-weight:200}@font-face{font-family:"Segoe UI";src:local("Segoe UI Semilight Italic");font-style:italic;font-weight:300}@font-face{font-family:"Segoe UI";src:local("Segoe UI Italic");font-style:italic;font-weight:400}@font-face{font-family:"Segoe UI";src:local("Segoe UI Semibold Italic");font-style:italic;font-weight:600}@font-face{font-family:"Segoe UI";src:local("Segoe UI Bold Italic");font-style:italic;font-weight:700}body,

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	downloaded
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	5621
Entropy (8bit):	4.2543291215767
Encrypted:	false
SSDEEP:	96:Rf6psAY2NMgC2s2K2U72u+qz3L3K2AtLP5y2YTDzGKOMSH0H2u+qz3LZ:96pNNlC7yu+qYVP42YTDz9S1u+qx
MD5:	EE0F7622A71A597595C5A8FB2F89A097
SHA1:	0D9768FDBA8B1D89A6DBA27D5CECC27737BF5CDD
SHA-256:	433388EFC4567EF14D3FED6F2DA976D457D43D09F6753E289C7FE544E0175281
SHA-512:	55E1161AC6A533B67FA3D073691E936090019B10283BC40F248F47DA38788A7A00FAF307BD5001B6327DAF38F874DC578A0CD212ECCF94520801C37DF668D9FF
Malicious:	false
Reputation:	low
URL:	https://statics.teams.cdn.live.net/hashedassets-launcher/logo.9a06a31283bb958af1e6112179685b71.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>.<svg class="msft-teams-logo" version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 141.5 16.2" style="enable-background:new 0 0 141.5 16.2;" xml:space="preserve">.<style type="text/css">...msft-teams-logo .st0{fill:#5b5fc7;}.</style>.<g>..<path class="st0" d="M15.2,16h-1.7V6c0-0.8,0-1.8,0.1-2.9h0c-0.1,0.5-0.3,1-0.4,1.4L8,16H7.2L2.1,4.6c-0.2-0.5-0.3-1-0.4-1.5h0...C1.7,3.7,1.7,4.6,1.7,6v10H0V1.1h2.3l4.6,10.4c0.3,0.6,0.5,1.2,0.7,1.8h0.1c0.3-0.8,0.5-1.4,0.7-1.8L13,1.1h2.2V16z"/>..<path class="st0" d="M19.1,2.6c-0.3,0-0.6-0.1-0.8-0.3C18.1,2.1,18,1.8,18,1.5c0-0.6,0.5-1.1,1.1-1.1c0,0,0,0,0,0...c0.3,0,0.6,0.1,0.8,0.3c0.4,0.4,0.4,1.1,0,1.6c0,0,0,0,0,0C19.7,2.5,19.4,2.6,19.1,2.6z M19.9,16h-1.7V5.3h1.7V16z"/>..<path class="st0" d="M29.9,15.5c-0.9,0.5-1.9,0.8-2.9,0.7c-1.4,0.1-2.7-0.5-3.7-1.5c-1-1-1.5-2.4-1.4-3.8c-0.1-1.5,0.5-3.1,1.5-4.2...c1-1.1,2.5-1.7,4-1.6c0.9,0,1.7,0.2,2.5,0

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	36
Entropy (8bit):	4.503258334775644
Encrypted:	false
SSDEEP:	3:Eq62iczBr9ks:EqdiczBys
MD5:	06B313E93DD76909460FBFC0CD98CB6B
SHA1:	C4F9B2BBD840A4328F85F54873C434336A193888
SHA-256:	B4532478707B495D0BB1C21C314AEF959DD1A5E0F66E52DAD5FC332C8B697CBA
SHA-512:	EFD7E8195D9C126883C71FED3EFEDE55916848B784F8434ED2677DF5004436F7EDE9F80277CB4675C4DEB8F243B2705A3806B412FAA8842E039E9DC467C11645
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSFwmCAmly1gHbXRIFDdFbUVISBQ1Xevf9?alt=proto
Preview:	ChgKDQ3RW1FSGgQIVhgCIAEKBw1Xevf9GgA=

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 15:57:17.212853909 CEST	49697	443	192.168.2.18	52.123.129.14
Apr 25, 2024 15:57:17.212899923 CEST	443	49697	52.123.129.14	192.168.2.18
Apr 25, 2024 15:57:17.212975025 CEST	49697	443	192.168.2.18	52.123.129.14
Apr 25, 2024 15:57:17.213196993 CEST	49697	443	192.168.2.18	52.123.129.14
Apr 25, 2024 15:57:17.213213921 CEST	443	49697	52.123.129.14	192.168.2.18
Apr 25, 2024 15:57:17.213531017 CEST	49698	443	192.168.2.18	52.123.129.14
Apr 25, 2024 15:57:17.213558912 CEST	443	49698	52.123.129.14	192.168.2.18
Apr 25, 2024 15:57:17.213622093 CEST	49698	443	192.168.2.18	52.123.129.14
Apr 25, 2024 15:57:17.213840961 CEST	49698	443	192.168.2.18	52.123.129.14
Apr 25, 2024 15:57:17.213855028 CEST	443	49698	52.123.129.14	192.168.2.18
Apr 25, 2024 15:57:17.563425064 CEST	443	49697	52.123.129.14	192.168.2.18
Apr 25, 2024 15:57:17.563638926 CEST	49697	443	192.168.2.18	52.123.129.14
Apr 25, 2024 15:57:17.563649893 CEST	443	49697	52.123.129.14	192.168.2.18
Apr 25, 2024 15:57:17.564759970 CEST	443	49697	52.123.129.14	192.168.2.18
Apr 25, 2024 15:57:17.564821959 CEST	49697	443	192.168.2.18	52.123.129.14
Apr 25, 2024 15:57:17.565673113 CEST	49697	443	192.168.2.18	52.123.129.14
Apr 25, 2024 15:57:17.565736055 CEST	443	49697	52.123.129.14	192.168.2.18
Apr 25, 2024 15:57:17.565874100 CEST	49697	443	192.168.2.18	52.123.129.14
Apr 25, 2024 15:57:17.565880060 CEST	443	49697	52.123.129.14	192.168.2.18
Apr 25, 2024 15:57:17.570843935 CEST	443	49698	52.123.129.14	192.168.2.18
Apr 25, 2024 15:57:17.571018934 CEST	49698	443	192.168.2.18	52.123.129.14
Apr 25, 2024 15:57:17.571032047 CEST	443	49698	52.123.129.14	192.168.2.18
Apr 25, 2024 15:57:17.572295904 CEST	443	49698	52.123.129.14	192.168.2.18
Apr 25, 2024 15:57:17.572380066 CEST	49698	443	192.168.2.18	52.123.129.14
Apr 25, 2024 15:57:17.573904037 CEST	49698	443	192.168.2.18	52.123.129.14
Apr 25, 2024 15:57:17.573967934 CEST	443	49698	52.123.129.14	192.168.2.18
Apr 25, 2024 15:57:17.619353056 CEST	49697	443	192.168.2.18	52.123.129.14
Apr 25, 2024 15:57:17.619379997 CEST	49698	443	192.168.2.18	52.123.129.14
Apr 25, 2024 15:57:17.619391918 CEST	443	49698	52.123.129.14	192.168.2.18
Apr 25, 2024 15:57:17.667390108 CEST	49698	443	192.168.2.18	52.123.129.14
Apr 25, 2024 15:57:18.038604021 CEST	443	49697	52.123.129.14	192.168.2.18
Apr 25, 2024 15:57:18.038741112 CEST	443	49697	52.123.129.14	192.168.2.18
Apr 25, 2024 15:57:18.038817883 CEST	49697	443	192.168.2.18	52.123.129.14
Apr 25, 2024 15:57:18.039134026 CEST	49697	443	192.168.2.18	52.123.129.14
Apr 25, 2024 15:57:18.039153099 CEST	443	49697	52.123.129.14	192.168.2.18
Apr 25, 2024 15:57:18.039163113 CEST	49697	443	192.168.2.18	52.123.129.14
Apr 25, 2024 15:57:18.039203882 CEST	49697	443	192.168.2.18	52.123.129.14
Apr 25, 2024 15:57:21.537888050 CEST	49712	443	192.168.2.18	23.46.200.91
Apr 25, 2024 15:57:21.537955046 CEST	443	49712	23.46.200.91	192.168.2.18
Apr 25, 2024 15:57:21.538033009 CEST	49712	443	192.168.2.18	23.46.200.91
Apr 25, 2024 15:57:21.540302992 CEST	49712	443	192.168.2.18	23.46.200.91
Apr 25, 2024 15:57:21.540318012 CEST	443	49712	23.46.200.91	192.168.2.18
Apr 25, 2024 15:57:21.787231922 CEST	443	49712	23.46.200.91	192.168.2.18
Apr 25, 2024 15:57:21.787436008 CEST	49712	443	192.168.2.18	23.46.200.91
Apr 25, 2024 15:57:21.791129112 CEST	49712	443	192.168.2.18	23.46.200.91
Apr 25, 2024 15:57:21.791160107 CEST	443	49712	23.46.200.91	192.168.2.18
Apr 25, 2024 15:57:21.791450977 CEST	443	49712	23.46.200.91	192.168.2.18
Apr 25, 2024 15:57:21.835422993 CEST	49712	443	192.168.2.18	23.46.200.91
Apr 25, 2024 15:57:21.839251995 CEST	49712	443	192.168.2.18	23.46.200.91
Apr 25, 2024 15:57:21.880129099 CEST	443	49712	23.46.200.91	192.168.2.18
Apr 25, 2024 15:57:21.980247974 CEST	49715	443	192.168.2.18	64.233.177.147
Apr 25, 2024 15:57:21.980304003 CEST	443	49715	64.233.177.147	192.168.2.18
Apr 25, 2024 15:57:21.980386019 CEST	49715	443	192.168.2.18	64.233.177.147
Apr 25, 2024 15:57:21.980720997 CEST	49715	443	192.168.2.18	64.233.177.147
Apr 25, 2024 15:57:21.980746031 CEST	443	49715	64.233.177.147	192.168.2.18
Apr 25, 2024 15:57:22.050398111 CEST	443	49712	23.46.200.91	192.168.2.18
Apr 25, 2024 15:57:22.050542116 CEST	443	49712	23.46.200.91	192.168.2.18
Apr 25, 2024 15:57:22.050611019 CEST	49712	443	192.168.2.18	23.46.200.91
Apr 25, 2024 15:57:22.051018953 CEST	49712	443	192.168.2.18	23.46.200.91
Apr 25, 2024 15:57:22.051058054 CEST	443	49712	23.46.200.91	192.168.2.18
Apr 25, 2024 15:57:22.051084042 CEST	49712	443	192.168.2.18	23.46.200.91
Apr 25, 2024 15:57:22.051099062 CEST	443	49712	23.46.200.91	192.168.2.18
Apr 25, 2024 15:57:22.080343962 CEST	49719	443	192.168.2.18	23.46.200.91
Apr 25, 2024 15:57:22.080369949 CEST	443	49719	23.46.200.91	192.168.2.18
Apr 25, 2024 15:57:22.080440044 CEST	49719	443	192.168.2.18	23.46.200.91
Apr 25, 2024 15:57:22.081190109 CEST	49719	443	192.168.2.18	23.46.200.91
Apr 25, 2024 15:57:22.081201077 CEST	443	49719	23.46.200.91	192.168.2.18
Apr 25, 2024 15:57:22.208653927 CEST	443	49715	64.233.177.147	192.168.2.18
Apr 25, 2024 15:57:22.209055901 CEST	49715	443	192.168.2.18	64.233.177.147
Apr 25, 2024 15:57:22.209146023 CEST	443	49715	64.233.177.147	192.168.2.18
Apr 25, 2024 15:57:22.210161924 CEST	443	49715	64.233.177.147	192.168.2.18
Apr 25, 2024 15:57:22.210263968 CEST	49715	443	192.168.2.18	64.233.177.147
Apr 25, 2024 15:57:22.214662075 CEST	49715	443	192.168.2.18	64.233.177.147
Apr 25, 2024 15:57:22.214750051 CEST	443	49715	64.233.177.147	192.168.2.18
Apr 25, 2024 15:57:22.264415026 CEST	49715	443	192.168.2.18	64.233.177.147
Apr 25, 2024 15:57:22.264455080 CEST	443	49715	64.233.177.147	192.168.2.18
Apr 25, 2024 15:57:22.306931973 CEST	443	49719	23.46.200.91	192.168.2.18
Apr 25, 2024 15:57:22.307064056 CEST	49719	443	192.168.2.18	23.46.200.91
Apr 25, 2024 15:57:22.308553934 CEST	49719	443	192.168.2.18	23.46.200.91
Apr 25, 2024 15:57:22.308576107 CEST	443	49719	23.46.200.91	192.168.2.18
Apr 25, 2024 15:57:22.308939934 CEST	443	49719	23.46.200.91	192.168.2.18
Apr 25, 2024 15:57:22.310311079 CEST	49719	443	192.168.2.18	23.46.200.91
Apr 25, 2024 15:57:22.311388016 CEST	49715	443	192.168.2.18	64.233.177.147
Apr 25, 2024 15:57:22.352154970 CEST	443	49719	23.46.200.91	192.168.2.18
Apr 25, 2024 15:57:22.526179075 CEST	443	49719	23.46.200.91	192.168.2.18
Apr 25, 2024 15:57:22.526282072 CEST	443	49719	23.46.200.91	192.168.2.18
Apr 25, 2024 15:57:22.526360035 CEST	49719	443	192.168.2.18	23.46.200.91
Apr 25, 2024 15:57:22.527251005 CEST	49719	443	192.168.2.18	23.46.200.91
Apr 25, 2024 15:57:22.527273893 CEST	443	49719	23.46.200.91	192.168.2.18
Apr 25, 2024 15:57:22.527283907 CEST	49719	443	192.168.2.18	23.46.200.91
Apr 25, 2024 15:57:22.527291059 CEST	443	49719	23.46.200.91	192.168.2.18
Apr 25, 2024 15:57:27.386168957 CEST	49728	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:57:27.386219025 CEST	443	49728	20.114.59.183	192.168.2.18
Apr 25, 2024 15:57:27.386323929 CEST	49728	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:57:27.387588024 CEST	49728	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:57:27.387605906 CEST	443	49728	20.114.59.183	192.168.2.18
Apr 25, 2024 15:57:27.913088083 CEST	443	49728	20.114.59.183	192.168.2.18
Apr 25, 2024 15:57:27.913255930 CEST	49728	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:57:27.987562895 CEST	49728	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:57:27.987606049 CEST	443	49728	20.114.59.183	192.168.2.18
Apr 25, 2024 15:57:27.987919092 CEST	443	49728	20.114.59.183	192.168.2.18
Apr 25, 2024 15:57:28.031352997 CEST	49728	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:57:28.064938068 CEST	49728	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:57:28.112118959 CEST	443	49728	20.114.59.183	192.168.2.18
Apr 25, 2024 15:57:28.419152021 CEST	443	49728	20.114.59.183	192.168.2.18
Apr 25, 2024 15:57:28.419179916 CEST	443	49728	20.114.59.183	192.168.2.18
Apr 25, 2024 15:57:28.419187069 CEST	443	49728	20.114.59.183	192.168.2.18
Apr 25, 2024 15:57:28.419214010 CEST	443	49728	20.114.59.183	192.168.2.18
Apr 25, 2024 15:57:28.419239998 CEST	443	49728	20.114.59.183	192.168.2.18
Apr 25, 2024 15:57:28.419287920 CEST	49728	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:57:28.419312954 CEST	443	49728	20.114.59.183	192.168.2.18
Apr 25, 2024 15:57:28.419329882 CEST	49728	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:57:28.419363022 CEST	49728	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:57:28.419378042 CEST	443	49728	20.114.59.183	192.168.2.18
Apr 25, 2024 15:57:28.419436932 CEST	49728	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:57:28.419444084 CEST	443	49728	20.114.59.183	192.168.2.18
Apr 25, 2024 15:57:28.419455051 CEST	443	49728	20.114.59.183	192.168.2.18
Apr 25, 2024 15:57:28.419502974 CEST	49728	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:57:28.431838036 CEST	49728	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:57:28.431858063 CEST	443	49728	20.114.59.183	192.168.2.18
Apr 25, 2024 15:57:28.431869030 CEST	49728	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:57:28.431874037 CEST	443	49728	20.114.59.183	192.168.2.18
Apr 25, 2024 15:57:28.586795092 CEST	49673	443	192.168.2.18	204.79.197.203
Apr 25, 2024 15:57:28.887355089 CEST	49673	443	192.168.2.18	204.79.197.203
Apr 25, 2024 15:57:29.494360924 CEST	49673	443	192.168.2.18	204.79.197.203
Apr 25, 2024 15:57:30.709387064 CEST	49673	443	192.168.2.18	204.79.197.203
Apr 25, 2024 15:57:32.239638090 CEST	443	49715	64.233.177.147	192.168.2.18
Apr 25, 2024 15:57:32.239686966 CEST	443	49715	64.233.177.147	192.168.2.18
Apr 25, 2024 15:57:32.239744902 CEST	49715	443	192.168.2.18	64.233.177.147
Apr 25, 2024 15:57:32.503427029 CEST	49715	443	192.168.2.18	64.233.177.147
Apr 25, 2024 15:57:32.503451109 CEST	443	49715	64.233.177.147	192.168.2.18
Apr 25, 2024 15:57:33.112337112 CEST	49673	443	192.168.2.18	204.79.197.203
Apr 25, 2024 15:57:34.277318001 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:34.277357101 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.277452946 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:34.277671099 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:34.277683973 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.624002934 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.624284983 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:34.624301910 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.625780106 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.625847101 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:34.626740932 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:34.626880884 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.626899004 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:34.668157101 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.675319910 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:34.675335884 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.723350048 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:34.833379030 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.833640099 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.833662033 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.833784103 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.833797932 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.833805084 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.833833933 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:34.833833933 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:34.833856106 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.833869934 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.833878994 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:34.833878994 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:34.833913088 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:34.833977938 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.834019899 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.834054947 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:34.834059954 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.834074020 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:34.882446051 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:34.942934990 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.942958117 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.943047047 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.943089962 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.943157911 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:34.943157911 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:34.943169117 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.943218946 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:34.943342924 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.943386078 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.943417072 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:34.943422079 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.943448067 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:34.943466902 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:34.944148064 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.944188118 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.944227934 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:34.944232941 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:34.944259882 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:34.944278002 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:35.025453091 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:35.025504112 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:35.025727987 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:35.025752068 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:35.025810003 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:35.053173065 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:35.053220034 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:35.053270102 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:35.053281069 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:35.053308964 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:35.053323030 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:35.053683996 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:35.053726912 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:35.053760052 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:35.053765059 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:35.053807974 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:35.053818941 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:35.053874969 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:35.053951025 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:35.053956032 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:35.054004908 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:35.054076910 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:35.054126978 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:35.054404974 CEST	49748	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:35.054419994 CEST	443	49748	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:35.103275061 CEST	49751	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:35.103358984 CEST	443	49751	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:35.103434086 CEST	49751	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:35.103688002 CEST	49751	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:35.103723049 CEST	443	49751	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:35.437683105 CEST	443	49751	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:35.437967062 CEST	49751	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:35.437988043 CEST	443	49751	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:35.439055920 CEST	443	49751	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:35.439127922 CEST	49751	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:35.439415932 CEST	49751	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:35.439479113 CEST	443	49751	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:35.490370035 CEST	49751	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:35.490428925 CEST	443	49751	152.199.4.44	192.168.2.18
Apr 25, 2024 15:57:35.538352966 CEST	49751	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:57:35.712058067 CEST	49679	443	192.168.2.18	52.182.141.63
Apr 25, 2024 15:57:35.964286089 CEST	49753	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:35.964318991 CEST	443	49753	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:35.964400053 CEST	49753	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:35.964670897 CEST	49753	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:35.964679956 CEST	443	49753	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:35.977283955 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:35.977305889 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:35.977371931 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:35.977545023 CEST	49755	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:35.977583885 CEST	443	49755	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:35.977638006 CEST	49755	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:35.977771997 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:35.977781057 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:35.977916956 CEST	49755	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:35.977929115 CEST	443	49755	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.014375925 CEST	49679	443	192.168.2.18	52.182.141.63
Apr 25, 2024 15:57:36.304188013 CEST	443	49753	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.304488897 CEST	49753	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.304502010 CEST	443	49753	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.305362940 CEST	443	49753	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.305440903 CEST	49753	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.306595087 CEST	49753	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.306647062 CEST	443	49753	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.306849957 CEST	49753	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.306854963 CEST	443	49753	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.311845064 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.312134027 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.312148094 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.313056946 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.313148975 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.313384056 CEST	443	49755	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.313436031 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.313492060 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.313600063 CEST	49755	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.313668966 CEST	443	49755	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.313678980 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.313687086 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.314712048 CEST	443	49755	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.314788103 CEST	49755	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.315088987 CEST	49755	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.315157890 CEST	443	49755	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.315242052 CEST	49755	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.315258980 CEST	443	49755	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.349332094 CEST	49753	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.365340948 CEST	49755	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.365454912 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.620392084 CEST	49679	443	192.168.2.18	52.182.141.63
Apr 25, 2024 15:57:36.637511969 CEST	443	49753	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.637542963 CEST	443	49753	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.637551069 CEST	443	49753	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.637569904 CEST	443	49753	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.637589931 CEST	443	49753	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.637638092 CEST	49753	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.637655020 CEST	443	49753	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.637669086 CEST	443	49753	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.637696028 CEST	49753	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.637733936 CEST	49753	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.637737989 CEST	443	49753	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.637753010 CEST	443	49753	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.637775898 CEST	49753	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.637808084 CEST	49753	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.639656067 CEST	49753	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.639666080 CEST	443	49753	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.641683102 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.641710997 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.641720057 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.641738892 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.641750097 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.641762018 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.641779900 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.641788960 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.641820908 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.641838074 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.642087936 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.642111063 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.642143011 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.642148018 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.642180920 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.644329071 CEST	443	49755	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.644357920 CEST	443	49755	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.644366026 CEST	443	49755	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.644390106 CEST	443	49755	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.644418001 CEST	443	49755	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.644458055 CEST	49755	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.644483089 CEST	443	49755	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.644495964 CEST	443	49755	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.644505024 CEST	49755	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.644639015 CEST	49755	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.645484924 CEST	49755	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.645498991 CEST	443	49755	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.751672029 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.751709938 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.751766920 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.751780033 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.751815081 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.751835108 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.752171040 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.752197027 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.752233982 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.752242088 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.752271891 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.752312899 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.752747059 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.752780914 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.752819061 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.752824068 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.752855062 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.752876997 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.861516953 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.861546040 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.861597061 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.861609936 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.861648083 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.861669064 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.861814022 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.861835003 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.861871004 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.861876011 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.861907959 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.861918926 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.861972094 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.862031937 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.862036943 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.862056971 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.862106085 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.862854004 CEST	49754	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.862864017 CEST	443	49754	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.896936893 CEST	49758	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.896989107 CEST	443	49758	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.897061110 CEST	49758	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.897284031 CEST	49758	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.897300959 CEST	443	49758	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.918401957 CEST	49759	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.918446064 CEST	443	49759	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:36.918526888 CEST	49759	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.918761969 CEST	49759	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:36.918787003 CEST	443	49759	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:37.409904003 CEST	443	49758	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:37.410355091 CEST	49758	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:37.410393000 CEST	443	49758	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:37.411849976 CEST	443	49758	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:37.411930084 CEST	49758	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:37.412231922 CEST	49758	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:37.412313938 CEST	443	49758	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:37.412450075 CEST	49758	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:37.412460089 CEST	443	49758	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:37.465460062 CEST	49758	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:37.747462988 CEST	443	49758	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:37.747490883 CEST	443	49758	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:37.747500896 CEST	443	49758	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:37.747526884 CEST	443	49758	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:37.747543097 CEST	443	49758	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:37.747554064 CEST	443	49758	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:37.747595072 CEST	49758	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:37.747693062 CEST	443	49758	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:37.747730017 CEST	49758	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:37.747780085 CEST	49758	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:37.753119946 CEST	49758	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:37.753171921 CEST	443	49758	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:37.831322908 CEST	49679	443	192.168.2.18	52.182.141.63
Apr 25, 2024 15:57:37.869086027 CEST	49760	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:37.869127989 CEST	443	49760	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:37.869286060 CEST	49760	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:37.869441986 CEST	49760	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:37.869467020 CEST	443	49760	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:37.925349951 CEST	49673	443	192.168.2.18	204.79.197.203
Apr 25, 2024 15:57:38.205609083 CEST	443	49760	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:38.205934048 CEST	49760	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:38.205960989 CEST	443	49760	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:38.207384109 CEST	443	49760	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:38.207504034 CEST	49760	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:38.207811117 CEST	49760	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:38.207887888 CEST	443	49760	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:38.207973957 CEST	49760	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:38.207983017 CEST	443	49760	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:38.260329962 CEST	49760	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:38.266917944 CEST	443	49759	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.267153025 CEST	49759	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:38.267163038 CEST	443	49759	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.268594027 CEST	443	49759	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.268728971 CEST	49759	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:38.268945932 CEST	49759	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:38.269025087 CEST	443	49759	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.269082069 CEST	49759	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:38.308381081 CEST	49759	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:38.308393955 CEST	443	49759	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.356337070 CEST	49759	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:38.538641930 CEST	443	49760	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:38.538670063 CEST	443	49760	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:38.538680077 CEST	443	49760	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:38.538714886 CEST	443	49760	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:38.538731098 CEST	443	49760	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:38.538738012 CEST	49760	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:38.538744926 CEST	443	49760	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:38.538762093 CEST	443	49760	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:38.538774014 CEST	49760	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:38.538774014 CEST	49760	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:38.538800001 CEST	49760	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:38.538808107 CEST	443	49760	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:38.538834095 CEST	443	49760	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:38.538877964 CEST	49760	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:38.538877964 CEST	49760	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:38.539808035 CEST	49760	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:38.539822102 CEST	443	49760	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:38.596688986 CEST	443	49759	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.596724987 CEST	443	49759	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.596734047 CEST	443	49759	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.596762896 CEST	443	49759	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.596774101 CEST	443	49759	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.596781969 CEST	443	49759	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.596803904 CEST	49759	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:38.596816063 CEST	443	49759	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.596829891 CEST	49759	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:38.596868038 CEST	49759	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:38.597402096 CEST	443	49759	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.597423077 CEST	443	49759	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.597491980 CEST	49759	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:38.597491980 CEST	49759	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:38.597501040 CEST	443	49759	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.597573996 CEST	49759	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:38.706604004 CEST	443	49759	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.706666946 CEST	443	49759	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.706756115 CEST	443	49759	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.706756115 CEST	49759	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:38.706787109 CEST	443	49759	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.706864119 CEST	49759	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:38.706890106 CEST	49759	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:38.706906080 CEST	443	49759	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.706945896 CEST	443	49759	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.706996918 CEST	49759	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:38.707649946 CEST	49759	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:38.707669020 CEST	443	49759	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.726794004 CEST	49761	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:38.726830006 CEST	443	49761	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.726953983 CEST	49761	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:38.727216959 CEST	49761	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:38.727236032 CEST	443	49761	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.728760004 CEST	49762	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:38.728805065 CEST	443	49762	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.728866100 CEST	49762	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:38.729829073 CEST	49762	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:38.729840994 CEST	443	49762	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.730165005 CEST	49763	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:38.730195045 CEST	443	49763	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:38.730268002 CEST	49763	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:38.730544090 CEST	49763	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:38.730556011 CEST	443	49763	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.061331987 CEST	443	49761	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.061675072 CEST	49761	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.061691046 CEST	443	49761	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.061984062 CEST	443	49761	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.062309980 CEST	49761	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.062366962 CEST	443	49761	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.062484026 CEST	49761	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.065356970 CEST	443	49763	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.065568924 CEST	49763	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.065578938 CEST	443	49763	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.066637039 CEST	443	49763	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.066723108 CEST	49763	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.066973925 CEST	49763	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.067047119 CEST	443	49763	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.067085981 CEST	49763	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.069314957 CEST	443	49762	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.069505930 CEST	49762	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.069530010 CEST	443	49762	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.070168972 CEST	443	49762	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.070442915 CEST	49762	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.070523977 CEST	49762	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.070528984 CEST	443	49762	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.070548058 CEST	443	49762	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.104123116 CEST	443	49761	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.108130932 CEST	443	49763	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.119359970 CEST	49762	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.119362116 CEST	49763	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.119380951 CEST	443	49763	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.167349100 CEST	49763	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.282505035 CEST	443	49761	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.282527924 CEST	443	49761	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.282598972 CEST	443	49761	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.282602072 CEST	49761	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.282679081 CEST	49761	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.283247948 CEST	49761	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.283267021 CEST	443	49761	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.288394928 CEST	443	49763	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.288422108 CEST	443	49763	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.288486958 CEST	49763	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.288501024 CEST	443	49763	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.288645983 CEST	49763	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.289892912 CEST	443	49762	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.289973021 CEST	443	49762	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.290047884 CEST	49762	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.290086031 CEST	443	49762	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.290149927 CEST	443	49762	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.290153980 CEST	49762	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.290209055 CEST	49762	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.299426079 CEST	49763	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.299443960 CEST	443	49763	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.301033974 CEST	49762	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.301079035 CEST	443	49762	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.310362101 CEST	49764	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:39.310401917 CEST	443	49764	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:39.310494900 CEST	49764	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:39.310642958 CEST	49765	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:39.310679913 CEST	443	49765	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:39.310790062 CEST	49765	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:39.310883045 CEST	49764	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:39.310904026 CEST	443	49764	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:39.311047077 CEST	49765	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:39.311063051 CEST	443	49765	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:39.321149111 CEST	49766	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.321181059 CEST	443	49766	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.321280003 CEST	49766	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.321588993 CEST	49767	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.321609974 CEST	443	49767	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.321774006 CEST	49767	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.321810007 CEST	49766	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.321821928 CEST	443	49766	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.321962118 CEST	49767	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.321975946 CEST	443	49767	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.654067993 CEST	443	49765	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:39.654499054 CEST	49765	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:39.654517889 CEST	443	49765	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:39.655991077 CEST	443	49765	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:39.656367064 CEST	49765	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:39.656536102 CEST	49765	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:39.656754017 CEST	443	49765	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:39.657445908 CEST	443	49766	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.657665014 CEST	49766	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.657680035 CEST	443	49766	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.657839060 CEST	443	49764	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:39.658066988 CEST	49764	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:39.658124924 CEST	443	49766	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.658128977 CEST	443	49764	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:39.658425093 CEST	49766	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.658502102 CEST	49766	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.658507109 CEST	443	49766	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.658528090 CEST	443	49766	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.658730030 CEST	443	49764	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:39.659017086 CEST	49764	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:39.659087896 CEST	443	49764	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:39.659101009 CEST	49764	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:39.662331104 CEST	443	49767	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.662610054 CEST	49767	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.662625074 CEST	443	49767	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.662981033 CEST	443	49767	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.663269997 CEST	49767	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.663330078 CEST	443	49767	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.663398981 CEST	49767	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.700124979 CEST	443	49764	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:39.708110094 CEST	443	49767	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.708357096 CEST	49766	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.708365917 CEST	49765	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:39.708383083 CEST	49764	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:39.875257969 CEST	443	49765	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:39.875298023 CEST	443	49765	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:39.875420094 CEST	49765	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:39.875437975 CEST	443	49765	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:39.875454903 CEST	443	49765	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:39.875503063 CEST	49765	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:39.876471043 CEST	49765	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:39.876488924 CEST	443	49765	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:39.877238989 CEST	443	49766	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.877347946 CEST	443	49766	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.877469063 CEST	49766	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.878000975 CEST	49766	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.878012896 CEST	443	49766	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.878745079 CEST	443	49764	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:39.878767014 CEST	443	49764	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:39.878854036 CEST	49764	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:39.878868103 CEST	443	49764	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:39.878923893 CEST	49764	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:39.879822969 CEST	49764	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:39.879864931 CEST	443	49764	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:39.882668018 CEST	49769	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:39.882738113 CEST	443	49769	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:39.882817984 CEST	49769	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:39.882831097 CEST	443	49767	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.882860899 CEST	443	49767	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.882913113 CEST	49767	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.882930040 CEST	443	49767	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.882944107 CEST	443	49767	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.882996082 CEST	49767	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.883024931 CEST	49769	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:39.883053064 CEST	443	49769	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:39.883989096 CEST	49767	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:39.884002924 CEST	443	49767	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:39.888115883 CEST	49770	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:39.888144016 CEST	443	49770	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:39.888228893 CEST	49770	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:39.888581991 CEST	49770	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:39.888595104 CEST	443	49770	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:40.217648029 CEST	443	49769	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:40.218099117 CEST	49769	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:40.218132973 CEST	443	49769	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:40.218472004 CEST	443	49769	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:40.218771935 CEST	49769	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:40.218868971 CEST	443	49769	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:40.218898058 CEST	49769	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:40.228797913 CEST	443	49770	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:40.229181051 CEST	49770	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:40.229192019 CEST	443	49770	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:40.229697943 CEST	443	49770	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:40.230210066 CEST	49770	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:40.230274916 CEST	443	49770	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:40.230287075 CEST	49770	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:40.234369993 CEST	49679	443	192.168.2.18	52.182.141.63
Apr 25, 2024 15:57:40.260121107 CEST	443	49769	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:40.266524076 CEST	49769	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:40.276119947 CEST	443	49770	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:40.282360077 CEST	49770	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:40.346856117 CEST	49771	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:40.346888065 CEST	443	49771	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:40.346986055 CEST	49771	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:40.347213030 CEST	49771	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:40.347242117 CEST	443	49771	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:40.364408970 CEST	49772	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:40.364479065 CEST	443	49772	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:40.364698887 CEST	49772	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:40.364825010 CEST	49772	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:40.364834070 CEST	443	49772	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:40.443572044 CEST	443	49769	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:40.443670988 CEST	443	49769	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:40.443799019 CEST	49769	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:40.448693037 CEST	443	49770	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:40.448715925 CEST	443	49770	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:40.448781013 CEST	443	49770	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:40.448839903 CEST	49770	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:40.448839903 CEST	49770	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:40.466428041 CEST	49770	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:40.466454029 CEST	443	49770	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:40.466815948 CEST	49769	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:40.466851950 CEST	443	49769	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:40.681638956 CEST	443	49771	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:40.681921005 CEST	49771	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:40.681932926 CEST	443	49771	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:40.682308912 CEST	443	49771	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:40.682684898 CEST	49771	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:40.682776928 CEST	443	49771	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:40.682893038 CEST	49771	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:40.705037117 CEST	443	49772	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:40.705324888 CEST	49772	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:40.705384970 CEST	443	49772	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:40.706548929 CEST	443	49772	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:40.707031965 CEST	49772	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:40.707153082 CEST	49772	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:40.707158089 CEST	443	49772	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:40.707209110 CEST	443	49772	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:40.722333908 CEST	49771	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:40.722345114 CEST	443	49771	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:40.754813910 CEST	49772	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:40.945291996 CEST	443	49772	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:40.945380926 CEST	443	49772	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:40.945528030 CEST	49772	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:40.946281910 CEST	49772	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:40.946295977 CEST	443	49772	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:40.948741913 CEST	49774	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:40.948829889 CEST	443	49774	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:40.948926926 CEST	49774	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:40.949131012 CEST	49774	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:40.949166059 CEST	443	49774	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:41.022144079 CEST	443	49771	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:41.022171021 CEST	443	49771	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:41.022180080 CEST	443	49771	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:41.022236109 CEST	443	49771	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:41.022285938 CEST	443	49771	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:41.022370100 CEST	49771	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:41.022370100 CEST	49771	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:41.022384882 CEST	443	49771	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:41.022424936 CEST	49771	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:41.022433043 CEST	49771	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:41.022679090 CEST	443	49771	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:41.022700071 CEST	443	49771	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:41.022743940 CEST	49771	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:41.022752047 CEST	443	49771	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:41.022761106 CEST	49771	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:41.022789001 CEST	49771	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:41.058279037 CEST	443	49771	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:41.058361053 CEST	49771	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:41.058361053 CEST	443	49771	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:41.058407068 CEST	49771	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:41.058613062 CEST	49771	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:41.058626890 CEST	443	49771	13.107.246.41	192.168.2.18
Apr 25, 2024 15:57:41.058634996 CEST	49771	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:41.058670044 CEST	49771	443	192.168.2.18	13.107.246.41
Apr 25, 2024 15:57:41.286173105 CEST	443	49774	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:41.286482096 CEST	49774	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:41.286540985 CEST	443	49774	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:41.286911011 CEST	443	49774	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:41.287228107 CEST	49774	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:41.287297010 CEST	443	49774	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:41.287363052 CEST	49774	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:41.328150034 CEST	443	49774	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:41.511219025 CEST	443	49774	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:41.511379004 CEST	443	49774	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:41.511445045 CEST	49774	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:41.512073040 CEST	49774	443	192.168.2.18	13.107.213.41
Apr 25, 2024 15:57:41.512125969 CEST	443	49774	13.107.213.41	192.168.2.18
Apr 25, 2024 15:57:45.038446903 CEST	49679	443	192.168.2.18	52.182.141.63
Apr 25, 2024 15:57:47.540366888 CEST	49673	443	192.168.2.18	204.79.197.203
Apr 25, 2024 15:57:54.646411896 CEST	49679	443	192.168.2.18	52.182.141.63
Apr 25, 2024 15:58:02.630333900 CEST	49698	443	192.168.2.18	52.123.129.14
Apr 25, 2024 15:58:02.630350113 CEST	443	49698	52.123.129.14	192.168.2.18
Apr 25, 2024 15:58:03.077578068 CEST	49690	80	192.168.2.18	23.40.205.35
Apr 25, 2024 15:58:03.187366962 CEST	80	49690	23.40.205.35	192.168.2.18
Apr 25, 2024 15:58:03.187525988 CEST	49690	80	192.168.2.18	23.40.205.35
Apr 25, 2024 15:58:04.887120962 CEST	49775	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:58:04.887154102 CEST	443	49775	20.114.59.183	192.168.2.18
Apr 25, 2024 15:58:04.887280941 CEST	49775	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:58:04.887665987 CEST	49775	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:58:04.887680054 CEST	443	49775	20.114.59.183	192.168.2.18
Apr 25, 2024 15:58:05.405962944 CEST	443	49775	20.114.59.183	192.168.2.18
Apr 25, 2024 15:58:05.406158924 CEST	49775	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:58:05.407603025 CEST	49775	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:58:05.407612085 CEST	443	49775	20.114.59.183	192.168.2.18
Apr 25, 2024 15:58:05.407845020 CEST	443	49775	20.114.59.183	192.168.2.18
Apr 25, 2024 15:58:05.409326077 CEST	49775	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:58:05.456115961 CEST	443	49775	20.114.59.183	192.168.2.18
Apr 25, 2024 15:58:05.915312052 CEST	443	49775	20.114.59.183	192.168.2.18
Apr 25, 2024 15:58:05.915334940 CEST	443	49775	20.114.59.183	192.168.2.18
Apr 25, 2024 15:58:05.915381908 CEST	443	49775	20.114.59.183	192.168.2.18
Apr 25, 2024 15:58:05.915445089 CEST	49775	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:58:05.915472984 CEST	443	49775	20.114.59.183	192.168.2.18
Apr 25, 2024 15:58:05.915491104 CEST	49775	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:58:05.915515900 CEST	49775	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:58:05.915582895 CEST	443	49775	20.114.59.183	192.168.2.18
Apr 25, 2024 15:58:05.915633917 CEST	443	49775	20.114.59.183	192.168.2.18
Apr 25, 2024 15:58:05.915658951 CEST	443	49775	20.114.59.183	192.168.2.18
Apr 25, 2024 15:58:05.915664911 CEST	49775	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:58:05.915708065 CEST	49775	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:58:05.918720007 CEST	49775	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:58:05.918740988 CEST	443	49775	20.114.59.183	192.168.2.18
Apr 25, 2024 15:58:05.918751955 CEST	49775	443	192.168.2.18	20.114.59.183
Apr 25, 2024 15:58:05.918756962 CEST	443	49775	20.114.59.183	192.168.2.18
Apr 25, 2024 15:58:12.142677069 CEST	49777	443	192.168.2.18	131.253.33.200
Apr 25, 2024 15:58:12.142725945 CEST	443	49777	131.253.33.200	192.168.2.18
Apr 25, 2024 15:58:12.142828941 CEST	49777	443	192.168.2.18	131.253.33.200
Apr 25, 2024 15:58:12.145454884 CEST	49777	443	192.168.2.18	131.253.33.200
Apr 25, 2024 15:58:12.145472050 CEST	443	49777	131.253.33.200	192.168.2.18
Apr 25, 2024 15:58:12.534543037 CEST	443	49777	131.253.33.200	192.168.2.18
Apr 25, 2024 15:58:12.534693956 CEST	49777	443	192.168.2.18	131.253.33.200
Apr 25, 2024 15:58:12.535716057 CEST	443	49777	131.253.33.200	192.168.2.18
Apr 25, 2024 15:58:12.535790920 CEST	49777	443	192.168.2.18	131.253.33.200
Apr 25, 2024 15:58:12.576693058 CEST	49777	443	192.168.2.18	131.253.33.200
Apr 25, 2024 15:58:12.576711893 CEST	443	49777	131.253.33.200	192.168.2.18
Apr 25, 2024 15:58:12.577219009 CEST	443	49777	131.253.33.200	192.168.2.18
Apr 25, 2024 15:58:12.577305079 CEST	49777	443	192.168.2.18	131.253.33.200
Apr 25, 2024 15:58:12.578680038 CEST	49777	443	192.168.2.18	131.253.33.200
Apr 25, 2024 15:58:12.578727961 CEST	443	49777	131.253.33.200	192.168.2.18
Apr 25, 2024 15:58:12.849889040 CEST	443	49777	131.253.33.200	192.168.2.18
Apr 25, 2024 15:58:12.849909067 CEST	443	49777	131.253.33.200	192.168.2.18
Apr 25, 2024 15:58:12.849972963 CEST	443	49777	131.253.33.200	192.168.2.18
Apr 25, 2024 15:58:12.850027084 CEST	49777	443	192.168.2.18	131.253.33.200
Apr 25, 2024 15:58:12.850056887 CEST	49777	443	192.168.2.18	131.253.33.200
Apr 25, 2024 15:58:12.853688955 CEST	49777	443	192.168.2.18	131.253.33.200
Apr 25, 2024 15:58:12.853713989 CEST	443	49777	131.253.33.200	192.168.2.18
Apr 25, 2024 15:58:19.272958994 CEST	49698	443	192.168.2.18	52.123.129.14
Apr 25, 2024 15:58:19.273055077 CEST	443	49698	52.123.129.14	192.168.2.18
Apr 25, 2024 15:58:19.273138046 CEST	49698	443	192.168.2.18	52.123.129.14
Apr 25, 2024 15:58:20.501287937 CEST	49751	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:58:20.501344919 CEST	443	49751	152.199.4.44	192.168.2.18
Apr 25, 2024 15:58:21.925481081 CEST	49779	443	192.168.2.18	64.233.177.147
Apr 25, 2024 15:58:21.925530910 CEST	443	49779	64.233.177.147	192.168.2.18
Apr 25, 2024 15:58:21.925616026 CEST	49779	443	192.168.2.18	64.233.177.147
Apr 25, 2024 15:58:21.925874949 CEST	49779	443	192.168.2.18	64.233.177.147
Apr 25, 2024 15:58:21.925894022 CEST	443	49779	64.233.177.147	192.168.2.18
Apr 25, 2024 15:58:22.150942087 CEST	443	49779	64.233.177.147	192.168.2.18
Apr 25, 2024 15:58:22.151305914 CEST	49779	443	192.168.2.18	64.233.177.147
Apr 25, 2024 15:58:22.151371956 CEST	443	49779	64.233.177.147	192.168.2.18
Apr 25, 2024 15:58:22.151740074 CEST	443	49779	64.233.177.147	192.168.2.18
Apr 25, 2024 15:58:22.152162075 CEST	49779	443	192.168.2.18	64.233.177.147
Apr 25, 2024 15:58:22.152241945 CEST	443	49779	64.233.177.147	192.168.2.18
Apr 25, 2024 15:58:22.195302963 CEST	49779	443	192.168.2.18	64.233.177.147
Apr 25, 2024 15:58:32.153088093 CEST	443	49779	64.233.177.147	192.168.2.18
Apr 25, 2024 15:58:32.153182983 CEST	443	49779	64.233.177.147	192.168.2.18
Apr 25, 2024 15:58:32.153254986 CEST	49779	443	192.168.2.18	64.233.177.147
Apr 25, 2024 15:58:33.271143913 CEST	49779	443	192.168.2.18	64.233.177.147
Apr 25, 2024 15:58:33.271203041 CEST	443	49779	64.233.177.147	192.168.2.18
Apr 25, 2024 15:58:35.622373104 CEST	443	49751	152.199.4.44	192.168.2.18
Apr 25, 2024 15:58:35.622473955 CEST	443	49751	152.199.4.44	192.168.2.18
Apr 25, 2024 15:58:35.622575998 CEST	49751	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:58:37.275803089 CEST	49751	443	192.168.2.18	152.199.4.44
Apr 25, 2024 15:58:37.275823116 CEST	443	49751	152.199.4.44	192.168.2.18
Apr 25, 2024 15:58:55.249420881 CEST	49692	80	192.168.2.18	192.229.211.108
Apr 25, 2024 15:58:55.358685017 CEST	80	49692	192.229.211.108	192.168.2.18
Apr 25, 2024 15:58:55.358798027 CEST	49692	80	192.168.2.18	192.229.211.108

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 15:57:17.100579977 CEST	58475	53	192.168.2.18	1.1.1.1
Apr 25, 2024 15:57:17.100886106 CEST	56737	53	192.168.2.18	1.1.1.1
Apr 25, 2024 15:57:17.191350937 CEST	53	64629	1.1.1.1	192.168.2.18
Apr 25, 2024 15:57:17.211601019 CEST	53	58475	1.1.1.1	192.168.2.18
Apr 25, 2024 15:57:17.212229013 CEST	53	56737	1.1.1.1	192.168.2.18
Apr 25, 2024 15:57:17.238648891 CEST	53	57673	1.1.1.1	192.168.2.18
Apr 25, 2024 15:57:17.868057013 CEST	53	50547	1.1.1.1	192.168.2.18
Apr 25, 2024 15:57:18.041994095 CEST	63870	53	192.168.2.18	1.1.1.1
Apr 25, 2024 15:57:18.042150021 CEST	50752	53	192.168.2.18	1.1.1.1
Apr 25, 2024 15:57:18.153012991 CEST	53	50752	1.1.1.1	192.168.2.18
Apr 25, 2024 15:57:19.404104948 CEST	54967	53	192.168.2.18	1.1.1.1
Apr 25, 2024 15:57:19.404640913 CEST	61469	53	192.168.2.18	1.1.1.1
Apr 25, 2024 15:57:21.467123985 CEST	49624	53	192.168.2.18	1.1.1.1
Apr 25, 2024 15:57:21.467459917 CEST	55458	53	192.168.2.18	1.1.1.1
Apr 25, 2024 15:57:21.868689060 CEST	59580	53	192.168.2.18	1.1.1.1
Apr 25, 2024 15:57:21.868797064 CEST	49554	53	192.168.2.18	1.1.1.1
Apr 25, 2024 15:57:21.978905916 CEST	53	59580	1.1.1.1	192.168.2.18
Apr 25, 2024 15:57:21.979465961 CEST	53	49554	1.1.1.1	192.168.2.18
Apr 25, 2024 15:57:31.689016104 CEST	58541	53	192.168.2.18	1.1.1.1
Apr 25, 2024 15:57:31.689254999 CEST	56327	53	192.168.2.18	1.1.1.1
Apr 25, 2024 15:57:31.814194918 CEST	56780	53	192.168.2.18	1.1.1.1
Apr 25, 2024 15:57:31.814358950 CEST	55568	53	192.168.2.18	1.1.1.1
Apr 25, 2024 15:57:31.924092054 CEST	53	55568	1.1.1.1	192.168.2.18
Apr 25, 2024 15:57:32.503830910 CEST	62839	53	192.168.2.18	1.1.1.1
Apr 25, 2024 15:57:32.503963947 CEST	63034	53	192.168.2.18	1.1.1.1
Apr 25, 2024 15:57:33.196222067 CEST	54949	53	192.168.2.18	1.1.1.1
Apr 25, 2024 15:57:33.196404934 CEST	52552	53	192.168.2.18	1.1.1.1
Apr 25, 2024 15:57:34.166260958 CEST	60374	53	192.168.2.18	1.1.1.1
Apr 25, 2024 15:57:34.166430950 CEST	51488	53	192.168.2.18	1.1.1.1
Apr 25, 2024 15:57:34.276304960 CEST	53	51488	1.1.1.1	192.168.2.18
Apr 25, 2024 15:57:34.276510954 CEST	53	60374	1.1.1.1	192.168.2.18
Apr 25, 2024 15:57:34.780054092 CEST	53	64041	1.1.1.1	192.168.2.18
Apr 25, 2024 15:57:35.836071968 CEST	58492	53	192.168.2.18	1.1.1.1
Apr 25, 2024 15:57:35.836208105 CEST	53264	53	192.168.2.18	1.1.1.1
Apr 25, 2024 15:57:40.575725079 CEST	53	59090	1.1.1.1	192.168.2.18
Apr 25, 2024 15:57:53.735954046 CEST	53	51636	1.1.1.1	192.168.2.18
Apr 25, 2024 15:58:16.318643093 CEST	53	51738	1.1.1.1	192.168.2.18
Apr 25, 2024 15:58:17.136183977 CEST	53	61164	1.1.1.1	192.168.2.18
Apr 25, 2024 15:58:35.909310102 CEST	138	138	192.168.2.18	192.168.2.255
Apr 25, 2024 15:58:45.193640947 CEST	53	53723	1.1.1.1	192.168.2.18

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 25, 2024 15:57:17.100579977 CEST	192.168.2.18	1.1.1.1	0x2e25	Standard query (0)	urlshortener.teams.cloud.microsoft	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:57:17.100886106 CEST	192.168.2.18	1.1.1.1	0x688	Standard query (0)	urlshortener.teams.cloud.microsoft	65	IN (0x0001)	false
Apr 25, 2024 15:57:18.041994095 CEST	192.168.2.18	1.1.1.1	0xef2b	Standard query (0)	teams.live.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:57:18.042150021 CEST	192.168.2.18	1.1.1.1	0x5e23	Standard query (0)	teams.live.com	65	IN (0x0001)	false
Apr 25, 2024 15:57:19.404104948 CEST	192.168.2.18	1.1.1.1	0x58d4	Standard query (0)	statics.teams.cdn.live.net	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:57:19.404640913 CEST	192.168.2.18	1.1.1.1	0x8900	Standard query (0)	statics.teams.cdn.live.net	65	IN (0x0001)	false
Apr 25, 2024 15:57:21.467123985 CEST	192.168.2.18	1.1.1.1	0xccdb	Standard query (0)	statics.teams.cdn.live.net	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:57:21.467459917 CEST	192.168.2.18	1.1.1.1	0x29b6	Standard query (0)	statics.teams.cdn.live.net	65	IN (0x0001)	false
Apr 25, 2024 15:57:21.868689060 CEST	192.168.2.18	1.1.1.1	0x3cfd	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:57:21.868797064 CEST	192.168.2.18	1.1.1.1	0x7aa4	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 25, 2024 15:57:31.689016104 CEST	192.168.2.18	1.1.1.1	0x1608	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:57:31.689254999 CEST	192.168.2.18	1.1.1.1	0x3061	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
Apr 25, 2024 15:57:31.814194918 CEST	192.168.2.18	1.1.1.1	0x4a07	Standard query (0)	teams.live.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:57:31.814358950 CEST	192.168.2.18	1.1.1.1	0x4b4e	Standard query (0)	teams.live.com	65	IN (0x0001)	false
Apr 25, 2024 15:57:32.503830910 CEST	192.168.2.18	1.1.1.1	0xcaff	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:57:32.503963947 CEST	192.168.2.18	1.1.1.1	0x2bf6	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
Apr 25, 2024 15:57:33.196222067 CEST	192.168.2.18	1.1.1.1	0x60c2	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:57:33.196404934 CEST	192.168.2.18	1.1.1.1	0x7ccd	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
Apr 25, 2024 15:57:34.166260958 CEST	192.168.2.18	1.1.1.1	0xb73	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:57:34.166430950 CEST	192.168.2.18	1.1.1.1	0x8563	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Apr 25, 2024 15:57:35.836071968 CEST	192.168.2.18	1.1.1.1	0xe9a2	Standard query (0)	identity.nel.measure.office.net	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:57:35.836208105 CEST	192.168.2.18	1.1.1.1	0xd189	Standard query (0)	identity.nel.measure.office.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 25, 2024 15:57:17.211601019 CEST	1.1.1.1	192.168.2.18	0x2e25	No error (0)	urlshortener.teams.cloud.microsoft	urlshortener-teams-cloud-microsoft.s-0005.dual-s-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:57:17.211601019 CEST	1.1.1.1	192.168.2.18	0x2e25	No error (0)	urlshortener-teams-cloud-microsoft.s-0005.dual-s-msedge.net	s-0005.dual-s-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:57:17.211601019 CEST	1.1.1.1	192.168.2.18	0x2e25	No error (0)	s-0005.dual-s-msedge.net		52.123.129.14	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:57:17.211601019 CEST	1.1.1.1	192.168.2.18	0x2e25	No error (0)	s-0005.dual-s-msedge.net		52.123.128.14	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:57:17.212229013 CEST	1.1.1.1	192.168.2.18	0x688	No error (0)	urlshortener.teams.cloud.microsoft	urlshortener-teams-cloud-microsoft.s-0005.dual-s-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:57:18.152509928 CEST	1.1.1.1	192.168.2.18	0xef2b	No error (0)	teams.live.com	s-0005.s-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:57:18.153012991 CEST	1.1.1.1	192.168.2.18	0x5e23	No error (0)	teams.live.com	s-0005.s-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:57:19.514657974 CEST	1.1.1.1	192.168.2.18	0x8900	No error (0)	statics.teams.cdn.live.net	tfl-staticscdn.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:57:19.514902115 CEST	1.1.1.1	192.168.2.18	0x58d4	No error (0)	statics.teams.cdn.live.net	tfl-staticscdn.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:57:21.577157021 CEST	1.1.1.1	192.168.2.18	0xccdb	No error (0)	statics.teams.cdn.live.net	tfl-staticscdn.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:57:21.577505112 CEST	1.1.1.1	192.168.2.18	0x29b6	No error (0)	statics.teams.cdn.live.net	tfl-staticscdn.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:57:21.978905916 CEST	1.1.1.1	192.168.2.18	0x3cfd	No error (0)	www.google.com		64.233.177.147	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:57:21.978905916 CEST	1.1.1.1	192.168.2.18	0x3cfd	No error (0)	www.google.com		64.233.177.99	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:57:21.978905916 CEST	1.1.1.1	192.168.2.18	0x3cfd	No error (0)	www.google.com		64.233.177.106	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:57:21.978905916 CEST	1.1.1.1	192.168.2.18	0x3cfd	No error (0)	www.google.com		64.233.177.104	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:57:21.978905916 CEST	1.1.1.1	192.168.2.18	0x3cfd	No error (0)	www.google.com		64.233.177.105	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:57:21.978905916 CEST	1.1.1.1	192.168.2.18	0x3cfd	No error (0)	www.google.com		64.233.177.103	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:57:21.979465961 CEST	1.1.1.1	192.168.2.18	0x7aa4	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 25, 2024 15:57:31.799180984 CEST	1.1.1.1	192.168.2.18	0x1608	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:57:31.799201012 CEST	1.1.1.1	192.168.2.18	0x3061	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:57:31.924092054 CEST	1.1.1.1	192.168.2.18	0x4b4e	No error (0)	teams.live.com	s-0005.s-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:57:31.924331903 CEST	1.1.1.1	192.168.2.18	0x4a07	No error (0)	teams.live.com	s-0005.s-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:57:32.613620996 CEST	1.1.1.1	192.168.2.18	0xcaff	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:57:32.613727093 CEST	1.1.1.1	192.168.2.18	0x2bf6	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:57:33.306173086 CEST	1.1.1.1	192.168.2.18	0x7ccd	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:57:33.306339025 CEST	1.1.1.1	192.168.2.18	0x60c2	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:57:34.276304960 CEST	1.1.1.1	192.168.2.18	0x8563	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:57:34.276510954 CEST	1.1.1.1	192.168.2.18	0xb73	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:57:34.276510954 CEST	1.1.1.1	192.168.2.18	0xb73	No error (0)	cs1100.wpc.omegacdn.net		152.199.4.44	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:57:35.945967913 CEST	1.1.1.1	192.168.2.18	0xe9a2	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:57:35.946139097 CEST	1.1.1.1	192.168.2.18	0xd189	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:57:35.962201118 CEST	1.1.1.1	192.168.2.18	0x22e	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:57:35.962201118 CEST	1.1.1.1	192.168.2.18	0x22e	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:57:35.962201118 CEST	1.1.1.1	192.168.2.18	0x22e	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:57:37.868532896 CEST	1.1.1.1	192.168.2.18	0xba4b	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 15:57:37.868532896 CEST	1.1.1.1	192.168.2.18	0xba4b	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 25, 2024 15:57:37.868532896 CEST	1.1.1.1	192.168.2.18	0xba4b	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

urlshortener.teams.cloud.microsoft

fs.microsoft.com

slscr.update.microsoft.com

https:

aadcdn.msftauth.net

aadcdn.msauth.net

www.bing.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.18	49697	52.123.129.14	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:57:17 UTC	696	OUT	GET /8DC6524B7BA4BE6-3-2 HTTP/1.1 Host: urlshortener.teams.cloud.microsoft Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:57:18 UTC	736	IN	HTTP/1.1 301 Moved Permanently Location: https://teams.live.com/l/chat/19:uni01_2hqxtwyf57dbz2miswffeciw5d4epfpr7i4h5u5gvnh7pqd4slpq@thread.v2/conversations?tenantId=9188040d-6c67-4c5b-b112-36a304b66dad&launchAgent=ES&laEntry=MAE&v=MAE5&lm=deeplink&lmsrc=email&emltid=10459c8b-4325-4997-8dae-4b4abe8055d7&linkpos=1&emltype=New_Activities_TFL&linktype=New_ChatActivity_TFL correlationTags: serverRequestId: 72e6d7a3-0c8c-4b8c-995f-ea0ec8a62ec4, clientRequestId: Strict-Transport-Security: max-age=31536000; includeSubDomains X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: CFFD0C6BF4914A6192266E15EC4F6779 Ref B: ATL331000108035 Ref C: 2024-04-25T13:57:17Z Date: Thu, 25 Apr 2024 13:57:17 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.18	49712	23.46.200.91	443

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:57:21 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-25 13:57:22 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/073D) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=147992 Date: Thu, 25 Apr 2024 13:57:22 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.18	49719	23.46.200.91	443

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:57:22 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-25 13:57:22 UTC	531	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0rcGnYgAAAAANOnx9vccHTr21ROgX9ESTU0pDRURHRTAzMDkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=148005 Date: Thu, 25 Apr 2024 13:57:22 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-25 13:57:22 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.18	49728	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:57:28 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+3LuncmL5GvGc6o&MD=ofF4+heM HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-25 13:57:28 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 271c301a-470a-409f-bbe8-4df51d583de3 MS-RequestId: 8fa9bb35-a02b-48c8-8d95-63a022cfd0d7 MS-CV: vkPCHuQGE0SN0/am.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 25 Apr 2024 13:57:27 GMT Connection: close Content-Length: 24490
2024-04-25 13:57:28 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-25 13:57:28 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.18	49748	152.199.4.44	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:57:34 UTC	635	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:57:34 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 1195952 Cache-Control: public, max-age=31536000 Content-MD5: 2vlVvyES905PeLIYeo1r7w== Content-Type: application/x-javascript Date: Thu, 25 Apr 2024 13:57:34 GMT Etag: 0x8DC4DBF5E20DC85 Last-Modified: Tue, 26 Mar 2024 18:05:49 GMT Server: ECAcc (agc/7F29) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 0776f3ba-701e-0068-1d37-8c4015000000 x-ms-version: 2009-09-19 Content-Length: 141339 Connection: close
2024-04-25 13:57:34 UTC	16383	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-04-25 13:57:34 UTC	1	IN	Data Raw: 75 Data Ascii: u
2024-04-25 13:57:34 UTC	16383	IN	Data Raw: 74 65 64 53 74 79 6c 65 28 65 2c 6e 75 6c 6c 29 3a 65 2e 63 75 72 72 65 6e 74 53 74 79 6c 65 3f 65 2e 63 75 72 72 65 6e 74 53 74 79 6c 65 3a 7b 7d 7d 2c 68 69 73 74 6f 72 79 3a 7b 70 75 73 68 53 74 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 5f 2e 69 73 48 69 73 74 6f 72 79 53 75 70 70 6f 72 74 65 64 28 29 26 26 64 2e 68 69 73 74 6f 72 79 2e 70 75 73 68 53 74 61 74 65 28 65 2c 6e 29 7d 2c 72 65 70 6c 61 63 65 53 74 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 5f 2e 69 73 48 69 73 74 6f 72 79 53 75 70 70 6f 72 74 65 64 28 29 26 26 64 2e 68 69 73 74 6f 72 79 2e 72 65 70 6c 61 63 65 53 74 61 74 65 28 65 2c 6e 29 7d 7d 2c 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 2c 72 29 7b 65 2e 61 64 64 Data Ascii: tedStyle(e,null):e.currentStyle?e.currentStyle:{}},history:{pushState:function(e,n){_.isHistorySupported()&&d.history.pushState(e,n)},replaceState:function(e,n){_.isHistorySupported()&&d.history.replaceState(e,n)}},addEventListener:function(e,n,t,r){e.add
2024-04-25 13:57:34 UTC	16383	IN	Data Raw: 53 4d 53 3a 22 38 30 30 34 33 34 45 31 22 2c 50 50 5f 45 5f 49 4e 4c 49 4e 45 4c 4f 47 49 4e 5f 49 4e 56 41 4c 49 44 5f 41 4c 54 3a 22 38 30 30 34 33 34 45 32 22 2c 50 50 5f 45 5f 50 52 45 56 49 4f 55 53 5f 50 41 53 53 57 4f 52 44 3a 22 38 30 30 34 31 30 31 33 22 2c 50 50 5f 45 5f 48 49 50 5f 56 41 4c 49 44 41 54 49 4f 4e 5f 57 52 4f 4e 47 3a 22 38 30 30 34 35 35 30 35 22 2c 50 50 5f 45 5f 48 49 50 5f 56 41 4c 49 44 41 54 49 4f 4e 5f 45 52 52 4f 52 5f 46 41 54 41 4c 3a 22 38 30 30 34 35 35 33 37 22 2c 50 50 5f 45 5f 48 49 50 5f 56 41 4c 49 44 41 54 49 4f 4e 5f 45 52 52 4f 52 5f 55 4e 41 55 54 48 45 4e 54 49 43 41 54 45 44 3a 22 38 30 30 34 35 35 33 38 22 2c 50 50 5f 45 5f 48 49 50 5f 56 41 4c 49 44 41 54 49 4f 4e 5f 45 52 52 4f 52 5f 4f 54 48 45 52 3a 22 Data Ascii: SMS:"800434E1",PP_E_INLINELOGIN_INVALID_ALT:"800434E2",PP_E_PREVIOUS_PASSWORD:"80041013",PP_E_HIP_VALIDATION_WRONG:"80045505",PP_E_HIP_VALIDATION_ERROR_FATAL:"80045537",PP_E_HIP_VALIDATION_ERROR_UNAUTHENTICATED:"80045538",PP_E_HIP_VALIDATION_ERROR_OTHER:"
2024-04-25 13:57:34 UTC	16383	IN	Data Raw: 5b 5d 3b 69 66 28 65 29 66 6f 72 28 76 61 72 20 6f 3d 30 2c 69 3d 65 2e 6c 65 6e 67 74 68 3b 6f 3c 69 3b 6f 2b 2b 29 72 2e 70 75 73 68 28 6e 2e 63 61 6c 6c 28 74 2c 65 5b 6f 5d 2c 6f 29 29 3b 72 65 74 75 72 6e 20 72 7d 2c 6a 62 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 76 61 72 20 72 3d 5b 5d 3b 69 66 28 65 29 66 6f 72 28 76 61 72 20 6f 3d 30 2c 69 3d 65 2e 6c 65 6e 67 74 68 3b 6f 3c 69 3b 6f 2b 2b 29 6e 2e 63 61 6c 6c 28 74 2c 65 5b 6f 5d 2c 6f 29 26 26 72 2e 70 75 73 68 28 65 5b 6f 5d 29 3b 72 65 74 75 72 6e 20 72 7d 2c 4e 62 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 6e 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 65 2e 70 75 73 68 2e 61 70 70 6c 79 28 65 2c 6e 29 3b 65 6c 73 65 20 66 6f 72 28 76 61 72 20 74 3d 30 2c 72 3d Data Ascii: [];if(e)for(var o=0,i=e.length;o<i;o++)r.push(n.call(t,e[o],o));return r},jb:function(e,n,t){var r=[];if(e)for(var o=0,i=e.length;o<i;o++)n.call(t,e[o],o)&&r.push(e[o]);return r},Nb:function(e,n){if(n instanceof Array)e.push.apply(e,n);else for(var t=0,r=
2024-04-25 13:57:34 UTC	16383	IN	Data Raw: 72 65 74 75 72 6e 21 21 65 7d 2c 53 2e 5a 61 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 28 65 5b 54 5d 3d 3d 3d 50 5b 54 5d 7c 7c 65 5b 54 5d 3d 3d 3d 53 2e 6f 2e 66 6e 5b 54 5d 26 26 65 2e 4e 63 29 7d 2c 53 2e 62 28 22 6f 62 73 65 72 76 61 62 6c 65 22 2c 53 2e 74 61 29 2c 53 2e 62 28 22 69 73 4f 62 73 65 72 76 61 62 6c 65 22 2c 53 2e 4f 29 2c 53 2e 62 28 22 69 73 57 72 69 74 65 61 62 6c 65 4f 62 73 65 72 76 61 62 6c 65 22 2c 53 2e 5a 61 29 2c 53 2e 62 28 22 69 73 57 72 69 74 61 62 6c 65 4f 62 73 65 72 76 61 62 6c 65 22 2c 53 2e 5a 61 29 2c 53 2e 62 28 22 6f 62 73 65 72 76 61 62 6c 65 2e 66 6e 22 2c 50 29 2c 53 2e 4c 28 50 2c 22 70 65 65 6b 22 2c 50 2e 76 29 2c 53 2e 4c 28 50 Data Ascii: return!!e},S.Za=function(e){return"function"==typeof e&&(e[T]===P[T]\|\|e[T]===S.o.fn[T]&&e.Nc)},S.b("observable",S.ta),S.b("isObservable",S.O),S.b("isWriteableObservable",S.Za),S.b("isWritableObservable",S.Za),S.b("observable.fn",P),S.L(P,"peek",P.v),S.L(P
2024-04-25 13:57:35 UTC	16383	IN	Data Raw: 75 6c 6c 2c 65 29 2e 62 69 6e 64 69 6e 67 43 6f 6e 74 65 78 74 46 6f 72 44 65 73 63 65 6e 64 61 6e 74 73 29 2c 74 26 26 21 62 5b 53 2e 61 2e 52 28 6e 29 5d 26 26 64 28 74 2c 6e 29 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 6e 2c 74 29 7b 76 61 72 20 6f 2c 69 3d 53 2e 61 2e 67 2e 55 62 28 65 2c 45 2c 7b 7d 29 2c 73 3d 69 2e 68 64 3b 69 66 28 21 6e 29 7b 69 66 28 73 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 59 6f 75 20 63 61 6e 6e 6f 74 20 61 70 70 6c 79 20 62 69 6e 64 69 6e 67 73 20 6d 75 6c 74 69 70 6c 65 20 74 69 6d 65 73 20 74 6f 20 74 68 65 20 73 61 6d 65 20 65 6c 65 6d 65 6e 74 2e 22 29 3b 69 2e 68 64 3d 21 30 7d 69 66 28 73 7c 7c 28 69 2e 63 6f 6e 74 65 78 74 3d 74 29 2c 69 2e 5a 62 7c 7c 28 69 2e 5a 62 3d 7b 7d 29 2c 6e 26 26 22 66 75 6e 63 74 69 6f Data Ascii: ull,e).bindingContextForDescendants),t&&!b[S.a.R(n)]&&d(t,n)}function p(e,n,t){var o,i=S.a.g.Ub(e,E,{}),s=i.hd;if(!n){if(s)throw Error("You cannot apply bindings multiple times to the same element.");i.hd=!0}if(s\|\|(i.context=t),i.Zb\|\|(i.Zb={}),n&&"functio
2024-04-25 13:57:35 UTC	5	IN	Data Raw: 6c 6c 2c 5b 65 Data Ascii: ll,[e
2024-04-25 13:57:35 UTC	16383	IN	Data Raw: 2c 22 63 68 61 6e 67 65 22 5d 29 2c 28 6c 7c 7c 53 2e 53 2e 59 61 28 29 29 26 26 53 2e 69 2e 6d 61 28 65 2c 53 2e 69 2e 48 29 2c 53 2e 61 2e 77 64 28 65 29 2c 75 26 26 32 30 3c 4d 61 74 68 2e 61 62 73 28 75 2d 65 2e 73 63 72 6f 6c 6c 54 6f 70 29 26 26 28 65 2e 73 63 72 6f 6c 6c 54 6f 70 3d 75 29 7d 7d 2c 53 2e 63 2e 6f 70 74 69 6f 6e 73 2e 24 62 3d 53 2e 61 2e 67 2e 5a 28 29 2c 53 2e 63 2e 73 65 6c 65 63 74 65 64 4f 70 74 69 6f 6e 73 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 66 75 6e 63 74 69 6f 6e 20 72 28 29 7b 76 61 72 20 72 3d 6e 28 29 2c 6f 3d 5b 5d 3b 53 2e 61 2e 44 28 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 6f 70 74 69 6f 6e 22 29 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 73 65 6c 65 Data Ascii: ,"change"]),(l\|\|S.S.Ya())&&S.i.ma(e,S.i.H),S.a.wd(e),u&&20<Math.abs(u-e.scrollTop)&&(e.scrollTop=u)}},S.c.options.$b=S.a.g.Z(),S.c.selectedOptions={init:function(e,n,t){function r(){var r=n(),o=[];S.a.D(e.getElementsByTagName("option"),(function(e){e.sele
2024-04-25 13:57:35 UTC	16383	IN	Data Raw: 6f 2e 4b 65 79 43 6f 64 65 3b 66 75 6e 63 74 69 6f 6e 20 66 28 65 29 7b 65 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 3f 65 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3a 65 2e 72 65 74 75 72 6e 56 61 6c 75 65 3d 21 31 7d 6e 2e 61 70 70 6c 79 45 78 74 65 6e 73 69 6f 6e 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 2c 74 3d 31 2c 6f 3d 7b 7d 3b 65 2e 63 6f 6d 70 6f 6e 65 6e 74 73 2e 6c 6f 61 64 65 72 73 2e 75 6e 73 68 69 66 74 28 7b 6c 6f 61 64 43 6f 6d 70 6f 6e 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 29 7b 65 2e 63 6f 6d 70 6f 6e 65 6e 74 73 2e 64 65 66 61 75 6c 74 4c 6f 61 64 65 72 2e 6c 6f 61 64 43 6f 6d 70 6f 6e 65 6e 74 28 6e 2c 74 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 69 3b 74 2e 65 6e 61 62 6c 65 45 Data Ascii: o.KeyCode;function f(e){e.preventDefault?e.preventDefault():e.returnValue=!1}n.applyExtensions=function(e){var n,t=1,o={};e.components.loaders.unshift({loadComponent:function(n,t,r){e.components.defaultLoader.loadComponent(n,t,(function(n){var i;t.enableE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.18	49753	13.107.246.41	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:57:36 UTC	658	OUT	GET /ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:57:36 UTC	781	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:57:36 GMT Content-Type: text/css Content-Length: 20314 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 27 Dec 2023 18:18:12 GMT ETag: 0x8DC07082FBB8D2B x-ms-request-id: c313eadd-401e-000a-792a-95eb8b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T135736Z-16f56cb894fcps2fa8agb63e8w00000003u0000000008tnz x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-25 13:57:36 UTC	15603	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 7d 6b 73 e3 36 b2 e8 f7 f9 15 5c a7 52 3b ce 4a 8c 48 3d 2d 57 52 3b 99 cc 26 3e 67 5e 35 33 d9 47 a5 52 5b b4 44 59 3c 43 89 ba 24 65 8f 57 47 ff fd e2 8d 06 d0 20 29 8f b3 d9 7b 2b 27 67 13 0b dd 6c 00 dd 8d 06 1a e8 06 be fe ea 0f c1 f3 62 77 5f 66 37 eb 3a 78 fa fc 3c 78 95 2d ca a2 2a 56 35 29 2f 77 45 99 d4 59 b1 0d 83 67 79 1e 30 a4 2a 28 d3 2a 2d 6f d3 65 18 7c f5 f5 d7 5f fd e1 49 bf fb ff 05 ef 3f 3c 7b f7 21 78 f3 97 e0 c3 8f 57 ef be 0f de 92 5f ff 08 5e bf f9 70 f5 fc 45 d0 99 ca 93 27 1f d6 59 15 ac b2 3c 0d c8 7f af 93 2a 5d 06 c5 36 28 ca 20 db 2e 44 ab d3 2a d8 90 7f 97 59 92 07 ab b2 d8 04 f5 3a 0d 76 65 f1 3f e9 82 f4 21 cf aa 9a 7c 74 9d e6 c5 5d f0 94 90 2b 97 c1 db a4 ac ef 83 ab b7 e7 61 f0 81 e0 16 Data Ascii: }ks6\R;JH=-WR;&>g^53GR[DY<C$eWG ){+'glbw_f7:x<x-V5)/wEYgy0(-oe\|_I?<{!xW_^pE'Y<]6( .D*Y:ve?!\|t]+a
2024-04-25 13:57:36 UTC	4711	IN	Data Raw: e7 bc b1 e2 92 61 7d df b0 68 ac ab 2c aa b1 88 da cb c6 22 89 f4 a2 b1 42 53 1e da 58 e7 55 1e b5 fb a5 96 31 c6 85 9c 5c 95 58 0f 77 34 04 a7 bc ef e9 bc 62 55 e4 cb 9d 46 11 60 f2 34 8a 20 ba 0a e1 1d 2d b3 ba 41 d4 6a 33 50 25 58 6c a8 15 02 68 eb 56 83 ba b5 a0 21 5d f4 aa e1 60 30 5e 26 13 b7 4f 5a e3 0c 32 50 fb 10 40 6b 9f fc 5a d9 82 86 f5 c9 a7 ad bc 4f 0f 53 c6 3e 8f 75 ef 81 fb bb e5 60 13 bf d0 d1 86 c0 d4 70 43 60 72 bc 81 ca 0c ee 7b ca cd 06 61 90 56 01 34 34 b4 0d 0f 13 81 b8 e1 dc 70 52 d0 d3 64 f3 b6 df 8a 2c 1c d2 a7 e1 c5 ec 1c b9 2b 18 00 b1 42 22 26 de 7d 9d 59 8d 1f 8e 83 89 00 6e 65 8f 64 aa a2 fc c3 d8 65 70 5f b6 f7 9c 65 7e ea 83 9d 2c f7 31 10 e4 08 df ce 47 c4 df 33 f4 3c 40 c9 2e 2b 17 af 8a ce 37 c9 36 db ed 73 c6 5e f7 a6 Data Ascii: a}h,"BSXU1\Xw4bUF`4 -Aj3P%XlhV!]`0^&OZ2P@kZOS>u`pC`r{aV44pRd,+B"&}Ynedep_e~,1G3<@.+76s^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.18	49754	13.107.246.41	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:57:36 UTC	635	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:57:36 UTC	798	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:57:36 GMT Content-Type: application/x-javascript Content-Length: 121212 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 27 Mar 2024 20:03:18 GMT ETag: 0x8DC4E98F25B224F x-ms-request-id: 16664174-e01e-0010-78aa-9555bc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T135736Z-16f56cb894frwf6dsz8f0wbk5c0000000290000000008vgf x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-25 13:57:36 UTC	15586	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e4 bd 6d 7b e3 38 8e 00 f8 fd 7e 85 a3 99 cb d8 1d c5 25 f9 dd 4a ab b3 ae bc 54 65 3b 89 33 71 aa bb 77 53 99 3c b2 44 3b ea c8 92 57 92 f3 32 8e f7 b7 1f 00 92 12 65 cb a9 aa d9 bd bb e7 9e eb 9d ad 58 24 48 82 20 08 82 20 08 7e f8 69 e7 ff a8 fc 54 d9 ff fe ff 2a a3 9b c1 f5 4d 65 78 5a b9 f9 7c 76 7d 5c b9 82 af ff a8 5c 0e 6f ce 8e 4e be bf 1e 6c 14 ff ff e6 c1 4f 2a 13 3f 60 15 f8 3b 76 12 e6 55 a2 b0 12 c5 15 3f 74 a3 78 1e c5 4e ca 92 ca 0c fe 8d 7d 27 a8 4c e2 68 56 49 1f 58 65 1e 47 7f 32 37 4d 2a 81 9f a4 50 68 cc 82 e8 b9 52 85 ea 62 af 72 e5 c4 e9 6b e5 ec aa 56 87 fa 19 d4 e6 4f fd 10 4a bb d1 fc 15 7e 3f a4 95 30 4a 7d 97 55 9c d0 a3 da 02 f8 08 13 56 59 84 1e 8b 2b cf 0f be fb 50 b9 f0 dd 38 4a a2 49 5a 89 99 Data Ascii: m{8~%JTe;3qwS<D;W2eX$H ~iTMexZ\|v}\\oNlO?`;vU?txN}'LhVIXeG27M*PhRbrkVOJ~?0J}UVY+P8JIZ
2024-04-25 13:57:36 UTC	16384	IN	Data Raw: b0 ef 62 55 51 a0 e9 cb 27 9f 3d a3 6d 30 b0 96 7c 26 fd 96 25 94 cd 6e 7f 53 66 e2 3e 4f 84 75 40 c2 24 a5 97 0f f8 d6 24 84 7c 74 3a 5e e5 77 0c 50 d0 e0 48 a7 e4 a8 89 96 43 e0 35 59 9f 95 56 9b 2d 34 b0 bd 86 78 37 2c c4 37 73 77 22 75 f3 e1 5f 38 2f 74 af 05 16 86 5f 43 fe 3c 3d 39 b2 67 1c 9f bc bd 49 de aa 97 df 9b a9 fe 68 8d 30 ef 14 1b 60 52 e4 74 98 9b 75 8a ef 91 f0 a7 31 48 37 d3 fe f2 df 7f b9 60 a8 33 a1 2e 75 7f 3e 82 6f 1e 4f 8c 79 f6 52 04 b2 e2 af 08 43 ce 9c 3f 54 ca 0f 32 10 12 63 4c 89 fd 03 e6 67 01 0a f2 87 0f 44 95 f2 8d d3 22 98 48 5c 6b 9a 42 5e 70 61 84 28 5c 46 29 86 d1 a3 bd 16 05 99 a2 9f 57 bf 1f 5b 26 de 65 7f c0 58 1c f8 ec 2e 8f 58 26 6d 0a 32 b0 08 46 e5 c8 43 8b 90 d6 78 01 6b ee 20 f0 9d 84 82 72 cd c6 e8 57 cf 9f 5b Data Ascii: bUQ'=m0\|&%nSf>Ou@$$\|t:^wPHC5YV-4x7,7sw"u_8/t_C<=9gIh0`Rtu1H7`3.u>oOyRC?T2cLgD"H\kB^pa(\F)W[&eX.X&m2FCxk rW[
2024-04-25 13:57:36 UTC	16384	IN	Data Raw: 31 80 37 9e 6f 95 62 00 67 7f 3b 0e f0 ad 2d 3e 8d 03 4c e7 25 87 ea 49 53 05 7d 91 d4 77 88 1c 5b f5 7b 53 3c f7 93 52 d4 97 70 ed 39 16 a9 0f f6 14 9e ad 6e f9 ab 6b cf b7 ce a1 08 89 38 c2 07 32 dd 4e a2 51 e0 a8 5f 6f 98 2b 47 5e 43 39 3c 36 3c 3e 00 d7 be 8c 05 0a 76 15 8f 21 70 9e 2a e1 3c 42 bc af 55 85 42 84 da 64 d2 d5 39 7a 3e df d8 20 df e7 12 c9 41 d5 10 64 fb e1 44 01 fd a8 86 aa 1e 57 90 19 62 73 47 65 d4 24 b5 91 9c 7e c8 5e 41 a1 84 24 bb 94 97 d7 01 23 26 9f 51 70 06 ff e4 57 80 e6 50 90 22 e9 15 56 47 25 ff c0 82 3b 40 7a 52 f2 44 2c ef 09 85 9d 40 3c 3c 43 d9 95 76 bf 03 08 0f 24 a1 c2 43 cc 8e 5f 7b dc 2a 20 38 f0 57 7b 5d 2f 26 76 45 97 04 b9 6d 28 10 45 41 67 52 3f 62 77 69 51 86 02 01 72 64 32 d7 64 5b 5f d4 74 32 50 b3 a0 41 b9 bd Data Ascii: 17obg;->L%IS}w[{S<Rp9nk82NQ_o+G^C9<6<>v!p<BUBd9z> AdDWbsGe$~^A$#&QpWP"VG%;@zRD,@<<Cv$C_{ 8W{]/&vEm(EAgR?bwiQrd2d[_t2PA
2024-04-25 13:57:36 UTC	16384	IN	Data Raw: 64 f0 28 03 b4 9b e4 f7 00 90 14 f2 82 3d 01 00 46 7d 9c b9 cf 35 2a 47 52 fc 3e 8d 46 71 7e bf c3 da ab b0 8f d1 e8 2e ba cf 1c 34 d6 c4 43 09 38 08 73 c8 77 c2 07 ad 32 15 b4 fd 5e 9a 22 35 0a bf f8 c8 c0 0f 46 07 83 36 d9 35 52 80 79 5a 78 ba 59 27 74 b3 e2 7e c5 1c 91 e4 bf 83 28 94 86 98 a3 be 72 87 73 d3 0f 73 fe b5 47 47 8c 7e 0e 7b 6c e3 f9 63 8f 81 d6 71 73 9f 15 4a 1d e9 1d d7 e1 72 99 57 cd c2 33 88 2f ef 5e c6 b2 8c 81 2c 3b 22 62 20 ee 9b bc 7f 13 b4 ca 31 28 43 d2 61 8f 11 21 e4 6d b8 72 30 6a 70 5e 31 e0 96 9a 85 f2 de 03 73 54 33 d4 f3 93 53 51 53 93 a0 ad 34 98 91 c5 e6 56 75 84 a9 60 69 ad 4d c6 d6 eb f8 db a3 d6 4e cc d9 10 4f 92 07 ee df 79 fe 5d f3 77 fe 90 72 90 bb f0 e1 77 1b 88 8b e6 69 f8 20 ed df ce ce 31 bc 78 d6 0f db 73 3f 53 Data Ascii: d(=F}5*GR>Fq~.4C8sw2^"5F65RyZxY't~(rssGG~{lcqsJrW3/^,;"b 1(Ca!mr0jp^1sT3SQS4Vu`iMNOy]wrwi 1xs?S
2024-04-25 13:57:36 UTC	16384	IN	Data Raw: 57 ee db 91 a4 65 5b fb 6e 83 b4 3b 96 d2 db 35 84 0e 7c 7d 7f 2e ec 22 48 f2 75 1f d6 18 85 c9 a1 b2 1f 7f a3 8a 39 6c 2d 74 7a 4e 14 50 e5 31 6a 69 9a 2d 97 43 d5 70 c6 6c 11 21 17 76 e4 96 7a ff 42 e3 58 37 18 24 e6 cf 14 ba 51 1b ef 5d c3 1a 65 90 14 40 cd 2a 32 6f a4 54 88 c0 49 10 06 eb 03 46 9c 4e 5e 96 92 86 37 3e 0d cf dc c1 da 5a 28 89 fc 60 1a 28 48 88 cd ce e8 5e 06 98 c5 5c 19 5d 03 12 69 44 6f 7f 9f f7 71 28 41 c6 e1 c3 95 38 6c b9 ce d5 75 aa 00 2b 68 a1 6c 60 d1 a0 52 e6 e5 17 c9 1a 92 16 89 ab c6 e8 71 1b 86 d9 b1 22 fe 30 10 14 7b d4 5f 13 a1 9c ab 9f e1 17 e2 25 68 4f 4c 4c b4 0f 9d c7 ba cf de 75 70 f1 7c f2 f0 b0 e1 d1 a7 d6 2e d6 36 06 ba 87 d9 cb 60 c2 66 0f dc 88 82 c2 9b 89 50 0b 20 61 80 73 4c 1d 12 a9 d7 ae c1 07 ce 9d 75 2f 7b Data Ascii: We[n;5\|}."Hu9l-tzNP1ji-Cpl!vzBX7$Q]e@*2oTIFN^7>Z(`(H^\]iDoq(A8lu+hl`Rq"0{_%hOLLup\|.6`fP asLu/{
2024-04-25 13:57:36 UTC	16384	IN	Data Raw: 51 e8 d8 49 1a c5 7e e0 d9 16 67 96 07 dd 24 06 a6 67 2e 3a 13 22 4e b9 73 c3 7d 82 d5 6e 0c ea d9 91 1f 4a 28 29 42 84 10 bd 29 34 59 91 49 cb 71 33 c8 8f cc 8f f8 6e 3a 4b 3c 1b aa 5e ec 0a 88 73 a8 c7 2e 70 1b 4c 50 30 61 b9 01 0b 63 77 37 eb 64 34 23 cb 0f 33 61 45 71 04 25 c5 b1 53 c9 5c 11 3b 99 6b 5b 8e c3 3d 58 06 bb e9 2c b1 21 16 dc 14 aa 44 c8 05 38 b8 25 18 83 25 e0 07 a4 b2 40 4f be d9 36 cb 6a 37 46 33 8a 63 d8 a3 2e 4c 98 48 78 31 73 1d c1 63 c9 a5 6b 65 41 40 42 72 37 f4 e4 25 16 68 34 62 69 e6 63 4d 2c 1f 82 c9 e1 2c f6 3c d2 9e 03 08 f6 dd 4c 9d d1 8c 52 1f e4 93 49 2f b2 c0 c6 dd d0 b2 bd c8 66 98 4d b0 58 61 59 ce 4e 38 b9 e3 27 8e 23 20 f3 32 32 0b 6d 2b 86 24 77 98 b0 3d 3b 82 7c 8f bc 30 0e 77 d2 8d d1 8c 62 e1 87 91 6d 05 ae 13 79 Data Ascii: QI~g$g.:"Ns}nJ()B)4YIq3n:K<^s.pLP0acw7d4#3aEq%S\;k[=X,!D8%%@O6j7F3c.LHx1sckeA@Br7%h4bicM,,<LRI/fMXaYN8'# 22m+$w=;\|0wbmy
2024-04-25 13:57:36 UTC	16384	IN	Data Raw: fa 8d 62 92 ff 9a 3b 5e 4f df 33 30 3a ba 6c ef 2b 3a 09 a6 ef 19 71 32 ea e5 2b 63 f2 57 d2 2a 7f b7 60 96 9b 2d 2a c8 61 5b 2e 04 2d e7 db e7 41 5b 04 47 33 d3 7e 65 e5 34 a3 a2 f1 6d 39 81 97 d9 3d 37 d1 47 77 c7 cf ae ac a3 7e b9 fe 73 95 9a 79 cd 32 ea 2c f1 d5 f7 5f 84 2c df 2e 8a b3 a3 b2 78 fc 41 f2 f3 c5 8a 57 68 fd f3 97 db d1 19 9b 37 35 a3 bf 7e 25 fe ff 55 a8 db 34 7e 33 ba 36 60 7f 6d 8a fe a6 f0 b3 59 b6 ba f3 64 63 5b d5 f7 3f 22 46 1c 9d 49 29 d2 f3 d3 b3 9d 8b f3 16 e6 94 a6 9b 6f 50 9e ff e1 f1 6e 87 12 f2 3f 5e ab 2d 0e d9 fc 01 6c d8 df 20 f2 e7 9b 30 53 5e e6 53 59 5e 47 da 2d a8 c2 37 e6 26 ff ed dc 97 3b 54 32 4b 9a fa 6a 5d ab 55 6e 9f 44 a2 bc 68 8d 32 0f e9 00 50 ef 6f 3d eb 4b 1c e9 3a 79 71 fe 9a b6 39 21 77 9d e0 b2 46 7e 54 Data Ascii: b;^O30:l+:q2+cW`-a[.-A[G3~e4m9=7Gw~sy2,_,.xAWh75~%U4~36`mYdc[?"FI)oPn?^-l 0S^SY^G-7&;T2Kj]UnDh2Po=K:yq9!wF~T
2024-04-25 13:57:36 UTC	7322	IN	Data Raw: 1f 07 4f 53 d4 c5 c3 63 98 d0 fe fd 26 b7 b8 5e e2 81 fb 3e 31 42 65 52 c6 b5 42 41 83 fd 4b 62 cc fd 28 d8 9f 11 23 a5 e4 6b ff 86 18 3e a7 51 fb 1f a1 7e 99 70 ed bf 03 f0 97 a9 d6 fe 29 d4 bf a6 3b f1 d0 9d cf d1 74 b5 1f 1b 21 13 9e f2 27 d9 dd 53 1c fb 65 27 ea f6 30 8e 31 9f 72 87 4d 36 ee 76 7b c0 00 e3 4e 16 1b 6e dc bd cb 57 3c 93 27 8f f3 04 ec d9 f9 0d 56 87 a0 f0 0c fb 60 81 44 01 57 00 16 8c 4c 2b 4f 31 d3 d5 57 3e ba fd 1d d3 40 89 80 66 59 20 bd f7 fc 2b 30 6a a4 3d fc e9 8b fc c7 ed 2d e9 71 60 bd 02 66 7d bd f8 91 dc dc 15 23 73 63 ee 41 c1 47 45 07 85 e3 a2 c1 6f bb e9 e7 28 f3 2f 3b fc 67 0f 6f f0 75 bf fa 6e 4a 5a 1f 7b 07 b0 0c 5c b8 dc 8f a9 90 82 e4 16 49 90 97 7c e1 15 60 83 bf 49 e2 e7 f3 c4 ff 88 31 b4 f1 59 e7 97 de e1 bb d9 e9 Data Ascii: OSc&^>1BeRBAKb(#k>Q~p);t!'Se'01rM6v{NnW<'V`DWL+O1W>@fY +0j=-q`f}#scAGEo(/;gounJZ{\I\|`I1Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.18	49755	13.107.246.41	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:57:36 UTC	654	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_l2bvdjfwt697xziuhxpwsg2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:57:36 UTC	797	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:57:36 GMT Content-Type: application/x-javascript Content-Length: 15799 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 28 Mar 2024 02:23:53 GMT ETag: 0x8DC4ECE1D0444D4 x-ms-request-id: 95b777dd-b01e-0049-4630-95459c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T135736Z-16f56cb894fdm27harvh90x83w00000003v0000000005u59 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-25 13:57:36 UTC	15587	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 dd 7d 4d 73 23 47 b2 d8 dd bf 02 8b 75 68 86 4f 3d 10 3e f8 89 11 34 06 01 70 06 4f 24 00 01 e0 50 0a 49 46 34 81 22 d8 4b a0 1b af bb 31 1c 2e 35 8e bd f9 f0 0e be da 37 1f 7c f2 d1 17 df fd 53 36 e2 f9 77 38 3f aa aa ab ba 1b 00 39 d2 d3 ee b3 42 c1 41 77 55 65 65 65 65 65 65 66 65 65 ff e1 66 ed 4f 63 2f f0 5f 8a bd 47 f5 bb 10 bc f4 f7 1e bd 9b 97 de 8f fe cf 7b a1 88 d7 a1 5f c0 df 25 f1 71 15 84 71 f4 fa 83 1b 16 e2 06 be 6a 3c ca 77 f5 c7 4f 8e 37 ab fb ce 22 70 67 62 56 ff 43 e5 d3 6b d9 54 60 d3 a9 bb 58 bc 8c 15 04 27 76 92 df c1 1e 3c 70 b3 c6 1f ca 49 c1 27 ec c6 6b 3c 6a 40 41 69 d9 10 4e 50 9a 36 3c f8 bb 6a 14 8b 4e f0 b2 bc f7 e9 e5 8f c9 30 9c c0 f1 00 f9 97 d5 3d c2 d2 6f 78 2f 2b 00 1f fe 39 d8 73 42 f8 e7 Data Ascii: }Ms#GuhO=>4pO$PIF4"K1.57\|S6w8?9BAwUeeeeeefeefOc/_G{_%qqj<wO7"pgbVCkT`X'v<pI'k<j@AiNP6<jN0=ox/+9sB
2024-04-25 13:57:36 UTC	212	IN	Data Raw: 4c d9 50 88 3d 11 31 a3 82 91 44 92 9b ac 27 fa 55 71 d0 e8 52 b2 83 36 27 fc b6 dc 23 94 e3 1e 80 37 6e 69 ad 92 7b 01 76 8e 29 d0 a4 f3 81 4e a5 61 fe e9 d7 44 09 47 be c4 aa 78 02 e5 da 24 f0 cf 03 17 6f 15 81 0e 9b 57 59 59 50 76 65 74 81 91 0e 08 e2 ca 8f 9f d0 09 e6 cc 63 f5 01 0c 1d b1 ff ac b6 da 7e a0 7c 70 78 3f 7a 67 ef 29 ac ad fb a8 08 00 af bb ab 0b 46 ef 41 74 8a 4c fb 39 f7 de 8d 28 4c 4b db fa 95 7d d4 f5 b7 b4 b4 70 4f 6e 04 ef ef ec d2 6a c8 b3 29 ad 7d 6c 5b d9 81 ae 31 dc 64 9c fb e5 ea ce 71 1a 0d 53 9d 56 9f d3 e9 b7 17 a3 2e 37 aa 7e fa f4 f3 9e c3 b9 43 4b 93 49 e3 0f e5 d7 ff 0f de d8 74 96 1f d7 00 00 Data Ascii: LP=1D'UqR6'#7ni{v)NaDGx$oWYYPvetc~\|px?zg)FAtL9(LK}pOnj)}l[1dqSV.7~CKIt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.18	49758	13.107.246.41	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:57:37 UTC	649	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:57:37 UTC	744	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:57:37 GMT Content-Type: image/x-icon Content-Length: 17174 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Sun, 18 Oct 2020 03:02:03 GMT ETag: 0x8D8731230C851A6 x-ms-request-id: 2ecb2c32-101e-002b-5d2b-9551ba000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T135737Z-16f56cb894f4hxjjs88cmwhuqs000000040g00000000497r x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-25 13:57:37 UTC	15640	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-04-25 13:57:37 UTC	1534	IN	Data Raw: 01 80 00 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 Data Ascii: ( @{L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.18	49760	13.107.213.41	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:57:38 UTC	404	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:57:38 UTC	744	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:57:38 GMT Content-Type: image/x-icon Content-Length: 17174 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Sun, 18 Oct 2020 03:02:03 GMT ETag: 0x8D8731230C851A6 x-ms-request-id: d959b9ac-701e-003d-51d2-921b94000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T135738Z-16f7b4795d4gnpqthyae4e8q5n0000000830000000002wye x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-25 13:57:38 UTC	15640	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-04-25 13:57:38 UTC	1534	IN	Data Raw: 01 80 00 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 Data Ascii: ( @{L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.18	49759	13.107.246.41	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:57:38 UTC	618	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:57:38 UTC	797	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:57:38 GMT Content-Type: application/x-javascript Content-Length: 54325 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 15 Feb 2024 19:13:15 GMT ETag: 0x8DC2E5A2998EB1D x-ms-request-id: 93a23132-b01e-0049-5d1f-93459c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T135738Z-16f7b4795d4b8mmb4gwx3fz9p000000008qg00000000973s x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-25 13:57:38 UTC	15587	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ec bd 6b 7b db 46 92 30 fa 7d 7f 05 85 67 46 06 4c 90 22 a9 8b 65 52 10 c7 76 92 79 bd 4f 12 fb d8 ce bc 67 8f cc c9 03 81 a0 84 98 02 b8 b8 d8 d6 88 dc df 7e aa aa ef 40 83 92 af c9 66 3c bb b1 88 46 a3 2f d5 dd d5 75 af bd fb 3b ff d1 b9 df e9 dd fd 7f 9d 97 af 1e bd 78 d5 79 f6 43 e7 d5 ff 79 fa e2 bb ce 73 78 fa af ce cf cf 5e 3d 7d f2 fd dd db c1 4e f1 bf 57 97 49 d1 59 24 cb b8 03 7f cf c3 22 9e 77 b2 b4 93 e5 9d 24 8d b2 7c 95 e5 61 19 17 9d 2b f8 37 4f c2 65 67 91 67 57 9d f2 32 ee ac f2 ec b7 38 2a 8b ce 32 29 4a f8 e8 3c 5e 66 ef 3a 2e 34 97 cf 3b cf c3 bc bc ee 3c 7d ee f5 a1 fd 18 5a 4b 2e 92 14 be 8e b2 d5 35 fc be 2c 3b 69 56 26 51 dc 09 d3 39 b5 b6 84 87 b4 88 3b 55 3a 8f f3 ce bb cb 24 ba ec fc 94 44 79 56 64 Data Ascii: k{F0}gFL"eRvyOg~@f<F/u;xyCysx^=}NWIY$"w$\|a+7OeggW28*2)J<^f:.4;<}ZK.5,;iV&Q9;U:$DyVd
2024-04-25 13:57:38 UTC	16384	IN	Data Raw: af 2c 68 22 6c ec af 0f f1 58 23 9c 57 4f 85 29 04 a2 a6 af 99 30 b3 14 9a 61 1d 83 94 a6 41 a5 e1 ba 40 8e 69 4d 84 c0 0c 7a ee 60 3d 99 b6 58 4f 32 bb c9 b1 51 33 f7 d0 cc 59 d4 64 3d a8 ea f4 ac 64 83 78 6e c2 77 d6 2c 2b 64 ba 9c e8 88 be 66 c5 8c df 66 99 b1 37 5b 0c 65 ed c6 b0 84 1d b8 27 9d b1 78 9f d1 85 0e f7 b3 61 34 de 22 6c a6 2f 35 ab 02 8b c7 89 b8 f8 6d be 19 44 1a 30 db e7 98 94 60 dc 01 03 75 61 53 a0 c6 87 a8 0e 1b 7a e3 5c 73 c0 60 ee 51 be 50 27 6e f4 b1 3e be 6e 52 fc db 7d 60 b6 9b e9 5b 3d 60 f2 fa ac ed ce 08 79 ab 13 40 ae a4 cc 80 81 49 2c 6b 50 9f d5 16 d2 7d b4 9d 74 bf 2b 55 8b fe 30 c4 64 10 31 bb 9d c9 e0 96 d3 e6 5e 6f 10 6f 75 1b 48 73 4a c9 96 29 ed 37 a6 64 1c 6a 49 ac e4 0d 41 ab af c5 fa 1e 4e 52 0c de 9d f6 7a ba 5f Data Ascii: ,h"lX#WO)0aA@iMz`=XO2Q3Yd=dxnw,+dff7[e'xa4"l/5mD0`uaSz\s`QP'n>nR}`[=`y@I,kP}t+U0d1^oouHsJ)7djIANRz_
2024-04-25 13:57:38 UTC	16384	IN	Data Raw: 0e 6a ee 80 44 c4 66 f1 6a 1b d6 a5 51 f4 e0 d1 11 ad 3c 3a ae a2 1c fd f7 9b 24 c3 f6 61 2e 2f 03 95 db 1a db 11 47 1c 6c 89 73 db 4d aa 52 da b0 57 db 32 bf 29 5f 14 77 2f 6b 5d 29 40 84 dd b9 1c e4 35 e5 58 be 7e cb 47 b9 bb 2a af 2e 8c 24 e3 da 82 16 69 69 c9 e0 a5 e4 f7 2e 25 75 e6 0a b6 d4 ed 8d c5 7c aa 50 dc 9c bf f5 32 fa f9 9a a1 fb 5b 8c 97 74 e1 59 21 ca 81 0c 11 73 4a 13 f3 55 f6 45 f9 3a bc a4 72 e9 69 3b 21 8d ae e3 f7 5e 42 e7 ce 71 21 e7 6f 59 7c ee e8 9b 5f a1 85 a7 01 59 7a 29 5e da 20 4b 2f c5 13 5d da b4 de 7b e9 8b e3 e6 74 04 65 da 5b 0f ca e4 1a c9 19 bf b1 7f 1f 64 ff df c5 f6 ba 6e 26 a0 b8 dd de 5a 6b db e4 cb ad 6d bf c0 ce 96 da d2 60 6a ab 5a e3 58 dc 52 e6 5f 6e 74 eb f6 74 f9 a7 8d fa af 6c a3 8e ae 2b bf a6 8d 7a b4 de 46 Data Ascii: jDfjQ<:$a./GlsMRW2)_w/k])@5X~G*.$ii.%u\|P2[tY!sJUE:ri;!^Bq!oY\|_Yz)^ K/]{te[dn&Zkm`jZXR_nttl+zF
2024-04-25 13:57:38 UTC	5970	IN	Data Raw: de 98 b0 b0 3e 49 0e 7e 63 40 3c 29 b8 d4 80 14 aa 30 32 c0 a4 8e 42 d4 35 3d 5f 18 b8 a3 11 36 4f 9a 57 c3 d9 74 ef a4 b8 f7 97 0d 0d bb 85 3e 8b 58 ca db be e7 c3 1b 78 bd b3 c3 96 68 64 69 85 5f 70 17 50 83 d8 fd 33 ab 3f bf a4 b3 1d 87 c9 32 e6 91 0b 6c 50 5a 4a f6 5c 2d 1d b3 22 79 95 55 3b 8d 66 e7 4b 13 fe f9 05 af ed 06 6b ab 90 17 34 34 0c 28 2d 2a bd f3 be c0 75 de d3 f6 02 7a 2f e0 69 a9 24 cb 5c ef 0f ef 5e 3c cd 2e 67 59 4a b6 fe 6a 52 34 68 93 b4 86 af 7e e1 84 3e d1 43 fe ac 88 cb 70 5e 4e 3a fd c3 de 59 54 c4 07 f7 85 be 29 16 8b 95 25 ab 59 35 e6 6f a8 db f0 2e 3e 7f fe 69 46 a2 81 57 38 17 aa 49 22 ed a7 b4 13 d1 92 8d eb 69 f9 16 09 1b 5c 25 e9 38 bb da 86 23 f6 4c d9 de 66 66 42 57 34 c8 1b fc 24 86 6d 5f d0 4a a9 01 18 3a 11 3d 65 48 Data Ascii: >I~c@<)02B5=_6OWt>Xxhdi_pP3?2lPZJ\-"yU;fKk44(-*uz/i$\^<.gYJjR4h~>Cp^N:YT)%Y5o.>iFW8I"i\%8#LffBW4$m_J:=eH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.18	49761	13.107.246.41	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:57:39 UTC	620	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_4d4b76a02ae121e3b20c.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:57:39 UTC	796	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:57:39 GMT Content-Type: application/x-javascript Content-Length: 5512 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 15 Feb 2024 19:13:16 GMT ETag: 0x8DC2E5A29A25668 x-ms-request-id: be1bb20b-701e-003d-3fc6-951b94000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T135739Z-16f56cb894fqlhb6ssxt4emkw8000000042g000000001d97 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-25 13:57:39 UTC	5512	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ad 5b 7d 77 da 46 d6 ff bf 9f 42 68 f7 10 69 33 96 4d 9a b6 cf e2 aa 3e 0e 2f 09 ad 1d bb 06 b7 9b 26 39 1c 81 06 50 2c 24 55 23 8c a9 e1 bb ef ef ce 48 48 80 c0 4e 9f ed 49 0d 9a b9 73 e7 ce 9d fb 7e c5 f1 bf 2a df 68 ff d2 8e 9e ff 9f d6 ed 9d df f4 b4 ab b6 d6 7b d7 b9 69 6a d7 78 fa a0 bd bf ea 75 1a ad e7 e3 a1 4d e9 ff de c4 13 da c8 f3 b9 86 cf 81 23 b8 ab 85 81 16 c6 9a 17 0c c3 38 0a 63 27 e1 42 9b e2 6f ec 39 be 36 8a c3 a9 96 4c b8 16 c5 e1 17 3e 4c 84 e6 7b 22 c1 a2 01 f7 c3 b9 66 00 5d ec 6a d7 4e 9c 2c b4 ce b5 69 01 3f 07 36 6f ec 05 58 3d 0c a3 05 be 4f 12 2d 08 13 6f c8 35 27 70 25 36 1f 0f 81 e0 da 2c 70 79 ac cd 27 de 70 a2 5d 7a c3 38 14 e1 28 d1 62 3e e4 de 3d 36 11 33 8c 6f 6e c1 34 27 e6 9a e0 89 36 0a Data Ascii: [}wFBhi3M>/&9P,$U#HHNIs~*h{ijxuM#8c'Bo96L>L{"f]jN,i?6oX=O-o5'p%6,py'p]z8(b>=63on4'6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.18	49763	13.107.246.41	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:57:39 UTC	668	OUT	GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:57:39 UTC	740	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:57:39 GMT Content-Type: image/gif Content-Length: 2672 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:47 GMT ETag: 0x8DB5C3F48EC4154 x-ms-request-id: 5901b676-e01e-003c-6525-953096000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T135739Z-16f56cb894f6dbs8zd0w00kxw800000003yg000000002hyg x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-25 13:57:39 UTC	2672	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e 69 18 14 00 21 Data Ascii: GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~i!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.18	49762	13.107.246.41	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:57:39 UTC	662	OUT	GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:57:39 UTC	740	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:57:39 GMT Content-Type: image/gif Content-Length: 3620 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4904824B x-ms-request-id: 595ab494-f01e-0009-17fb-95968d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T135739Z-16f56cb894fqzbbqtg9rp3gtgg000000040g000000009qvn x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-25 13:57:39 UTC	3620	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 0f Data Ascii: GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.18	49765	13.107.213.41	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:57:39 UTC	423	OUT	GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:57:39 UTC	734	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:57:39 GMT Content-Type: image/gif Content-Length: 2672 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:47 GMT ETag: 0x8DB5C3F48EC4154 x-ms-request-id: e098ad9f-c01e-0002-3857-92b39a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T135739Z-16f7b4795d4xft4nk2mmryd7dc00000009200000000002k7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-25 13:57:39 UTC	2672	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e 69 18 14 00 21 Data Ascii: GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~i!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.18	49766	13.107.246.41	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:57:39 UTC	662	OUT	GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:57:39 UTC	784	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:57:39 GMT Content-Type: image/svg+xml Content-Length: 673 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:46 GMT ETag: 0x8DB5C3F47E260FD x-ms-request-id: fa83c1cc-301e-0029-2557-9207be000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T135739Z-16f7b4795d4hbs9nymf33py59c000000089g000000007zyt x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-25 13:57:39 UTC	673	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 21 02 39 81 41 Data Ascii: Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9!9A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.18	49764	13.107.213.41	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:57:39 UTC	417	OUT	GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:57:39 UTC	740	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:57:39 GMT Content-Type: image/gif Content-Length: 3620 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4904824B x-ms-request-id: 595ab494-f01e-0009-17fb-95968d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T135739Z-16f56cb894fcps2fa8agb63e8w00000003sg00000000g4xt x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-25 13:57:39 UTC	3620	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 0f Data Ascii: GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.18	49767	13.107.246.41	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:57:39 UTC	663	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:57:39 UTC	785	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:57:39 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4911527F x-ms-request-id: 34635e06-b01e-001d-7c3f-928aa7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T135739Z-16f7b4795d4hbs9nymf33py59c000000089g000000007zyu x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-25 13:57:39 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.18	49769	13.107.213.41	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:57:40 UTC	417	OUT	GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:57:40 UTC	805	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:57:40 GMT Content-Type: image/svg+xml Content-Length: 673 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:46 GMT ETag: 0x8DB5C3F47E260FD x-ms-request-id: 6c0e0a0f-001e-0076-24a1-95ed92000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T135740Z-16f56cb894f2bgjg7qau3rrudn00000003xg00000000he50 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-25 13:57:40 UTC	673	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 21 02 39 81 41 Data Ascii: Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9!9A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.18	49770	13.107.213.41	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:57:40 UTC	418	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:57:40 UTC	785	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:57:40 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:48 GMT ETag: 0x8DB5C3F4911527F x-ms-request-id: e1b72844-a01e-0014-092d-95f9b4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T135740Z-16f56cb894f6dbs8zd0w00kxw800000003y00000000047k7 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-25 13:57:40 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.18	49771	13.107.246.41	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:57:40 UTC	624	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:57:41 UTC	818	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:57:40 GMT Content-Type: application/x-javascript Content-Length: 35813 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 15 Feb 2024 19:13:16 GMT ETag: 0x8DC2E5A29EDB0A1 x-ms-request-id: 73802cd2-601e-0008-0e17-96bd8f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T135740Z-16f56cb894fdm27harvh90x83w00000003t000000000fuhp x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-25 13:57:41 UTC	15566	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 e4 bd 7b 7f db 38 92 28 fa ff f9 14 b6 a6 c7 11 db b4 2c ea 2d db 8c c7 f1 a3 93 99 a4 93 cd a3 67 67 6c 75 86 a2 20 89 6d 8a 94 49 ca 8f c4 de cf 7e ab 0a 6f 52 76 92 d9 b3 e7 dc df bd 99 69 9a 28 14 0a 85 02 50 28 14 0a d4 ee cf 9b ff 6b e3 e7 8d 9d ef ff b7 f1 e1 e3 d1 fb 8f 1b 6f cf 36 3e be 7c f5 fe 64 e3 1d a4 fe b1 f1 eb db 8f af 8e 4f bf 9f 0e 56 8a ff 7d 9c 47 f9 c6 34 8a d9 06 fc 1d 07 39 9b 6c a4 c9 46 9a 6d 44 49 98 66 cb 34 0b 0a 96 6f 2c e0 99 45 41 bc 31 cd d2 c5 46 31 67 1b cb 2c fd 83 85 45 be 11 47 79 01 85 c6 2c 4e 6f 36 ea 40 2e 9b 6c bc 0b b2 e2 6e e3 d5 3b a7 01 f4 19 50 8b 66 51 02 a5 c3 74 79 07 ef f3 62 23 49 8b 28 64 1b 41 32 21 6a 31 24 92 9c 6d ac 92 09 cb 36 6e e6 51 38 df 78 13 85 59 9a a7 d3 62 Data Ascii: {8(,-gglu mI~oRvi(P(ko6>\|dOV}G49lFmDIf4o,EA1F1g,EGy,No6@.ln;PfQtyb#I(dA2!j1$m6nQ8xYb
2024-04-25 13:57:41 UTC	16384	IN	Data Raw: fb f4 8a 9f 60 92 f4 a9 99 cc fa b2 bd d7 13 b0 c4 06 dc ca 65 96 2c ec 0f e5 1d 27 21 95 80 e4 d4 cb 2b 1f 51 c4 8b 15 a2 2b 7a 64 54 7d 78 69 fe fa 15 f1 34 37 7f ff 6a 48 38 1a 63 c0 31 54 3e 0d 4a 3c 74 5e fb 49 76 ca 59 7b 5d bb 7c 7a dd 96 b0 75 ce 53 22 b3 de f0 a1 2c fb db ee 74 13 31 9f 8b df f9 c1 01 f8 21 9a a9 2f 3e 92 7d 93 1b 80 50 01 a6 12 d2 92 90 6b 1b a2 4f df 78 d2 08 c8 0e 38 44 1d a9 b7 45 fa aa 04 50 9f a1 66 22 2d 27 02 ed 08 cd ef cc 4d 44 5a 5d b0 9c 72 80 0a b5 a6 e3 0f 00 98 4b 42 87 83 cc 2f c2 11 eb e5 cf 3f d0 77 57 f9 cf 71 c9 a1 46 3d 8b e0 b5 83 72 11 e4 73 39 87 69 73 9b 2f ec 2f 29 53 cd e5 0e 5d 44 92 7e 5b 00 d4 47 1c 02 9e 54 2e b0 50 a4 55 20 57 a8 6e ee 7c 78 7b f6 51 8f 40 42 4c a7 85 1e 83 1c 12 1b de fe a9 80 48 Data Ascii: `e,'!+Q+zdT}xi47jH8c1T>J<t^IvY{]\|zuS",t1!/>}PkOx8DEPf"-'MDZ]rKB/?wWqF=rs9is//)S]D~[GT.PU Wn\|x{Q@BLH
2024-04-25 13:57:41 UTC	3863	IN	Data Raw: ac c2 18 06 70 37 5a 66 93 fc 61 14 40 f7 bf 8e fc cd dd a4 86 91 90 19 d3 45 f3 72 8f 21 d5 e4 0c 79 9a 4f 10 48 66 a8 4e a4 db e3 4b c1 87 72 bb 6d 34 d5 3e d9 cc 55 c8 ee 9c a4 a6 95 b9 d5 17 33 33 2c e8 70 fb 44 11 ed bb 2c 48 eb 8c 92 a6 b8 a8 8a e5 0a 9f 59 31 be e5 8c 34 65 74 1e 1c 19 75 de 81 31 86 b5 fe 29 4d 81 0b 7b 6d e1 fe 15 2e 1f 3e ef ec 93 cf 31 d1 93 93 0c 4e 1f 1b ff a4 f6 da 09 9c d7 b5 ee c9 6b 67 87 b8 3c 9d ce 19 2e 03 e2 e2 f1 42 df df f1 2b 2b 86 2b a8 9a 25 10 da a6 5a 4e ee 79 00 b9 f3 53 d2 6d 63 74 4b d1 35 fc e2 22 6c e8 e9 c0 6c bf f5 8e a0 23 c0 d8 95 3b 3d eb 13 df e7 53 29 ef 2b 5b 5d c9 12 0c 9e 8a 33 00 52 25 5a b7 87 89 f1 16 cb 67 4f 25 77 f7 16 52 dc ae f6 b1 c2 c6 4b c1 41 51 e7 9d 50 3f d3 0e 55 45 ba 19 14 a8 a5 Data Ascii: p7Zfa@Er!yOHfNKrm4>U33,pD,HY14etu1)M{m.>1Nkg<.B+++%ZNySmctK5"ll#;=S)+[]3R%ZgO%wRKAQP?UE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.18	49772	13.107.246.41	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:57:40 UTC	663	OUT	GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:57:40 UTC	784	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:57:40 GMT Content-Type: image/svg+xml Content-Length: 621 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:49 GMT ETag: 0x8DB5C3F49ED96E0 x-ms-request-id: c8148d51-601e-0060-6c1d-95a7bc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T135740Z-16f56cb894fff7nsaw34vw5a9w00000003y0000000004f3n x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-25 13:57:40 UTC	621	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 7d 55 4d 6f 22 31 0c fd 2b a3 d9 ab 93 c9 f7 47 3b 20 cd 9e 38 6c af 1c b8 4d 0b 05 24 0a 55 19 41 57 ab fe f7 b5 93 a0 55 61 58 0d d8 60 27 ef 3d db 09 b4 c7 d3 ba fa 7c db ed 8f 93 7a 33 0c ef 0f 4d 73 3e 9f f9 59 f3 c3 c7 ba 51 42 88 06 57 d4 d5 79 bb 1c 36 93 da 84 ba da ac b6 eb cd 90 3f 9f b6 ab f3 cf c3 e7 a4 16 95 a8 4c c0 57 3d 6d 97 ab d7 e3 b4 3d 0e bf 77 ab 29 ef ff bc 6e 77 bb 87 fd 61 bf 7a fc e2 cf f9 db 0f 23 e8 79 fc 6a 9b bc ac 6d f2 a6 8f d5 cb 50 bd ec fa 23 ca e9 ef b1 36 d3 f6 bd 1f 36 97 75 cf 75 b5 9c d4 4f 46 80 56 dc fa 30 37 62 a6 d5 5c bb 99 0a 73 ad 66 ca cc 55 e0 de b9 4e 0a ee 42 84 e2 04 3e 12 64 04 2d 7a 0c a5 78 89 32 cb ad f1 4c 72 0b 52 72 29 dc c5 e5 ac e2 4a 46 cc 7a 19 3b 4c 68 af a1 b8 Data Ascii: }UMo"1+G; 8lM$UAWUaX`'=\|z3Ms>YQBWy6?LW=m=w)nwaz#yjmP#66uuOFV07b\sfUNB>d-zx2LrRr)JFz;Lh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.18	49774	13.107.213.41	443	6956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:57:41 UTC	418	OUT	GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 13:57:41 UTC	784	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 13:57:41 GMT Content-Type: image/svg+xml Content-Length: 621 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 24 May 2023 10:11:49 GMT ETag: 0x8DB5C3F49ED96E0 x-ms-request-id: c8148d51-601e-0060-6c1d-95a7bc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240425T135741Z-16f56cb894ff7nzt0vygeuawx800000003y0000000008w1n x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-25 13:57:41 UTC	621	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 7d 55 4d 6f 22 31 0c fd 2b a3 d9 ab 93 c9 f7 47 3b 20 cd 9e 38 6c af 1c b8 4d 0b 05 24 0a 55 19 41 57 ab fe f7 b5 93 a0 55 61 58 0d d8 60 27 ef 3d db 09 b4 c7 d3 ba fa 7c db ed 8f 93 7a 33 0c ef 0f 4d 73 3e 9f f9 59 f3 c3 c7 ba 51 42 88 06 57 d4 d5 79 bb 1c 36 93 da 84 ba da ac b6 eb cd 90 3f 9f b6 ab f3 cf c3 e7 a4 16 95 a8 4c c0 57 3d 6d 97 ab d7 e3 b4 3d 0e bf 77 ab 29 ef ff bc 6e 77 bb 87 fd 61 bf 7a fc e2 cf f9 db 0f 23 e8 79 fc 6a 9b bc ac 6d f2 a6 8f d5 cb 50 bd ec fa 23 ca e9 ef b1 36 d3 f6 bd 1f 36 97 75 cf 75 b5 9c d4 4f 46 80 56 dc fa 30 37 62 a6 d5 5c bb 99 0a 73 ad 66 ca cc 55 e0 de b9 4e 0a ee 42 84 e2 04 3e 12 64 04 2d 7a 0c a5 78 89 32 cb ad f1 4c 72 0b 52 72 29 dc c5 e5 ac e2 4a 46 cc 7a 19 3b 4c 68 af a1 b8 Data Ascii: }UMo"1+G; 8lM$UAWUaX`'=\|z3Ms>YQBWy6?LW=m=w)nwaz#yjmP#66uuOFV07b\sfUNB>d-zx2LrRr)JFz;Lh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.18	49775	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:58:05 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+3LuncmL5GvGc6o&MD=ofF4+heM HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-25 13:58:05 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 237e0fc5-8078-4f76-b143-a7bc2576fed2 MS-RequestId: 30724ea3-d68e-4d26-b963-20bf2d2276c6 MS-CV: XUO/B8lRmEGOYT6C.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 25 Apr 2024 13:58:04 GMT Connection: close Content-Length: 25457
2024-04-25 13:58:05 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-25 13:58:05 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.18	49777	131.253.33.200	443

Timestamp	Bytes transferred	Direction	Data
2024-04-25 13:58:12 UTC	2731	OUT	GET /client/config?cc=CH&setlang=en-CH HTTP/1.1 X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-UserAgeClass: Unknown X-BM-Market: CH X-BM-DateFormat: dd/MM/yyyy X-Device-OSSKU: 48 X-BM-DTZ: 120 X-DeviceID: 01000A410900B03D X-BM-WindowsFlights: FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12E85C75 X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAWtQnwbmX7VUoIL0A/0tuvmSMZ%2BUrAnALtIsyGvaqn6qiETbPN0SqiXClK1ON7nmG5huWfeacitoN9verPGjadPlbqSuFx/IlcU8VZniYn%2BjduDxGw29/39CJ8ex/eMHqeEJ3Uvh/hOEXKeozkjY3zO%2BW0tg5mv070rrp%2B1oqJqrpi5/5rqctXDElUyF7BBNvmOBevoKEqS5WQaW7xF4%2Bw8YSl9O82jw%2B6HIalQw8Aoq6Viy7ymyYKRg4Kyd8jwSd14lpuWubgVPxp33TymrpIuqYqeZpwaI1TeeVG8mEWSvYABLtZTJSjs0MzrrKorNjYM3UUjrPKWXEm3IU8kNsi8DZgAACM1847Xs3kD3qAHaU97LFBxO6d9AtzDDDxCglyNcSvu/TsIJFiWE02vohY9Tf5UHNE/vaa45XWFlcPqPJnRMgNVE7Z27Qfo4NzmZzvrZQmEpedh/CMCF9q5fQ2jQBZW3xUpHtwAwEv1PGLr4av8XqL7E1rGsiXSz2nEXC2ej8x7Btb1TYqEdgv0R7Kyz1iGJB8bnKSVEei9XsCLkZszBqgyw5VM7w00ciM0bdV3lWRSHzMMev2p6rbOX7AcfE54xFJf2HidiYcC3%2BvQCh6VwHG3lr2OgdMpQlErZ34YwFhzkLA/pgWsKmIbXXBEJdrDd1/V%2B2Imu6qaVtG2ISAPpDfWH%2BVPh9sJ6w8r7HwMqiKHLhBiHH6qgBNvxuQUx0iWZVNp9GTY2tMSds1V2%2BkAZUMphZmn1CjFjxgeE3vhHI/0ycKk6UEJIL8bkLRthkXgiGg8wXSbJ9CpY4XRF1RTkdE3CmGN9zPY3IcB7mpP0cSyxJgeO1tobr1MsA%2BpWgBLEYY4inl4W/SyR3KNSXMMfKYoVPWPqENW3uskui0DIXCaCN9HVaVNyoCK/%2BsUnlmbHSTDz2gE%3D%26p%3D X-Agent-DeviceId: 01000A410900B03D X-BM-CBT: 1714053490 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 X-Device-isOptin: false Accept-language: en-GB, en, en-US X-Device-Touch: false X-Device-ClientSession: B3ADC63356A4439E878B0AB53C27ABEA X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI Host: www.bing.com Connection: Keep-Alive Cookie: SRCHUID=V=2&GUID=B4BB39E5F80E411D94C438C0FA7ACF94&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&LUT=1707317051026&IPMH=6b344233&IPMID=1707317270835&HV=1707317277; ANON=A=680C1B1A649CBD64DD40EBFCFFFFFFFF; MUID=BC76BB0020D345C1A049A4820CB4C03C; MUIDB=BC76BB0020D345C1A049A4820CB4C03C
2024-04-25 13:58:12 UTC	1512	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 2215 Content-Type: application/json; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Set-Cookie: _EDGE_S=SID=086BBB5DD00560E42F86AF31D1896122&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: MUIDB=BC76BB0020D345C1A049A4820CB4C03C; expires=Tue, 20-May-2025 13:58:12 GMT; path=/; HttpOnly Set-Cookie: SRCHHPGUSR=SRCHLANG=en&LUT=1707317051026&IPMH=6b344233&IPMID=1707317270835&HV=1707317277; domain=.bing.com; expires=Tue, 20-May-2025 13:58:12 GMT; path=/; secure; SameSite=None Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/; secure; SameSite=None Set-Cookie: _SS=SID=086BBB5DD00560E42F86AF31D1896122; domain=.bing.com; path=/; secure; SameSite=None X-EventID: 662a61746ce04f4098e02e1822d34551 UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 9E66CFC4F27444E49D2719BFE66ED5FB Ref B: BL2AA2010203031 Ref C: 2024-04-25T13:58:12Z Date: Thu, 25 Apr 2024 13:58:12 GMT Connection: close
2024-04-25 13:58:12 UTC	2215	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65 Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value

Target ID:	0
Start time:	15:57:15
Start date:	25/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://urlshortener.teams.cloud.microsoft/8DC6524B7BA4BE6-3-2
Imagebase:	0x7ff728d30000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	15:57:16
Start date:	25/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1972,i,12641275858175302215,10052665692327869527,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff728d30000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://urlshortener.teams.cloud.microsoft/8DC6524B7BA4BE6-3-2

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Windows Analysis Report
https://urlshortener.teams.cloud.microsoft/8DC6524B7BA4BE6-3-2